source: creddy/attribute.c @ aa33ad9

#define GNU_SOURCE

#include <err.h>
#include <termios.h>

#include <credentials/keys/private_key.h>

#include "creddy.h"
#include "libcreddy.h"

void attribute_main(options_t *opts) {
    int i, ret, role_len = 1;

    if (
        opts->issuer == NULL ||
        opts->key == NULL ||
        opts->role == NULL ||
        opts->out == NULL
    )
        usage(opts);


    // issuer
    creddy_id_t *issuer = creddy_id_from_file(opts->issuer);
    if (issuer == NULL)
        errx(1, "Can't load cert from %s", opts->issuer);

    // private key
    ret = creddy_id_load_privkey(issuer, opts->key);
    if (!ret)
        errx(1, "Can't load private key from %s", opts->key);

    creddy_attribute_t *attr = NULL;
    ret = creddy_attribute_create(&attr, issuer, opts->role, opts->validity);
    if (ret == CREDDY_ATTRIBUTE_ISSUER_NOKEY)
        abort(); // should never happen
    if (ret == CREDDY_ATTRIBUTE_INVALID_ROLE)
        errx(1, "Invalid role name: %s", opts->role);
    if (ret == CREDDY_ATTRIBUTE_INVALID_VALIDITY)
        errx(1, "Invalid validity: must be >= 1 day");

    for (i = 0; i < opts->num_subjects; ++i) {
        subject_t *cur = &opts->subjects[i];

        // if we have a cert we need to get its ID
        if (cur->cert) {
            creddy_id_t *subject = creddy_id_from_file(cur->cert);
            if (subject == NULL)
                errx(1, "Can't load subject cert from %s", cur->cert);
            cur->id = xstrdup(creddy_id_keyid(subject));
            creddy_id_free(subject);
        }

        // just a principal, add it
        if (!cur->role) {
            ret = creddy_attribute_principal(attr, cur->id);
            if (!ret)
                errx(1, "Invalid principal: %s", cur->id);
        }

        // either role or linking role
        else {
            char *role = cur->role;
            char *start[3];
            int name_parts = 0, j;

            start[name_parts++] = role;

            // split the role string up into name parts (turn . into \0)
            for (j = 0; role[j] != '\0'; ++j)
                if (role[j] == '.') {
                    if (name_parts == 3) {
                        printf("bad subject role name (too many dots)\n");
                        usage(opts);
                    }
                    start[name_parts++] = &role[j+1];
                    role[j] = 0;
                }

            // role
            if (name_parts == 1) {
                ret = creddy_attribute_role(attr, cur->id, start[0]);
                if (!ret)
                    errx(1, "Invalid role: %s.%s", cur->id, start[0]);
            }

            // linking role
            else {
                ret = creddy_attribute_linking_role(attr, cur->id, start[0], start[1]);
                if (!ret)
                    errx(1, "Invalid linking role: %s.%s.%s", cur->id, start[0], start[1]);
            }
        }
    }

    ret = creddy_attribute_bake(attr);
    if (!ret)
        errx(1, "Couldn't bake attribute cert");

    FILE *out = fopen(opts->out, "w");
    if (out == NULL)
        err(1, "Couldn't open attr cert file %s for writing", opts->out);

    creddy_attribute_write(attr, out);

    fclose(out);

    creddy_attribute_free(attr);
}