path: root/pki/base/ra/etc/init.d/httpd

#!/bin/bash
#
# --- BEGIN COPYRIGHT BLOCK ---
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# Copyright (C) 2007 Red Hat, Inc.
# All rights reserved.
# --- END COPYRIGHT BLOCK ---
#
# [INSTANCE_ID]    Startup script for the Apache HTTP Server
#
# chkconfig:    - 86 14
# description:  Registration Authority \
#               (Apache 2.2)
# processname:  [INSTANCE_ID]
# config:       [HTTPD_CONF]
# pidfile:      [SERVER_ROOT]/logs/[INSTANCE_ID].pid

# Disallow 'others' the ability to 'write' to new files
umask 00002

# Check to insure that this script's original invocation directory
# has not been deleted!
CWD=`/bin/pwd > /dev/null 2>&1`
if [ $? -ne 0 ] ; then
	echo "Cannot invoke '$0' from non-existent directory!"
	exit 255
fi

# Check to insure that this script's associated PKI
# subsystem currently resides on this system.
SUBSYSTEM_TYPE=[SUBSYSTEM_TYPE]
if [ ! -d /usr/share/pki/${SUBSYSTEM_TYPE} ] ; then
	echo "This machine is missing the '${SUBSYSTEM_TYPE}' subsystem!"
	exit 255
fi

# Obtain the operating system upon which this script is being executed
OS=`uname -s`
ARCHITECTURE=""

# Time to wait in seconds, before killing process
#
#     NOTE:  Defined in "tomcat5.conf" for other PKI Subsystems.
#
STARTUP_WAIT=30
SHUTDOWN_WAIT=30

# This script must be run as root!
RV=0
if [ ${OS} = "Linux" ] ; then
	if [ `id -u` -ne 0 ] ; then
		echo "Must be 'root' to execute '$0'!"
		exit 1
	fi
	ARCHITECTURE=`uname -i`
elif [ ${OS} = "SunOS" ] ; then
	if [ `/usr/xpg4/bin/id -u` -ne 0 ] ; then
		echo "Must be 'root' to execute '$0'!"
		exit 1
	fi
	ARCHITECTURE=`uname -p`
	if	[ "${ARCHITECTURE}" = "sparc" ] &&
		[ -d "/usr/lib/sparcv9/" ] ; then
		ARCHITECTURE="sparcv9"
	fi
else
	echo "Unsupported OS '${OS}'!"
	exit 1
fi

# Initialize environment variables
LD_LIBRARY_PATH=[SYSTEM_USER_LIBRARIES]:[SYSTEM_LIBRARIES]:${LD_LIBRARY_PATH}
LD_LIBRARY_PATH=[SECURITY_LIBRARIES]:${LD_LIBRARY_PATH}
export LD_LIBRARY_PATH

# Source function library.
if [ -f /etc/init.d/functions ]; then
	. /etc/init.d/functions
else
	# The checkpid() function is provided for platforms that do not
	# contain the "/etc/init.d/functions" file (e. g. - Solaris) . . .

	# Check if ${pid} (could be plural) are running (keep count)
	checkpid()
	{
		rv=0
		for i in $* ; do
			ps -p $i > /dev/null 2>&1 ;
			if [ $? -ne 0 ] ; then
				rv=`expr $rv + 1`
			else
				rv=`expr $rv + 0`
			fi
		done
		# echo "rv=$rv"
		return $rv
	}

	# Create the following directories on platforms
	# where they do not exist (e. g. - Solaris) . . .
	if [ ! -d /var/lock/subsys ] ; then
		mkdir -p /var/lock/subsys
	fi
fi

########################################################################
#   This section contains modified content of "/etc/sysconfig/httpd"   #
########################################################################
# Configuration file for the [INSTANCE_ID] service.

#
# The default processing model (MPM) is the process-based
# 'prefork' model.  A thread-based model, 'worker', is also
# available, but does not work with some modules (such as PHP).
# The service must be stopped before changing this variable.
#
HTTPD=[FORTITUDE_DIR]/sbin/httpd.worker

#
# To pass additional options (for instance, -D definitions) to the
# httpd binary at startup, set OPTIONS here.
#
OPTIONS="-f [HTTPD_CONF]"

#
# By default, the httpd process is started in the C locale; to 
# change the locale in which the server runs, the HTTPD_LANG
# variable can be set.
#
HTTPD_LANG=C
########################################################################
#                                                                      #
########################################################################

# This will prevent initlog from swallowing up a pass-phrase prompt if
# mod_ssl needs a pass-phrase from the user.
INITLOG_ARGS=""

# Set HTTPD=/usr/sbin/httpd.worker in /etc/sysconfig/httpd to use a server
# with the thread-based "worker" MPM; BE WARNED that some modules may not
# work correctly with a thread-based MPM; notably PHP will refuse to start.

# Path to the server binary and short-form for messages.
httpd=${HTTPD:-[FORTITUDE_DIR]/sbin/httpd}
prog=[INSTANCE_ID]
pki_instance_configuration_file=[SERVER_ROOT]/conf/CS.cfg
pidfile=${PIDFILE:-[SERVER_ROOT]/logs/[INSTANCE_ID].pid}
lockfile=${LOCKFILE:-/var/lock/subsys/[INSTANCE_ID]}
RESTART_SERVER=[SERVER_ROOT]/conf/restart_server_after_configuration
RETVAL=0

# see if httpd is linked with the openldap libraries - we need to override them
if [ ${OS} = "Linux" ]; then
	hasopenldap=0

	/usr/bin/ldd $httpd 2>&1 | grep libldap- > /dev/null 2>&1 && hasopenldap=1

	if [ $hasopenldap -eq 1 ] ; then
		LD_PRELOAD="[SYSTEM_USER_LIBRARIES]/libldap60.so"
		LD_PRELOAD="[SYSTEM_USER_LIBRARIES]/libssl3.so:${LD_PRELOAD}"
		export LD_PRELOAD
	fi
elif [ ${OS} = "SunOS" ] ; then
	LD_PRELOAD_64="[SYSTEM_USER_LIBRARIES]/libldap60.so"
	LD_PRELOAD_64="[SYSTEM_USER_LIBRARIES]/dirsec/libssl3.so:${LD_PRELOAD_64}"
	export LD_PRELOAD_64
fi

check_pki_configuration_status()
{
	rv=0

	rv=`grep -c ^preop ${pki_instance_configuration_file}`

	rv=`expr ${rv} + 0`

	if [ ${rv} -ne 0 ] ; then
		echo "    '[INSTANCE_ID]' must still be CONFIGURED!"
		echo "    (see /var/log/[INSTANCE_ID]-install.log)"
	elif [ -f ${RESTART_SERVER} ] ; then
		echo "    Although '[INSTANCE_ID]' has been CONFIGURED, it must still be RESTARTED!"
		rv=255
	fi

	return ${rv}
}

get_pki_status_definitions()
{
	# establish well-known strings
	listen_statement="Listen"
	total_ports=0
	UNSECURE_PORT=""
	CLIENTAUTH_PORT=""
	NON_CLIENTAUTH_PORT=""

	# check to see that an instance-specific "httpd.conf" file exists
	if [ ! -f [HTTPD_CONF] ] ; then
		echo "File '[HTTPD_CONF]' does not exist!"
		exit 255
	fi

	# check to see that an instance-specific "nss.conf" file exists
	if [ ! -f [NSS_CONF] ] ; then
		echo "File '[NSS_CONF]' does not exist!"
		exit 255
	fi

	# read this instance-specific "httpd.conf" file line-by-line
	# to obtain the current value of the PKI unsecure port

	exec < [HTTPD_CONF]
	while read line; do
		# look for the listen statement
		head=`echo $line | cut -b1-6`
		if [ "$head" == "$listen_statement" ] ; then
			# once the 'unsecure' listen statement has been found,
			# extract the numeric port information
			port=`echo $line | cut -b8-`
			UNSECURE_PORT=$port
			echo "    Unsecure Port              = http://[SERVER_NAME]:${UNSECURE_PORT}"
			total_ports=`expr ${total_ports} + 1`
			break;
		fi
	done

	# read this instance-specific "nss.conf" file line-by-line
	# to obtain the current value of the "clientauth" PKI secure port
	# AND the current value of the "non-clientauth" PKI secure port

	exec < [NSS_CONF]
	while read line; do
		# look for the listen statement
		head=`echo $line | cut -b1-6`
		if	[ "$head" == "$listen_statement" ] &&
			[ ${total_ports} -eq 2           ] ; then
			# once the 'non-clientauth' listen statement has been found,
			# extract the numeric port information
			non_clientauth_port=`echo $line | cut -b8-`
			NON_CLIENTAUTH_PORT=$non_clientauth_port
			echo "    Secure Non-Clientauth Port = https://[SERVER_NAME]:${NON_CLIENTAUTH_PORT}"
			total_ports=`expr ${total_ports} + 1`
			break
		fi
		if	[ "$head" == "$listen_statement" ] &&
			[ ${total_ports} -eq 1           ] ; then
			# once the 'clientauth' listen statement has been found,
			# extract the numeric port information
			clientauth_port=`echo $line | cut -b8-`
			CLIENTAUTH_PORT=$clientauth_port
			echo "    Secure Clientauth Port     = https://[SERVER_NAME]:${CLIENTAUTH_PORT}"
			total_ports=`expr ${total_ports} + 1`
		fi
	done

	if [ ${total_ports} -eq 3 ] ; then
		return 0
	else
		return 255
	fi
}

get_pki_configuration_definitions()
{
	# Obtain the PKI Subsystem Type
	line=`grep ^cs.type= ${pki_instance_configuration_file}`
	pki_subsystem=`echo "${line}" | cut -b9-`
	if [ "${line}" != "" ] ; then
		if	[ "${pki_subsystem}" != "CA"   ]  &&
			[ "${pki_subsystem}" != "KRA"  ]  &&
			[ "${pki_subsystem}" != "OCSP" ]  &&
			[ "${pki_subsystem}" != "TKS"  ]  &&
			[ "${pki_subsystem}" != "RA"   ]  &&
			[ "${pki_subsystem}" != "TPS"  ]
		then
			return 255
		fi
		if	[ "${pki_subsystem}" == "KRA"   ] ; then
			# Rename "KRA" to "DRM"
			pki_subsystem="DRM"
		fi
	else
		return 255
	fi

	# If "${pki_subsystem}" is a CA, DRM, OCSP, or TKS,
	# check to see if "${pki_subsystem}" is a "Clone"
	pki_clone=""
	if	[ "${pki_subsystem}" == "CA"   ]  ||
		[ "${pki_subsystem}" == "DRM"  ]  ||
		[ "${pki_subsystem}" == "OCSP" ]  ||
		[ "${pki_subsystem}" == "TKS"  ]
	then
		line=`grep ^subsystem.select= ${pki_instance_configuration_file}`
		if [ "${line}" != "" ] ; then
			pki_clone=`echo "${line}" | cut -b18-`
			if [ "${pki_clone}" != "Clone" ] ; then
				# Reset "${pki_clone}" to be empty
				pki_clone=""
			fi
		else
			return 255
		fi
	fi

	# If "${pki_subsystem}" is a CA, and is NOT a "Clone", check to
	# see "${pki_subsystem}" is a "Root" or a "Subordinate" CA
	pki_hierarchy=""
	if	[ "${pki_subsystem}" == "CA" ]  &&
		[ "${pki_clone}" != "Clone"  ]
	then
		line=`grep ^hierarchy.select= ${pki_instance_configuration_file}`
		if [ "${line}" != "" ] ; then
			pki_hierarchy=`echo "${line}" | cut -b18-`
		else
			return 255
		fi
	fi

	# If ${pki_subsystem} is a CA, check to
	# see if it is also a Security Domain
	pki_security_domain=""
	if	[ "${pki_subsystem}" == "CA" ] ; then
		line=`grep ^securitydomain.select= ${pki_instance_configuration_file}`
		if [ "${line}" != "" ] ; then
			pki_security_domain=`echo "${line}" | cut -b23-`
			if [ "${pki_security_domain}" == "new" ] ; then
				# Set a fixed value for "${pki_security_domain}"
				pki_security_domain="(Security Domain)"
			else
				# Reset "${pki_security_domain}" to be empty
				pki_security_domain=""
			fi
		else
			return 255
		fi
	fi

	# Always obtain this PKI instance's "registered"
	# security domain information
	pki_security_domain_name=""
	pki_security_domain_hostname=""
	pki_security_domain_https_admin_port=""

	line=`grep ^securitydomain.name= ${pki_instance_configuration_file}`
	if [ "${line}" != "" ] ; then
		pki_security_domain_name=`echo "${line}" | cut -b21-`
	else
		return 255
	fi

	line=`grep ^securitydomain.host= ${pki_instance_configuration_file}`
	if [ "${line}" != "" ] ; then
		pki_security_domain_hostname=`echo "${line}" | cut -b21-`
	else
		return 255
	fi

	line=`grep ^securitydomain.httpsadminport= ${pki_instance_configuration_file}`
	if [ "${line}" != "" ] ; then
		pki_security_domain_https_admin_port=`echo "${line}" | cut -b31-`
	else
		return 255
	fi

	# Compose the "PKI Instance Name" Status Line
	pki_instance_name="PKI Instance Name:   [INSTANCE_ID]"

	# Compose the "PKI Subsystem Type" Status Line
	header="PKI Subsystem Type: "
	if   [ "${pki_clone}" != "" ] ; then
		if [ "${pki_security_domain}" != "" ]; then
			# Possible Values:
			#
			#     "CA Clone (Security Domain)"
			#
			data="${pki_subsystem} ${pki_clone} ${pki_security_domain}"
		else
			# Possible Values:
			#
			#     "CA Clone"
			#     "DRM Clone"
			#     "OCSP Clone"
			#     "TKS Clone"
			#
			data="${pki_subsystem} ${pki_clone}"
		fi
	elif [ "${pki_hierarchy}" != "" ] ; then
		if [ "${pki_security_domain}" != "" ]; then
			# Possible Values:
			#
			#     "Root CA (Security Domain)"
			#     "Subordinate CA (Security Domain)"
			#
			data="${pki_hierarchy} ${pki_subsystem} ${pki_security_domain}"
		else
			# Possible Values:
			#
			#     "Root CA"
			#     "Subordinate CA"
			#
			data="${pki_hierarchy} ${pki_subsystem}"
		fi
	else
		# Possible Values:
		#
		#     "DRM"
		#     "OCSP"
		#     "RA"
		#     "TKS"
		#     "TPS"
		#
		data="${pki_subsystem}"
	fi
	pki_subsystem_type="${header} ${data}"

	# Compose the "Registered PKI Security Domain Information" Status Line
	header="Name: "
	registered_pki_security_domain_name="${header} ${pki_security_domain_name}"

	header="URL:  "
	if	[ "${pki_security_domain_hostname}" != ""         ] &&
		[ "${pki_security_domain_https_admin_port}" != "" ]
	then
		data="https://${pki_security_domain_hostname}:${pki_security_domain_https_admin_port}"
	else
		return 255
	fi
	registered_pki_security_domain_url="${header} ${data}"

	# Print the "PKI Subsystem Type" Status Line
	echo
	echo "    ${pki_instance_name}"

	# Print the "PKI Subsystem Type" Status Line
	echo
	echo "    ${pki_subsystem_type}"

	# Print the "Registered PKI Security Domain Information" Status Line
	echo
	echo "    Registered PKI Security Domain Information:"
	echo "    =========================================================================="
	echo "    ${registered_pki_security_domain_name}"
	echo "    ${registered_pki_security_domain_url}"
	echo "    =========================================================================="

	return 0
}

get_pki_secure_port()
{
	# establish well-known strings
	listen_statement="Listen"

	# first check to see that an instance-specific "nss.conf" file exists
	if [ ! -f [NSS_CONF] ] ; then
		echo "File '[NSS_CONF]' does not exist!"
		exit 255
	fi

	# read this instance-specific "nss.conf" file line-by-line
	# to obtain the current value of the "clientauth" PKI secure port
	
	exec < [NSS_CONF]
	while read line; do
		# look for the listen statement
		head=`echo $line | cut -b1-6`
		if [ "$head" == "$listen_statement" ] ; then
			# once the 'clientauth' listen statement has been found,
			# extract the numeric port information
			port=`echo $line | cut -b8-`
			SECURE_PORT=$port
			return 0
		fi
	done

	return 255
}

# The semantics of these two functions differ from the way apachectl does
# things -- attempting to start while running is a failure, and shutdown
# when not running is also a failure.  So we just do it the way init scripts
# are expected to behave here.
start()
{
	echo -n $"Starting $prog: "

	if [ -f ${RESTART_SERVER} ] ; then
		rm -f ${RESTART_SERVER}
	fi

	if [ -f ${lockfile} ] ; then
		if [ -f ${pidfile} ]; then
			read kpid < ${pidfile}
			if checkpid $kpid 2>&1; then
				echo
				echo "process already running"
				return 255
			else
				echo
				echo -n "lock file found but no process "
				echo -n "running for pid $kpid, continuing"
				echo
				echo
			fi
		fi
	fi

        # restore context for ncipher hsm
        [ -x /sbin/restorecon ] && [ -d /dev/nfast ] && /sbin/restorecon -R /dev/nfast


	if [ -f /etc/init.d/functions ]; then
		/usr/sbin/selinuxenabled
		RETVAL=$?
		if [ $RETVAL = 0 ] ; then	
			if [ ${ARCHITECTURE} = "i386" ] ; then
				LANG=$HTTPD_LANG daemon runcon -t pki_ra_t -- $httpd $OPTIONS
				# overwrite output from "daemon"
				echo -n $"Starting $prog:                                        "
			elif [ ${ARCHITECTURE} = "x86_64" ] ; then
				# NOTE:  "daemon" is incompatible with "httpd"
				#        on 64-bit architectures
				LANG=$HTTPD_LANG runcon -t pki_ra_t -- $httpd $OPTIONS
			fi
		else
			LANG=$HTTPD_LANG daemon $httpd $OPTIONS
			# overwrite output from "daemon"
			echo -n $"Starting $prog:                                        "
		fi
	else
		LANG=$HTTPD_LANG $httpd $OPTIONS -k start
	fi

	RETVAL=$?
	[ $RETVAL = 0 ] && touch ${lockfile}

	if [ $RETVAL = 0 ] ; then
		count=0;

		let swait=$STARTUP_WAIT
		until	[ -s ${pidfile} ] ||
				[ $count -gt $swait ]
		do
			echo -n "."
			sleep 1
			let count=$count+1;
		done

		if [ -f /etc/init.d/functions ]; then
			echo_success
			echo
		else
			echo "                                       [  OK  ]"
		fi

		get_pki_secure_port
		if [ $? -ne 0 ] ; then
			SECURE_PORT="<Port Undefined>"
		fi

		# Set permissions of log files
		pki_logs_directory=`dirname ${pidfile}`
		for file in ${pki_logs_directory}/*; do
			if [ "${file}" != "${pidfile}" ]; then
				chmod 00660 ${file}
				chgrp [GROUPID] ${file}
				chown [USERID] ${file}
			fi
		done
	else
		if [ -f /etc/init.d/functions ]; then
			echo_failure
			echo
		else
			echo "                                       [  FAILED  ]"
		fi
	fi

	if [ ${OS} = "Linux" ] ; then
		sleep 10
	elif [ ${OS} = "SunOS" ] ; then
		sleep 20
	fi
	echo
	status
	return $RETVAL
}

stop()
{
	echo -n "Stopping $prog: "

	if [ -f ${lockfile} ] ; then
		$httpd $OPTIONS -k stop

		RETVAL=$?

		if [ $RETVAL = 0 ]; then
			count=0;

			if [ -f ${pidfile} ]; then
				read kpid < ${pidfile}
				let kwait=$SHUTDOWN_WAIT

				until	[ `ps -p $kpid | grep -c $kpid` = '0' ] ||
						[ $count -gt $kwait ]
				do
					echo -n "."
					sleep 1
					let count=$count+1;
				done

				if [ $count -gt $kwait ]; then
					kill -9 $kpid
				fi
			fi

			rm -f ${lockfile}
			rm -f ${pidfile}

			if [ -f /etc/init.d/functions ]; then
				echo_success
				echo
			else
				echo "                                       [  OK  ]"
			fi
		else
			if [ -f /etc/init.d/functions ]; then
				echo_failure
				echo
			else
				echo "                                       [  FAILED  ]"
			fi
		fi
	else
		echo
		echo "process already stopped"
	fi
}

reload()
{
	echo -n $"Reloading $prog: "

	if ! LANG=$HTTPD_LANG $httpd $OPTIONS -t >&/dev/null; then
		RETVAL=$?
		echo $"not reloading due to configuration syntax error"
		if [ -f /etc/init.d/functions ]; then
			failure $"not reloading $httpd due to configuration syntax error"
		else
			echo $"not reloading $httpd due to configuration syntax error"
		fi
	else
		if [ -f /etc/init.d/functions ]; then
			killproc $httpd -HUP
			# overwrite output from "killproc"
			echo -n $"Stopping $prog:                                        "
		else
			if [ -f ${lockfile} ] ; then
				if [ -f ${pidfile} ]; then
					read kpid < ${pidfile}
					if checkpid $kpid 2>&1; then
						kill -HUP $kpid
					fi
				else
					echo
					echo -n "lock file found but no process "
					echo -n "running for pid $kpid, continuing"
					echo
					echo
				fi
			fi
		fi
	fi
	echo
}

status()
{
	if [ -f ${pidfile} ] ; then
		pid=`cat ${pidfile}`
		if [ "${pid}" == "" ] ; then
			echo "[INSTANCE_ID] pid file exists but is empty"
		elif kill -0 ${pid} > /dev/null 2>&1 ; then
			echo "[INSTANCE_ID] (pid ${pid}) is running ..."
			echo
			check_pki_configuration_status
			if [ $? -eq 0 ] ; then
				get_pki_status_definitions
				if [ $? -ne 0 ] ; then
					echo
					echo "[INSTANCE_ID] Status Definitions not found"
				fi
				get_pki_configuration_definitions
				if [ $? -ne 0 ] ; then
					echo
					echo "[INSTANCE_ID] Configuration Definitions not found"
				fi
			fi
			echo
		else
			echo "[INSTANCE_ID] is dead but pid file exists"
		fi
	else
		echo "[INSTANCE_ID] is stopped"
	fi
}

# See how we were called.
case "$1" in
	start)
		start
		;;
	stop)
		stop
		;;
	restart)
		stop
		sleep 2
		start
		;;
	condrestart)
		if [ -f ${pidfile} ] ; then
			stop
			sleep 2
			start
		else
			echo -n "Unable to restart process since "
			echo -n "'${pidfile}' does not exist!"
			echo
		fi
		;;
	reload)
		reload
		;;
	status)
		status
		;;
	*)
		echo $"Usage: $prog {start|stop|restart|condrestart|reload|status}"
		exit 1
esac

exit $RETVAL