graphene-os-server-infrastructure/certbot-ocsp-fetcher

#!/usr/bin/env bash

# Unofficial Bash strict mode
set \
  -o errexit \
  -o errtrace \
  -o noglob \
  -o nounset \
  -o pipefail
IFS=$'\n\t'
shopt -s inherit_errexit

exit_with_error() {
  echo "${@}" >&2
  exit 1
}

check_for_dependencies() {
  if ((BASH_VERSINFO[0] == 4 && \
    BASH_VERSINFO[1] < 3 || \
    BASH_VERSINFO[0] < 4)); then
    exit_with_error \
      error:$'\t\t'"${0##*/} requires Bash 4.3+."
  fi

  if ! { command -v openssl >&- &&
    [[ $(openssl version) =~ ^OpenSSL\ ([[:digit:]]+)\.([[:digit:]]+) ]] &&
    ((BASH_REMATCH[1] == 1 && \
    BASH_REMATCH[2] >= 1 || \
    BASH_REMATCH[1] > 1)); }; then
    # shellcheck disable=2016
    exit_with_error \
      error:$'\t\t'"${0##*/} requires OpenSSL 1.1.0+," \
      'but it is not available on $PATH.'
  fi
}

parse_cli_arguments() {
  local -r usage=(
    "USAGE: ${0}"
    "[-c/--certbot-dir DIRECTORY]"
    "[-f/--force-update]"
    "[-h/--help]"
    "[-n/--cert-name NAME[,NAME...] [-u/--ocsp-responder URL]]"
    "[-o/--output-dir DIRECTORY]"
    "[-q/--quiet]"
    "[-v/--verbose]"
    "[-w/--no-reload-webserver]"
  )

  declare -gl ERROR_ENCOUNTERED

  declare -gi VERBOSITY=1
  local -r verbosity_error=(
    "error: -q/--quiet cannot be specified in conjunction with -v/--verbose."
  )

  while ((${#} > 0)); do
    local parameter=${1}

    case ${parameter} in
      -[^-]?*)
        set -- "-${parameter:1:1}" "-${parameter:2}" "${@:2}"
        ;;
      -c | --certbot-dir | --certbot-dir=?*)
        if [[ -v CERTBOT_DIR ]]; then
          exit_with_error "${usage[@]}"
        fi

        if [[ ${parameter} =~ --certbot-dir=(.+) ]]; then
          CERTBOT_DIR=${BASH_REMATCH[1]}
        else
          if [[ -n ${2:-} ]]; then
            CERTBOT_DIR=${2}
            shift
          else
            exit_with_error "${usage[@]}"
          fi
        fi

        CERTBOT_DIR=$(
          realpath \
            --canonicalize-missing \
            --relative-base . \
            -- "${CERTBOT_DIR}"
          echo x
        )
        CERTBOT_DIR=${CERTBOT_DIR%??}
        shift
        ;;
      -f | --force-update)
        if [[ ! -v FORCE_UPDATE ]]; then
          declare -glr FORCE_UPDATE=true
        fi
        shift
        ;;
      -h | --help)
        echo >&2 "${usage[@]}"
        exit
        ;;
      -n | --cert-name | --cert-name=?*)
        if [[ ${parameter} =~ --cert-name=(.+) ]]; then
          local cert_lineages_value=${BASH_REMATCH[1]}
          shift
        else
          if [[ -n ${2:-} ]]; then
            local cert_lineages_value=${2}
            shift 2
          else
            exit_with_error "${usage[@]}"
          fi
        fi

        # Loop over any lineages passed in the same value of --cert-name.
        OLDIFS=${IFS}
        IFS=,
        declare -Ag CERT_LINEAGES
        # Check if a hardcoded OCSP responder was specified for this set of
        # lineages.
        case ${1:-} in
          -u | --ocsp-responder)
            if [[ -n ${2:-} ]]; then
              for lineage_name in ${cert_lineages_value}; do
                CERT_LINEAGES["${lineage_name}"]=${2}
              done
              shift
            else
              exit_with_error "${usage[@]}"
            fi
            shift
            ;;
          --ocsp-responder=?*)
            [[ ${1} =~ --ocsp-responder=(.+) ]]
            for lineage_name in ${cert_lineages_value}; do
              CERT_LINEAGES["${lineage_name}"]=${BASH_REMATCH[1]}
            done
            shift
            ;;
          *)
            # If no OCSP responder was specified, just save the lineage
            # name as the key, with an empty value.
            for lineage_name in ${cert_lineages_value}; do
              CERT_LINEAGES["${lineage_name}"]=
            done
            ;;
        esac
        unset lineage_name cert_lineages_value
        IFS=${OLDIFS}
        ;;
      -o | --output-dir | --output-dir=?*)
        if [[ -v OUTPUT_DIR ]]; then
          exit_with_error "${usage[@]}"
        fi

        if [[ ${parameter} =~ --output-dir=(.+) ]]; then
          OUTPUT_DIR=${BASH_REMATCH[1]}
        else
          if [[ -n ${2:-} ]]; then
            OUTPUT_DIR=${2}
            shift
          else
            exit_with_error "${usage[@]}"
          fi
        fi

        OUTPUT_DIR=$(
          realpath \
            --canonicalize-missing \
            --relative-base . \
            -- "${OUTPUT_DIR}"
          echo x
        )
        OUTPUT_DIR=${OUTPUT_DIR%??}
        shift
        ;;
      -q | --quiet)
        if ((VERBOSITY != 1)); then
          exit_with_error "${verbosity_error[@]}"
        else
          readonly VERBOSITY=0
          shift
        fi
        ;;
      -v | --verbose)
        if ((VERBOSITY == 0)); then
          exit_with_error "${verbosity_error[@]}"
        else
          VERBOSITY+=1
          shift
        fi
        ;;
      -w | --no-reload-webserver)
        if [[ ! -v RELOAD_WEBSERVER ]]; then
          declare -glr RELOAD_WEBSERVER=false
        fi
        shift
        ;;
      *)
        exit_with_error "${usage[@]}"
        ;;
    esac
  done

  # When not parsed, the stdout and/or stderr output of all external commands
  # we call in the script is redirected to file descriptor 3.  Depending on the
  # desired verbosity, we redirect this file descriptor to either stderr or to
  # /dev/null.
  if ((VERBOSITY >= 2)); then
    exec 3>&2
  else
    exec 3>/dev/null
  fi
}

# Set output directory if necessary and check if it's writeable
prepare_output_dir() {
  if [[ -v OUTPUT_DIR ]]; then
    if [[ ! -e ${OUTPUT_DIR} ]]; then
      # Don't yet fail if it's not possible to create the directory, so we can
      # exit with a custom error down below
      mkdir \
        --parents \
        -- "${OUTPUT_DIR}" || true
    fi
  else
    readonly OUTPUT_DIR=.
  fi

  if [[ ! -w ${OUTPUT_DIR} ]]; then
    exit_with_error \
      error:$'\t\t'"no write access to output directory (\"${OUTPUT_DIR}\")"
  fi
}

start_in_correct_mode() {
  # Create temporary directory to store OCSP staple file,
  # before having checked the certificate status in the response
  local temp_output_dir
  temp_output_dir=$(mktemp --directory)
  readonly temp_output_dir
  trap "rm -r -- ""${temp_output_dir}" EXIT

  declare -A lineages_processed

  # These two environment variables are set if this script is invoked by Certbot
  if [[ ! -v RENEWED_DOMAINS || ! -v RENEWED_LINEAGE ]]; then
    run_standalone
  else
    run_as_deploy_hook
  fi

  print_and_handle_result
}

# Run in "check one or all certificate lineage(s) managed by Certbot" mode
# $1 - Path to temporary output directory
run_standalone() {
  readonly CERTBOT_DIR=${CERTBOT_DIR:-/etc/letsencrypt}

  if [[ ! -r ${CERTBOT_DIR} || (-d ${CERTBOT_DIR}/live && ! -r ${CERTBOT_DIR}/live) ]]; then
    exit_with_error \
      error:$'\t\t'"can't access ${CERTBOT_DIR}/live"
  fi

  # Check specific lineage if passed on CLI,
  # or otherwise all lineages in Certbot's dir
  if [[ -v CERT_LINEAGES[@] ]]; then
    for lineage_name in "${!CERT_LINEAGES[@]}"; do
      if [[ -r ${CERTBOT_DIR}/live/${lineage_name} ]]; then
        fetch_ocsp_response \
          "--standalone" \
          "${temp_output_dir}" \
          "${lineage_name}" \
          "${CERT_LINEAGES["${lineage_name}"]}"
      else
        exit_with_error \
          "error:"$'\t\t'"can't access ${CERTBOT_DIR}/live/${lineage_name}"
      fi
    done
  else
    set +f
    shopt -s nullglob
    for lineage_dir in "${CERTBOT_DIR}"/live/*; do
      set -f

      # Skip non-directories, like Certbot's README file
      [[ -d ${lineage_dir} ]] || continue

      fetch_ocsp_response \
        "--standalone" "${temp_output_dir}" "${lineage_dir##*/}"
    done
    unset lineage_dir
  fi
}

# Run in deploy-hook mode, only processing the passed lineage
# $1 - Path to temporary output directory
run_as_deploy_hook() {
  if [[ -v CERTBOT_DIR ]]; then
    # The directory is already inferred from the environment variable that
    # Certbot passes
    exit_with_error \
      error:$'\t\t'"-c/--certbot-dir cannot be passed" \
      "when run as Certbot hook"
  fi

  if [[ -v FORCE_UPDATE ]]; then
    # When run as deploy hook the behavior of this flag is used by default.
    # Therefore passing this flag would not have any effect.
    exit_with_error \
      error:$'\t\t'"-f/--force-update cannot be passed" \
      "when run as Certbot hook"
  fi

  if [[ -v CERT_LINEAGES[@] ]]; then
    # The certificate lineage is already inferred from the environment
    # variable that Certbot passes
    exit_with_error \
      error:$'\t\t'"-n/--cert-name cannot be passed when run as Certbot hook"
  fi

  fetch_ocsp_response \
    --deploy_hook "${temp_output_dir}" "${RENEWED_LINEAGE##*/}"
}

# Check if it's necessary to fetch a new OCSP response
check_for_existing_ocsp_staple_file() {
  [[ -f ${OUTPUT_DIR}/${lineage_name}.der ]] || return 1

  # Validate and verify the existing local OCSP staple file
  local existing_ocsp_response
  set +e
  existing_ocsp_response=$(openssl ocsp \
    -no_nonce \
    -issuer "${lineage_dir}/chain.pem" \
    -cert "${lineage_dir}/cert.pem" \
    -verify_other "${lineage_dir}/chain.pem" \
    -respin "${OUTPUT_DIR}/${lineage_name}.der" 2>&3)
  local -ir existing_ocsp_response_rc=${?}
  set -e
  readonly existing_ocsp_response

  ((existing_ocsp_response_rc == 0)) || return 1

  for existing_ocsp_response_line in ${existing_ocsp_response}; do
    if [[ ${existing_ocsp_response_line} =~ ^[[:blank:]]*"This Update: "(.+)$ ]]; then
      local -r this_update=${BASH_REMATCH[1]}
    elif [[ ${existing_ocsp_response_line} =~ ^[[:blank:]]*"Next Update: "(.+)$ ]]; then
      local -r next_update=${BASH_REMATCH[1]}
    fi
  done
  [[ -n ${this_update:-} && -n ${next_update:-} ]] || return 1

  # Only continue fetching OCSP response if existing response expires within
  # half of its lifetime.
  local -ri response_lifetime_in_seconds=$((\
    $(date +%s --date "${next_update}") - $(date +%s --date "${this_update}")))
  (($(date +%s) < \
  $(date +%s --date "${this_update}") + response_lifetime_in_seconds / 2)) || return 1
}

# Generate file used by ssl_stapling_file in nginx config of websites
# $1 - Whether to run as a deploy hook for Certbot, or standalone
# $2 - Path to temporary output directory
# $3 - Name of certificate lineage
# $4 - OCSP endpoint (if specified on command line)
fetch_ocsp_response() {
  local -r temp_output_dir=${2}
  local -r lineage_name=${3}
  case ${1} in
    --standalone)
      local -r lineage_dir=${CERTBOT_DIR}/live/${lineage_name}

      if [[ ${FORCE_UPDATE:-} != true ]] &&
        check_for_existing_ocsp_staple_file; then
        lineages_processed["${lineage_name}"]="not updated"$'\t'"valid staple file on disk"
        return
      fi
      ;;
    --deploy_hook)
      local -r lineage_dir=${RENEWED_LINEAGE}
      ;;
    *)
      return 1
      ;;
  esac
  shift 3

  # Verify that the leaf certificate is still valid. If the certificate is
  # expired, we don't have to request a (new) OCSP response.
  local cert_expiry_output
  set +e
  cert_expiry_output=$(openssl x509 \
    -in "${lineage_dir}/cert.pem" \
    -checkend 0 \
    -noout 2>&3)
  local -ri cert_expiry_rc=${?}
  set -e
  if ((cert_expiry_rc != 0)); then
    ERROR_ENCOUNTERED=true
    lineages_processed["${lineage_name}"]="not updated"
    if [[ ${cert_expiry_output} == "Certificate will expire" ]]; then
      lineages_processed["${lineage_name}"]+=$'\t'"leaf certificate expired"
    fi
    return
  fi

  local ocsp_endpoint
  if [[ -n ${1-} ]]; then
    ocsp_endpoint=${1}
  else
    ocsp_endpoint=$(openssl x509 \
      -noout \
      -ocsp_uri \
      -in "${lineage_dir}/cert.pem" \
      2>&3)
  fi

  # Request, verify and temporarily save the actual OCSP response,
  # and check whether the certificate status is "good"
  local ocsp_call_output
  set +e
  ocsp_call_output=$(openssl ocsp \
    -no_nonce \
    -url "${ocsp_endpoint}" \
    -issuer "${lineage_dir}/chain.pem" \
    -cert "${lineage_dir}/cert.pem" \
    -verify_other "${lineage_dir}/chain.pem" \
    -respout "${temp_output_dir}/${lineage_name}.der" 2>&3)
  local -ir ocsp_call_rc=${?}
  set -e
  readonly ocsp_call_output=${ocsp_call_output#${lineage_dir}/cert.pem: }
  local -r cert_status=${ocsp_call_output%%$'\n'*}

  if [[ ${ocsp_call_rc} != 0 || ${cert_status} != good ]]; then
    ERROR_ENCOUNTERED=true

    lineages_processed["${lineage_name}"]="not updated"
    if ((VERBOSITY >= 2)); then
      lineages_processed["${lineage_name}"]+=$'\t'"${ocsp_call_output//[[:space:]]/ }"
    else
      lineages_processed["${lineage_name}"]+=$'\t'"${cert_status}"
    fi

    return
  fi

  # If arrived here status was good, so move OCSP staple file to definitive
  # folder
  mv "${temp_output_dir}/${lineage_name}.der" "${OUTPUT_DIR}/"

  lineages_processed["${lineage_name}"]=updated
}

print_and_handle_result() {
  local -r header=LINEAGE$'\t'RESULT$'\t'REASON

  for lineage_name in "${!lineages_processed[@]}"; do
    local lineages_processed_formatted+=$'\n'"${lineage_name}"$'\t'"${lineages_processed["${lineage_name}"]}"
  done
  unset lineage_name
  lineages_processed_formatted=$(sort <<<"${lineages_processed_formatted:-}")
  readonly lineages_processed_formatted

  if [[ ${RELOAD_WEBSERVER:-} != false ]]; then
    reload_webserver
  fi

  local -r output=${header}${lineages_processed_formatted:-}${nginx_status-}

  if ((VERBOSITY >= 1)); then
    if command -v column >&-; then
      column -ts$'\t' <<<"${output}"
    else
      # shellcheck disable=2016
      echo >&2 \
        'Install the BSD utility `column` for properly formatted output.'$'\n'
      echo "${output}"
    fi
  fi

  [[ ${ERROR_ENCOUNTERED:-} != true ]]
}

reload_webserver() {
  for lineage_name in "${!lineages_processed[@]}"; do
    if [[ ${lineages_processed["${lineage_name}"]} == updated ]]; then
      if nginx -s reload >&3 2>&1; then
        # The last line includes a leading space, to workaround the lack of the
        # `-n` flag in later versions of `column`.
        local -r nginx_status=$'\n\n \t'"nginx reloaded"
      else
        ERROR_ENCOUNTERED=true
        local -r nginx_status=$'\n\n \t'"nginx not reloaded"$'\t'"unable to reload nginx service, try manually"
      fi
      break
    fi
  done
  unset lineage_name
}

main() {
  check_for_dependencies

  parse_cli_arguments "${@}"

  prepare_output_dir

  start_in_correct_mode
}

main "${@}"