cert_cmd.c

Go to the documentation of this file.

/*
 * Copyright (C) 2016 Michael Brown <mbrown@fensystems.co.uk>.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 *
 * You can also choose to distribute this program under the terms of
 * the Unmodified Binary Distribution Licence (as given in the file
 * COPYING.UBDL), provided that you have satisfied its requirements.
 */

FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
FILE_SECBOOT ( PERMITTED );

#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <getopt.h>
#include <ipxe/x509.h>
#include <ipxe/certstore.h>
#include <ipxe/image.h>
#include <ipxe/command.h>
#include <ipxe/parseopt.h>
#include <usr/imgmgmt.h>
#include <usr/certmgmt.h>

/** @file
 *
 * Certificate management commands
 *
 */

/** "cert<xxx>" options */
struct cert_options {
        /** Certificate subject name */
        char *name;
        /** Keep certificate file after parsing */
        int keep;
};

/** "cert<xxx>" option list */
static union {
        /* "certstore" takes both options */
        struct option_descriptor certstore[2];
        /* "certstat" takes only --subject */
        struct option_descriptor certstat[1];
        /* "certfree" takes only --subject */
        struct option_descriptor certfree[1];
} opts = {
        .certstore = {
                OPTION_DESC ( "subject", 's', required_argument,
                              struct cert_options, name, parse_string ),
                OPTION_DESC ( "keep", 'k', no_argument,
                              struct cert_options, keep, parse_flag ),
        },
};

/** A "cert<xxx>" command descriptor */
struct cert_command_descriptor {
        /** Command descriptor */
        struct command_descriptor cmd;
        /** Payload
         *
         * @v cert              X.509 certificate
         * @ret rc              Return status code
         */
        int ( * payload ) ( struct x509_certificate *cert );
};

/**
 * Construct "cert<xxx>" command descriptor
 *
 * @v _struct           Options structure type
 * @v _options          Option descriptor array
 * @v _min_args         Minimum number of non-option arguments
 * @v _max_args         Maximum number of non-option arguments
 * @v _usage            Command usage
 * @v _payload          Payload method
 * @ret _command        Command descriptor
 */
#define CERT_COMMAND_DESC( _struct, _options, _min_args, _max_args,     \
                           _usage, _payload )                           \
        {                                                               \
                .cmd = COMMAND_DESC ( _struct, _options, _min_args,     \
                                      _max_args, _usage ),              \
                .payload = _payload,                                    \
        }

/**
 * Execute "cert<xxx>" command
 *
 * @v argc              Argument count
 * @v argv              Argument list
 * @v certcmd           Command descriptor
 * @ret rc              Return status code
 */
static int cert_exec ( int argc, char **argv,
                       struct cert_command_descriptor *certcmd ) {
        struct command_descriptor *cmd = &certcmd->cmd;
        struct cert_options opts;
        struct image *image = NULL;
        struct x509_certificate *cert;
        struct x509_certificate *tmp;
        unsigned int count = 0;
        size_t offset = 0;
        int next;
        int rc;

        /* Parse options */
        if ( ( rc = parse_options ( argc, argv, cmd, &opts ) ) != 0 )
                goto err_parse;

        /* Acquire image, if applicable */
        if ( ( optind < argc ) &&
             ( ( rc = imgacquire ( argv[optind], 0, &image ) ) != 0 ) )
                goto err_acquire;

        /* Get first entry in certificate store */
        tmp = list_first_entry ( &certstore.links, struct x509_certificate,
                                 store.list );

        /* Iterate over certificates */
        while ( 1 ) {

                /* Get next certificate from image or store as applicable */
                if ( image ) {

                        /* Get next certificate from image */
                        if ( offset >= image->len )
                                break;
                        next = image_x509 ( image, offset, &cert );
                        if ( next < 0 ) {
                                rc = next;
                                printf ( "Could not parse certificate: %s\n",
                                         strerror ( rc ) );
                                goto err_x509;
                        }
                        offset = next;

                } else {

                        /* Get next certificate from store */
                        cert = tmp;
                        if ( ! cert )
                                break;
                        tmp = list_next_entry ( tmp, &certstore.links,
                                                store.list );
                        x509_get ( cert );
                }

                /* Skip non-matching names, if a name was specified */
                if ( opts.name && ( x509_check_name ( cert, opts.name ) != 0 )){
                        x509_put ( cert );
                        continue;
                }

                /* Execute payload */
                if ( ( rc = certcmd->payload ( cert ) ) != 0 ) {
                        x509_put ( cert );
                        goto err_payload;
                }

                /* Count number of certificates processed */
                count++;

                /* Drop reference to certificate */
                x509_put ( cert );
        }

        /* Fail if a name was specified and no matching certificates
         * were found.
         */
        if ( opts.name && ( count == 0 ) ) {
                printf ( "\"%s\" : no such certificate\n", opts.name );
                rc = -ENOENT;
                goto err_none;
        }

 err_none:
 err_payload:
 err_x509:
        if ( image && ( ! opts.keep ) )
                unregister_image ( image );
 err_acquire:
 err_parse:
        return rc;
}

/**
 * "certstat" payload
 *
 * @v cert              X.509 certificate
 * @ret rc              Return status code
 */
static int certstat_payload ( struct x509_certificate *cert ) {

        certstat ( cert );
        return 0;
}

/** "certstat" command descriptor */
static struct cert_command_descriptor certstat_cmd =
        CERT_COMMAND_DESC ( struct cert_options, opts.certstat, 0, 0, NULL,
                            certstat_payload );

/**
 * The "certstat" command
 *
 * @v argc              Argument count
 * @v argv              Argument list
 * @ret rc              Return status code
 */
static int certstat_exec ( int argc, char **argv ) {

        return cert_exec ( argc, argv, &certstat_cmd );
}

/**
 * "certstore" payload
 *
 * @v cert              X.509 certificate
 * @ret rc              Return status code
 */
static int certstore_payload ( struct x509_certificate *cert ) {

        /* Mark certificate as having been added explicitly */
        cert->flags |= X509_FL_EXPLICIT;

        return 0;
}

/** "certstore" command descriptor */
static struct cert_command_descriptor certstore_cmd =
        CERT_COMMAND_DESC ( struct cert_options, opts.certstore, 0, 1,
                            "[<uri|image>]", certstore_payload );

/**
 * The "certstore" command
 *
 * @v argc              Argument count
 * @v argv              Argument list
 * @ret rc              Return status code
 */
static int certstore_exec ( int argc, char **argv ) {

        return cert_exec ( argc, argv, &certstore_cmd );
}

/**
 * "certfree" payload
 *
 * @v cert              X.509 certificate
 * @ret rc              Return status code
 */
static int certfree_payload ( struct x509_certificate *cert ) {

        /* Remove from certificate store */
        certstore_del ( cert );

        return 0;
}

/** "certfree" command descriptor */
static struct cert_command_descriptor certfree_cmd =
        CERT_COMMAND_DESC ( struct cert_options, opts.certfree, 0, 0, NULL,
                            certfree_payload );

/**
 * The "certfree" command
 *
 * @v argc              Argument count
 * @v argv              Argument list
 * @ret rc              Return status code
 */
static int certfree_exec ( int argc, char **argv ) {

        return cert_exec ( argc, argv, &certfree_cmd );
}

/** Certificate management commands */
COMMAND ( certstat, certstat_exec );
COMMAND ( certstore, certstore_exec );
COMMAND ( certfree, certfree_exec );