chore: Änderungen commited
This commit is contained in:
@ -335,4 +335,248 @@ verify_environment() {
|
||||
log "ERROR" "Umgebungsverifikation fehlgeschlagen ($errors Fehler)"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
install_mercedes_certificates() {
|
||||
log "INFO" "Installiere Mercedes-Benz Corporate Zertifikate..."
|
||||
|
||||
# Prüfe ob Mercedes-Zertifikate im Projekt vorhanden sind
|
||||
local mercedes_cert_dir="$INSTALL_PATH/certs/mercedes"
|
||||
if [[ ! -d "$mercedes_cert_dir" ]]; then
|
||||
log "WARN" "Mercedes-Zertifikat-Verzeichnis nicht gefunden: $mercedes_cert_dir"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# System-Zertifikat-Verzeichnis erstellen
|
||||
local system_cert_dir="/usr/local/share/ca-certificates/mercedes"
|
||||
mkdir -p "$system_cert_dir"
|
||||
|
||||
# Mercedes-Zertifikate finden und installieren
|
||||
local cert_files_found=0
|
||||
|
||||
# Corp-Prj-Root-CA.cer
|
||||
if [[ -f "$mercedes_cert_dir/Corp-Prj-Root-CA.cer" ]]; then
|
||||
log "INFO" "Installiere Mercedes Corp-Prj-Root-CA Zertifikat..."
|
||||
|
||||
# Konvertiere .cer zu .crt für ca-certificates
|
||||
cp "$mercedes_cert_dir/Corp-Prj-Root-CA.cer" "$system_cert_dir/Corp-Prj-Root-CA.crt"
|
||||
chmod 644 "$system_cert_dir/Corp-Prj-Root-CA.crt"
|
||||
cert_files_found=$((cert_files_found + 1))
|
||||
|
||||
log "INFO" "✓ Corp-Prj-Root-CA Zertifikat installiert"
|
||||
fi
|
||||
|
||||
# Corp-Root-CA-G2.cer
|
||||
if [[ -f "$mercedes_cert_dir/Corp-Root-CA-G2.cer" ]]; then
|
||||
log "INFO" "Installiere Mercedes Corp-Root-CA-G2 Zertifikat..."
|
||||
|
||||
# Konvertiere .cer zu .crt für ca-certificates
|
||||
cp "$mercedes_cert_dir/Corp-Root-CA-G2.cer" "$system_cert_dir/Corp-Root-CA-G2.crt"
|
||||
chmod 644 "$system_cert_dir/Corp-Root-CA-G2.crt"
|
||||
cert_files_found=$((cert_files_found + 1))
|
||||
|
||||
log "INFO" "✓ Corp-Root-CA-G2 Zertifikat installiert"
|
||||
fi
|
||||
|
||||
# Weitere Mercedes-Zertifikate automatisch erkennen
|
||||
for cert_file in "$mercedes_cert_dir"/*.cer "$mercedes_cert_dir"/*.crt; do
|
||||
if [[ -f "$cert_file" ]]; then
|
||||
local basename=$(basename "$cert_file")
|
||||
local cert_name="${basename%.*}"
|
||||
|
||||
# Überspringe bereits behandelte Zertifikate
|
||||
if [[ "$cert_name" == "Corp-Prj-Root-CA" ]] || [[ "$cert_name" == "Corp-Root-CA-G2" ]]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
log "INFO" "Installiere zusätzliches Mercedes-Zertifikat: $basename..."
|
||||
cp "$cert_file" "$system_cert_dir/${cert_name}.crt"
|
||||
chmod 644 "$system_cert_dir/${cert_name}.crt"
|
||||
cert_files_found=$((cert_files_found + 1))
|
||||
|
||||
log "INFO" "✓ $basename installiert"
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ $cert_files_found -eq 0 ]]; then
|
||||
log "WARN" "Keine Mercedes-Zertifikate gefunden"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# CA-Zertifikat-Store aktualisieren
|
||||
log "INFO" "Aktualisiere System-Zertifikat-Store..."
|
||||
if update-ca-certificates --verbose; then
|
||||
log "INFO" "✓ System-Zertifikat-Store erfolgreich aktualisiert"
|
||||
else
|
||||
log "ERROR" "Fehler beim Aktualisieren des Zertifikat-Stores"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Zertifikat-Installation für Python-Requests konfigurieren
|
||||
configure_python_certificates
|
||||
|
||||
# Zertifikat-Installation für Node.js konfigurieren
|
||||
configure_nodejs_certificates
|
||||
|
||||
# Zertifikat-Installation für Chromium konfigurieren
|
||||
configure_chromium_certificates
|
||||
|
||||
log "INFO" "Mercedes-Zertifikate Installation abgeschlossen ($cert_files_found Zertifikate)"
|
||||
}
|
||||
|
||||
configure_python_certificates() {
|
||||
log "INFO" "Konfiguriere Python für Mercedes-Zertifikate..."
|
||||
|
||||
# Python-Requests Zertifikat-Pfad konfigurieren
|
||||
local python_cert_config="/etc/myp/python-certs.conf"
|
||||
cat > "$python_cert_config" << 'EOF'
|
||||
# Mercedes-Benz Python Certificate Configuration
|
||||
# Für requests und andere Python-HTTP-Libraries
|
||||
|
||||
# CA Bundle Pfad für requests
|
||||
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
|
||||
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
|
||||
export SSL_CERT_DIR=/etc/ssl/certs
|
||||
|
||||
# Zusätzliche Umgebungsvariablen für Corporate-Umgebung
|
||||
export PYTHONHTTPSVERIFY=1
|
||||
export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
|
||||
EOF
|
||||
|
||||
# Python-Konfiguration in Benutzer-Profile einbinden
|
||||
if [[ -f "/home/$PROJECT_USER/.bashrc" ]]; then
|
||||
echo "# Mercedes-Benz Python Certificate Configuration" >> "/home/$PROJECT_USER/.bashrc"
|
||||
echo "source /etc/myp/python-certs.conf" >> "/home/$PROJECT_USER/.bashrc"
|
||||
fi
|
||||
|
||||
# Für systemweite Anwendung
|
||||
echo "source /etc/myp/python-certs.conf" >> "/etc/environment"
|
||||
|
||||
log "INFO" "Python-Zertifikat-Konfiguration abgeschlossen"
|
||||
}
|
||||
|
||||
configure_nodejs_certificates() {
|
||||
log "INFO" "Konfiguriere Node.js für Mercedes-Zertifikate..."
|
||||
|
||||
# Node.js CA-Konfiguration
|
||||
local nodejs_cert_config="/etc/myp/nodejs-certs.conf"
|
||||
cat > "$nodejs_cert_config" << 'EOF'
|
||||
# Mercedes-Benz Node.js Certificate Configuration
|
||||
|
||||
# CA Bundle für Node.js
|
||||
export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
# Deaktiviere strenge SSL-Verifikation nur wenn nötig (nicht empfohlen)
|
||||
# export NODE_TLS_REJECT_UNAUTHORIZED=0
|
||||
EOF
|
||||
|
||||
# Node.js-Konfiguration in Profile einbinden
|
||||
if [[ -f "/home/$PROJECT_USER/.bashrc" ]]; then
|
||||
echo "# Mercedes-Benz Node.js Certificate Configuration" >> "/home/$PROJECT_USER/.bashrc"
|
||||
echo "source /etc/myp/nodejs-certs.conf" >> "/home/$PROJECT_USER/.bashrc"
|
||||
fi
|
||||
|
||||
log "INFO" "Node.js-Zertifikat-Konfiguration abgeschlossen"
|
||||
}
|
||||
|
||||
configure_chromium_certificates() {
|
||||
log "INFO" "Konfiguriere Chromium für Mercedes-Zertifikate..."
|
||||
|
||||
# Chromium Policy-Verzeichnis erstellen
|
||||
local chromium_policy_dir="/etc/chromium/policies/managed"
|
||||
mkdir -p "$chromium_policy_dir"
|
||||
|
||||
# Chromium Certificate Policy
|
||||
cat > "$chromium_policy_dir/mercedes-certificates.json" << 'EOF'
|
||||
{
|
||||
"AutoSelectCertificateForUrls": [
|
||||
"https://*.mercedes-benz.com",
|
||||
"https://*.daimler.com",
|
||||
"https://*.daimlertruck.com"
|
||||
],
|
||||
"CertificateTransparencyEnforcementDisabledForUrls": [
|
||||
"*.mercedes-benz.com",
|
||||
"*.daimler.com",
|
||||
"*.daimlertruck.com"
|
||||
],
|
||||
"AllowInsecureLocalhost": true
|
||||
}
|
||||
EOF
|
||||
|
||||
# Chromium NSS-Datenbank für Benutzer konfigurieren
|
||||
if command -v certutil >/dev/null 2>&1; then
|
||||
local nss_dir="/home/$PROJECT_USER/.pki/nssdb"
|
||||
mkdir -p "$nss_dir"
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "/home/$PROJECT_USER/.pki"
|
||||
|
||||
# NSS-Datenbank initialisieren falls nicht vorhanden
|
||||
if [[ ! -f "$nss_dir/cert9.db" ]]; then
|
||||
sudo -u "$PROJECT_USER" certutil -N -d sql:"$nss_dir" --empty-password
|
||||
fi
|
||||
|
||||
# Mercedes-Zertifikate zu NSS-Datenbank hinzufügen
|
||||
for cert_file in /usr/local/share/ca-certificates/mercedes/*.crt; do
|
||||
if [[ -f "$cert_file" ]]; then
|
||||
local cert_name=$(basename "$cert_file" .crt)
|
||||
sudo -u "$PROJECT_USER" certutil -A -n "Mercedes-$cert_name" -t "C,," -d sql:"$nss_dir" -i "$cert_file" || true
|
||||
fi
|
||||
done
|
||||
|
||||
log "INFO" "Mercedes-Zertifikate zu Chromium NSS-Datenbank hinzugefügt"
|
||||
else
|
||||
log "WARN" "certutil nicht verfügbar, installiere NSS-Tools..."
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y libnss3-tools
|
||||
|
||||
# Nach Installation nochmal versuchen
|
||||
if command -v certutil >/dev/null 2>&1; then
|
||||
configure_chromium_certificates
|
||||
fi
|
||||
fi
|
||||
|
||||
log "INFO" "Chromium-Zertifikat-Konfiguration abgeschlossen"
|
||||
}
|
||||
|
||||
verify_mercedes_certificates() {
|
||||
log "INFO" "Überprüfe Mercedes-Zertifikat-Installation..."
|
||||
|
||||
local errors=0
|
||||
|
||||
# Prüfe installierte Zertifikate
|
||||
local cert_count=$(find /usr/local/share/ca-certificates/mercedes -name "*.crt" 2>/dev/null | wc -l)
|
||||
if [[ $cert_count -eq 0 ]]; then
|
||||
log "ERROR" "Keine Mercedes-Zertifikate installiert"
|
||||
errors=$((errors + 1))
|
||||
else
|
||||
log "INFO" "✓ $cert_count Mercedes-Zertifikate installiert"
|
||||
fi
|
||||
|
||||
# Prüfe CA-Store-Update
|
||||
if [[ -f "/etc/ssl/certs/ca-certificates.crt" ]]; then
|
||||
# Prüfe ob Mercedes-Zertifikate im CA-Bundle enthalten sind
|
||||
if grep -q "Daimler AG" /etc/ssl/certs/ca-certificates.crt; then
|
||||
log "INFO" "✓ Mercedes-Zertifikate im System-CA-Store gefunden"
|
||||
else
|
||||
log "WARN" "Mercedes-Zertifikate möglicherweise nicht im CA-Store"
|
||||
fi
|
||||
else
|
||||
log "ERROR" "System-CA-Store nicht gefunden"
|
||||
errors=$((errors + 1))
|
||||
fi
|
||||
|
||||
# Teste HTTPS-Verbindung zu Mercedes-Domain (falls möglich)
|
||||
if command -v curl >/dev/null 2>&1; then
|
||||
if curl -s --connect-timeout 5 https://www.mercedes-benz.com >/dev/null 2>&1; then
|
||||
log "INFO" "✓ HTTPS-Verbindung zu Mercedes-Domain erfolgreich"
|
||||
else
|
||||
log "WARN" "HTTPS-Verbindung zu Mercedes-Domain fehlgeschlagen (möglicherweise Netzwerk)"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ $errors -eq 0 ]]; then
|
||||
log "INFO" "Mercedes-Zertifikat-Verifikation erfolgreich"
|
||||
return 0
|
||||
else
|
||||
log "ERROR" "Mercedes-Zertifikat-Verifikation fehlgeschlagen ($errors Fehler)"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
@ -39,6 +39,9 @@ test_installation() {
|
||||
# Security-Tests
|
||||
test_security
|
||||
|
||||
# Mercedes-Zertifikat-Tests
|
||||
test_mercedes_certificates
|
||||
|
||||
# Performance-Tests
|
||||
test_performance
|
||||
|
||||
@ -618,6 +621,118 @@ test_performance() {
|
||||
fi
|
||||
}
|
||||
|
||||
test_mercedes_certificates() {
|
||||
log "INFO" "=== MERCEDES-ZERTIFIKAT-TESTS ==="
|
||||
|
||||
local test_errors=0
|
||||
|
||||
# Prüfe ob Mercedes-Zertifikat-Verzeichnis existiert
|
||||
log "INFO" "Teste Mercedes-Zertifikat-Installation..."
|
||||
if [[ -d "/usr/local/share/ca-certificates/mercedes" ]]; then
|
||||
local cert_count=$(find /usr/local/share/ca-certificates/mercedes -name "*.crt" | wc -l)
|
||||
if [[ $cert_count -gt 0 ]]; then
|
||||
log "INFO" "✓ $cert_count Mercedes-Zertifikate installiert"
|
||||
else
|
||||
log "ERROR" "✗ Keine Mercedes-Zertifikate gefunden"
|
||||
test_errors=$((test_errors + 1))
|
||||
fi
|
||||
else
|
||||
log "WARN" "Mercedes-Zertifikat-Verzeichnis nicht gefunden (möglicherweise keine Zertifikate im Projekt)"
|
||||
fi
|
||||
|
||||
# Prüfe System-CA-Store
|
||||
log "INFO" "Teste System-CA-Store..."
|
||||
if [[ -f "/etc/ssl/certs/ca-certificates.crt" ]]; then
|
||||
log "INFO" "✓ System-CA-Store gefunden"
|
||||
|
||||
# Prüfe ob Mercedes-Zertifikate integriert sind
|
||||
if grep -q "Daimler AG" /etc/ssl/certs/ca-certificates.crt 2>/dev/null; then
|
||||
log "INFO" "✓ Mercedes-Zertifikate im CA-Store integriert"
|
||||
else
|
||||
log "WARN" "Mercedes-Zertifikate nicht im CA-Store gefunden"
|
||||
fi
|
||||
else
|
||||
log "ERROR" "✗ System-CA-Store nicht gefunden"
|
||||
test_errors=$((test_errors + 1))
|
||||
fi
|
||||
|
||||
# Prüfe Python-Zertifikat-Konfiguration
|
||||
log "INFO" "Teste Python-Zertifikat-Konfiguration..."
|
||||
if [[ -f "/etc/myp/python-certs.conf" ]]; then
|
||||
log "INFO" "✓ Python-Zertifikat-Konfiguration vorhanden"
|
||||
|
||||
# Teste Python SSL-Kontext
|
||||
if python3 -c "import ssl; print('SSL-Kontext:', ssl.create_default_context())" >/dev/null 2>&1; then
|
||||
log "INFO" "✓ Python SSL-Kontext funktioniert"
|
||||
else
|
||||
log "ERROR" "✗ Python SSL-Kontext fehlerhaft"
|
||||
test_errors=$((test_errors + 1))
|
||||
fi
|
||||
else
|
||||
log "WARN" "Python-Zertifikat-Konfiguration nicht gefunden"
|
||||
fi
|
||||
|
||||
# Prüfe Node.js-Zertifikat-Konfiguration
|
||||
log "INFO" "Teste Node.js-Zertifikat-Konfiguration..."
|
||||
if [[ -f "/etc/myp/nodejs-certs.conf" ]]; then
|
||||
log "INFO" "✓ Node.js-Zertifikat-Konfiguration vorhanden"
|
||||
else
|
||||
log "WARN" "Node.js-Zertifikat-Konfiguration nicht gefunden"
|
||||
fi
|
||||
|
||||
# Prüfe Chromium-Zertifikat-Konfiguration
|
||||
log "INFO" "Teste Chromium-Zertifikat-Konfiguration..."
|
||||
if [[ -f "/etc/chromium/policies/managed/mercedes-certificates.json" ]]; then
|
||||
log "INFO" "✓ Chromium-Zertifikat-Policy vorhanden"
|
||||
else
|
||||
log "WARN" "Chromium-Zertifikat-Policy nicht gefunden"
|
||||
fi
|
||||
|
||||
# Teste NSS-Datenbank für Chromium
|
||||
if [[ -d "/home/$PROJECT_USER/.pki/nssdb" ]]; then
|
||||
log "INFO" "✓ Chromium NSS-Datenbank vorhanden"
|
||||
|
||||
# Prüfe Mercedes-Zertifikate in NSS
|
||||
if command -v certutil >/dev/null 2>&1; then
|
||||
local nss_cert_count=$(sudo -u "$PROJECT_USER" certutil -L -d sql:"/home/$PROJECT_USER/.pki/nssdb" 2>/dev/null | grep -c "Mercedes-" || echo "0")
|
||||
if [[ $nss_cert_count -gt 0 ]]; then
|
||||
log "INFO" "✓ $nss_cert_count Mercedes-Zertifikate in NSS-Datenbank"
|
||||
else
|
||||
log "WARN" "Keine Mercedes-Zertifikate in NSS-Datenbank gefunden"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
log "WARN" "Chromium NSS-Datenbank nicht gefunden"
|
||||
fi
|
||||
|
||||
# Teste HTTPS-Verbindungen (falls Netzwerk verfügbar)
|
||||
log "INFO" "Teste HTTPS-Verbindungen..."
|
||||
if command -v curl >/dev/null 2>&1; then
|
||||
# Test zu bekannter Mercedes-Domain
|
||||
if curl -s --connect-timeout 5 --max-time 10 https://www.mercedes-benz.com >/dev/null 2>&1; then
|
||||
log "INFO" "✓ HTTPS-Verbindung zu Mercedes-Domain erfolgreich"
|
||||
else
|
||||
log "WARN" "HTTPS-Verbindung zu Mercedes-Domain fehlgeschlagen (Netzwerk/Firewall)"
|
||||
fi
|
||||
|
||||
# Test zu Standard-HTTPS-Site
|
||||
if curl -s --connect-timeout 5 --max-time 10 https://www.google.com >/dev/null 2>&1; then
|
||||
log "INFO" "✓ HTTPS-Verbindung zu Standard-Site erfolgreich"
|
||||
else
|
||||
log "WARN" "HTTPS-Verbindungen generell problematisch"
|
||||
test_errors=$((test_errors + 1))
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ $test_errors -eq 0 ]]; then
|
||||
log "INFO" "✓ Mercedes-Zertifikat-Tests bestanden"
|
||||
return 0
|
||||
else
|
||||
log "ERROR" "✗ Mercedes-Zertifikat-Tests fehlgeschlagen ($test_errors Fehler)"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
test_integration() {
|
||||
log "INFO" "=== INTEGRATION-TESTS ==="
|
||||
|
||||
|
||||
Reference in New Issue
Block a user