Comment crypter les courriers électroniques avec S/MIME

Voici un script pour crypter des courriels préexistants, mais vous devez y avoir accès en tant que fichiers au format MH. En bonus, il utilise GPG au lieu de S/MIME si le deuxième argument est un ID de clé GPG. Si le second argument est un chemin vers un fichier se terminant par .pem, alors le script suppose que le second argument est un certificat X509 au format pem pour lequel la clé privée correspondante sera éventuellement utilisée pour déchiffrer l'email.

#!/usr/bin/awk -f

## Encrypt emails in MH format.

## 1st argument is email file to encrypt.
## 2nd argument is PGP key identifier, or for S/MIME, certificate file.

BEGIN {
        ## If second argument ends with .pem, assume that S/MIME output
        ## is required, otherwise assume PGP/MIME.
        if (ARGC == 3 && ARGV[2] ~ /\.pem$/) S = 1 ## S/MIME, not PGP

        if (S == 1) {
                Encrypt = "openssl smime -encrypt -aes256 -outform pem " ARGV[2]
                Encrypt = Encrypt "|sed '/^-----BEGIN PKCS7-----/d;"
                Encrypt = Encrypt "/^-----END PKCS7-----/d'"}
        else {
                Encrypt = "gpg2 --armor --encrypt -r " ARGV[2]
                Random = "openssl rand -base64 30"}

        for (i=2;i < ARGC;i++) delete ARGV[i]        ## Just one input file.
}

{
        sub(/\r$/,"",$0)}

##==========================================================

BlankCount > 0 {           ## Everything from the 1st blank line onwards:
        print $0 | Encrypt ## Pipe opened on 1st matching line; stays open.
        next}

##----------------------------------------------------------

$0 ~ /^[^ \t]/ {        ## Any line starting with a non-whitespace character.
        CurrentBlank = 0
        if (Started == 0) Started = 1}

##----------------------------------------------------------

$0 ~ /^[ \t]*$/ {        ## Blank line NOT at the top of the file.
        if (CurrentBlank == 0 && Started == 1) BlankCount++
        CurrentBlank = 1

        ## New Content-Type and Content-Transfer-Encoding headers to go at the
        ## end of the header-block, i.e. before the first blank line:
        if (BlankCount == 1) {
                if (S == 1) {
                        H = "Content-Type: application/pkcs7-mime;"
                        H = H " name=\"smime.p7m\"; smime-type=enveloped-data\n"
                        H = H "Content-Transfer-Encoding: base64\n"
                        H = H "Content-Disposition: attachment;"
                        H = H " filename=\"smime.p7m\"\n"
                        H = H "Content-Description: S/MIME Encrypted Message"}
                else {
                        Random | getline Boundary
                        Boundary = "Encrypt_/" Boundary

                        H = "Content-Type: multipart/encrypted;"
                        H = H "\n boundary=\"" Boundary "\";"
                        H = H "\n protocol=\"application/pgp-encrypted\"\n\n"

                        H = H "--" Boundary "\n"
                        H = H "Content-Type: application/pgp-encrypted\n\n"

                        H = H "Version: 1\n\n"

                        H = H "--" Boundary "\n"
                        H = H "Content-Type: application/octet-stream\n"}

                print H

                printf("%s\n", ContentType) | Encrypt
                printf("%s\n\n", TransferEncoding) | Encrypt}}

##----------------------------------------------------------

## Save original Content-Type and Content-Transfer-Encoding to put in
## encrypted part:

tolower($0) ~ /^content-type[ \t]*:/ {
        ContentType = $0
        sub(/[^:][^:]*: */,"",ContentType)
        ContentType = "Content-Type: " ContentType
        ContentTypeLineNumber = FNR
        next}
tolower($0) ~ /^content-transfer-encoding[ \t]*:/ {
        TransferEncoding = $0
        TransferEncoding = "Content-Transfer-Encoding: " TransferEncoding
        sub(/[^:][^:]*: */,"",TransferEncoding)
        TransferEncodingLineNumber = FNR
        next}

$0 ~ /^[ \t][ \t]*[^ \t]/ {        ## Non-blank line starting with space or tab
        CurrentBlank = 0
        if (BlankCount == 0 && FNR > 1) {
                ## This must be a continuation line in the header
                if (FNR - 1 == ContentTypeLineNumber) {
                        ContentTypeLineNumber = FNR
                        ContentType = ContentType "\n" $0
                        next}
                if (FNR - 1 == TransferEncodingLineNumber) {
                        TransferEncodingLineNumber = FNR
                        TransferEncoding = TransferEncoding "\n" $0
                        next}}}

##----------------------------------------------------------

Started == 1 {                ## All header lines other than Type and Encoding.
        print $0}

END {
        close(Encrypt)
        if (S == 1) print ""
        else printf("\n--%s--\n", Boundary)}

##----------------------------------------------------------