ipxe/src/hci/commands/cert_cmd.c

/*
 * Copyright (C) 2016 Michael Brown <mbrown@fensystems.co.uk>.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 *
 * You can also choose to distribute this program under the terms of
 * the Unmodified Binary Distribution Licence (as given in the file
 * COPYING.UBDL), provided that you have satisfied its requirements.
 */

FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );

#include <stdio.h>
#include <errno.h>
#include <getopt.h>
#include <ipxe/x509.h>
#include <ipxe/certstore.h>
#include <ipxe/image.h>
#include <ipxe/command.h>
#include <ipxe/parseopt.h>
#include <usr/imgmgmt.h>
#include <usr/certmgmt.h>

/** @file
 *
 * Certificate management commands
 *
 */

/** "cert<xxx>" options */
struct cert_options {
	/** Certificate subject name */
	char *name;
	/** Keep certificate file after parsing */
	int keep;
};

/** "cert<xxx>" option list */
static union {
	/* "certstore" takes both options */
	struct option_descriptor certstore[2];
	/* "certstat" takes only --subject */
	struct option_descriptor certstat[1];
	/* "certfree" takes only --subject */
	struct option_descriptor certfree[1];
} opts = {
	.certstore = {
		OPTION_DESC ( "subject", 's', required_argument,
			      struct cert_options, name, parse_string ),
		OPTION_DESC ( "keep", 'k', no_argument,
			      struct cert_options, keep, parse_flag ),
	},
};

/** A "cert<xxx>" command descriptor */
struct cert_command_descriptor {
	/** Command descriptor */
	struct command_descriptor cmd;
	/** Payload
	 *
	 * @v cert		X.509 certificate
	 * @ret rc		Return status code
	 */
	int ( * payload ) ( struct x509_certificate *cert );
};

/**
 * Construct "cert<xxx>" command descriptor
 *
 * @v _struct		Options structure type
 * @v _options		Option descriptor array
 * @v _min_args		Minimum number of non-option arguments
 * @v _max_args		Maximum number of non-option arguments
 * @v _usage		Command usage
 * @v _payload		Payload method
 * @ret _command	Command descriptor
 */
#define CERT_COMMAND_DESC( _struct, _options, _min_args, _max_args,	\
			   _usage, _payload )				\
	{								\
		.cmd = COMMAND_DESC ( _struct, _options, _min_args,	\
				      _max_args, _usage ),		\
		.payload = _payload,					\
	}

/**
 * Execute "cert<xxx>" command
 *
 * @v argc		Argument count
 * @v argv		Argument list
 * @v certcmd		Command descriptor
 * @ret rc		Return status code
 */
static int cert_exec ( int argc, char **argv,
		       struct cert_command_descriptor *certcmd ) {
	struct command_descriptor *cmd = &certcmd->cmd;
	struct cert_options opts;
	struct image *image = NULL;
	struct x509_certificate *cert;
	struct x509_certificate *tmp;
	unsigned int count = 0;
	size_t offset = 0;
	int next;
	int rc;

	/* Parse options */
	if ( ( rc = parse_options ( argc, argv, cmd, &opts ) ) != 0 )
		goto err_parse;

	/* Acquire image, if applicable */
	if ( ( optind < argc ) &&
	     ( ( rc = imgacquire ( argv[optind], 0, &image ) ) != 0 ) )
		goto err_acquire;

	/* Get first entry in certificate store */
	tmp = list_first_entry ( &certstore.links, struct x509_certificate,
				 store.list );

	/* Iterate over certificates */
	while ( 1 ) {

		/* Get next certificate from image or store as applicable */
		if ( image ) {

			/* Get next certificate from image */
			if ( offset >= image->len )
				break;
			next = image_x509 ( image, offset, &cert );
			if ( next < 0 ) {
				rc = next;
				printf ( "Could not parse certificate: %s\n",
					 strerror ( rc ) );
				goto err_x509;
			}
			offset = next;

		} else {

			/* Get next certificate from store */
			cert = tmp;
			if ( ! cert )
				break;
			tmp = list_next_entry ( tmp, &certstore.links,
						store.list );
			x509_get ( cert );
		}

		/* Skip non-matching names, if a name was specified */
		if ( opts.name && ( x509_check_name ( cert, opts.name ) != 0 )){
			x509_put ( cert );
			continue;
		}

		/* Execute payload */
		if ( ( rc = certcmd->payload ( cert ) ) != 0 ) {
			x509_put ( cert );
			goto err_payload;
		}

		/* Count number of certificates processed */
		count++;

		/* Drop reference to certificate */
		x509_put ( cert );
	}

	/* Fail if a name was specified and no matching certificates
	 * were found.
	 */
	if ( opts.name && ( count == 0 ) ) {
		printf ( "\"%s\" : no such certificate\n", opts.name );
		rc = -ENOENT;
		goto err_none;
	}

 err_none:
 err_payload:
 err_x509:
	if ( image && ( ! opts.keep ) )
		unregister_image ( image );
 err_acquire:
 err_parse:
	return rc;
}

/**
 * "certstat" payload
 *
 * @v cert		X.509 certificate
 * @ret rc		Return status code
 */
static int certstat_payload ( struct x509_certificate *cert ) {

	certstat ( cert );
	return 0;
}

/** "certstat" command descriptor */
static struct cert_command_descriptor certstat_cmd =
	CERT_COMMAND_DESC ( struct cert_options, opts.certstat, 0, 0, NULL,
			    certstat_payload );

/**
 * The "certstat" command
 *
 * @v argc		Argument count
 * @v argv		Argument list
 * @ret rc		Return status code
 */
static int certstat_exec ( int argc, char **argv ) {

	return cert_exec ( argc, argv, &certstat_cmd );
}

/**
 * "certstore" payload
 *
 * @v cert		X.509 certificate
 * @ret rc		Return status code
 */
static int certstore_payload ( struct x509_certificate *cert ) {

	/* Mark certificate as having been added explicitly */
	cert->flags |= X509_FL_EXPLICIT;

	return 0;
}

/** "certstore" command descriptor */
static struct cert_command_descriptor certstore_cmd =
	CERT_COMMAND_DESC ( struct cert_options, opts.certstore, 0, 1,
			    "[<uri|image>]", certstore_payload );

/**
 * The "certstore" command
 *
 * @v argc		Argument count
 * @v argv		Argument list
 * @ret rc		Return status code
 */
static int certstore_exec ( int argc, char **argv ) {

	return cert_exec ( argc, argv, &certstore_cmd );
}

/**
 * "certfree" payload
 *
 * @v cert		X.509 certificate
 * @ret rc		Return status code
 */
static int certfree_payload ( struct x509_certificate *cert ) {

	/* Remove from certificate store */
	certstore_del ( cert );

	return 0;
}

/** "certfree" command descriptor */
static struct cert_command_descriptor certfree_cmd =
	CERT_COMMAND_DESC ( struct cert_options, opts.certfree, 0, 0, NULL,
			    certfree_payload );

/**
 * The "certfree" command
 *
 * @v argc		Argument count
 * @v argv		Argument list
 * @ret rc		Return status code
 */
static int certfree_exec ( int argc, char **argv ) {

	return cert_exec ( argc, argv, &certfree_cmd );
}

/** Certificate management commands */
struct command certmgmt_commands[] __command = {
	{
		.name = "certstat",
		.exec = certstat_exec,
	},
	{
		.name = "certstore",
		.exec = certstore_exec,
	},
	{
		.name = "certfree",
		.exec = certfree_exec,
	},
};