| commit | 5f0f6d405faa7e165a9ad2b8c98541a5242e7140 | [log] [tgz] |
|---|---|---|
| author | Patrick Williams <patrick@stwcx.xyz> | Fri Dec 03 13:40:36 2021 -0600 |
| committer | Patrick Williams <patrick@stwcx.xyz> | Fri Dec 03 14:44:56 2021 -0600 |
| tree | ebff87e7b03b29000ef7e45d5a406b9f4bffac06 | |
| parent | 7f7b47bea7bbd518d1ff5a306ecf3806cf8d0834 [diff] |
certificate: reduce nested sdbusplus::object inheritence
The CertIfaces type use to end up being:
object<object<Certificate>, Replace, Delete>
The nested object is unnecessary and can lead to incorrect behavior for
signal emittance. The upstream sdbusplus library attempted to fix this
automatically by flattening the resulting diamond inheritance, but some
of the code here attempted to use `object<Certificate>::function` calls,
which by the automatic flattening was not in the CertIface's inheritance
structure.
Tested:
# Launched certificate manager.
./builddir/phosphor-certificiate-manager --endpoint=ldap --path=/tmp/certificate_test --unit=bmcweb.service --type=authority
# Copied certificate into /tmp/certificate_test
cp /etc/ssl/certs/Go_Daddy_Class_2_CA.pem /tmp/certificate_test
# Checked busctl that Certificate object exists.
busctl --user tree xyz.openbmc_project.Certs.Manager.Authority.Ldap
└─/xyz
└─/xyz/openbmc_project
└─/xyz/openbmc_project/certs
└─/xyz/openbmc_project/certs/authority
└─/xyz/openbmc_project/certs/authority/ldap
└─/xyz/openbmc_project/certs/authority/ldap/1
busctl --user introspect xyz.openbmc_project.Certs.Manager.Authority.Ldap /xyz/openbmc_project/certs/authority/ldap/1 xyz.openbmc_project.Certs.Certificate
NAME TYPE SIGNATURE RESULT/VALUE >
.CertificateString property s "-----BEGIN CERTIFICATE-->
.Issuer property s "C=US,O=The Go Daddy Grou>
.KeyUsage property as 0 >
.Subject property s "C=US,O=The Go Daddy Grou>
.ValidNotAfter property t 2035170380 >
.ValidNotBefore property t 1088485580
Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Change-Id: If11679eb26708ce146c8451acb2169782e89ea54
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
To build this package, do the following steps:
1. ./bootstrap.sh
2. ./configure ${CONFIGURE_FLAGS}
3. make
To clean the repository run `./bootstrap.sh clean`.
Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options]
Options:
--help Print this menu
--type certificate type
Valid types: client,server,authority
--endpoint d-bus endpoint
--path certificate file path
--unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=ldap \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.