#!/bin/sh
#
# $FreeBSD$
#

# PROVIDE: mail
# REQUIRE: LOGIN FILESYSTEMS
#	we make mail start late, so that things like .forward's are not
#	processed until the system is fully operational
# KEYWORD: shutdown

# XXX - Get together with sendmail mantainer to figure out how to
#	better handle SENDMAIL_ENABLE and 3rd party MTAs.
#
. /etc/rc.subr

name="sendmail"
desc="Electronic mail transport agent"
rcvar="sendmail_enable"
required_files="/etc/mail/${name}.cf"
start_precmd="sendmail_precmd"

load_rc_config $name
command=${sendmail_program:-/usr/sbin/${name}}
pidfile=${sendmail_pidfile:-/var/run/${name}.pid}
procname=${sendmail_procname:-/usr/sbin/${name}}

CERTDIR=/etc/mail/certs

case ${sendmail_enable} in
[Nn][Oo][Nn][Ee])
	sendmail_enable="NO"
	sendmail_submit_enable="NO"
	sendmail_outbound_enable="NO"
	sendmail_msp_queue_enable="NO"
	;;
esac

# If sendmail_enable=yes, don't need submit or outbound daemon
if checkyesno sendmail_enable; then
	sendmail_submit_enable="NO"
	sendmail_outbound_enable="NO"
fi

# If sendmail_submit_enable=yes, don't need outbound daemon
if checkyesno sendmail_submit_enable; then
	sendmail_outbound_enable="NO"
fi

sendmail_cert_create()
{
	cnname="${sendmail_cert_cn:-`hostname`}"
	cnname="${cnname:-amnesiac}"

	# based upon:
	# http://www.sendmail.org/~ca/email/other/cagreg.html
	CAdir=`mktemp -d` &&
	certpass=`(date; ps ax ; hostname) | md5 -q`

	# make certificate authority
	( cd "$CAdir" &&
	chmod 700 "$CAdir" &&
	mkdir certs crl newcerts &&
	echo "01" > serial &&
	:> index.txt &&

	cat <<-OPENSSL_CNF > openssl.cnf &&
		RANDFILE	= $CAdir/.rnd
		[ ca ]
		default_ca	= CA_default
		[ CA_default ]
		dir		= .
		certs		= \$dir/certs		# Where the issued certs are kept
		crl_dir		= \$dir/crl		# Where the issued crl are kept
		database	= \$dir/index.txt	# database index file.
		new_certs_dir	= \$dir/newcerts	# default place for new certs.
		certificate	= \$dir/cacert.pem 	# The CA certificate
		serial		= \$dir/serial 		# The current serial number
		crlnumber	= \$dir/crlnumber	# the current crl number
		crl		= \$dir/crl.pem 	# The current CRL
		private_key	= \$dir/cakey.pem
		x509_extensions	= usr_cert		# The extensions to add to the cert
		name_opt 	= ca_default		# Subject Name options
		cert_opt 	= ca_default		# Certificate field options
		default_days	= 365			# how long to certify for
		default_crl_days= 30			# how long before next CRL
		default_md	= default		# use public key default MD
		preserve	= no			# keep passed DN ordering
		policy		= policy_anything
		[ policy_anything ]
		countryName		= optional
		stateOrProvinceName	= optional
		localityName		= optional
		organizationName	= optional
		organizationalUnitName	= optional
		commonName		= supplied
		emailAddress		= optional
		[ req ]
		default_bits		= 2048
		default_keyfile 	= privkey.pem
		distinguished_name	= req_distinguished_name
		attributes		= req_attributes
		x509_extensions	= v3_ca	# The extensions to add to the self signed cert
		string_mask = utf8only
		prompt = no
		[ req_distinguished_name ]
		countryName			= XX
		stateOrProvinceName		= Some-state
		localityName			= Some-city
		0.organizationName		= Some-org
		CN				= $cnname
		[ req_attributes ]
		challengePassword		= foobar
		unstructuredName		= An optional company name
		[ usr_cert ]
		basicConstraints=CA:FALSE
		nsComment			= "OpenSSL Generated Certificate"
		subjectKeyIdentifier=hash
		authorityKeyIdentifier=keyid,issuer
		[ v3_req ]
		basicConstraints = CA:FALSE
		keyUsage = nonRepudiation, digitalSignature, keyEncipherment
		[ v3_ca ]
		subjectKeyIdentifier=hash
		authorityKeyIdentifier=keyid:always,issuer
		basicConstraints = CA:true
	OPENSSL_CNF

	# though we use a password, the key is discarded and never used
	openssl req -batch -passout pass:"$certpass" -new -x509 \
	    -keyout cakey.pem -out cacert.pem -days 3650 \
	    -config openssl.cnf -newkey rsa:2048 >/dev/null 2>&1 &&

	# make new certificate
	openssl req -batch -nodes -new -x509 -keyout newkey.pem \
	    -out newreq.pem -days 365 -config openssl.cnf \
	    -newkey rsa:2048 >/dev/null 2>&1 &&

	# sign certificate
	openssl x509 -x509toreq -in newreq.pem -signkey newkey.pem \
	    -out tmp.pem >/dev/null 2>&1 &&
	openssl ca -notext -config openssl.cnf \
	    -out newcert.pem -keyfile cakey.pem -cert cacert.pem \
	    -key "$certpass" -batch -infiles tmp.pem >/dev/null 2>&1 &&

	mkdir -p "$CERTDIR" &&
	chmod 0755 "$CERTDIR" &&
	chmod 644 newcert.pem cacert.pem &&
	chmod 600 newkey.pem &&
	cp -p newcert.pem "$CERTDIR"/host.cert &&
	cp -p cacert.pem "$CERTDIR"/cacert.pem &&
	cp -p newkey.pem "$CERTDIR"/host.key &&
	ln -s cacert.pem "$CERTDIR"/`openssl x509 -hash -noout \
	    -in cacert.pem`.0)

	retVal="$?"
	rm -rf "$CAdir"

	return "$retVal"
}

sendmail_precmd()
{
	# Die if there's pre-8.10 custom configuration file.  This check is
	# mandatory for smooth upgrade.  See NetBSD PR 10100 for details.
	#
	if checkyesno ${rcvar} && [ -f "/etc/${name}.cf" ]; then
		if ! cmp -s "/etc/mail/${name}.cf" "/etc/${name}.cf"; then
			warn \
    "${name} was not started; you have multiple copies of sendmail.cf."
			return 1
		fi
	fi

	# check modifications on /etc/mail/aliases
	if checkyesno sendmail_rebuild_aliases; then
		if [ -f "/etc/mail/aliases.db" ]; then
			if [ "/etc/mail/aliases" -nt "/etc/mail/aliases.db" ]; then
				echo \
	    	"${name}: /etc/mail/aliases newer than /etc/mail/aliases.db, regenerating"
				/usr/bin/newaliases
			fi
		else
			echo \
	    	"${name}: /etc/mail/aliases.db not present, generating"
				/usr/bin/newaliases
		fi
	fi

	if checkyesno sendmail_cert_create && [ ! \( \
	    -f "$CERTDIR/host.cert" -o -f "$CERTDIR/host.key" -o \
	    -f "$CERTDIR/cacert.pem" \) ]; then
		if ! openssl version >/dev/null 2>&1; then
			warn "OpenSSL not available, but sendmail_cert_create is YES."
		else
			info Creating certificate for sendmail.
			sendmail_cert_create
		fi
	fi
}

run_rc_command "$1"

required_files=

if checkyesno sendmail_submit_enable; then
	name="sendmail_submit"
	rcvar="sendmail_submit_enable"
	_rc_restart_done=false
	run_rc_command "$1"
fi

if checkyesno sendmail_outbound_enable; then
	name="sendmail_outbound"
	rcvar="sendmail_outbound_enable"
	_rc_restart_done=false
	run_rc_command "$1"
fi

name="sendmail_msp_queue"
rcvar="sendmail_msp_queue_enable"
pidfile="${sendmail_msp_queue_pidfile:-/var/spool/clientmqueue/sm-client.pid}"
required_files="/etc/mail/submit.cf"
_rc_restart_done=false
run_rc_command "$1"