--- /dev/null
+/*
+ * Copyright (C) 2016 Michael Brown <mbrown@fensystems.co.uk>.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ *
+ * You can also choose to distribute this program under the terms of
+ * the Unmodified Binary Distribution Licence (as given in the file
+ * COPYING.UBDL), provided that you have satisfied its requirements.
+ */
+
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+
+#include <stdio.h>
+#include <errno.h>
+#include <getopt.h>
+#include <ipxe/x509.h>
+#include <ipxe/certstore.h>
+#include <ipxe/image.h>
+#include <ipxe/command.h>
+#include <ipxe/parseopt.h>
+#include <usr/imgmgmt.h>
+#include <usr/certmgmt.h>
+
+/** @file
+ *
+ * Certificate management commands
+ *
+ */
+
+/** "cert<xxx>" options */
+struct cert_options {
+ /** Certificate subject name */
+ char *name;
+ /** Keep certificate file after parsing */
+ int keep;
+};
+
+/** "cert<xxx>" option list */
+static union {
+ /* "certstore" takes both options */
+ struct option_descriptor certstore[2];
+ /* "certstat" takes only --subject */
+ struct option_descriptor certstat[1];
+ /* "certfree" takes only --subject */
+ struct option_descriptor certfree[1];
+} opts = {
+ .certstore = {
+ OPTION_DESC ( "subject", 's', required_argument,
+ struct cert_options, name, parse_string ),
+ OPTION_DESC ( "keep", 'k', no_argument,
+ struct cert_options, keep, parse_flag ),
+ },
+};
+
+/** A "cert<xxx>" command descriptor */
+struct cert_command_descriptor {
+ /** Command descriptor */
+ struct command_descriptor cmd;
+ /** Payload
+ *
+ * @v cert X.509 certificate
+ * @ret rc Return status code
+ */
+ int ( * payload ) ( struct x509_certificate *cert );
+};
+
+/**
+ * Construct "cert<xxx>" command descriptor
+ *
+ * @v _struct Options structure type
+ * @v _options Option descriptor array
+ * @v _min_args Minimum number of non-option arguments
+ * @v _max_args Maximum number of non-option arguments
+ * @v _usage Command usage
+ * @v _payload Payload method
+ * @ret _command Command descriptor
+ */
+#define CERT_COMMAND_DESC( _struct, _options, _min_args, _max_args, \
+ _usage, _payload ) \
+ { \
+ .cmd = COMMAND_DESC ( _struct, _options, _min_args, \
+ _max_args, _usage ), \
+ .payload = _payload, \
+ }
+
+/**
+ * Execute "cert<xxx>" command
+ *
+ * @v argc Argument count
+ * @v argv Argument list
+ * @v certcmd Command descriptor
+ * @ret rc Return status code
+ */
+static int cert_exec ( int argc, char **argv,
+ struct cert_command_descriptor *certcmd ) {
+ struct command_descriptor *cmd = &certcmd->cmd;
+ struct cert_options opts;
+ struct image *image = NULL;
+ struct x509_certificate *cert;
+ struct x509_certificate *tmp;
+ unsigned int count = 0;
+ size_t offset = 0;
+ int next;
+ int rc;
+
+ /* Parse options */
+ if ( ( rc = parse_options ( argc, argv, cmd, &opts ) ) != 0 )
+ goto err_parse;
+
+ /* Acquire image, if applicable */
+ if ( ( optind < argc ) &&
+ ( ( rc = imgacquire ( argv[optind], 0, &image ) ) != 0 ) )
+ goto err_acquire;
+
+ /* Get first entry in certificate store */
+ tmp = list_first_entry ( &certstore.links, struct x509_certificate,
+ store.list );
+
+ /* Iterate over certificates */
+ while ( 1 ) {
+
+ /* Get next certificate from image or store as applicable */
+ if ( image ) {
+
+ /* Get next certificate from image */
+ if ( offset >= image->len )
+ break;
+ next = image_x509 ( image, offset, &cert );
+ if ( next < 0 ) {
+ rc = next;
+ printf ( "Could not parse certificate: %s\n",
+ strerror ( rc ) );
+ goto err_x509;
+ }
+ offset = next;
+
+ } else {
+
+ /* Get next certificate from store */
+ cert = tmp;
+ if ( ! cert )
+ break;
+ tmp = list_next_entry ( tmp, &certstore.links,
+ store.list );
+ x509_get ( cert );
+ }
+
+ /* Skip non-matching names, if a name was specified */
+ if ( opts.name && ( x509_check_name ( cert, opts.name ) != 0 )){
+ x509_put ( cert );
+ continue;
+ }
+
+ /* Execute payload */
+ if ( ( rc = certcmd->payload ( cert ) ) != 0 ) {
+ x509_put ( cert );
+ goto err_payload;
+ }
+
+ /* Count number of certificates processed */
+ count++;
+
+ /* Drop reference to certificate */
+ x509_put ( cert );
+ }
+
+ /* Fail if a name was specified and no matching certificates
+ * were found.
+ */
+ if ( opts.name && ( count == 0 ) ) {
+ printf ( "\"%s\" : no such certificate\n", opts.name );
+ rc = -ENOENT;
+ goto err_none;
+ }
+
+ err_none:
+ err_payload:
+ err_x509:
+ if ( image && ( ! opts.keep ) )
+ unregister_image ( image );
+ err_acquire:
+ err_parse:
+ return rc;
+}
+
+/**
+ * "certstat" payload
+ *
+ * @v cert X.509 certificate
+ * @ret rc Return status code
+ */
+static int certstat_payload ( struct x509_certificate *cert ) {
+
+ certstat ( cert );
+ return 0;
+}
+
+/** "certstat" command descriptor */
+static struct cert_command_descriptor certstat_cmd =
+ CERT_COMMAND_DESC ( struct cert_options, opts.certstat, 0, 0, NULL,
+ certstat_payload );
+
+/**
+ * The "certstat" command
+ *
+ * @v argc Argument count
+ * @v argv Argument list
+ * @ret rc Return status code
+ */
+static int certstat_exec ( int argc, char **argv ) {
+
+ return cert_exec ( argc, argv, &certstat_cmd );
+}
+
+/**
+ * "certstore" payload
+ *
+ * @v cert X.509 certificate
+ * @ret rc Return status code
+ */
+static int certstore_payload ( struct x509_certificate *cert ) {
+
+ /* Mark certificate as having been added explicitly */
+ cert->flags |= X509_FL_EXPLICIT;
+
+ return 0;
+}
+
+/** "certstore" command descriptor */
+static struct cert_command_descriptor certstore_cmd =
+ CERT_COMMAND_DESC ( struct cert_options, opts.certstore, 0, 1,
+ "[<uri|image>]", certstore_payload );
+
+/**
+ * The "certstore" command
+ *
+ * @v argc Argument count
+ * @v argv Argument list
+ * @ret rc Return status code
+ */
+static int certstore_exec ( int argc, char **argv ) {
+
+ return cert_exec ( argc, argv, &certstore_cmd );
+}
+
+/**
+ * "certfree" payload
+ *
+ * @v cert X.509 certificate
+ * @ret rc Return status code
+ */
+static int certfree_payload ( struct x509_certificate *cert ) {
+
+ /* Remove from certificate store */
+ certstore_del ( cert );
+
+ return 0;
+}
+
+/** "certfree" command descriptor */
+static struct cert_command_descriptor certfree_cmd =
+ CERT_COMMAND_DESC ( struct cert_options, opts.certfree, 0, 0, NULL,
+ certfree_payload );
+
+/**
+ * The "certfree" command
+ *
+ * @v argc Argument count
+ * @v argv Argument list
+ * @ret rc Return status code
+ */
+static int certfree_exec ( int argc, char **argv ) {
+
+ return cert_exec ( argc, argv, &certfree_cmd );
+}
+
+/** Certificate management commands */
+struct command certmgmt_commands[] __command = {
+ {
+ .name = "certstat",
+ .exec = certstat_exec,
+ },
+ {
+ .name = "certstore",
+ .exec = certstore_exec,
+ },
+ {
+ .name = "certfree",
+ .exec = certfree_exec,
+ },
+};
projects / thirdparty / ipxe.git / commitdiff
