--- loncom/Lond.pm	2016/07/25 19:49:45	1.9
+++ loncom/Lond.pm	2018/12/22 17:06:02	1.14
@@ -1,6 +1,6 @@
 # The LearningOnline Network
 #
-# $Id: Lond.pm,v 1.9 2016/07/25 19:49:45 raeburn Exp $
+# $Id: Lond.pm,v 1.14 2018/12/22 17:06:02 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -38,7 +38,7 @@ use LONCAPA;
 use Apache::lonnet;
 use GDBM_File;
 use Crypt::OpenSSL::X509;
-
+use Crypt::PKCS10;
 
 sub dump_with_regexp {
     my ( $tail, $clientversion ) = @_;
@@ -783,18 +783,56 @@ sub dump_profile_database {
     return $qresult;
 }
 
+sub is_course {
+    my ($cdom,$cnum) = @_;
+
+    return unless (($cdom =~ /^$LONCAPA::match_domain$/) &&
+                   ($cnum =~ /^$LONCAPA::match_courseid$/));
+    my $hashid = $cdom.':'.$cnum;
+    my ($iscourse,$cached) =
+        &Apache::lonnet::is_cached_new('iscourse',$hashid);
+    unless (defined($cached)) {
+        my $hashref =
+            &tie_domain_hash($cdom, "nohist_courseids", &GDBM_WRCREAT());
+        if (ref($hashref) eq 'HASH') {
+            my $esc_key = &escape($cdom.'_'.$cnum);
+            if (exists($hashref->{$esc_key})) {
+                $iscourse = 1;
+            } else {
+                $iscourse = 0;
+            }
+            &Apache::lonnet::do_cache_new('iscourse',$hashid,$iscourse,3600);
+            unless (&untie_domain_hash($hashref)) {
+                &logthis("Failed to untie tied hash for nohist_courseids.db for $cdom");
+            }
+        } else {
+            &logthis("Failed to tie hash for nohist_courseids.db for $cdom");
+        }
+    }
+    return $iscourse;
+}
+
 sub server_certs {
-    my ($perlvar) = @_;
+    my ($perlvar,$lonhost,$hostname) = @_;
     my %pemfiles = (
                      key      => 'lonnetPrivateKey',
                      host     => 'lonnetCertificate',
                      hostname => 'lonnetHostnameCertificate',
                      ca       => 'lonnetCertificateAuthority',
                    );
-    my (%md5hash,%info);
+    my (%md5hash,%expected_cn,%expired,%revoked,%wrongcn,%info,$crlfile);
+    %info = (
+                key => {},
+                ca  => {},
+                host => {},
+                hostname => {},
+            ); 
     if (ref($perlvar) eq 'HASH') {
+        $expected_cn{'host'} = $Apache::lonnet::serverhomeIDs{$hostname};
+        $expected_cn{'hostname'} = 'internal-'.$hostname;
         my $certsdir = $perlvar->{'lonCertificateDirectory'};
         if (-d $certsdir) {
+            $crlfile = $certsdir.'/'.$perlvar->{'lonnetCertRevocationList'};
             foreach my $key (keys(%pemfiles)) {
                 if ($perlvar->{$pemfiles{$key}}) {
                     my $file = $certsdir.'/'.$perlvar->{$pemfiles{$key}};
@@ -809,6 +847,7 @@ sub server_certs {
                             if (open(PIPE,"openssl rsa -noout -modulus -in $file | openssl md5 |")) {
                                 $md5hash{$key} = <PIPE>;
                                 close(PIPE);
+                                chomp($md5hash{$key});
                             }
                         } else {
                             if ($key eq 'ca') {
@@ -827,6 +866,7 @@ sub server_certs {
                                 if (open(PIPE,"openssl x509 -noout -modulus -in $file | openssl md5 |")) {
                                     $md5hash{$key} = <PIPE>;
                                     close(PIPE);
+                                    chomp($md5hash{$key});
                                 }
                             }
                             my $x509 = Crypt::OpenSSL::X509->new_from_file($file);
@@ -842,6 +882,55 @@ sub server_certs {
                             $info{$key}{'alg'} = $x509->sig_alg_name();
                             $info{$key}{'size'} = $x509->bit_length();
                             $info{$key}{'email'} = $x509->email();
+                            $info{$key}{'serial'} = $x509->serial();
+                            $info{$key}{'issuerhash'} = $x509->issuer_hash();
+                            if ($x509->checkend(0)) {
+                                $expired{$key} = 1;
+                            }
+                            if (($key eq 'host') || ($key eq 'hostname')) {
+                                if ($info{$key}{'cn'} ne $expected_cn{$key}) {
+                                    $wrongcn{$key} = 1;
+                                }
+                                if ((-e $crlfile) && ($info{$key}{'serial'} =~ /^\w+$/)) {
+                                    my $serial = $info{$key}{'serial'};
+                                    if (open(PIPE,"openssl crl -inform PEM -text -in $crlfile | grep $serial |")) {
+                                        my $result = <PIPE>;
+                                        close(PIPE);
+                                        chomp($result);
+                                        if ($result ne '') {
+                                            $revoked{$key} = 1;
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if (($key eq 'host') || ($key eq 'hostname')) {
+                        my $csrfile = $file;
+                        $csrfile =~ s/\.pem$/.csr/;
+                        if (-e $csrfile) {
+                            if (open(PIPE,"openssl req -noout -modulus -in $csrfile |openssl md5 |")) {
+                                my $csrhash = <PIPE>;
+                                close(PIPE);
+                                chomp($csrhash);
+                                if ((!-e $file) || ($csrhash ne $md5hash{$key}) || ($expired{$key}) ||
+                                    ($wrongcn{$key}) || ($revoked{$key})) {
+                                    Crypt::PKCS10->setAPIversion(1);
+                                    my $decoded = Crypt::PKCS10->new( $csrfile,(PEMonly => 1, readFile => 1));
+                                    if (ref($decoded)) {
+                                        if ($decoded->commonName() eq $expected_cn{$key}) {
+                                            $info{$key.'-csr'}{'cn'} = $decoded->commonName();
+                                            $info{$key.'-csr'}{'alg'} = $decoded->pkAlgorithm();
+                                            $info{$key.'-csr'}{'email'} = $decoded->emailAddress();
+                                            my $params = $decoded->subjectPublicKeyParams();
+                                            if (ref($params) eq 'HASH') {
+                                                $info{$key.'-csr'}{'size'} = $params->{keylen};
+                                            }
+                                            $md5hash{$key.'-csr'} = $csrhash;
+                                        }
+                                    }
+                                }
+                            }
                         }
                     }
                 }
@@ -851,7 +940,31 @@ sub server_certs {
     foreach my $key ('host','hostname') {
         if ($md5hash{$key}) {
             if ($md5hash{$key} eq $md5hash{'key'}) {
-                $info{$key}{'status'} = 'ok';
+                if ($revoked{$key}) {
+                    $info{$key}{'status'} = 'revoked';
+                } elsif ($expired{$key}) {
+                    $info{$key}{'status'} = 'expired';
+                } elsif ($wrongcn{$key}) {
+                    $info{$key}{'status'} = 'wrongcn';
+                } elsif ((exists($info{'ca'}{'issuerhash'})) &&
+                         ($info{'ca'}{'issuerhash'} ne $info{$key}{'issuerhash'})) {
+                    $info{$key}{'status'} = 'mismatch';
+                } else {
+                    $info{$key}{'status'} = 'ok';
+                }
+            } elsif ($info{'key'}{'status'} =~ /ok/) {
+                $info{$key}{'status'} = 'otherkey';
+            } else {
+                $info{$key}{'status'} = 'nokey';
+            }
+        }
+        if ($md5hash{$key.'-csr'}) {
+            if ($md5hash{$key.'-csr'} eq $md5hash{'key'}) {
+                $info{$key.'-csr'}{'status'} = 'ok';
+            } elsif ($info{'key'}{'status'} =~ /ok/) {
+                $info{$key.'-csr'}{'status'} = 'otherkey';
+            } else {
+                $info{$key.'-csr'}{'status'} = 'nokey';
             }
         }
     }