redfish-core/lib/certificate_service.hpp

#pragma once

#include <app.hpp>
#include <boost/convert.hpp>
#include <boost/convert/strtol.hpp>
#include <registries/privilege_registry.hpp>

#include <variant>
namespace redfish
{
namespace certs
{
constexpr char const* httpsObjectPath =
    "/xyz/openbmc_project/certs/server/https";
constexpr char const* certInstallIntf = "xyz.openbmc_project.Certs.Install";
constexpr char const* certReplaceIntf = "xyz.openbmc_project.Certs.Replace";
constexpr char const* objDeleteIntf = "xyz.openbmc_project.Object.Delete";
constexpr char const* certPropIntf = "xyz.openbmc_project.Certs.Certificate";
constexpr char const* dbusPropIntf = "org.freedesktop.DBus.Properties";
constexpr char const* dbusObjManagerIntf = "org.freedesktop.DBus.ObjectManager";
constexpr char const* ldapObjectPath = "/xyz/openbmc_project/certs/client/ldap";
constexpr char const* httpsServiceName =
    "xyz.openbmc_project.Certs.Manager.Server.Https";
constexpr char const* ldapServiceName =
    "xyz.openbmc_project.Certs.Manager.Client.Ldap";
constexpr char const* authorityServiceName =
    "xyz.openbmc_project.Certs.Manager.Authority.Ldap";
constexpr char const* authorityObjectPath =
    "/xyz/openbmc_project/certs/authority/ldap";
} // namespace certs

/**
 * The Certificate schema defines a Certificate Service which represents the
 * actions available to manage certificates and links to where certificates
 * are installed.
 */

// TODO: Issue#61 No entries are available for Certificate
// service at https://www.dmtf.org/standards/redfish
// "redfish standard registries". Need to modify after DMTF
// publish Privilege details for certificate service

inline void requestRoutesCertificateService(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/CertificateService/")
        .privileges(redfish::privileges::getCertificateService)
        .methods(
            boost::beast::http::verb::
                get)([](const crow::Request& req,
                        const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
            asyncResp->res.jsonValue = {
                {"@odata.type",
                 "#CertificateService.v1_0_0.CertificateService"},
                {"@odata.id", "/redfish/v1/CertificateService"},
                {"Id", "CertificateService"},
                {"Name", "Certificate Service"},
                {"Description", "Actions available to manage certificates"}};
            // /redfish/v1/CertificateService/CertificateLocations is something
            // only ConfigureManager can access then only display when the user
            // has permissions ConfigureManager
            Privileges effectiveUserPrivileges =
                redfish::getUserPrivileges(req.userRole);
            if (isOperationAllowedWithPrivileges({{"ConfigureManager"}},
                                                 effectiveUserPrivileges))
            {
                asyncResp->res.jsonValue["CertificateLocations"] = {
                    {"@odata.id",
                     "/redfish/v1/CertificateService/CertificateLocations"}};
            }
            asyncResp->res.jsonValue["Actions"]
                                    ["#CertificateService.ReplaceCertificate"] =
                {{"target", "/redfish/v1/CertificateService/Actions/"
                            "CertificateService.ReplaceCertificate"},
                 {"CertificateType@Redfish.AllowableValues", {"PEM"}}};
            asyncResp->res
                .jsonValue["Actions"]["#CertificateService.GenerateCSR"] = {
                {"target", "/redfish/v1/CertificateService/Actions/"
                           "CertificateService.GenerateCSR"}};
        });
} // requestRoutesCertificateService

/**
 * @brief Find the ID specified in the URL
 * Finds the numbers specified after the last "/" in the URL and returns.
 * @param[in] path URL
 * @return -1 on failure and number on success
 */
inline long getIDFromURL(const std::string_view url)
{
    std::size_t found = url.rfind('/');
    if (found == std::string::npos)
    {
        return -1;
    }

    if ((found + 1) < url.length())
    {
        std::string_view str = url.substr(found + 1);

        return boost::convert<long>(str, boost::cnv::strtol()).value_or(-1);
    }

    return -1;
}

inline std::string getCertificateFromReqBody(
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const crow::Request& req)
{
    nlohmann::json reqJson = nlohmann::json::parse(req.body, nullptr, false);

    if (reqJson.is_discarded())
    {
        // We did not receive JSON request, proceed as it is RAW data
        return req.body;
    }

    std::string certificate;
    std::optional<std::string> certificateType = "PEM";

    if (!json_util::readJson(reqJson, asyncResp->res, "CertificateString",
                             certificate, "CertificateType", certificateType))
    {
        BMCWEB_LOG_ERROR << "Required parameters are missing";
        messages::internalError(asyncResp->res);
        return {};
    }

    if (*certificateType != "PEM")
    {
        messages::propertyValueNotInList(asyncResp->res, *certificateType,
                                         "CertificateType");
        return {};
    }

    return certificate;
}

/**
 * Class to create a temporary certificate file for uploading to system
 */
class CertificateFile
{
  public:
    CertificateFile() = delete;
    CertificateFile(const CertificateFile&) = delete;
    CertificateFile& operator=(const CertificateFile&) = delete;
    CertificateFile(CertificateFile&&) = delete;
    CertificateFile& operator=(CertificateFile&&) = delete;
    CertificateFile(const std::string& certString)
    {
        std::array<char, 18> dirTemplate = {'/', 't', 'm', 'p', '/', 'C',
                                            'e', 'r', 't', 's', '.', 'X',
                                            'X', 'X', 'X', 'X', 'X', '\0'};
        char* tempDirectory = mkdtemp(dirTemplate.data());
        if (tempDirectory)
        {
            certDirectory = tempDirectory;
            certificateFile = certDirectory / "cert.pem";
            std::ofstream out(certificateFile, std::ofstream::out |
                                                   std::ofstream::binary |
                                                   std::ofstream::trunc);
            out << certString;
            out.close();
            BMCWEB_LOG_DEBUG << "Creating certificate file" << certificateFile;
        }
    }
    ~CertificateFile()
    {
        if (std::filesystem::exists(certDirectory))
        {
            BMCWEB_LOG_DEBUG << "Removing certificate file" << certificateFile;
            std::error_code ec;
            std::filesystem::remove_all(certDirectory, ec);
            if (ec)
            {
                BMCWEB_LOG_ERROR << "Failed to remove temp directory"
                                 << certDirectory;
            }
        }
    }
    std::string getCertFilePath()
    {
        return certificateFile;
    }

  private:
    std::filesystem::path certificateFile;
    std::filesystem::path certDirectory;
};

static std::unique_ptr<sdbusplus::bus::match::match> csrMatcher;
/**
 * @brief Read data from CSR D-bus object and set to response
 *
 * @param[in] asyncResp Shared pointer to the response message
 * @param[in] certURI Link to certifiate collection URI
 * @param[in] service D-Bus service name
 * @param[in] certObjPath certificate D-Bus object path
 * @param[in] csrObjPath CSR D-Bus object path
 * @return None
 */
static void getCSR(const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
                   const std::string& certURI, const std::string& service,
                   const std::string& certObjPath,
                   const std::string& csrObjPath)
{
    BMCWEB_LOG_DEBUG << "getCSR CertObjectPath" << certObjPath
                     << " CSRObjectPath=" << csrObjPath
                     << " service=" << service;
    crow::connections::systemBus->async_method_call(
        [asyncResp, certURI](const boost::system::error_code ec,
                             const std::string& csr) {
            if (ec)
            {
                BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
                messages::internalError(asyncResp->res);
                return;
            }
            if (csr.empty())
            {
                BMCWEB_LOG_ERROR << "CSR read is empty";
                messages::internalError(asyncResp->res);
                return;
            }
            asyncResp->res.jsonValue["CSRString"] = csr;
            asyncResp->res.jsonValue["CertificateCollection"] = {
                {"@odata.id", certURI}};
        },
        service, csrObjPath, "xyz.openbmc_project.Certs.CSR", "CSR");
}

/**
 * Action to Generate CSR
 */
inline void requestRoutesCertificateActionGenerateCSR(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/CertificateService/Actions/"
                      "CertificateService.GenerateCSR/")
        // Incorrect Privilege;  Should be ConfigureManager
        //.privileges(redfish::privileges::postCertificateService)
        .privileges({{"ConfigureComponents"}})
        .methods(boost::beast::http::verb::post)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
                static const int rsaKeyBitLength = 2048;

                // Required parameters
                std::string city;
                std::string commonName;
                std::string country;
                std::string organization;
                std::string organizationalUnit;
                std::string state;
                nlohmann::json certificateCollection;

                // Optional parameters
                std::optional<std::vector<std::string>> optAlternativeNames =
                    std::vector<std::string>();
                std::optional<std::string> optContactPerson = "";
                std::optional<std::string> optChallengePassword = "";
                std::optional<std::string> optEmail = "";
                std::optional<std::string> optGivenName = "";
                std::optional<std::string> optInitials = "";
                std::optional<int64_t> optKeyBitLength = rsaKeyBitLength;
                std::optional<std::string> optKeyCurveId = "secp384r1";
                std::optional<std::string> optKeyPairAlgorithm = "EC";
                std::optional<std::vector<std::string>> optKeyUsage =
                    std::vector<std::string>();
                std::optional<std::string> optSurname = "";
                std::optional<std::string> optUnstructuredName = "";
                if (!json_util::readJson(
                        req, asyncResp->res, "City", city, "CommonName",
                        commonName, "ContactPerson", optContactPerson,
                        "Country", country, "Organization", organization,
                        "OrganizationalUnit", organizationalUnit, "State",
                        state, "CertificateCollection", certificateCollection,
                        "AlternativeNames", optAlternativeNames,
                        "ChallengePassword", optChallengePassword, "Email",
                        optEmail, "GivenName", optGivenName, "Initials",
                        optInitials, "KeyBitLength", optKeyBitLength,
                        "KeyCurveId", optKeyCurveId, "KeyPairAlgorithm",
                        optKeyPairAlgorithm, "KeyUsage", optKeyUsage, "Surname",
                        optSurname, "UnstructuredName", optUnstructuredName))
                {
                    return;
                }

                // bmcweb has no way to store or decode a private key challenge
                // password, which will likely cause bmcweb to crash on startup
                // if this is not set on a post so not allowing the user to set
                // value
                if (*optChallengePassword != "")
                {
                    messages::actionParameterNotSupported(
                        asyncResp->res, "GenerateCSR", "ChallengePassword");
                    return;
                }

                std::string certURI;
                if (!redfish::json_util::readJson(certificateCollection,
                                                  asyncResp->res, "@odata.id",
                                                  certURI))
                {
                    return;
                }

                std::string objectPath;
                std::string service;
                if (boost::starts_with(certURI,
                                       "/redfish/v1/Managers/bmc/"
                                       "NetworkProtocol/HTTPS/Certificates"))
                {
                    objectPath = certs::httpsObjectPath;
                    service = certs::httpsServiceName;
                }
                else if (boost::starts_with(
                             certURI,
                             "/redfish/v1/AccountService/LDAP/Certificates"))
                {
                    objectPath = certs::ldapObjectPath;
                    service = certs::ldapServiceName;
                }
                else
                {
                    messages::actionParameterNotSupported(
                        asyncResp->res, "CertificateCollection", "GenerateCSR");
                    return;
                }

                // supporting only EC and RSA algorithm
                if (*optKeyPairAlgorithm != "EC" &&
                    *optKeyPairAlgorithm != "RSA")
                {
                    messages::actionParameterNotSupported(
                        asyncResp->res, "KeyPairAlgorithm", "GenerateCSR");
                    return;
                }

                // supporting only 2048 key bit length for RSA algorithm due to
                // time consumed in generating private key
                if (*optKeyPairAlgorithm == "RSA" &&
                    *optKeyBitLength != rsaKeyBitLength)
                {
                    messages::propertyValueNotInList(
                        asyncResp->res, std::to_string(*optKeyBitLength),
                        "KeyBitLength");
                    return;
                }

                // validate KeyUsage supporting only 1 type based on URL
                if (boost::starts_with(certURI,
                                       "/redfish/v1/Managers/bmc/"
                                       "NetworkProtocol/HTTPS/Certificates"))
                {
                    if (optKeyUsage->size() == 0)
                    {
                        optKeyUsage->push_back("ServerAuthentication");
                    }
                    else if (optKeyUsage->size() == 1)
                    {
                        if ((*optKeyUsage)[0] != "ServerAuthentication")
                        {
                            messages::propertyValueNotInList(
                                asyncResp->res, (*optKeyUsage)[0], "KeyUsage");
                            return;
                        }
                    }
                    else
                    {
                        messages::actionParameterNotSupported(
                            asyncResp->res, "KeyUsage", "GenerateCSR");
                        return;
                    }
                }
                else if (boost::starts_with(
                             certURI,
                             "/redfish/v1/AccountService/LDAP/Certificates"))
                {
                    if (optKeyUsage->size() == 0)
                    {
                        optKeyUsage->push_back("ClientAuthentication");
                    }
                    else if (optKeyUsage->size() == 1)
                    {
                        if ((*optKeyUsage)[0] != "ClientAuthentication")
                        {
                            messages::propertyValueNotInList(
                                asyncResp->res, (*optKeyUsage)[0], "KeyUsage");
                            return;
                        }
                    }
                    else
                    {
                        messages::actionParameterNotSupported(
                            asyncResp->res, "KeyUsage", "GenerateCSR");
                        return;
                    }
                }

                // Only allow one CSR matcher at a time so setting retry
                // time-out and timer expiry to 10 seconds for now.
                static const int timeOut = 10;
                if (csrMatcher)
                {
                    messages::serviceTemporarilyUnavailable(
                        asyncResp->res, std::to_string(timeOut));
                    return;
                }

                // Make this static so it survives outside this method
                static boost::asio::steady_timer timeout(*req.ioService);
                timeout.expires_after(std::chrono::seconds(timeOut));
                timeout.async_wait([asyncResp](
                                       const boost::system::error_code& ec) {
                    csrMatcher = nullptr;
                    if (ec)
                    {
                        // operation_aborted is expected if timer is canceled
                        // before completion.
                        if (ec != boost::asio::error::operation_aborted)
                        {
                            BMCWEB_LOG_ERROR << "Async_wait failed " << ec;
                        }
                        return;
                    }
                    BMCWEB_LOG_ERROR << "Timed out waiting for Generating CSR";
                    messages::internalError(asyncResp->res);
                });

                // create a matcher to wait on CSR object
                BMCWEB_LOG_DEBUG << "create matcher with path " << objectPath;
                std::string match(
                    "type='signal',"
                    "interface='org.freedesktop.DBus.ObjectManager',"
                    "path='" +
                    objectPath +
                    "',"
                    "member='InterfacesAdded'");
                csrMatcher = std::make_unique<sdbusplus::bus::match::match>(
                    *crow::connections::systemBus, match,
                    [asyncResp, service, objectPath,
                     certURI](sdbusplus::message::message& m) {
                        timeout.cancel();
                        if (m.is_method_error())
                        {
                            BMCWEB_LOG_ERROR << "Dbus method error!!!";
                            messages::internalError(asyncResp->res);
                            return;
                        }
                        std::vector<std::pair<
                            std::string,
                            std::vector<std::pair<std::string,
                                                  std::variant<std::string>>>>>
                            interfacesProperties;
                        sdbusplus::message::object_path csrObjectPath;
                        m.read(csrObjectPath, interfacesProperties);
                        BMCWEB_LOG_DEBUG << "CSR object added"
                                         << csrObjectPath.str;
                        for (auto& interface : interfacesProperties)
                        {
                            if (interface.first ==
                                "xyz.openbmc_project.Certs.CSR")
                            {
                                getCSR(asyncResp, certURI, service, objectPath,
                                       csrObjectPath.str);
                                break;
                            }
                        }
                    });
                crow::connections::systemBus->async_method_call(
                    [asyncResp](const boost::system::error_code& ec,
                                const std::string&) {
                        if (ec)
                        {
                            BMCWEB_LOG_ERROR << "DBUS response error: "
                                             << ec.message();
                            messages::internalError(asyncResp->res);
                            return;
                        }
                    },
                    service, objectPath, "xyz.openbmc_project.Certs.CSR.Create",
                    "GenerateCSR", *optAlternativeNames, *optChallengePassword,
                    city, commonName, *optContactPerson, country, *optEmail,
                    *optGivenName, *optInitials, *optKeyBitLength,
                    *optKeyCurveId, *optKeyPairAlgorithm, *optKeyUsage,
                    organization, organizationalUnit, state, *optSurname,
                    *optUnstructuredName);
            });
} // requestRoutesCertificateActionGenerateCSR

/**
 * @brief Parse and update Certificate Issue/Subject property
 *
 * @param[in] asyncResp Shared pointer to the response message
 * @param[in] str  Issuer/Subject value in key=value pairs
 * @param[in] type Issuer/Subject
 * @return None
 */
static void updateCertIssuerOrSubject(nlohmann::json& out,
                                      const std::string_view value)
{
    // example: O=openbmc-project.xyz,CN=localhost
    std::string_view::iterator i = value.begin();
    while (i != value.end())
    {
        std::string_view::iterator tokenBegin = i;
        while (i != value.end() && *i != '=')
        {
            ++i;
        }
        if (i == value.end())
        {
            break;
        }
        const std::string_view key(tokenBegin,
                                   static_cast<size_t>(i - tokenBegin));
        ++i;
        tokenBegin = i;
        while (i != value.end() && *i != ',')
        {
            ++i;
        }
        const std::string_view val(tokenBegin,
                                   static_cast<size_t>(i - tokenBegin));
        if (key == "L")
        {
            out["City"] = val;
        }
        else if (key == "CN")
        {
            out["CommonName"] = val;
        }
        else if (key == "C")
        {
            out["Country"] = val;
        }
        else if (key == "O")
        {
            out["Organization"] = val;
        }
        else if (key == "OU")
        {
            out["OrganizationalUnit"] = val;
        }
        else if (key == "ST")
        {
            out["State"] = val;
        }
        // skip comma character
        if (i != value.end())
        {
            ++i;
        }
    }
}

/**
 * @brief Retrieve the certificates properties and append to the response
 * message
 *
 * @param[in] asyncResp Shared pointer to the response message
 * @param[in] objectPath  Path of the D-Bus service object
 * @param[in] certId  Id of the certificate
 * @param[in] certURL  URL of the certificate object
 * @param[in] name  name of the certificate
 * @return None
 */
static void getCertificateProperties(
    const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
    const std::string& objectPath, const std::string& service, long certId,
    const std::string& certURL, const std::string& name)
{
    using PropertyType =
        std::variant<std::string, uint64_t, std::vector<std::string>>;
    using PropertiesMap = boost::container::flat_map<std::string, PropertyType>;
    BMCWEB_LOG_DEBUG << "getCertificateProperties Path=" << objectPath
                     << " certId=" << certId << " certURl=" << certURL;
    crow::connections::systemBus->async_method_call(
        [asyncResp, certURL, certId, name](const boost::system::error_code ec,
                                           const PropertiesMap& properties) {
            if (ec)
            {
                BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
                messages::resourceNotFound(asyncResp->res, name,
                                           std::to_string(certId));
                return;
            }
            asyncResp->res.jsonValue = {
                {"@odata.id", certURL},
                {"@odata.type", "#Certificate.v1_0_0.Certificate"},
                {"Id", std::to_string(certId)},
                {"Name", name},
                {"Description", name}};
            for (const auto& property : properties)
            {
                if (property.first == "CertificateString")
                {
                    asyncResp->res.jsonValue["CertificateString"] = "";
                    const std::string* value =
                        std::get_if<std::string>(&property.second);
                    if (value)
                    {
                        asyncResp->res.jsonValue["CertificateString"] = *value;
                    }
                }
                else if (property.first == "KeyUsage")
                {
                    nlohmann::json& keyUsage =
                        asyncResp->res.jsonValue["KeyUsage"];
                    keyUsage = nlohmann::json::array();
                    const std::vector<std::string>* value =
                        std::get_if<std::vector<std::string>>(&property.second);
                    if (value)
                    {
                        for (const std::string& usage : *value)
                        {
                            keyUsage.push_back(usage);
                        }
                    }
                }
                else if (property.first == "Issuer")
                {
                    const std::string* value =
                        std::get_if<std::string>(&property.second);
                    if (value)
                    {
                        updateCertIssuerOrSubject(
                            asyncResp->res.jsonValue["Issuer"], *value);
                    }
                }
                else if (property.first == "Subject")
                {
                    const std::string* value =
                        std::get_if<std::string>(&property.second);
                    if (value)
                    {
                        updateCertIssuerOrSubject(
                            asyncResp->res.jsonValue["Subject"], *value);
                    }
                }
                else if (property.first == "ValidNotAfter")
                {
                    const uint64_t* value =
                        std::get_if<uint64_t>(&property.second);
                    if (value)
                    {
                        std::time_t time = static_cast<std::time_t>(*value);
                        asyncResp->res.jsonValue["ValidNotAfter"] =
                            crow::utility::getDateTime(time);
                    }
                }
                else if (property.first == "ValidNotBefore")
                {
                    const uint64_t* value =
                        std::get_if<uint64_t>(&property.second);
                    if (value)
                    {
                        std::time_t time = static_cast<std::time_t>(*value);
                        asyncResp->res.jsonValue["ValidNotBefore"] =
                            crow::utility::getDateTime(time);
                    }
                }
            }
            asyncResp->res.addHeader("Location", certURL);
        },
        service, objectPath, certs::dbusPropIntf, "GetAll",
        certs::certPropIntf);
}

using GetObjectType =
    std::vector<std::pair<std::string, std::vector<std::string>>>;

/**
 * Action to replace an existing certificate
 */
inline void requestRoutesCertificateActionsReplaceCertificate(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/CertificateService/Actions/"
                      "CertificateService.ReplaceCertificate/")
        .privileges(redfish::privileges::postCertificateService)
        .methods(
            boost::beast::http::verb::
                post)([](const crow::Request& req,
                         const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
            std::string certificate;
            nlohmann::json certificateUri;
            std::optional<std::string> certificateType = "PEM";

            if (!json_util::readJson(req, asyncResp->res, "CertificateString",
                                     certificate, "CertificateUri",
                                     certificateUri, "CertificateType",
                                     certificateType))
            {
                BMCWEB_LOG_ERROR << "Required parameters are missing";
                messages::internalError(asyncResp->res);
                return;
            }

            if (!certificateType)
            {
                // should never happen, but it never hurts to be paranoid.
                return;
            }
            if (certificateType != "PEM")
            {
                messages::actionParameterNotSupported(
                    asyncResp->res, "CertificateType", "ReplaceCertificate");
                return;
            }

            std::string certURI;
            if (!redfish::json_util::readJson(certificateUri, asyncResp->res,
                                              "@odata.id", certURI))
            {
                messages::actionParameterMissing(
                    asyncResp->res, "ReplaceCertificate", "CertificateUri");
                return;
            }

            BMCWEB_LOG_INFO << "Certificate URI to replace" << certURI;
            long id = getIDFromURL(certURI);
            if (id < 0)
            {
                messages::actionParameterValueFormatError(
                    asyncResp->res, certURI, "CertificateUri",
                    "ReplaceCertificate");
                return;
            }
            std::string objectPath;
            std::string name;
            std::string service;
            if (boost::starts_with(certURI,
                                   "/redfish/v1/Managers/bmc/NetworkProtocol/"
                                   "HTTPS/Certificates/"))
            {
                objectPath = std::string(certs::httpsObjectPath) + "/" +
                             std::to_string(id);
                name = "HTTPS certificate";
                service = certs::httpsServiceName;
            }
            else if (boost::starts_with(
                         certURI,
                         "/redfish/v1/AccountService/LDAP/Certificates/"))
            {
                objectPath = std::string(certs::ldapObjectPath) + "/" +
                             std::to_string(id);
                name = "LDAP certificate";
                service = certs::ldapServiceName;
            }
            else if (boost::starts_with(
                         certURI,
                         "/redfish/v1/Managers/bmc/Truststore/Certificates/"))
            {
                objectPath = std::string(certs::authorityObjectPath) + "/" +
                             std::to_string(id);
                name = "TrustStore certificate";
                service = certs::authorityServiceName;
            }
            else
            {
                messages::actionParameterNotSupported(
                    asyncResp->res, "CertificateUri", "ReplaceCertificate");
                return;
            }

            std::shared_ptr<CertificateFile> certFile =
                std::make_shared<CertificateFile>(certificate);
            crow::connections::systemBus->async_method_call(
                [asyncResp, certFile, objectPath, service, certURI, id,
                 name](const boost::system::error_code ec) {
                    if (ec)
                    {
                        BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
                        messages::resourceNotFound(asyncResp->res, name,
                                                   std::to_string(id));
                        return;
                    }
                    getCertificateProperties(asyncResp, objectPath, service, id,
                                             certURI, name);
                    BMCWEB_LOG_DEBUG << "HTTPS certificate install file="
                                     << certFile->getCertFilePath();
                },
                service, objectPath, certs::certReplaceIntf, "Replace",
                certFile->getCertFilePath());
        });
} // requestRoutesCertificateActionsReplaceCertificate

/**
 * Certificate resource describes a certificate used to prove the identity
 * of a component, account or service.
 */

inline void requestRoutesHTTPSCertificate(App& app)
{
    BMCWEB_ROUTE(
        app,
        "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/<str>/")
        .privileges(redfish::privileges::getCertificate)
        .methods(
            boost::beast::http::verb::
                get)([](const crow::Request& req,
                        const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
                        const std::string& param) -> void {
            if (param.empty())
            {
                messages::internalError(asyncResp->res);
                return;
            }
            long id = getIDFromURL(req.url);

            BMCWEB_LOG_DEBUG << "HTTPSCertificate::doGet ID="
                             << std::to_string(id);
            std::string certURL =
                "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/" +
                std::to_string(id);
            std::string objectPath = certs::httpsObjectPath;
            objectPath += "/";
            objectPath += std::to_string(id);
            getCertificateProperties(asyncResp, objectPath,
                                     certs::httpsServiceName, id, certURL,
                                     "HTTPS Certificate");
        });
}

/**
 * Collection of HTTPS certificates
 */
inline void requestRoutesHTTPSCertificateCollection(App& app)
{
    BMCWEB_ROUTE(app,
                 "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/")
        .privileges(redfish::privileges::getCertificateCollection)
        .methods(
            boost::beast::http::verb::
                get)([](const crow::Request&,
                        const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
            asyncResp->res.jsonValue = {
                {"@odata.id",
                 "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates"},
                {"@odata.type", "#CertificateCollection.CertificateCollection"},
                {"Name", "HTTPS Certificates Collection"},
                {"Description", "A Collection of HTTPS certificate instances"}};

            crow::connections::systemBus->async_method_call(
                [asyncResp](const boost::system::error_code ec,
                            const ManagedObjectType& certs) {
                    if (ec)
                    {
                        BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
                        messages::internalError(asyncResp->res);
                        return;
                    }
                    nlohmann::json& members =
                        asyncResp->res.jsonValue["Members"];
                    members = nlohmann::json::array();
                    for (const auto& cert : certs)
                    {
                        long id = getIDFromURL(cert.first.str);
                        if (id >= 0)
                        {
                            members.push_back(
                                {{"@odata.id",
                                  "/redfish/v1/Managers/bmc/"
                                  "NetworkProtocol/HTTPS/Certificates/" +
                                      std::to_string(id)}});
                        }
                    }
                    asyncResp->res.jsonValue["Members@odata.count"] =
                        members.size();
                },
                certs::httpsServiceName, certs::httpsObjectPath,
                certs::dbusObjManagerIntf, "GetManagedObjects");
        });

    BMCWEB_ROUTE(app,
                 "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/")
        .privileges(redfish::privileges::postCertificateCollection)
        .methods(boost::beast::http::verb::post)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
                BMCWEB_LOG_DEBUG << "HTTPSCertificateCollection::doPost";

                asyncResp->res.jsonValue = {
                    {"Name", "HTTPS Certificate"},
                    {"Description", "HTTPS Certificate"}};

                std::string certFileBody =
                    getCertificateFromReqBody(asyncResp, req);

                if (certFileBody.empty())
                {
                    BMCWEB_LOG_ERROR
                        << "Cannot get certificate from request body.";
                    messages::unrecognizedRequestBody(asyncResp->res);
                    return;
                }

                std::shared_ptr<CertificateFile> certFile =
                    std::make_shared<CertificateFile>(certFileBody);

                crow::connections::systemBus->async_method_call(
                    [asyncResp, certFile](const boost::system::error_code ec,
                                          const std::string& objectPath) {
                        if (ec)
                        {
                            BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
                            messages::internalError(asyncResp->res);
                            return;
                        }
                        long certId = getIDFromURL(objectPath);
                        if (certId < 0)
                        {
                            BMCWEB_LOG_ERROR << "Invalid objectPath value"
                                             << objectPath;
                            messages::internalError(asyncResp->res);
                            return;
                        }
                        std::string certURL =
                            "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/"
                            "Certificates/" +
                            std::to_string(certId);
                        getCertificateProperties(
                            asyncResp, objectPath, certs::httpsServiceName,
                            certId, certURL, "HTTPS Certificate");
                        BMCWEB_LOG_DEBUG << "HTTPS certificate install file="
                                         << certFile->getCertFilePath();
                    },
                    certs::httpsServiceName, certs::httpsObjectPath,
                    certs::certInstallIntf, "Install",
                    certFile->getCertFilePath());
            });
} // requestRoutesHTTPSCertificateCollection

/**
 * @brief Retrieve the certificates installed list and append to the
 * response
 *
 * @param[in] asyncResp Shared pointer to the response message
 * @param[in] certURL  Path of the certificate object
 * @param[in] path  Path of the D-Bus service object
 * @return None
 */
inline void
    getCertificateLocations(const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
                            const std::string& certURL, const std::string& path,
                            const std::string& service)
{
    BMCWEB_LOG_DEBUG << "getCertificateLocations URI=" << certURL
                     << " Path=" << path << " service= " << service;
    crow::connections::systemBus->async_method_call(
        [asyncResp, certURL](const boost::system::error_code ec,
                             const ManagedObjectType& certs) {
            if (ec)
            {
                BMCWEB_LOG_WARNING
                    << "Certificate collection query failed: " << ec
                    << ", skipping " << certURL;
                return;
            }
            nlohmann::json& links =
                asyncResp->res.jsonValue["Links"]["Certificates"];
            for (auto& cert : certs)
            {
                long id = getIDFromURL(cert.first.str);
                if (id >= 0)
                {
                    links.push_back(
                        {{"@odata.id", certURL + std::to_string(id)}});
                }
            }
            asyncResp->res.jsonValue["Links"]["Certificates@odata.count"] =
                links.size();
        },
        service, path, certs::dbusObjManagerIntf, "GetManagedObjects");
}

/**
 * The certificate location schema defines a resource that an administrator
 * can use in order to locate all certificates installed on a given service.
 */
inline void requestRoutesCertificateLocations(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/CertificateService/CertificateLocations/")
        .privileges(redfish::privileges::getCertificateLocations)
        .methods(
            boost::beast::http::verb::
                get)([](const crow::Request&,
                        const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
            asyncResp->res.jsonValue = {
                {"@odata.id",
                 "/redfish/v1/CertificateService/CertificateLocations"},
                {"@odata.type",
                 "#CertificateLocations.v1_0_0.CertificateLocations"},
                {"Name", "Certificate Locations"},
                {"Id", "CertificateLocations"},
                {"Description",
                 "Defines a resource that an administrator can use in order to "
                 "locate all certificates installed on a given service"}};

            nlohmann::json& links =
                asyncResp->res.jsonValue["Links"]["Certificates"];
            links = nlohmann::json::array();
            getCertificateLocations(
                asyncResp,
                "/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/",
                certs::httpsObjectPath, certs::httpsServiceName);
            getCertificateLocations(
                asyncResp, "/redfish/v1/AccountService/LDAP/Certificates/",
                certs::ldapObjectPath, certs::ldapServiceName);
            getCertificateLocations(
                asyncResp, "/redfish/v1/Managers/bmc/Truststore/Certificates/",
                certs::authorityObjectPath, certs::authorityServiceName);
        });
}
// requestRoutesCertificateLocations

/**
 * Collection of LDAP certificates
 */
inline void requestRoutesLDAPCertificateCollection(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/AccountService/LDAP/Certificates/")
        .privileges(redfish::privileges::getCertificateCollection)
        .methods(boost::beast::http::verb::get)(
            [](const crow::Request&,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
                asyncResp->res.jsonValue = {
                    {"@odata.id",
                     "/redfish/v1/AccountService/LDAP/Certificates"},
                    {"@odata.type",
                     "#CertificateCollection.CertificateCollection"},
                    {"Name", "LDAP Certificates Collection"},
                    {"Description",
                     "A Collection of LDAP certificate instances"}};

                crow::connections::systemBus->async_method_call(
                    [asyncResp](const boost::system::error_code ec,
                                const ManagedObjectType& certs) {
                        nlohmann::json& members =
                            asyncResp->res.jsonValue["Members"];
                        nlohmann::json& count =
                            asyncResp->res.jsonValue["Members@odata.count"];
                        members = nlohmann::json::array();
                        count = 0;
                        if (ec)
                        {
                            BMCWEB_LOG_WARNING
                                << "LDAP certificate query failed: " << ec;
                            return;
                        }
                        for (const auto& cert : certs)
                        {
                            long id = getIDFromURL(cert.first.str);
                            if (id >= 0)
                            {
                                members.push_back(
                                    {{"@odata.id", "/redfish/v1/AccountService/"
                                                   "LDAP/Certificates/" +
                                                       std::to_string(id)}});
                            }
                        }
                        count = members.size();
                    },
                    certs::ldapServiceName, certs::ldapObjectPath,
                    certs::dbusObjManagerIntf, "GetManagedObjects");
            });

    BMCWEB_ROUTE(app, "/redfish/v1/AccountService/LDAP/Certificates/")
        .privileges(redfish::privileges::postCertificateCollection)
        .methods(boost::beast::http::verb::post)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
                std::string certFileBody =
                    getCertificateFromReqBody(asyncResp, req);

                if (certFileBody.empty())
                {
                    BMCWEB_LOG_ERROR
                        << "Cannot get certificate from request body.";
                    messages::unrecognizedRequestBody(asyncResp->res);
                    return;
                }

                std::shared_ptr<CertificateFile> certFile =
                    std::make_shared<CertificateFile>(certFileBody);

                crow::connections::systemBus->async_method_call(
                    [asyncResp, certFile](const boost::system::error_code ec,
                                          const std::string& objectPath) {
                        if (ec)
                        {
                            BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
                            messages::internalError(asyncResp->res);
                            return;
                        }
                        long certId = getIDFromURL(objectPath);
                        if (certId < 0)
                        {
                            BMCWEB_LOG_ERROR << "Invalid objectPath value"
                                             << objectPath;
                            messages::internalError(asyncResp->res);
                            return;
                        }
                        std::string certURL =
                            "/redfish/v1/AccountService/LDAP/Certificates/" +
                            std::to_string(certId);
                        getCertificateProperties(asyncResp, objectPath,
                                                 certs::ldapServiceName, certId,
                                                 certURL, "LDAP Certificate");
                        BMCWEB_LOG_DEBUG << "LDAP certificate install file="
                                         << certFile->getCertFilePath();
                    },
                    certs::ldapServiceName, certs::ldapObjectPath,
                    certs::certInstallIntf, "Install",
                    certFile->getCertFilePath());
            });
} // requestRoutesLDAPCertificateCollection

/**
 * Certificate resource describes a certificate used to prove the identity
 * of a component, account or service.
 */
inline void requestRoutesLDAPCertificate(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/AccountService/LDAP/Certificates/<str>/")
        .privileges(redfish::privileges::getCertificate)
        .methods(boost::beast::http::verb::get)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
               const std::string&) {
                long id = getIDFromURL(req.url);
                if (id < 0)
                {
                    BMCWEB_LOG_ERROR << "Invalid url value" << req.url;
                    messages::internalError(asyncResp->res);
                    return;
                }
                BMCWEB_LOG_DEBUG << "LDAP Certificate ID="
                                 << std::to_string(id);
                std::string certURL =
                    "/redfish/v1/AccountService/LDAP/Certificates/" +
                    std::to_string(id);
                std::string objectPath = certs::ldapObjectPath;
                objectPath += "/";
                objectPath += std::to_string(id);
                getCertificateProperties(asyncResp, objectPath,
                                         certs::ldapServiceName, id, certURL,
                                         "LDAP Certificate");
            });
} // requestRoutesLDAPCertificate
/**
 * Collection of TrustStoreCertificate certificates
 */
inline void requestRoutesTrustStoreCertificateCollection(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/Managers/bmc/Truststore/Certificates/")
        .privileges(redfish::privileges::getCertificate)
        .methods(boost::beast::http::verb::get)(
            [](const crow::Request&,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
                asyncResp->res.jsonValue = {
                    {"@odata.id",
                     "/redfish/v1/Managers/bmc/Truststore/Certificates/"},
                    {"@odata.type",
                     "#CertificateCollection.CertificateCollection"},
                    {"Name", "TrustStore Certificates Collection"},
                    {"Description",
                     "A Collection of TrustStore certificate instances"}};

                crow::connections::systemBus->async_method_call(
                    [asyncResp](const boost::system::error_code ec,
                                const ManagedObjectType& certs) {
                        if (ec)
                        {
                            BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
                            messages::internalError(asyncResp->res);
                            return;
                        }
                        nlohmann::json& members =
                            asyncResp->res.jsonValue["Members"];
                        members = nlohmann::json::array();
                        for (const auto& cert : certs)
                        {
                            long id = getIDFromURL(cert.first.str);
                            if (id >= 0)
                            {
                                members.push_back(
                                    {{"@odata.id", "/redfish/v1/Managers/bmc/"
                                                   "Truststore/Certificates/" +
                                                       std::to_string(id)}});
                            }
                        }
                        asyncResp->res.jsonValue["Members@odata.count"] =
                            members.size();
                    },
                    certs::authorityServiceName, certs::authorityObjectPath,
                    certs::dbusObjManagerIntf, "GetManagedObjects");
            });

    BMCWEB_ROUTE(app, "/redfish/v1/Managers/bmc/Truststore/Certificates/")
        .privileges(redfish::privileges::postCertificateCollection)
        .methods(boost::beast::http::verb::post)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) {
                std::string certFileBody =
                    getCertificateFromReqBody(asyncResp, req);

                if (certFileBody.empty())
                {
                    BMCWEB_LOG_ERROR
                        << "Cannot get certificate from request body.";
                    messages::unrecognizedRequestBody(asyncResp->res);
                    return;
                }

                std::shared_ptr<CertificateFile> certFile =
                    std::make_shared<CertificateFile>(certFileBody);
                crow::connections::systemBus->async_method_call(
                    [asyncResp, certFile](const boost::system::error_code ec,
                                          const std::string& objectPath) {
                        if (ec)
                        {
                            BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
                            messages::internalError(asyncResp->res);
                            return;
                        }
                        long certId = getIDFromURL(objectPath);
                        if (certId < 0)
                        {
                            BMCWEB_LOG_ERROR << "Invalid objectPath value"
                                             << objectPath;
                            messages::internalError(asyncResp->res);
                            return;
                        }
                        std::string certURL = "/redfish/v1/Managers/bmc/"
                                              "Truststore/Certificates/" +
                                              std::to_string(certId);

                        getCertificateProperties(
                            asyncResp, objectPath, certs::authorityServiceName,
                            certId, certURL, "TrustStore Certificate");
                        BMCWEB_LOG_DEBUG
                            << "TrustStore certificate install file="
                            << certFile->getCertFilePath();
                    },
                    certs::authorityServiceName, certs::authorityObjectPath,
                    certs::certInstallIntf, "Install",
                    certFile->getCertFilePath());
            });
} // requestRoutesTrustStoreCertificateCollection

/**
 * Certificate resource describes a certificate used to prove the identity
 * of a component, account or service.
 */
inline void requestRoutesTrustStoreCertificate(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/Managers/bmc/Truststore/Certificates/<str>/")
        .privileges(redfish::privileges::getCertificate)
        .methods(boost::beast::http::verb::get)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
               const std::string&) {
                long id = getIDFromURL(req.url);
                if (id < 0)
                {
                    BMCWEB_LOG_ERROR << "Invalid url value" << req.url;
                    messages::internalError(asyncResp->res);
                    return;
                }
                BMCWEB_LOG_DEBUG << "TrustStoreCertificate::doGet ID="
                                 << std::to_string(id);
                std::string certURL =
                    "/redfish/v1/Managers/bmc/Truststore/Certificates/" +
                    std::to_string(id);
                std::string objectPath = certs::authorityObjectPath;
                objectPath += "/";
                objectPath += std::to_string(id);
                getCertificateProperties(asyncResp, objectPath,
                                         certs::authorityServiceName, id,
                                         certURL, "TrustStore Certificate");
            });

    BMCWEB_ROUTE(app, "/redfish/v1/Managers/bmc/Truststore/Certificates/<str>/")
        .privileges(redfish::privileges::deleteCertificate)
        .methods(boost::beast::http::verb::delete_)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
               const std::string& param) {
                if (param.empty())
                {
                    messages::internalError(asyncResp->res);
                    return;
                }

                long id = getIDFromURL(req.url);
                if (id < 0)
                {
                    BMCWEB_LOG_ERROR << "Invalid url value: " << req.url;
                    messages::resourceNotFound(asyncResp->res,
                                               "TrustStore Certificate",
                                               std::string(req.url));
                    return;
                }
                BMCWEB_LOG_DEBUG << "TrustStoreCertificate::doDelete ID="
                                 << std::to_string(id);
                std::string certPath = certs::authorityObjectPath;
                certPath += "/";
                certPath += std::to_string(id);

                crow::connections::systemBus->async_method_call(
                    [asyncResp, id](const boost::system::error_code ec) {
                        if (ec)
                        {
                            messages::resourceNotFound(asyncResp->res,
                                                       "TrustStore Certificate",
                                                       std::to_string(id));
                            return;
                        }
                        BMCWEB_LOG_INFO << "Certificate deleted";
                        asyncResp->res.result(
                            boost::beast::http::status::no_content);
                    },
                    certs::authorityServiceName, certPath, certs::objDeleteIntf,
                    "Delete");
            });
} // requestRoutesTrustStoreCertificate
} // namespace redfish