IPSec: replace (self-signed) X.509 certs by their raw pubkey for authentication.

There is no need to bother with X.509 cruft here.

1 files changed, 4 insertions, 1 deletions

diff --git a/roles/common/files/usr/local/bin/genkeypair.sh b/roles/common/files/usr/local/bin/genkeypair.sh
index 45e2181..01b279a 100755
--- a/roles/common/files/usr/local/bin/genkeypair.sh
+++ b/roles/common/files/usr/local/bin/genkeypair.sh
@@ -30,40 +30,41 @@ hash=
 force=0
 config=
 pubkey=pubkey.pem
 privkey=privkey.pem
 dns=
 ou=
 cn=
 usage=
 mode=
 owner=
 group=
 
 usage() {
     cat >&2 <<- EOF
 		Usage: $0 command [OPTIONS]
 
 		Command:
 		    x509:       generate a self-signed X.509 server certificate
 		    csr:        generate a Certificate Signing Request
 		    dkim:       generate a private key (to use for DKIM signing)
+		    keypair:    generate a key pair
 
 		Options:
 		    -t type:    key type (default: rsa)
 		    -b bits:    key length or EC curve (default: 2048 for RSA, 1024 for DSA, secp224r1 for ECDSA)
 		    -h digest:  digest algorithm
 		    --ou:       organizational Unit Name; can be repeated
 		    --cn:       common Name (default: \$(hostname --fqdn)
 		    --dns:      hostname for AltName; can be repeated
 		    -f:         force; can be repeated (0: don't overwrite, default;
 		                                        1: reuse private key if it exists;
 		                                        2: overwrite both keys if they exist)
 		    --config:   configuration file
 		    --pubkey:   public key file (default: pubkey.pem)
 		    --privkey:  private key file (default: privkey.pem)
 		    --usage:    key usage (default: digitalSignature,keyEncipherment,keyCertSign)
 		    --mode:     set privkey's permission mode (default: 0600)
 		    --owner:    set privkey's owner (default: the process' current owner)
 		    --group:    set privkey's group (default: the process' current group)
 
 		Return values:
@@ -71,41 +72,41 @@ usage() {
 		    1  The public or private key file exists, and -f is not set
 		    2  The key generation failed
 	EOF
 }
 
 dkiminfo() {
     echo "Add the following TXT record to your DNS zone:"
     echo "${cn:-$(date +%Y%m%d)}._domainkey\tIN\tTXT ( "
     # See https://tools.ietf.org/html/rfc4871#section-3.6.1
     # t=s:      the "i=" domain in signature headers MUST NOT be a subdomain of "d="
     # s=email:  limit DKIM signing to email
     openssl pkey -pubout <"$privkey" | sed '/^--.*--$/d' \
     | { echo -n "v=DKIM1; k=$type; t=s; s=email; p="; tr -d '\n'; } \
     | fold -w 250 \
     | { sed 's/.*/\t"&"/'; echo ' )'; }
 }
 
 [ $# -gt 0 ] || { usage; exit 2; }
 cmd="$1"; shift
 case "$cmd" in
-    x509|csr|dkim) ;;
+    x509|csr|dkim|keypair) ;;
     *) echo "Unrecognized command: $cmd" >&2; exit 2
 esac
 
 nou=1
 while [ $# -gt 0 ]; do
     case "$1" in
         -t) shift; type="$1";;
         -t*) type="${1#-t}";;
 
         -b) shift; bits="$1";;
         -b*) bits="${1#-b}";;
 
         -h) shift; hash="$1";;
         -h*) hash="${1#-h}";;
 
         --dns=?*) dns="${dns:+$dns, }DNS:${1#--dns=}";;
         --cn=?*) cn="${1#--cn=}";;
         --ou=?*) ou="${ou:+$ou\n}$nou.organizationalUnitName = ${1#--ou=}"
                  nou=$(( 1 + $nou ));;
 
@@ -184,21 +185,23 @@ if [ -s "$privkey" -a $force -eq 0 ]; then
     exit 1
 elif [ ! -s "$privkey" -o $force -ge 2 ]; then
     install --mode="${mode:-0600}" ${owner:+--owner="$owner"} ${group:+--group="$group"} /dev/null "$privkey" || exit 2
     openssl $genkey -rand /dev/urandom $genkeyargs >"$privkey" || exit 2
     [ "$cmd" = dkim ] && { dkiminfo; exit; }
 fi
 
 if [ "$cmd" = x509 -a "$pubkey" = "$privkey" ]; then
     pubkey=$(mktemp)
     openssl req -config "$config" -new -x509 ${hash:+-$hash} -days 3650 -key "$privkey" >"$pubkey" || exit 2
     cat "$pubkey" >>"$privkey" || exit 2
     rm -f "$pubkey"
 elif [ "$cmd" = x509 -o "$cmd" = csr ]; then
     if [ -s "$pubkey" -a $force -eq 0 ]; then
         echo "Error: public key exists: $pubkey" >&2
         exit 1
     else
         [ "$cmd" = x509 ] && x509=-x509 || x509=
         openssl req -config "$config" -new $x509 ${hash:+-$hash} -days 3650 -key "$privkey" >"$pubkey" || exit 2
     fi
+elif [ "$cmd" = keypair -a "$pubkey" ]; then
+    openssl pkey -pubout <"$privkey" >"$pubkey"
 fi