From 2fd7c09281cf65430477d33a45df0ac876ea04ad Mon Sep 17 00:00:00 2001 From: Endi Sukma Dewata Date: Wed, 21 Nov 2012 13:28:22 -0500 Subject: Reorganized RA templates and scripts. The templates, JS, and CGI scripts for RA have been reorganized into the RA core package. Ticket #407 --- base/ra/apache/docroot/ee/scep/enroll.cgi | 112 ++++++++++++++++++++++++ base/ra/apache/docroot/ee/scep/enroll.vm | 74 ++++++++++++++++ base/ra/apache/docroot/ee/scep/index.cgi | 68 +++++++++++++++ base/ra/apache/docroot/ee/scep/index.vm | 83 ++++++++++++++++++ base/ra/apache/docroot/ee/scep/installer.cgi | 74 ++++++++++++++++ base/ra/apache/docroot/ee/scep/installer.vm | 73 ++++++++++++++++ base/ra/apache/docroot/ee/scep/manager.cgi | 68 +++++++++++++++ base/ra/apache/docroot/ee/scep/manager.vm | 123 +++++++++++++++++++++++++++ base/ra/apache/docroot/ee/scep/pkiclient.cgi | 113 ++++++++++++++++++++++++ base/ra/apache/docroot/ee/scep/submit.cgi | 91 ++++++++++++++++++++ base/ra/apache/docroot/ee/scep/submit.vm | 76 +++++++++++++++++ 11 files changed, 955 insertions(+) create mode 100755 base/ra/apache/docroot/ee/scep/enroll.cgi create mode 100644 base/ra/apache/docroot/ee/scep/enroll.vm create mode 100755 base/ra/apache/docroot/ee/scep/index.cgi create mode 100644 base/ra/apache/docroot/ee/scep/index.vm create mode 100755 base/ra/apache/docroot/ee/scep/installer.cgi create mode 100644 base/ra/apache/docroot/ee/scep/installer.vm create mode 100755 base/ra/apache/docroot/ee/scep/manager.cgi create mode 100644 base/ra/apache/docroot/ee/scep/manager.vm create mode 100755 base/ra/apache/docroot/ee/scep/pkiclient.cgi create mode 100755 base/ra/apache/docroot/ee/scep/submit.cgi create mode 100644 base/ra/apache/docroot/ee/scep/submit.vm (limited to 'base/ra/apache/docroot/ee/scep') diff --git a/base/ra/apache/docroot/ee/scep/enroll.cgi b/base/ra/apache/docroot/ee/scep/enroll.cgi new file mode 100755 index 000000000..53291636a --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/enroll.cgi @@ -0,0 +1,112 @@ +#!/usr/bin/perl +# +# --- BEGIN COPYRIGHT BLOCK --- +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# +# +# + +package op; + +use lib $ENV{DOCUMENT_ROOT} . "/../lib/perl"; + +use MIME::Base64; +use URI::URL; +use URI::Escape; +use XML::Simple; +use CGI; +use PKI::Base::Conf; +use PKI::Base::Util; +use PKI::Base::Registry; +use PKI::Service::Op; +use Template::Velocity; +use PKI::Conn::CA; +use PKI::Base::PinStore; + +use vars qw (@ISA); +use PKI::Service::Op; +@ISA = qw(PKI::Service::Op); + +sub new { + my $self = {}; + bless ($self); + return $self; +} + +sub process() +{ + my $self = shift; + my $q = CGI->new(); + + my $util = PKI::Base::Util->new(); + + my $docroot = PKI::Base::Registry->get_docroot(); + my $parser = PKI::Base::Registry->get_parser(); + my $cfg = PKI::Base::Registry->get_config(); + + $self->debug_params($cfg, $q); + + my $client_id = $util->get_val($q->param('client_id')); + my $site_id = $util->get_val($q->param('site_id')); + my $pin = $util->get_alphanum_val($q->param('pin')); + my $csr = $util->get_val($q->param('csr')); + + my $key = $client_id . "/" . $site_id; + + my $pin_store = PKI::Base::PinStore->new(); + $pin_store->open($cfg); + my $pinref = $pin_store->read_pin($key); + if (defined($pinref) && $pinref->{'pin'} eq $pin) { + $pin_store->delete($key); + } else { + $pin_store->close(); + # error, redirect user back to the original enrollment page + print $q->redirect("/ee/scep/installer.cgi"); + return; + } + $pin_store->close(); + + my $profile_id = $cfg->get("request.scep.profileId"); + my $cert_request_type = $cfg->get("request.scep.reqType"); + + my $ca = PKI::Conn::CA->new(); + $ca->open($cfg); + my $cert = $ca->enroll($pinref->{'rid'}, "ca1", $profile_id, $cert_request_type, $csr); + $ca->close(); + my $decoded = decode_base64($cert); + my $encoded = encode_base64($decoded); + + my %context; + $context{cert} = $encoded; + + my $result = $parser->execute_file_with_context("ee/scep/enroll.vm", + \%context); + + my $xml = $q->param('xml'); + if ($xml eq "true") { + print "Content-Type: text/xml\n\n"; + print $self->xml_output(\%context); + } else { + print "Content-Type: text/html\n\n"; + print "$result"; + } +} + +my $op = op->new(); +$op->execute(); diff --git a/base/ra/apache/docroot/ee/scep/enroll.vm b/base/ra/apache/docroot/ee/scep/enroll.vm new file mode 100644 index 000000000..2893eac1c --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/enroll.vm @@ -0,0 +1,74 @@ + + + + +SCEP Router Enrollment + + + + + + + +#include ( "header.vm" ) + + + + +
+ +
+
+ +
+ - +
+ + +
+
+ +
+ + + +RA Services : +SCEP Enrollment
+Installer Interface +
+

+This form is for router installer to retrieve the requested certificate. +

+ Your Certificate: +
+

+-----BEGIN CERTIFICATE-----
+$cert
+-----END CERTIFICATE-----
+
+#include ( "footer.vm" ) + + + diff --git a/base/ra/apache/docroot/ee/scep/index.cgi b/base/ra/apache/docroot/ee/scep/index.cgi new file mode 100755 index 000000000..c73fc379a --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/index.cgi @@ -0,0 +1,68 @@ +#!/usr/bin/perl +# +# --- BEGIN COPYRIGHT BLOCK --- +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# +# +# + +package op; + +use lib $ENV{DOCUMENT_ROOT} . "/../lib/perl"; + +use CGI; +use PKI::Service::Op; +use Template::Velocity; +use PKI::Base::Registry; + +use vars qw (@ISA); +use PKI::Service::Op; +@ISA = qw(PKI::Service::Op); + +sub new { + my $self = {}; + bless ($self); + return $self; +} + +sub process() +{ + my $self = shift; + my $q = CGI->new(); + + my $docroot = PKI::Base::Registry->get_docroot(); + my $parser = PKI::Base::Registry->get_parser(); + my $cfg = PKI::Base::Registry->get_config(); + + my %context; + my $result = $parser->execute_file_with_context("ee/scep/index.vm", + \%context); + + my $xml = $q->param('xml'); + if ($xml eq "true") { + print "Content-Type: text/xml\n\n"; + print $self->xml_output(\%context); + } else { + print "Content-Type: text/html\n\n"; + print "$result"; + } +} + +my $op = op->new(); +$op->execute(); diff --git a/base/ra/apache/docroot/ee/scep/index.vm b/base/ra/apache/docroot/ee/scep/index.vm new file mode 100644 index 000000000..3d75a8d40 --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/index.vm @@ -0,0 +1,83 @@ + + + + +RA End-Entity + + + + + + + +#include ( "header.vm" ) + + + + +
+ +
+
+ +
+ - +
+ + +
+
+ +
+ + + +RA Services : SCEP Enrollment
+
+

+In the SCEP enrollment, a manager must firstly submit a one-time pin creation request to the RA. RA Agent will then approve and generate an one-time pin. The pin will be returned to the manager who will give the pin to a local router installer. The router installer visits the enrollment form where certificate request, one time pin and other necessary information are submitted. The system will issue the certificate immediately. +

+

+ + + + + + + +
+ +
  • Request Submission - Manager
    • +     +
    + +
  • SCEP Enrollment - Installer
    • +     +
    +
    +#include ( "footer.vm" ) + + + diff --git a/base/ra/apache/docroot/ee/scep/installer.cgi b/base/ra/apache/docroot/ee/scep/installer.cgi new file mode 100755 index 000000000..8453c2cc4 --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/installer.cgi @@ -0,0 +1,74 @@ +#!/usr/bin/perl +# +# --- BEGIN COPYRIGHT BLOCK --- +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# +# +# + +package op; + +use lib $ENV{DOCUMENT_ROOT} . "/../lib/perl"; + +use CGI; +use PKI::Service::Op; +use Template::Velocity; +use PKI::Base::Conf; +use PKI::Base::Registry; + +use vars qw (@ISA); +use PKI::Service::Op; +@ISA = qw(PKI::Service::Op); + +sub new { + my $self = {}; + bless ($self); + return $self; +} + +sub process() +{ + my $self = shift; + my $q = CGI->new(); + + my $docroot = PKI::Base::Registry->get_docroot(); + my $parser = PKI::Base::Registry->get_parser(); + my $cfg = PKI::Base::Registry->get_config(); + + $self->debug_params($cfg, $q); + + my %context; + $context{machine} = $cfg->get("service.machineName"); + $context{port} = $cfg->get("service.unsecurePort"); + + my $result = $parser->execute_file_with_context("ee/scep/installer.vm", + \%context); + + my $xml = $q->param('xml'); + if ($xml eq "true") { + print "Content-Type: text/xml\n\n"; + print $self->xml_output(\%context); + } else { + print "Content-Type: text/html\n\n"; + print "$result"; + } +} + +my $op = op->new(); +$op->execute(); diff --git a/base/ra/apache/docroot/ee/scep/installer.vm b/base/ra/apache/docroot/ee/scep/installer.vm new file mode 100644 index 000000000..be9f969ac --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/installer.vm @@ -0,0 +1,73 @@ + + + + +SCEP Router Request Using a One-Time Pin + + + + + + + +#include ( "header.vm" ) + + + + +
    + +
    +
    + +
    + - +
    + + +
    +
    + +
    + + + +RA Services : +SCEP Enrollment
    +Installer Interface +
    +

    +This form is for router installer to request a certificate with the given one time pin. +

    +

    +The SCEP enrollment URL for the router is: +
    +
    +http://$machine:$port/ee/scep/pkiclient.cgi +
    +#include ( "footer.vm" ) + + + diff --git a/base/ra/apache/docroot/ee/scep/manager.cgi b/base/ra/apache/docroot/ee/scep/manager.cgi new file mode 100755 index 000000000..8b547a928 --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/manager.cgi @@ -0,0 +1,68 @@ +#!/usr/bin/perl +# +# --- BEGIN COPYRIGHT BLOCK --- +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# +# +# + +package op; + +use lib $ENV{DOCUMENT_ROOT} . "/../lib/perl"; + +use CGI; +use PKI::Service::Op; +use Template::Velocity; +use PKI::Base::Registry; + +use vars qw (@ISA); +use PKI::Service::Op; +@ISA = qw(PKI::Service::Op); + +sub new { + my $self = {}; + bless ($self); + return $self; +} + +sub process() +{ + my $self = shift; + my $q = CGI->new(); + + my $docroot = PKI::Base::Registry->get_docroot(); + my $parser = PKI::Base::Registry->get_parser(); + my $cfg = PKI::Base::Registry->get_config(); + + my %context; + my $result = $parser->execute_file_with_context("ee/scep/manager.vm", + \%context); + + my $xml = $q->param('xml'); + if ($xml eq "true") { + print "Content-Type: text/xml\n\n"; + print $self->xml_output(\%context); + } else { + print "Content-Type: text/html\n\n"; + print "$result"; + } +} + +my $op = op->new(); +$op->execute(); diff --git a/base/ra/apache/docroot/ee/scep/manager.vm b/base/ra/apache/docroot/ee/scep/manager.vm new file mode 100644 index 000000000..e5b6abed5 --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/manager.vm @@ -0,0 +1,123 @@ + + + + +SCEP Router Manager Request for a One-Time Pin + + + + + + + +#include ( "header.vm" ) + + + + +
    + +
    +
    + +
    + - +
    + + +
    +
    + +
    + + + + + +RA Services : +SCEP Enrollment
    +Manager Interface +
    +

    +This form is for manager to request for a one time pin so that router installer can request for a certificate. +

    + + +

    + + + + + + + + + + + + + + + + + + + + + +
    Client ID:
    Site ID (IP Address):
    Your Email:
      
    + +
    +#include ( "footer.vm" ) + + + diff --git a/base/ra/apache/docroot/ee/scep/pkiclient.cgi b/base/ra/apache/docroot/ee/scep/pkiclient.cgi new file mode 100755 index 000000000..a54558f37 --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/pkiclient.cgi @@ -0,0 +1,113 @@ +#!/usr/bin/perl +# +# --- BEGIN COPYRIGHT BLOCK --- +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# +# +# + +package op; + +use lib $ENV{DOCUMENT_ROOT} . "/../lib/perl"; + +use MIME::Base64; +use URI::URL; +use URI::Escape; +use XML::Simple; +use CGI; +use PKI::Base::Conf; +use PKI::Base::Util; +use PKI::Service::Op; +use Template::Velocity; +use PKI::Conn::CA; +use PKI::Base::PinStore; +use PKI::Base::Registry; + +use vars qw (@ISA); +use PKI::Service::Op; +@ISA = qw(PKI::Service::Op); + +sub new { + my $self = {}; + bless ($self); + return $self; +} + +sub process() +{ + my $self = shift; + my $q = CGI->new(); + + my $util = PKI::Base::Util->new(); + + my $docroot = PKI::Base::Registry->get_docroot(); + my $parser = PKI::Base::Registry->get_parser(); + my $cfg = PKI::Base::Registry->get_config(); + + $self->debug_params($cfg, $q); + + my $operation = $util->get_alphanum_val($q->param('operation')); + my $message = $util->get_val($q->param('message')); + $message = uri_escape($message); + + my $ca = PKI::Conn::CA->new(); + $ca->open($cfg); + if ($operation eq "GetCACert") { + my $content = $ca->scep_get_ca_cert("ca1", $operation, $message); + + print "Content-Type: application/x-x509-ca-cert\n\n"; + print $content; + } elsif ($operation eq "PKIOperation") { + my $decoded = $ca->scep_decode("ca1", $operation, $message); + $decoded =~ /(\.*\<\/XMLResponse\>)/; + $decoded = $1; + my $parser = XML::Simple->new(); + my $response = $parser->XMLin($decoded); + + # one time pin + my $pin = $response->{'PKCS10'}->{'ChallengePassword'}->{'Password'} ; + # IP Address + my $key = $ENV{'REMOTE_ADDR'}; + + # check PIN + if (1) { + my $pin_store = PKI::Base::PinStore->new(); + $pin_store->open($cfg); + my $pinref = $pin_store->read_pin($key); + if (defined($pinref) && $pinref->{'pin'} eq $pin) { + $pin_store->delete($key); + } else { + $pin_store->close(); + # XXX - return SCEP error + print $q->redirect("/ee/scep/installer.cgi"); + return; + } + $pin_store->close(); + } + + my $content = $ca->scep_pki_message("ca1", $operation, $message); + + print "Content-Type: application/x-pki-message\n\n"; + print $content; + } + $ca->close(); +} + +my $op = op->new(); +$op->execute(); diff --git a/base/ra/apache/docroot/ee/scep/submit.cgi b/base/ra/apache/docroot/ee/scep/submit.cgi new file mode 100755 index 000000000..b3dfd7a5d --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/submit.cgi @@ -0,0 +1,91 @@ +#!/usr/bin/perl +# +# --- BEGIN COPYRIGHT BLOCK --- +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Copyright (C) 2007 Red Hat, Inc. +# All rights reserved. +# --- END COPYRIGHT BLOCK --- +# +# +# +# + +package op; + +use lib $ENV{DOCUMENT_ROOT} . "/../lib/perl"; + +use DBI; +use CGI; +use PKI::Service::Op; +use PKI::Base::Conf; +use PKI::Base::Util; +use PKI::Request::Queue; +use Template::Velocity; +use PKI::Base::Registry; + +use vars qw (@ISA); +use PKI::Service::Op; +@ISA = qw(PKI::Service::Op); + +sub new { + my $self = {}; + bless ($self); + return $self; +} + +sub process() +{ + my $self = shift; + my $q = CGI->new(); + + my $util = PKI::Base::Util->new(); + + my $client_id = $util->get_val($q->param('client_id')); + my $site_id = $util->get_val($q->param('site_id')); + my $email = $util->get_val($q->param('email')); + + my $docroot = PKI::Base::Registry->get_docroot(); + my $parser = PKI::Base::Registry->get_parser(); + my $cfg = PKI::Base::Registry->get_config(); + + $self->debug_params($cfg, $q); + + my $queue = PKI::Request::Queue->new(); + $queue->open($cfg); + my $request_id = $queue->create_request("scep", + "client_id=" . $client_id . ";" . + "site_id=" . $site_id, + "0", + $email); + my %context; + $context{request_id} = $util->html_encode($request_id); + $self->debug_log($cfg, "request $request_id created"); + $queue->close(); + + my $result = $parser->execute_file_with_context("ee/scep/submit.vm", + \%context); + + my $xml = $q->param('xml'); + if ($xml eq "true") { + print "Content-Type: text/xml\n\n"; + print $self->xml_output(\%context); + } else { + print "Content-Type: text/html\n\n"; + print "$result"; + } +} + +my $op = op->new(); +$op->execute(); diff --git a/base/ra/apache/docroot/ee/scep/submit.vm b/base/ra/apache/docroot/ee/scep/submit.vm new file mode 100644 index 000000000..6786bf936 --- /dev/null +++ b/base/ra/apache/docroot/ee/scep/submit.vm @@ -0,0 +1,76 @@ + + + + +SCEP Router Request Submission + + + + + + + +#include ( "header.vm" ) + + + + +
    + +
    +
    + +
    + - +
    + + +
    +
    + +
    + + + +RA Services : +SCEP Enrollment
    +Manager Interface +
    +

    +Your request has been successfully submitted. +

    +

    + + + + + +
    Request ID:$request_id
    + +
    +#include ( "footer.vm" ) + + + -- cgit