From 4e62d2564af970db24e6679e9cb750b227ad4c1b Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Fri, 3 Jun 2016 10:22:23 +1000 Subject: [PATCH] Add 'issuer' request option for specifying issuer FreeIPA is implementing a 'lightweight CAs' feature where a single Dogtag instance can host multiple CAs. Add the '--issuer' / '-X' getcert-request option for specifying a particular CA, and the 'CERTMONGER_CA_ISSUER' environment variable for passing the value to submit helpers. Also update the 'ipa-submit' helper to set the 'ca' argument if the environment variable is set. --- src/cadata.c | 1 + src/getcert-rekey.1.in | 3 +++ src/getcert-request.1.in | 3 +++ src/getcert-resubmit.1.in | 3 +++ src/getcert-start-tracking.1.in | 3 +++ src/getcert.c | 44 ++++++++++++++++++++++++++++++++++++----- src/ipa.c | 27 ++++++++++++++++++------- src/store-files.c | 9 +++++++++ src/store-int.h | 1 + src/submit-e.c | 1 + src/submit-e.h | 1 + src/tdbus.h | 1 + src/tdbush.c | 25 ++++++++++++++++++++++- tests/028-dbus/expected.out | 1 + 14 files changed, 110 insertions(+), 13 deletions(-) diff --git a/src/cadata.c b/src/cadata.c index 947b2e68d3e74abf688aebd48344bfbf964e5656..7861fe73104143d6a9135fcb50b3ead583b03bf7 100644 --- a/src/cadata.c +++ b/src/cadata.c @@ -50,6 +50,7 @@ const char *attribute_map[] = { CM_SUBMIT_REQ_EMAIL_ENV, CM_DBUS_PROP_TEMPLATE_EMAIL, CM_SUBMIT_REQ_IP_ADDRESS_ENV, CM_DBUS_PROP_TEMPLATE_IP_ADDRESS, CM_SUBMIT_PROFILE_ENV, CM_DBUS_PROP_TEMPLATE_PROFILE, + CM_SUBMIT_ISSUER_ENV, CM_DBUS_PROP_TEMPLATE_ISSUER, NULL, }; diff --git a/src/getcert-rekey.1.in b/src/getcert-rekey.1.in index 9fbf7f09a0966430f452e3ac5b179998b3669760..ba11bf7de7266e957e509b95c26f56707a1854eb 100644 --- a/src/getcert-rekey.1.in +++ b/src/getcert-rekey.1.in @@ -61,6 +61,9 @@ the CA should correspond to one listed by \fIgetcert list-cas\fR. Request a certificate using the named profile, template, or certtype, from the specified CA. .TP +\fB\-X\fR NAME +Request a certificate using the named issuer from the specified CA. +.TP \fB\-I\fR NAME Assign the specified nickname to this task, replacing the previous nickname. diff --git a/src/getcert-request.1.in b/src/getcert-request.1.in index 1d9fc782bc0325032dfcb16b0248602b59a9fb9b..ed9dd6a7afb2af159de7f4e930c686ba13a05b27 100644 --- a/src/getcert-request.1.in +++ b/src/getcert-request.1.in @@ -87,6 +87,9 @@ the CA should correspond to one listed by \fIgetcert list-cas\fR. \fB\-T\fR NAME Request a certificate using the named profile, template, or certtype, from the specified CA. +.TP +\fB\-X\fR NAME +Request a certificate using the named issuer from the specified CA. .SH SIGNING REQUEST OPTIONS diff --git a/src/getcert-resubmit.1.in b/src/getcert-resubmit.1.in index 3da89ba0b7a5fb36c013772df30cf22b4e979be4..ec92b6e1edbf14cb62a9a07d2ea0c4737f6b3eac 100644 --- a/src/getcert-resubmit.1.in +++ b/src/getcert-resubmit.1.in @@ -48,6 +48,9 @@ the CA should correspond to one listed by \fIgetcert list-cas\fR. Request a certificate using the named profile, template, or certtype, from the specified CA. .TP +\fB\-X\fR NAME +Request a certificate using the named issuer from the specified CA. +.TP \fB\-I\fR NAME Assign the specified nickname to this task, replacing the previous nickname. diff --git a/src/getcert-start-tracking.1.in b/src/getcert-start-tracking.1.in index ff06404ae1db1e6aae94ada03120fd412e2f286b..75d3a4d159d1cb60d727b3736528eedc3ebde1ad 100644 --- a/src/getcert-start-tracking.1.in +++ b/src/getcert-start-tracking.1.in @@ -85,6 +85,9 @@ useful in combination with \fB\-r\fR. \fB\-T\fR NAME Request a certificate using the named profile, template, or certtype, from the specified CA. +.TP +\fB\-X\fR NAME +Request a certificate using the named issuer from the specified CA. .SH SIGNING REQUEST OPTIONS If and when \fIcertmonger\fR attempts to obtain a new certificate to replace diff --git a/src/getcert.c b/src/getcert.c index 4e0a5abe7eb5d53c25da855d2b2227511877124d..d2c0b19d87ae74b83f32784b4f523edef89fdb56 100644 --- a/src/getcert.c +++ b/src/getcert.c @@ -747,7 +747,7 @@ request(const char *argv0, int argc, const char **argv) char *pin = NULL, *pinfile = NULL, *cpass = NULL, *cpassfile = NULL; int keysize = 0, auto_renew = 1, verbose = 0, ku = 0, kubit, c, i, j; char *ca = DEFAULT_CA, *subject = NULL, **eku = NULL, *oid, *id = NULL; - char *profile = NULL, kustring[16]; + char *profile = NULL, *issuer = NULL, kustring[16]; char **principal = NULL, **dns = NULL, **email = NULL, **ipaddr = NULL; char *key_owner = NULL, *key_perms = NULL; char *cert_owner = NULL, *cert_perms = NULL; @@ -789,6 +789,7 @@ request(const char *argv0, int argc, const char **argv) {"ca", 'c', POPT_ARG_STRING, &ca, 0, _("use the specified CA configuration rather than the default"), HELP_TYPE_NAME}, #endif {"profile", 'T', POPT_ARG_STRING, NULL, 'T', _("ask the CA to process the request using the named profile or template"), HELP_TYPE_NAME}, + {"issuer", 'X', POPT_ARG_STRING, NULL, 'X', _("ask the CA to process the request using the named issuer"), HELP_TYPE_NAME}, {"subject-name", 'N', POPT_ARG_STRING, NULL, 'N', _("set requested subject name (default: CN=)"), HELP_TYPE_SUBJECT}, {"key-usage", 'u', POPT_ARG_STRING, NULL, 'u', _("set requested key usage value"), HELP_TYPE_KU}, {"extended-key-usage", 'U', POPT_ARG_STRING, NULL, 'U', _("set requested extended key usage OID"), HELP_TYPE_EKU}, @@ -918,6 +919,9 @@ request(const char *argv0, int argc, const char **argv) case 'T': profile = talloc_strdup(globals.tctx, poptarg); break; + case 'X': + issuer = talloc_strdup(globals.tctx, poptarg); + break; case 'N': subject = talloc_strdup(globals.tctx, poptarg); break; @@ -1360,6 +1364,13 @@ request(const char *argv0, int argc, const char **argv) params[i] = ¶m[i]; i++; } + if (issuer != NULL) { + param[i].key = CM_DBUS_PROP_TEMPLATE_ISSUER; + param[i].value_type = cm_tdbusm_dict_s; + param[i].value.s = issuer; + params[i] = ¶m[i]; + i++; + } if (precommand != NULL) { param[i].key = CM_DBUS_PROP_CERT_PRESAVE_COMMAND; param[i].value_type = cm_tdbusm_dict_s; @@ -1551,7 +1562,7 @@ add_basic_request(enum cm_tdbus_type bus, char *id, char *key_perms, char *cert_perms, char *pin, char *pinfile, char *cpass, char *cpassfile, - char *ca, char *profile, + char *ca, char *profile, char *issuer, char *precommand, char *postcommand, char **anchor_dbs, char **anchor_files, int is_ca, int path_length, @@ -1726,6 +1737,13 @@ add_basic_request(enum cm_tdbus_type bus, char *id, params[i] = ¶m[i]; i++; } + if (issuer != NULL) { + param[i].key = CM_DBUS_PROP_TEMPLATE_ISSUER; + param[i].value_type = cm_tdbusm_dict_s; + param[i].value.s = issuer; + params[i] = ¶m[i]; + i++; + } if (precommand != NULL) { param[i].key = CM_DBUS_PROP_CERT_PRESAVE_COMMAND; param[i].value_type = cm_tdbusm_dict_s; @@ -1808,7 +1826,7 @@ set_tracking(const char *argv0, const char *category, char **anchor_dbs = NULL, **anchor_files = NULL; char *id = NULL, *new_id = NULL, *new_request; char *keyfile = NULL, *certfile = NULL, *ca = DEFAULT_CA; - char *profile = NULL; + char *profile = NULL, *issuer = NULL; char *pin = NULL, *pinfile = NULL, *cpass = NULL, *cpassfile = NULL; char *key_owner = NULL, *key_perms = NULL; char *cert_owner = NULL, *cert_perms = NULL; @@ -1850,6 +1868,7 @@ set_tracking(const char *argv0, const char *category, {"ca", 'c', POPT_ARG_STRING, &ca, 0, _("use the specified CA configuration rather than the default"), HELP_TYPE_NAME}, #endif {"profile", 'T', POPT_ARG_STRING, NULL, 'T', _("ask the CA to process the request using the named profile or template"), HELP_TYPE_NAME}, + {"issuer", 'X', POPT_ARG_STRING, NULL, 'X', _("ask the CA to process the request using the named issuer"), HELP_TYPE_NAME}, {"key-usage", 'u', POPT_ARG_STRING, NULL, 'u', _("override requested key usage value"), HELP_TYPE_KU}, {"extended-key-usage", 'U', POPT_ARG_STRING, NULL, 'U', _("override requested extended key usage OID"), HELP_TYPE_EKU}, {"principal", 'K', POPT_ARG_STRING, NULL, 'K', _("override requested principal name"), HELP_TYPE_PRINCIPAL}, @@ -2388,7 +2407,7 @@ set_tracking(const char *argv0, const char *category, key_perms, cert_perms, pin, pinfile, cpass, cpassfile, - ca, profile, + ca, profile, issuer, precommand, postcommand, anchor_dbs, anchor_files, is_ca, path_length, @@ -2464,7 +2483,7 @@ rekey_or_resubmit(const char *argv0, const char *category, int argc, char *id = NULL, *new_id = NULL, *ca = NULL, *new_request, *nss_scheme; char *subject = NULL, **eku = NULL, *oid = NULL; char **principal = NULL, **dns = NULL, **email = NULL, **ipaddr = NULL; - char *profile = NULL, kustring[16]; + char *profile = NULL, *issuer = NULL, kustring[16]; char *key_owner = NULL, *key_perms = NULL; char *cert_owner = NULL, *cert_perms = NULL; char *keytype = NULL; @@ -2502,6 +2521,7 @@ rekey_or_resubmit(const char *argv0, const char *category, int argc, {"ca", 'c', POPT_ARG_STRING, &ca, 0, _("use the specified CA configuration rather than the current one"), HELP_TYPE_NAME}, #endif {"profile", 'T', POPT_ARG_STRING, NULL, 'T', _("ask the CA to process the request using the named profile or template"), HELP_TYPE_NAME}, + {"issuer", 'X', POPT_ARG_STRING, NULL, 'X', _("ask the CA to process the request using the named issuer"), HELP_TYPE_NAME}, {"subject-name", 'N', POPT_ARG_STRING, NULL, 'N', _("set requested subject name (default: CN=)"), HELP_TYPE_SUBJECT}, {"key-usage", 'u', POPT_ARG_STRING, NULL, 'u', _("set requested key usage value"), HELP_TYPE_KU}, {"extended-key-usage", 'U', POPT_ARG_STRING, NULL, 'U', _("set requested extended key usage OID"), HELP_TYPE_EKU}, @@ -2579,6 +2599,9 @@ rekey_or_resubmit(const char *argv0, const char *category, int argc, case 'T': profile = talloc_strdup(globals.tctx, poptarg); break; + case 'X': + issuer = talloc_strdup(globals.tctx, poptarg); + break; case 'i': id = talloc_strdup(globals.tctx, poptarg); break; @@ -2951,6 +2974,13 @@ rekey_or_resubmit(const char *argv0, const char *category, int argc, params[i] = ¶m[i]; i++; } + if (issuer != NULL) { + param[i].key = CM_DBUS_PROP_TEMPLATE_ISSUER; + param[i].value_type = cm_tdbusm_dict_s; + param[i].value.s = issuer; + params[i] = ¶m[i]; + i++; + } if (precommand != NULL) { param[i].key = CM_DBUS_PROP_CERT_PRESAVE_COMMAND; param[i].value_type = cm_tdbusm_dict_s; @@ -4769,6 +4799,7 @@ help(const char *twopartcmd, const char *category) N_(" -c CA use the specified CA rather than the default\n"), #endif N_(" -T PROFILE ask the CA to process the request using the named profile or template\n"), + N_(" -X ISSUER ask the CA to process the request using the named issuer\n"), N_("* Parameters for the signing request:\n"), N_(" -N NAME set requested subject name (default: CN=)\n"), N_(" -U EXTUSAGE set requested extended key usage OID\n"), @@ -4817,6 +4848,7 @@ help(const char *twopartcmd, const char *category) N_(" -c CA use the specified CA rather than the default\n"), #endif N_(" -T PROFILE ask the CA to process the request using the named profile or template\n"), + N_(" -X ISSUER ask the CA to process the request using the named issuer\n"), N_("* Parameters for the signing request at renewal time:\n"), N_(" -U EXTUSAGE override requested extended key usage OID\n"), N_(" -u KEYUSAGE set requested key usage value\n"), @@ -4895,6 +4927,7 @@ help(const char *twopartcmd, const char *category) N_(" -c CA use the specified CA rather than the current one\n"), #endif N_(" -T PROFILE ask the CA to process the request using the named profile or template\n"), + N_(" -X ISSUER ask the CA to process the request using the named issuer\n"), N_("* Bus options:\n"), N_(" -S connect to the certmonger service on the system bus\n"), N_(" -s connect to the certmonger service on the session bus\n"), @@ -4942,6 +4975,7 @@ help(const char *twopartcmd, const char *category) N_(" -c CA use the specified CA rather than the current one\n"), #endif N_(" -T PROFILE ask the CA to process the request using the named profile or template\n"), + N_(" -X ISSUER ask the CA to process the request using the named issuer\n"), N_(" -G TYPE type of new key to be generated\n"), N_(" -g SIZE size of new key to be generated\n"), N_("* Bus options:\n"), diff --git a/src/ipa.c b/src/ipa.c index 5236abb40246c270d1b14c5cfbc467dbd6e8f7a4..cb69e27b63530fd7cfe31fe20b760f701bcbd175 100644 --- a/src/ipa.c +++ b/src/ipa.c @@ -332,7 +332,8 @@ cm_locate_xmlrpc_service(const char *server, /* Make an XML-RPC request to the "cert_request" method. */ static int submit_or_poll_uri(const char *uri, const char *cainfo, const char *capath, - const char *csr, const char *reqprinc, const char *profile) + const char *csr, const char *reqprinc, + const char *profile, const char *issuer) { struct cm_submit_x_context *ctx; const char *args[2]; @@ -366,6 +367,10 @@ submit: if (profile != NULL) { cm_submit_x_add_named_arg_s(ctx, "profile_id", profile); } + /* Add the requested CA named argument. */ + if (issuer != NULL) { + cm_submit_x_add_named_arg_s(ctx, "ca", issuer); + } /* Tell the server to add entries for a principal if one * doesn't exist yet. */ cm_submit_x_add_named_arg_b(ctx, "add", 1); @@ -440,12 +445,14 @@ static int submit_or_poll(const char *uri, const char *cainfo, const char *capath, const char *server, int ldap_uri_cmd, const char *ldap_uri, const char *host, const char *domain, char *basedn, - const char *csr, const char *reqprinc, const char *profile) + const char *csr, const char *reqprinc, + const char *profile, const char *issuer) { int i, u; char **uris; - i = submit_or_poll_uri(uri, cainfo, capath, csr, reqprinc, profile); + i = submit_or_poll_uri( + uri, cainfo, capath, csr, reqprinc, profile, issuer); if ((i == CM_SUBMIT_STATUS_UNREACHABLE) || (i == CM_SUBMIT_STATUS_UNCONFIGURED)) { u = cm_locate_xmlrpc_service(server, ldap_uri_cmd, ldap_uri, @@ -455,8 +462,9 @@ submit_or_poll(const char *uri, const char *cainfo, const char *capath, if (strcmp(uris[u], uri) == 0) { continue; } - i = submit_or_poll_uri(uris[u], cainfo, capath, - csr, reqprinc, profile); + i = submit_or_poll_uri( + uris[u], cainfo, capath, csr, reqprinc, + profile, issuer); if ((i != CM_SUBMIT_STATUS_UNREACHABLE) && (i != CM_SUBMIT_STATUS_UNCONFIGURED)) { talloc_free(uris); @@ -556,7 +564,7 @@ main(int argc, const char **argv) const char *xmlrpc_uri = NULL, *ldap_uri = NULL, *server = NULL, *csrfile; int xmlrpc_uri_cmd = 0, ldap_uri_cmd = 0, verbose = 0; const char *mode = CM_OP_SUBMIT; - char ldn[LINE_MAX], *basedn = NULL, *profile = NULL; + char ldn[LINE_MAX], *basedn = NULL, *profile = NULL, *issuer = NULL; krb5_error_code kret; poptContext pctx; struct poptOption popts[] = { @@ -571,6 +579,7 @@ main(int argc, const char **argv) {"use-ccache-creds", 'K', POPT_ARG_NONE, NULL, 'K', "use default ccache instead of creating a new one using keytab", NULL}, {"principal-of-request", 'P', POPT_ARG_STRING, &reqprinc, 0, "principal name in signing request", "PRINCIPAL"}, {"profile", 'T', POPT_ARG_STRING, &profile, 0, "request enrollment using the specified profile", "NAME"}, + {"issuer", 'X', POPT_ARG_STRING, &issuer, 0, "request enrollment using the specified CA", "NAME"}, {"basedn", 'b', POPT_ARG_STRING, &basedn, 0, "IPA domain LDAP base DN", "DN"}, {"verbose", 'v', POPT_ARG_NONE, NULL, 'v', NULL, NULL}, POPT_AUTOHELP @@ -729,6 +738,10 @@ main(int argc, const char **argv) (getenv(CM_SUBMIT_PROFILE_ENV) != NULL)) { profile = strdup(getenv(CM_SUBMIT_PROFILE_ENV)); } + if ((issuer == NULL) && + (getenv(CM_SUBMIT_ISSUER_ENV) != NULL)) { + issuer = strdup(getenv(CM_SUBMIT_ISSUER_ENV)); + } if ((server != NULL) && !xmlrpc_uri_cmd) { snprintf(uri, sizeof(uri), "https://%s/ipa/xml", server); @@ -835,7 +848,7 @@ main(int argc, const char **argv) return submit_or_poll(uri, cainfo, capath, server, ldap_uri_cmd, ldap_uri, host, domain, basedn, - csr, reqprinc, profile); + csr, reqprinc, profile, issuer); } else if (strcasecmp(mode, CM_OP_FETCH_ROOTS) == 0) { return fetch_roots(server, ldap_uri_cmd, ldap_uri, host, diff --git a/src/store-files.c b/src/store-files.c index c966b5db4257575751608de3bc314ca2cb18d091..08ee0c641cebdf204072ab6c71dbee32a3c64783 100644 --- a/src/store-files.c +++ b/src/store-files.c @@ -144,6 +144,7 @@ enum cm_store_file_field { cm_store_entry_field_template_ocsp_location, cm_store_entry_field_template_ns_comment, cm_store_entry_field_template_profile, + cm_store_entry_field_template_issuer, cm_store_entry_field_template_no_ocsp_check, cm_store_entry_field_template_ns_certtype, @@ -318,6 +319,7 @@ static struct cm_store_file_field_list { {cm_store_entry_field_template_ns_comment, "template_ns_comment"}, {cm_store_entry_field_template_profile, "template_profile"}, /* right */ {cm_store_entry_field_template_profile, "ca_profile"}, /* wrong */ + {cm_store_entry_field_template_issuer, "template_issuer"}, {cm_store_entry_field_template_no_ocsp_check, "template_no_ocsp_check"}, {cm_store_entry_field_template_ns_certtype, "template_ns_certtype"}, @@ -1206,6 +1208,9 @@ cm_store_entry_read(void *parent, const char *filename, FILE *fp) case cm_store_entry_field_template_profile: ret->cm_template_profile = free_if_empty(p); break; + case cm_store_entry_field_template_issuer: + ret->cm_template_issuer = free_if_empty(p); + break; case cm_store_entry_field_template_no_ocsp_check: ret->cm_template_no_ocsp_check = atoi(p) != 0; talloc_free(p); @@ -1449,6 +1454,7 @@ cm_store_ca_read(void *parent, const char *filename, FILE *fp) case cm_store_entry_field_template_ocsp_location: case cm_store_entry_field_template_ns_comment: case cm_store_entry_field_template_profile: + case cm_store_entry_field_template_issuer: case cm_store_entry_field_template_no_ocsp_check: case cm_store_entry_field_template_ns_certtype: case cm_store_entry_field_challenge_password: @@ -2055,6 +2061,8 @@ cm_store_entry_write(FILE *fp, struct cm_store_entry *entry) entry->cm_template_ns_comment); cm_store_file_write_str(fp, cm_store_entry_field_template_profile, entry->cm_template_profile); + cm_store_file_write_str(fp, cm_store_entry_field_template_issuer, + entry->cm_template_issuer); cm_store_file_write_int(fp, cm_store_entry_field_template_no_ocsp_check, entry->cm_template_no_ocsp_check ? 1 : 0); cm_store_file_write_str(fp, cm_store_entry_field_template_ns_certtype, @@ -2822,6 +2830,7 @@ cm_store_entry_dup(void *parent, struct cm_store_entry *entry) ret->cm_template_ocsp_location = cm_store_maybe_strdupv(ret, entry->cm_template_ocsp_location); ret->cm_template_ns_comment = cm_store_maybe_strdup(ret, entry->cm_template_ns_comment); ret->cm_template_profile = cm_store_maybe_strdup(ret, entry->cm_template_profile); + ret->cm_template_issuer = cm_store_maybe_strdup(ret, entry->cm_template_issuer); ret->cm_template_no_ocsp_check = entry->cm_template_no_ocsp_check; ret->cm_template_ns_certtype = cm_store_maybe_strdup(ret, entry->cm_template_ns_certtype); diff --git a/src/store-int.h b/src/store-int.h index d7d3fc86306b103b0a90faef7396697743b9c8da..2d3a35387516c48ab81a6422e42d57d5741593f6 100644 --- a/src/store-int.h +++ b/src/store-int.h @@ -142,6 +142,7 @@ struct cm_store_entry { char **cm_template_ocsp_location; char *cm_template_ns_comment; char *cm_template_profile; + char *cm_template_issuer; char *cm_template_ns_certtype; unsigned int cm_template_no_ocsp_check: 1; /* A challenge password, which may be included (in cleartext form!) in diff --git a/src/submit-e.c b/src/submit-e.c index 5b2f9f89c43f73e64211869b685947a1dc58f948..f398ea5712a693593352ca8a4f5656def51ea133 100644 --- a/src/submit-e.c +++ b/src/submit-e.c @@ -886,6 +886,7 @@ cm_submit_e_helper_main(int fd, struct cm_store_ca *ca, maybe_setenv(CM_SUBMIT_COOKIE_ENV, entry->cm_ca_cookie); maybe_setenv(CM_SUBMIT_CA_NICKNAME_ENV, entry->cm_ca_nickname); maybe_setenv(CM_SUBMIT_PROFILE_ENV, entry->cm_template_profile); + maybe_setenv(CM_SUBMIT_ISSUER_ENV, entry->cm_template_issuer); maybe_setenv(CM_SUBMIT_CERTIFICATE_ENV, entry->cm_cert); /* Only pass SCEP data to the helper if we haven't used this set of * nonced data before. It'll ask for fresh data if it needs it. */ diff --git a/src/submit-e.h b/src/submit-e.h index 2e325cf7d36436b89287e9933db83a6d853abfd1..0148d4da07507a000d8e6e8aca98f2ed84669eca 100644 --- a/src/submit-e.h +++ b/src/submit-e.h @@ -48,6 +48,7 @@ const char *cm_submit_e_status_text(enum cm_external_status status); #define CM_SUBMIT_COOKIE_ENV "CERTMONGER_CA_COOKIE" #define CM_SUBMIT_CA_NICKNAME_ENV "CERTMONGER_CA_NICKNAME" #define CM_SUBMIT_PROFILE_ENV "CERTMONGER_CA_PROFILE" +#define CM_SUBMIT_ISSUER_ENV "CERTMONGER_CA_ISSUER" #define CM_SUBMIT_CERTIFICATE_ENV "CERTMONGER_CERTIFICATE" #define CM_SUBMIT_SCEP_CA_IDENTIFIER_ENV "CERTMONGER_SCEP_CA_IDENTIFIER" #define CM_SUBMIT_SCEP_RA_CERTIFICATE_ENV "CERTMONGER_SCEP_RA_CERTIFICATE" diff --git a/src/tdbus.h b/src/tdbus.h index c9b3afeb59548c2dc1260cfd7c76b39327a42f89..496f2dd289a0bd9b4d66451ea5eb0acf83d0cf5f 100644 --- a/src/tdbus.h +++ b/src/tdbus.h @@ -108,6 +108,7 @@ #define CM_DBUS_PROP_TEMPLATE_FRESHEST_CRL "template-freshest-crl" #define CM_DBUS_PROP_TEMPLATE_NS_COMMENT "template-ns-comment" #define CM_DBUS_PROP_TEMPLATE_PROFILE "template-profile" +#define CM_DBUS_PROP_TEMPLATE_ISSUER "template-issuer" #define CM_DBUS_PROP_TEMPLATE_NS_CERTTYPE "template-ns-certtype" #define CM_DBUS_SIGNAL_REQUEST_CERT_SAVED "SavedCertificate" #define CM_DBUS_PROP_CA_PRESAVE_COMMAND "ca-presave-command" diff --git a/src/tdbush.c b/src/tdbush.c index 074e7e825f7b74a7d50ffd30171c096267837c63..30857b20cc36fb2cc8175ac05e87eef51fb6be94 100644 --- a/src/tdbush.c +++ b/src/tdbush.c @@ -1562,6 +1562,13 @@ base_add_request(DBusConnection *conn, DBusMessage *msg, param->value.s); } param = cm_tdbusm_find_dict_entry(d, + CM_DBUS_PROP_TEMPLATE_ISSUER, + cm_tdbusm_dict_s); + if (param != NULL) { + new_entry->cm_template_issuer = maybe_strdup(new_entry, + param->value.s); + } + param = cm_tdbusm_find_dict_entry(d, CM_DBUS_PROP_TEMPLATE_CHALLENGE_PASSWORD, cm_tdbusm_dict_s); if ((param != NULL) && @@ -3344,6 +3351,14 @@ request_modify(DBusConnection *conn, DBusMessage *msg, } } else if ((param->value_type == cm_tdbusm_dict_s) && + (strcasecmp(param->key, CM_DBUS_PROP_TEMPLATE_ISSUER) == 0)) { + talloc_free(entry->cm_template_issuer); + entry->cm_template_issuer = maybe_strdup(entry, param->value.s); + if (n_propname + 2 < sizeof(propname) / sizeof(propname[0])) { + propname[n_propname++] = CM_DBUS_PROP_TEMPLATE_ISSUER; + } + } else + if ((param->value_type == cm_tdbusm_dict_s) && (strcasecmp(param->key, CM_DBUS_PROP_TEMPLATE_CHALLENGE_PASSWORD) == 0)) { talloc_free(entry->cm_template_challenge_password); entry->cm_template_challenge_password = maybe_strdup(entry, @@ -6750,6 +6765,14 @@ cm_tdbush_iface_request(void) NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL), make_interface_item(cm_tdbush_interface_property, + make_property(CM_DBUS_PROP_TEMPLATE_ISSUER, + cm_tdbush_property_string, + cm_tdbush_property_readwrite, + cm_tdbush_property_char_p, + offsetof(struct cm_store_entry, cm_template_issuer), + NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, + NULL), + make_interface_item(cm_tdbush_interface_property, make_property(CM_DBUS_PROP_TEMPLATE_NS_CERTTYPE, cm_tdbush_property_string, cm_tdbush_property_readwrite, @@ -7194,7 +7217,7 @@ cm_tdbush_iface_request(void) make_interface_item(cm_tdbush_interface_signal, make_signal(CM_DBUS_SIGNAL_REQUEST_CERT_SAVED, NULL), - NULL))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))); + NULL)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))); } return ret; } diff --git a/tests/028-dbus/expected.out b/tests/028-dbus/expected.out index ba55dd5ce97c74475dbebb761c41dd2e64e64365..b2660317b3102373f2a5a877a7224f727929412c 100644 --- a/tests/028-dbus/expected.out +++ b/tests/028-dbus/expected.out @@ -328,6 +328,7 @@ OK + -- 2.5.5