path: root/cepceslib.sh

#!/bin/sh
# vim: set noet sts=4 sw=4 ts=4:
# File: cepceslib.sh
# Location: https://bgstack15.ddns.net/cgit/cepceslib
# Author: bgstack15, Sathvik Kolla
# SPDX-License-Identifier: GPL-3.0-only
# Startdate: 2024-08-23 08:21
# Title: CES username enrollment
# Purpose:
# History:
# Usage:
# Reference:
#    https://gist.github.com/leechristensen/28e4ddf89d77b70fe3e694684374c8a5
#    https://www.server-world.info/en/note?os=Windows_Server_2022&p=iis&f=8
#    https://stackoverflow.com/questions/3765212/an-error-occurred-when-verifying-security-for-the-message
#    https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wstep/a22e793f-2c7e-4f5e-a22c-f05c49535855
#    chatgpt for wsse:usernametoken fields and all xmlns entries
#    https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-xcep/3642fda9-8de2-417a-adad-9d368ffe8fc2
#    https://medium.com/@fmcalbuquerque/python-elementtree-xml-api-with-dynamic-namespaces-171d9c9f391e
# Improve:
#    Use IP.1 if a SAN is an ip address
# Dependencies:
#    openssl, python3
# Documentation: README.md

gen_csr() {
    # input env vars: KEYFILE, CSRFILE, TEMPLATE, CN, SANS
    _cnf="$( mktemp )"
	_cn="${CN:-$( hostname -f )}"
	_san="${SANS:-$( hostname -s )}"
	_san_list="$( echo "${_san}" | tr ',' '\n' | grep -E '.' | awk '{gsub("^","DNS."NR+1" = ",$0);print;}' )"
    cat >"${_cnf}" <<EOFCONF
oid_section = new_oids
[ req ]
prompt             = no
default_bits       = 4096
default_md         = sha256
default_keyfile    = privkey.pem
distinguished_name = req_distinguished_name
req_extensions     = req_ext

[ new_oids ]
certificateTemplateName = 1.3.6.1.4.1.311.20.2

[ req_distinguished_name ]
C = US
ST = New York
L = New York
O = Example Organization
# Important value
CN = ${_cn}
#emailAddress = noreply@example.com

[ req_ext ]
basicConstraints       = CA:FALSE
keyUsage               = digitalSignature, keyEncipherment
subjectAltName         = @alt_names
certificateTemplateName = ASN1:UTF8STRING:${TEMPLATE}

[ alt_names ]
# Important value
DNS.1 = ${_cn}
${_san_list}
EOFCONF
    # generate the csr
    openssl req -config "${_cnf}" -new -key "${KEYFILE}" -out "${CSRFILE}"
    # end of gen_csr
    rm "${_cnf}"
}

gen_ces() {
    # input env vars: CSRFILE, CESFILE, CESURL, CESUSER, CESPASSWORD
    # strip header/footer and make it on a single line
    _csr_contents="$( sed -r -e '/^-----/d' "${CSRFILE}" | tr -d '\n' )"
    cat >"${CESFILE}" <<EOFCES
    <s:Envelope xmlns:a="http://www.w3.org/2005/08/addressing"
    xmlns:s="http://www.w3.org/2003/05/soap-envelope"
    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <s:Header>
            <a:Action s:mustUnderstand="1">http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep</a:Action>
            <a:MessageID>urn:uuid:$( uuidgen )</a:MessageID>
            <a:To s:mustUnderstand="1">${CESURL}</a:To>
            <a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo>
            <wsse:Security s:mustUnderstand="1">
                <wsse:UsernameToken>
                    <wsse:Username>${CESUSER}</wsse:Username>
                    <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">${CESPASSWORD}</wsse:Password>
                </wsse:UsernameToken>
            </wsse:Security>
        </s:Header>
        <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
            <RequestSecurityToken PreferredLanguage="en-US" xmlns="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
                <TokenType>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3</TokenType>
                <RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</RequestType>
                <BinarySecurityToken ValueType="http://schemas.microsoft.com/windows/pki/2009/01/enrollment#PKCS10" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#base64binary" a:Id=""
                    xmlns:a="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                    xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
                    ${_csr_contents}
                </BinarySecurityToken>
                <RequestID xsi:nil="true" xmlns="http://schemas.microsoft.com/windows/pki/2009/01/enrollment" />
            </RequestSecurityToken>
        </s:Body>
    </s:Envelope>
EOFCES
}

submit_ces_request() {
    # input env vars: CESURL, CESFILE
    # -k for irony
    curl ${VERBOSE:+--verbose} \
		--silent \
        "${CESURL}" \
        -H "Content-Type: application/soap+xml" \
        -X POST \
        --data @"${CESFILE}" \
        -k
}

parse_ces_response() {
    # input env vars: CESRESPONSEFILE
    {
        printf '%s\r\n' '-----BEGIN PKCS7-----'
        python3 <<-EOFPYTHON
import xml.etree.ElementTree as ET, sys
rf = "${CESRESPONSEFILE}"
tree = ET.parse(rf)
print(tree.findall(".//*[@ValueType='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#PKCS7']")[0].text)
EOFPYTHON
        printf '%s\r\n' '-----END PKCS7-----'
    } | grep -E '.' | openssl pkcs7 -in /dev/stdin -print_certs
}

use_ces() {
    # input env vars: KEYFILE, CSRFILE, CESURL, CESPASSWORD/CESPASSWODFILE, TEMPLATE, CERTFILE
    # optional: CESFILE, CESRESPONSEFILE
    unset _used_temp_crf _used_temp_cf
    test -z "${KEYFILE}" && { echo "Fatal! Need KEYFILE. Aborted." 1>&2 ; return 1 ; }
    test -z "${CSRFILE}" && { echo "Fatal! Need CSRFILE. Aborted." 1>&2 ; return 1 ; }
    test -z "${CESURL}" && { echo "Fatal! Need CESURL. Aborted." 1>&2 ; return 1 ; }
    test -z "${CESUSER}" && { echo "Fatal! Need CESUSER. Aborted." 1>&2 ; return 1 ; }
    test -z "${TEMPLATE}" && { echo "Fatal! Need TEMPLATE. How about WebServerV3? Aborted." 1>&2 ; return 1 ; }
    test -z "${CESPASSWORD}" && test -z "${CESPASSWORDFILE}" && { echo "Fatal! Need CESPASSWORD or CESPASSWORDFILE. Aborted." 1>&2 ; return 1 ; }
    test -n "$( cat "${CESPASSWORDFILE}" 2>/dev/null )" && CESPASSWORD="$( cat "${CESPASSWORDFILE}" )"
    test -z "${CESPASSWORD}" && { echo "Fatal! Need CESPASSWORD or CESPASSWORDFILE populated. Aborted." 1>&2 ; return 1 ; }
    test -z "${CESRESPONSEFILE}" && { CESRESPONSEFILE="$( mktemp )" ; _used_temp_crf=1 ; echo "Using CESRESPONSEFILE=${CESRESPONSEFILE}" 1>&2 ; }
    test -z "${CERTFILE}" && { echo "Fatal! Need CERTFILE. Aborted." 1>&2 ; return 1 ; }
    test -z "$( cat "${KEYFILE}" 2>/dev/null )" && {
        # need to generate a new key
        openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out "${KEYFILE}"
    }
    # so now we have KEYFILE. Lets assume we need to make CSRFILE
    test -z "$( cat "${CSRFILE}" 2>/dev/null )" && {
        gen_csr # will produce CSRFILE
    }
    test -z "${CESFILE}" && { CESFILE="$( mktemp )" ; _used_temp_cf=1 ; echo "Using CESFILE=${CESFILE}" 1>&2 ; }
    test -z "$( cat "${CESFILE}" 2>/dev/null )" && {
        gen_ces # will populate CESFILE
    }
    test -z "${SKIP_SUBMIT}" && {
        submit_ces_request > "${CESRESPONSEFILE}"
    }
    test -n "$( cat "${CESRESPONSEFILE}" 2>/dev/null )" && {
        parse_ces_response > "${CERTFILE}"
    }
    # CLEANUP
    test -n "${_used_temp_crf}" && rm -f "${CESRESPONSEFILE:-NOTHINGTODEL}" 1>/dev/null 2>&1
    test -n "${_used_temp_cf}" && rm -f "${CESFILE:-NOTHINGTODEL}" 1>/dev/null 2>&1
    test -z "${NO_CLEAN}" && {
        rm -f "${CESRESPONSEFILE}" "${CESFILE}" 1>/dev/null 2>&1
    }
}

gen_cep() {
    # input env vars: CEPFILE, CEPURL, CESUSER, CESPASSWORD
    cat >"${CEPFILE}" <<EOFCEP
    <s:Envelope xmlns:a="http://www.w3.org/2005/08/addressing"
    xmlns:s="http://www.w3.org/2003/05/soap-envelope"
    xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <s:Header>
            <a:Action s:mustUnderstand="1">http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies</a:Action>
            <a:MessageID>urn:uuid:$( uuidgen )</a:MessageID>
            <a:To s:mustUnderstand="1">${CEPURL}</a:To>
            <a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo>
            <wsse:Security s:mustUnderstand="1">
                <wsse:UsernameToken>
                    <wsse:Username>${CESUSER}</wsse:Username>
                    <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">${CESPASSWORD}</wsse:Password>
                </wsse:UsernameToken>
            </wsse:Security>
        </s:Header>
        <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema">
            <GetPolicies xmlns="http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy">
            <client>
                <lastUpdate>0001-01-01T00:00:00</lastUpdate>
                <preferredLanguage xsi:nil="true"></preferredLanguage>
            </client>
            <requestFilter xsi:nil="true"></requestFilter>
            </GetPolicies>
        </s:Body>
    </s:Envelope>
EOFCEP
}

submit_cep_request() {
    # input env vars: CEPURL, CEPFILE
    curl ${VERBOSE:+--verbose} \
		--silent \
        "${CEPURL}" \
        -H "Content-Type: application/soap+xml; charset=utf-8" \
        -X POST \
        --data @"${CEPFILE}" \
        -k
}

parse_cep_response() {
    # input env vars: CEPRESPONSEFILE
    # You might be tempted to use ElementTree.register_namespace(), but the author was unable to make that work here, and findall(,namespaces={"ns1":ns}) is not shorter than what is used here and was not tested.
    python3 <<EOFPYTHON
import xml.etree.ElementTree as ET, sys
rf = "${CEPRESPONSEFILE}"
ns = "{http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy}"
tree = ET.parse(rf)
print("endpoints:" + ','.join([i.text for i in tree.findall(f".//{ns}GetPoliciesResponse/{ns}cAs/{ns}cA/{ns}uris/{ns}cAURI/{ns}uri")]))
for p in tree.findall(f".//{ns}policies/{ns}policy"):
    if p.find(f"./{ns}attributes/{ns}permission/{ns}enroll").text.lower() in ["true","t","1","yes","y"]:
        print(p.find(f"./{ns}attributes/{ns}commonName").text)
EOFPYTHON
}

use_cep() {
    # input env vars: CEPURL, CESUSER, CESPASSWORD
    # optional: CEPFILE, CEPRESPONSEFILE
    unset _used_temp_cf _used_temp_crf
    test -z "${CEPURL}" && { echo "Fatal! Need CEPURL. Aborted." 1>&2 ; return 1 ; }
    test -z "${CESPASSWORD}" && test -z "${CESPASSWORDFILE}" && { echo "Fatal! Need CESPASSWORD or CESPASSWORDFILE. Aborted." 1>&2 ; return 1 ; }
    test -n "$( cat "${CESPASSWORDFILE}" 2>/dev/null )" && CESPASSWORD="$( cat "${CESPASSWORDFILE}" )"
    test -z "${CESPASSWORD}" && { echo "Fatal! Need CESPASSWORD or CESPASSWORDFILE populated. Aborted." 1>&2 ; return 1 ; }
    # process
    test -z "${CEPFILE}" && { CEPFILE="$( mktemp )" ; _used_temp_cf=1 ; echo "Using CEPFILE=${CEPFILE}" 1>&2 ; }
    test -z "$( cat "${CEPFILE}" 2>/dev/null )" && {
        gen_cep # will populate CEPFILE
    }
    test -z "${CEPRESPONSEFILE}" && { CEPRESPONSEFILE="$( mktemp )" ; _used_temp_crf=1 ; echo "Using CEPRESPONSEFILE=${CEPRESPONSEFILE}" 1>&2 ; }
    test -z "${SKIP_SUBMIT}" && {
        submit_cep_request > "${CEPRESPONSEFILE}"
    }
    test -n "$( cat "${CEPRESPONSEFILE}" 2>/dev/null )" && {
        parse_cep_response # will print available templates
    }
    # CLEANUP
    test -n "${_used_temp_crf}" && rm -f "${CEPRESPONSEFILE:-NOTHINGTODEL}" 1>/dev/null 2>&1
    test -n "${_used_temp_cf}" && rm -f "${CEPFILE:-NOTHINGTODEL}" 1>/dev/null 2>&1
    test -z "${NO_CLEAN}" && {
        rm -f "${CEPRESPONSEFILE}" "${CEPFILE}" 1>/dev/null 2>&1
    }
}

# https://stackoverflow.com/questions/2683279/how-to-detect-if-a-script-is-being-sourced
# BEGIN IS-SOURCED
sourced=0
if [ -n "$ZSH_VERSION" ]; then
    case $ZSH_EVAL_CONTEXT in *:file) sourced=1;; esac
elif [ -n "$KSH_VERSION" ]; then
    [ "$(cd -- "$(dirname -- "$0")" && pwd -P)/$(basename -- "$0")" != "$(cd -- "$(dirname -- "${.sh.file}")" && pwd -P)/$(basename -- "${.sh.file}")" ] && sourced=1
elif [ -n "$BASH_VERSION" ]; then
    (return 0 2>/dev/null) && sourced=1
else # All other shells: examine $0 for known shell binary filenames.
# Detects `sh` and `dash`; add additional shell filenames as needed.
    case ${0##*/} in sh|-sh|dash|-dash) sourced=1;; esac
fi
# END IS-SOURCED

# MAIN
if test "${sourced}" = "0" ;
then
    action="${action:-${1:-NONE}}"
    case "${action}" in
        use_cep) use_cep ;;
        use_ces) use_ces ;;
        *) echo "Warning: action ${action} not defined yet. Skipping..." 1>&2 ; exit 1 ;
    esac
fi