extract-cert: Cope with multiple X.509 certificates in a single file

This is not required for the module signing key, although it doesn't do any harm — it just means that any additional certs in the PEM file are also trusted by the kernel. But it does allow us to use the extract-cert tool for processing the extra certs from CONFIG_SYSTEM_TRUSTED_KEYS, instead of that horrid awk|base64 hack. Also cope with being invoked with no input file, creating an empty output file as a result.

David Woodhouse committed 11 years ago

Commit 84706ca1 parent ed8c2071 file · +46 −12Browse files

Unified · Split

scripts/extract-cert.c+46−12

@@ -73,17 +73,34 @@ static void drain_openssl_errors(void) · 72 unmodified lines
73	73	} while(0)
74	74
75	75	static const char *key_pass;
	76	+static BIO *wb;
	77	+static char *cert_dst;
	78	+int kbuild_verbose;
	79	+
	80	+static void write_cert(X509 *x509)
	81	+{
	82	+ char buf[200];
	83	+
	84	+ if (!wb) {
	85	+ wb = BIO_new_file(cert_dst, "wb");
	86	+ ERR(!wb, "%s", cert_dst);
	87	+ }
	88	+ X509_NAME_oneline(X509_get_subject_name(x509), buf, sizeof(buf));
	89	+ ERR(!i2d_X509_bio(wb, x509), cert_dst);
	90	+ if (kbuild_verbose)
	91	+ fprintf(stderr, "Extracted cert: %s\n", buf);
	92	+}
76	93
77	94	int main(int argc, char **argv)
78	95	{
79		− char cert_src, cert_dst;
80		− X509 *x509;
81		− BIO *b;
	96	+ char *cert_src;
82	97
83	98	OpenSSL_add_all_algorithms();
84	99	ERR_load_crypto_strings();
85	100	ERR_clear_error();
86	101
	102	+ kbuild_verbose = atoi(getenv("KBUILD_VERBOSE")?:"0");
	103	+
87	104	key_pass = getenv("KBUILD_SIGN_PIN");
88	105
89	106	if (argc != 3)
@@ -92,7 +109,13 @@ int main(int argc, char **argv) · 2 unmodified lines
92	109	cert_src = argv[1];
93	110	cert_dst = argv[2];
94	111
95		− if (!strncmp(cert_src, "pkcs11:", 7)) {
	112	+ if (!cert_src[0]) {
	113	+ /* Invoked with no input; create empty file */
	114	+ FILE *f = fopen(cert_dst, "wb");
	115	+ ERR(!f, "%s", cert_dst);
	116	+ fclose(f);
	117	+ exit(0);
	118	+ } else if (!strncmp(cert_src, "pkcs11:", 7)) {
96	119	ENGINE *e;
97	120	struct {
98	121	const char *cert_id;
@@ -114,19 +137,30 @@ int main(int argc, char **argv) · 15 unmodified lines
114	137	ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
115	138	ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
116	139	ERR(!parms.cert, "Get X.509 from PKCS#11");
117		− x509 = parms.cert;
	140	+ write_cert(parms.cert);
118	141	} else {
	142	+ BIO *b;
	143	+ X509 *x509;
	144	+
119	145	b = BIO_new_file(cert_src, "rb");
120	146	ERR(!b, "%s", cert_src);
121		− x509 = PEM_read_bio_X509(b, NULL, NULL, NULL);
122		− ERR(!x509, "%s", cert_src);
123		− BIO_free(b);
	147	+
	148	+ while (1) {
	149	+ x509 = PEM_read_bio_X509(b, NULL, NULL, NULL);
	150	+ if (wb && !x509) {
	151	+ unsigned long err = ERR_peek_last_error();
	152	+ if (ERR_GET_LIB(err) == ERR_LIB_PEM &&
	153	+ ERR_GET_REASON(err) == PEM_R_NO_START_LINE) {
	154	+ ERR_clear_error();
	155	+ break;
	156	+ }
	157	+ }
	158	+ ERR(!x509, "%s", cert_src);
	159	+ write_cert(x509);
	160	+ }
124	161	}
125	162
126		− b = BIO_new_file(cert_dst, "wb");
127		− ERR(!b, "%s", cert_dst);
128		− ERR(!i2d_X509_bio(b, x509), cert_dst);
129		− BIO_free(b);
	163	+ BIO_free(wb);
130	164
131	165	return 0;
132	166	}