install-dsssl.sh

#!/bin/bash
#
# DSSSL System Installer
# Replaces system OpenSSL with DSSSL (DSMIL-Grade OpenSSL)
#
# WARNING: This script modifies system libraries. Use with caution.
# Always test in a non-production environment first.
#
# Classification: UNCLASSIFIED // FOR OFFICIAL USE ONLY

set -euo pipefail

# Script configuration
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
INSTALL_PREFIX="${INSTALL_PREFIX:-/usr/local}"
BACKUP_DIR="${BACKUP_DIR:-/opt/dsssl-backup-$(date +%Y%m%d-%H%M%S)}"
LOG_FILE="${LOG_FILE:-/var/log/dsssl-install.log}"
FORCE_INSTALL="${FORCE_INSTALL:-0}"
BUILD_LIBSSL11="${BUILD_LIBSSL11:-0}"
LIBSSL11_PREFIX="${LIBSSL11_PREFIX:-/usr}"  # Default to system install for libssl1.1

# Parse command line arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        --force|--yes|-y)
            FORCE_INSTALL=1
            shift
            ;;
        --prefix=*)
            INSTALL_PREFIX="${1#*=}"
            shift
            ;;
        --with-libssl11)
            BUILD_LIBSSL11=1
            shift
            ;;
        --libssl11-prefix=*)
            LIBSSL11_PREFIX="${1#*=}"
            shift
            ;;
        --help|-h)
            echo "Usage: $0 [options]"
            echo "Options:"
            echo "  --force, --yes, -y         Skip interactive confirmation"
            echo "  --prefix=PATH              Installation prefix (default: /usr/local)"
            echo "  --with-libssl11             Build and install libssl1.1 as system default OpenSSL"
            echo "  --libssl11-prefix=PATH      Installation prefix for libssl1.1 (default: /usr - system default)"
            echo "  --help, -h                  Show this help"
            exit 0
            ;;
        *)
            log_error "Unknown option: $1"
            echo "Use --help for usage information"
            exit 1
            ;;
    esac
done

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Logging function
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$LOG_FILE"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $*" | tee -a "$LOG_FILE" >&2
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $*" | tee -a "$LOG_FILE"
}

log_info() {
    echo -e "${GREEN}[INFO]${NC} $*" | tee -a "$LOG_FILE"
}

# Check if running as root
check_root() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root"
        exit 1
    fi
}

# Detect system OpenSSL locations
detect_openssl() {
    log_info "Detecting system OpenSSL installation..."
    
    OPENSSL_BIN=$(command -v openssl || echo "")
    OPENSSL_LIB_DIRS=(
        "/usr/lib"
        "/usr/lib64"
        "/usr/local/lib"
        "/usr/local/lib64"
        "/lib"
        "/lib64"
    )
    
    OPENSSL_LIBS=(
        "libssl.so"
        "libcrypto.so"
        "libssl.so.4"
        "libcrypto.so.4"
        "libssl.so.3"
        "libcrypto.so.3"
        "libssl.so.1.1"
        "libcrypto.so.1.1"
    )
    
    if [[ -z "$OPENSSL_BIN" ]]; then
        log_error "OpenSSL binary not found in PATH"
        exit 1
    fi
    
    log_info "Found OpenSSL binary: $OPENSSL_BIN"
    OPENSSL_VERSION=$($OPENSSL_BIN version 2>/dev/null || echo "unknown")
    log_info "System OpenSSL version: $OPENSSL_VERSION"
}

# Create backup
create_backup() {
    log_info "Creating backup of system OpenSSL..."
    
    mkdir -p "$BACKUP_DIR"
    
    # Backup binary
    if [[ -f "$OPENSSL_BIN" ]]; then
        cp -v "$OPENSSL_BIN" "$BACKUP_DIR/openssl.bin" 2>&1 | tee -a "$LOG_FILE"
    fi
    
    # Backup libraries
    for lib_dir in "${OPENSSL_LIB_DIRS[@]}"; do
        if [[ -d "$lib_dir" ]]; then
            for lib in "${OPENSSL_LIBS[@]}"; do
                if [[ -f "$lib_dir/$lib" ]] || [[ -L "$lib_dir/$lib" ]]; then
                    mkdir -p "$BACKUP_DIR/lib"
                    cp -v "$lib_dir/$lib" "$BACKUP_DIR/lib/" 2>&1 | tee -a "$LOG_FILE" || true
                fi
            done
        fi
    done
    
    # Backup include files
    OPENSSL_INCLUDE_DIRS=(
        "/usr/include/openssl"
        "/usr/local/include/openssl"
    )
    
    for inc_dir in "${OPENSSL_INCLUDE_DIRS[@]}"; do
        if [[ -d "$inc_dir" ]]; then
            mkdir -p "$BACKUP_DIR/include"
            cp -rv "$inc_dir" "$BACKUP_DIR/include/" 2>&1 | tee -a "$LOG_FILE" || true
        fi
    done
    
    # Save system information
    {
        echo "Backup created: $(date)"
        echo "System: $(uname -a)"
        echo "OpenSSL binary: $OPENSSL_BIN"
        echo "OpenSSL version: $OPENSSL_VERSION"
        echo "Backup directory: $BACKUP_DIR"
    } > "$BACKUP_DIR/backup-info.txt"
    
    log_info "Backup created in: $BACKUP_DIR"
}

# Build DSSSL if needed
build_dsssl() {
    log_info "Checking DSSSL build status..."

    # Check for DSSSL libraries in current directory (where we built them)
    if [[ ! -f "$SCRIPT_DIR/libssl.so.4" ]] && [[ ! -f "$SCRIPT_DIR/libssl.so" ]]; then
        log_warn "DSSSL not built. Building now..."

        if [[ ! -f "$SCRIPT_DIR/util/build-dsllvm-world.sh" ]]; then
            log_error "Build script not found. Please build DSSSL first."
            exit 1
        fi

        cd "$SCRIPT_DIR"
        ./util/build-dsllvm-world.sh --clean

        if [[ $? -ne 0 ]]; then
            log_error "DSSSL build failed"
            exit 1
        fi
    else
        log_info "DSSSL already built"
    fi
}

# Build libssl1.1 if requested
build_libssl11() {
    if [[ $BUILD_LIBSSL11 -eq 1 ]]; then
        log_info "Building libssl1.1 with DSLLVM..."

        if [[ ! -f "$SCRIPT_DIR/util/build-libssl1.1-dsllvm.sh" ]]; then
            log_error "libssl1.1 build script not found"
            exit 1
        fi

        if [[ ! -d "$SCRIPT_DIR/openssl-1.1.1" ]]; then
            log_error "OpenSSL 1.1.1 source not found. Please add it to the repository."
            exit 1
        fi

        cd "$SCRIPT_DIR"
        if [[ "$LIBSSL11_PREFIX" == "/usr" ]]; then
            # System install - make libssl1.1 the default system OpenSSL
            log_info "Installing libssl1.1 as system default OpenSSL with DSSSL hardening..."
            ./util/build-libssl1.1-dsllvm.sh --clean --system-install --install
        else
            # Custom prefix install
            ./util/build-libssl1.1-dsllvm.sh --clean --prefix="$LIBSSL11_PREFIX" --install
        fi

        if [[ $? -ne 0 ]]; then
            log_error "libssl1.1 build failed"
            exit 1
        fi

        log_info "libssl1.1 built and installed successfully"

        # Provide guidance on header usage
        if [[ "$LIBSSL11_PREFIX" == "/usr" ]]; then
            log_info "Header usage:"
            log_info "  - DSSSL 4.x headers: $INSTALL_PREFIX/include/openssl"
            log_info "  - libssl1.1 headers: /usr/include/openssl-1.1 (symlinked to /usr/include/openssl)"
        fi
    fi
}

# Install DSSSL
install_dsssl() {
    log_info "Installing DSSSL..."
    
    cd "$SCRIPT_DIR"
    
    # Check for built files in current directory (where we built DSSSL)
    if [[ ! -f "$SCRIPT_DIR/apps/openssl" ]]; then
        log_error "DSSSL openssl binary not found. Please build DSSSL first."
        exit 1
    fi

    if [[ ! -f "$SCRIPT_DIR/libssl.so.4" ]]; then
        log_error "DSSSL libraries not found. Please build DSSSL first."
        exit 1
    fi

    # Install binaries
    log_info "Installing binaries..."
    install -m 755 "$SCRIPT_DIR/apps/openssl" "$INSTALL_PREFIX/bin/openssl"
    
    # Create symlink if /usr/bin/openssl exists
    if [[ -f "/usr/bin/openssl" ]] && [[ "$INSTALL_PREFIX" != "/usr" ]]; then
        mv "/usr/bin/openssl" "/usr/bin/openssl.system" 2>/dev/null || true
        ln -sf "$INSTALL_PREFIX/bin/openssl" "/usr/bin/openssl"
    fi
    
    # Install libraries
    log_info "Installing libraries..."

    # Libraries are in the current directory
    
    # Determine system library and include directories
    SYSTEM_LIB_DIR="/usr/lib"
    SYSTEM_INCLUDE_DIR="/usr/include"
    if [[ -d "/usr/lib64" ]] && [[ $(uname -m) == "x86_64" ]]; then
        SYSTEM_LIB_DIR="/usr/lib64"
    fi
    
    # Install libssl1.1 first (system default)
    if [[ -d "$SCRIPT_DIR/ssl1.1" ]] && [[ $BUILD_LIBSSL11 -eq 1 ]]; then
        log_info "Installing libssl1.1 as system default..."

        # Install libssl1.1 libraries
        for lib in libssl.so.1.1 libcrypto.so.1.1; do
            if [[ -f "$SCRIPT_DIR/ssl1.1/$lib" ]]; then
                install -m 755 "$SCRIPT_DIR/ssl1.1/$lib" "$SYSTEM_LIB_DIR/$lib"

                # Create symlinks for system compatibility
                if [[ "$lib" == "libssl.so.1.1" ]]; then
                    ln -sf "$SYSTEM_LIB_DIR/libssl.so.1.1" "$SYSTEM_LIB_DIR/libssl.so" 2>/dev/null || true
                fi
                if [[ "$lib" == "libcrypto.so.1.1" ]]; then
                    ln -sf "$SYSTEM_LIB_DIR/libcrypto.so.1.1" "$SYSTEM_LIB_DIR/libcrypto.so" 2>/dev/null || true
                fi
            fi
        done

        # Install libssl1.1 headers
        if [[ -d "$SCRIPT_DIR/ssl1.1/include" ]]; then
            mkdir -p "$SYSTEM_INCLUDE_DIR"
            cp -r "$SCRIPT_DIR/ssl1.1/include/openssl" "$SYSTEM_INCLUDE_DIR/" 2>/dev/null || true
        fi
    fi

    # Install DSSSL libssl (OpenSSL 4.x)
    for lib in libssl.so.4 libcrypto.so.4; do
        if [[ -f "$SCRIPT_DIR/$lib" ]]; then
            install -m 755 "$SCRIPT_DIR/$lib" "$SYSTEM_LIB_DIR/$lib"

            # Update library links (but don't override libssl1.1 symlinks)
            if [[ "$lib" == "libssl.so.4" ]] && [[ ! -f "$SYSTEM_LIB_DIR/libssl.so.1.1" ]]; then
                ln -sf "$SYSTEM_LIB_DIR/libssl.so.4" "$SYSTEM_LIB_DIR/libssl.so" 2>/dev/null || true
            fi
            if [[ "$lib" == "libcrypto.so.4" ]] && [[ ! -f "$SYSTEM_LIB_DIR/libcrypto.so.1.1" ]]; then
                ln -sf "$SYSTEM_LIB_DIR/libcrypto.so.4" "$SYSTEM_LIB_DIR/libcrypto.so" 2>/dev/null || true
            fi
        fi
    done
    
    # Update library cache
    log_info "Updating library cache..."
    if command -v ldconfig >/dev/null 2>&1; then
        ldconfig
    fi
    
    # Install provider modules (oqs-provider, policy, etc.)
    MODULE_SRC=""
    if [[ -d "${SCRIPT_DIR}/ossl-modules" ]]; then
        MODULE_SRC="${SCRIPT_DIR}/ossl-modules"
    elif [[ -d "${SCRIPT_DIR}/oqs-provider/_build/lib" ]]; then
        MODULE_SRC="${SCRIPT_DIR}/oqs-provider/_build/lib"
    fi

    if [[ -n "$MODULE_SRC" ]]; then
        MODULE_DEST="${INSTALL_PREFIX}/lib64/ossl-modules"
        mkdir -p "$MODULE_DEST"
        log_info "Installing provider modules from ${MODULE_SRC} to ${MODULE_DEST}..."
        cp -v "${MODULE_SRC}"/*.so "$MODULE_DEST"/ 2>&1 | tee -a "$LOG_FILE" || true
    else
        log_warn "Provider modules not found; ensure oqs-provider was built (ossl-modules missing)"
    fi

    # Install include files
    log_info "Installing include files..."
    if [[ -d "$SCRIPT_DIR/include/openssl" ]]; then
        mkdir -p "$INSTALL_PREFIX/include"
        cp -r "$SCRIPT_DIR/include/openssl" "$INSTALL_PREFIX/include/"
    elif [[ -d "include/openssl" ]]; then
        mkdir -p "$INSTALL_PREFIX/include"
        cp -r "include/openssl" "$INSTALL_PREFIX/include/"
    fi

    # Install configs (profiles + oqs-provider)
    if [[ -d "${SCRIPT_DIR}/configs" ]]; then
        mkdir -p "${INSTALL_PREFIX}/ssl"
        cp -v "${SCRIPT_DIR}/configs/"*.cnf "${INSTALL_PREFIX}/ssl/" 2>&1 | tee -a "$LOG_FILE" || true
    fi
    
    log_info "DSSSL installation complete"
}

# Verify installation
verify_installation() {
    log_info "Verifying installation..."
    
    # Check binary
    NEW_OPENSSL=$(command -v openssl || echo "")
    if [[ -z "$NEW_OPENSSL" ]]; then
        log_error "OpenSSL binary not found after installation"
        return 1
    fi
    
    # Check version
    NEW_VERSION=$($NEW_OPENSSL version 2>/dev/null || echo "unknown")
    log_info "Installed OpenSSL version: $NEW_VERSION"
    
    # Check if it's DSSSL
    if $NEW_OPENSSL version 2>&1 | grep -qi "dsssl\|dsmil"; then
        log_info "DSSSL detected in version string"
    else
        log_warn "DSSSL identifier not found in version string"
    fi
    
    # Test basic functionality
    log_info "Testing basic functionality..."
    if $NEW_OPENSSL version -a >/dev/null 2>&1; then
        log_info "Basic functionality test passed"
    else
        log_error "Basic functionality test failed"
        return 1
    fi

    # Provider sanity (optional, best-effort)
    if [[ -d "${INSTALL_PREFIX}/lib64/ossl-modules" ]]; then
        OPENSSL_MODULES="${INSTALL_PREFIX}/lib64/ossl-modules" \
        OPENSSL_CONF="${INSTALL_PREFIX}/ssl/world.cnf" \
        $NEW_OPENSSL list -providers >/dev/null 2>&1 && \
        log_info "Provider load check passed (OPENSSL_MODULES=${INSTALL_PREFIX}/lib64/ossl-modules)"
    fi
    
    # Test library loading
    log_info "Testing library loading..."
    if ldconfig -p | grep -q "libssl.so"; then
        log_info "Library loading test passed"
        # Check which libssl is loaded
        LIBSSL_PATH=$(ldconfig -p | grep "libssl.so" | head -1 | awk '{print $4}')
        if [[ -n "$LIBSSL_PATH" ]] && [[ "$LIBSSL_PATH" == *"libssl.so.1.1"* ]]; then
            log_info "✓ libssl1.1 is the active system SSL library"
        else
            log_info "DSSSL 4.x libssl is the active system SSL library"
        fi
    else
        log_warn "Library loading test inconclusive"
    fi
    
    log_info "Installation verification complete"
    return 0
}

# Create rollback script
create_rollback_script() {
    log_info "Creating rollback script..."
    
    ROLLBACK_SCRIPT="$BACKUP_DIR/rollback.sh"
    
    cat > "$ROLLBACK_SCRIPT" <<EOF
#!/bin/bash
#
# DSSSL Rollback Script
# Restores system OpenSSL from backup
#
# Backup created: $(date)
# Backup directory: $BACKUP_DIR

set -euo pipefail

echo "Rolling back DSSSL installation..."

# Restore binary
if [[ -f "$BACKUP_DIR/openssl.bin" ]]; then
    install -m 755 "$BACKUP_DIR/openssl.bin" "$OPENSSL_BIN"
fi

# Restore libraries
if [[ -d "$BACKUP_DIR/lib" ]]; then
    for lib in "$BACKUP_DIR/lib"/*; do
        if [[ -f "\$lib" ]]; then
            libname=\$(basename "\$lib")
            for lib_dir in /usr/lib /usr/lib64 /usr/local/lib /usr/local/lib64; do
                if [[ -d "\$lib_dir" ]]; then
                    install -m 755 "\$lib" "\$lib_dir/\$libname" 2>/dev/null || true
                fi
            done
        fi
    done
    ldconfig
fi

# Restore include files
if [[ -d "$BACKUP_DIR/include/openssl" ]]; then
    for inc_dir in /usr/include /usr/local/include; do
        if [[ -d "\$inc_dir" ]]; then
            rm -rf "\$inc_dir/openssl"
            cp -r "$BACKUP_DIR/include/openssl" "\$inc_dir/"
        fi
    done
fi

# Restore /usr/bin/openssl if it was moved
if [[ -f "/usr/bin/openssl.system" ]]; then
    mv "/usr/bin/openssl.system" "/usr/bin/openssl"
fi

echo "Rollback complete"
EOF
    
    chmod +x "$ROLLBACK_SCRIPT"
    log_info "Rollback script created: $ROLLBACK_SCRIPT"
}

# Main installation function
main() {
    log_info "=========================================="
    log_info "DSSSL System Installer"
    log_info "=========================================="
    log_info "This will replace system OpenSSL with DSSSL"
    log_info "Backup will be created in: $BACKUP_DIR"
    log_info ""
    
    # Safety check
    if [[ "${FORCE_INSTALL:-}" != "1" ]]; then
        echo -n "Are you sure you want to continue? (yes/no): "
        read -r response
        if [[ "$response" != "yes" ]]; then
            log_info "Installation cancelled"
            exit 0
        fi
    fi
    
    # Run installation steps
    check_root
    detect_openssl
    create_backup
    build_dsssl
    build_libssl11
    install_dsssl
    
    if verify_installation; then
        create_rollback_script
        log_info "=========================================="
        log_info "Installation completed successfully!"
        log_info "Backup location: $BACKUP_DIR"
        log_info "Rollback script: $BACKUP_DIR/rollback.sh"
        log_info "Set runtime env (example):"
        log_info "  export OPENSSL_MODULES=${INSTALL_PREFIX}/lib64/ossl-modules"
        log_info "  export OPENSSL_CONF=${INSTALL_PREFIX}/ssl/world.cnf   # or dsmil-secure.cnf / atomal.cnf"
        log_info "  export LD_LIBRARY_PATH=${INSTALL_PREFIX}/lib64:${INSTALL_PREFIX}/lib:\$LD_LIBRARY_PATH"

        if [[ $BUILD_LIBSSL11 -eq 1 ]]; then
            log_info ""
            if [[ "$LIBSSL11_PREFIX" == "/usr" ]]; then
                log_info "libssl1.1 installed as system default OpenSSL with DSSSL hardening!"
                log_info "All applications will automatically use hardened libssl1.1"
                log_info "DSSSL 4.x remains available at: $INSTALL_PREFIX"
                log_info ""
                log_info "To use DSSSL 4.x specifically:"
                log_info "  export LD_LIBRARY_PATH=${INSTALL_PREFIX}/lib:\$LD_LIBRARY_PATH"
                log_info "  export OPENSSL_MODULES=${INSTALL_PREFIX}/lib64/ossl-modules"
                log_info "  export OPENSSL_CONF=${INSTALL_PREFIX}/ssl/world.cnf"
            else
                log_info "libssl1.1 also installed to: $LIBSSL11_PREFIX"
                log_info "To use libssl1.1 specifically:"
                log_info "  export LD_LIBRARY_PATH=${LIBSSL11_PREFIX}/lib:\$LD_LIBRARY_PATH"
                log_info "  export PKG_CONFIG_PATH=${LIBSSL11_PREFIX}/lib/pkgconfig:\$PKG_CONFIG_PATH"
            fi
        fi

        log_info "=========================================="
    else
        log_error "Installation verification failed"
        log_info "You can rollback using: $BACKUP_DIR/rollback.sh"
        exit 1
    fi
}

# Run main function
main "$@"