SunnyQjm/ndn-cxx
1
0 Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

docs+ndnsec: improve description and parsing of command options, rewrite man pages

Browse Source 
Replace custom redmine_issue extension with sphinx.ext.extlinks

Refs: #4907
Change-Id: Ib0cb94156ae4fc80cdcaf4c70d7c8d55c16fcbc3
This commit is contained in:
Davide Pesavento committed 2019-04-14 16:50:19 -04:00
1 parent fa995ac3d3
commit b310efbdaa
31 files changed
+886 -1187
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.waf-tools/sphinx_build.py
+8 -8
View File
@@ -44,28 +44,28 @@ def apply_sphinx(self):
task.inputs.append(conf)
confdir = conf.parent.abspath()
buildername = getattr(self, "builder", "html")
srcdir = getattr(self, "srcdir", confdir)
outdir = self.path.find_or_declare(getattr(self, "outdir", buildername)).get_bld()
doctreedir = getattr(self, "doctreedir", os.path.join(outdir.abspath(), ".doctrees"))
buildername = getattr(self, 'builder', 'html')
srcdir = getattr(self, 'srcdir', confdir)
outdir = self.path.find_or_declare(getattr(self, 'outdir', buildername)).get_bld()
doctreedir = getattr(self, 'doctreedir', os.path.join(outdir.abspath(), '.doctrees'))
task.env['BUILDERNAME'] = buildername
task.env['SRCDIR'] = srcdir
task.env['DOCTREEDIR'] = doctreedir
task.env['OUTDIR'] = outdir.abspath()
task.env['VERSION'] = "version=%s" % self.VERSION
task.env['RELEASE'] = "release=%s" % self.VERSION
task.env['VERSION'] = 'version=%s' % self.version
task.env['RELEASE'] = 'release=%s' % getattr(self, 'release', self.version)
import imp
confData = imp.load_source('sphinx_conf', conf.abspath())
if buildername == "man":
if buildername == 'man':
for i in confData.man_pages:
target = outdir.find_or_declare('%s.%d' % (i[1], i[4]))
task.outputs.append(target)
if self.install_path:
self.bld.install_files("%s/man%d/" % (self.install_path, i[4]), target)
self.bld.install_files('%s/man%d/' % (self.install_path, i[4]), target)
else:
task.outputs.append(outdir)
README.md
+3 -3
View File
@@ -4,9 +4,9 @@
[![Build Status](https://travis-ci.org/named-data/ndn-cxx.svg?branch=master)](https://travis-ci.org/named-data/ndn-cxx)
![Latest Version](https://img.shields.io/github/tag/named-data/ndn-cxx.svg?color=darkkhaki&label=latest%20version)
ndn-cxx is a C++14 library, implementing Named Data Networking (NDN) primitives
that can be used to write various NDN applications. The library is currently
being used by the following projects:
**ndn-cxx** is a C++14 library implementing Named Data Networking (NDN) primitives
that can be used to write various NDN applications. The library is currently being
used by the following projects:
* [NFD - NDN Forwarding Daemon](https://github.com/named-data/NFD)
* [NLSR - Named-data Link-State Routing protocol](https://github.com/named-data/NLSR)
docs/conf.py
+79 -198
View File
@@ -1,37 +1,53 @@
# -*- coding: utf-8 -*-
#
# NFD - Named Data Networking Forwarding Daemon documentation build configuration file, created by
# sphinx-quickstart on Sun Apr 6 19:58:22 2014.
# Configuration file for the Sphinx documentation builder.
#
# This file is execfile()d with the current directory set to its
# containing dir.
#
# Note that not all possible configuration values are present in this
# autogenerated file.
#
# All configuration values have a default; values that are commented out
# serve to show the default.
# This file only contains a selection of the most common options. For a full
# list see the documentation:
# http://www.sphinx-doc.org/en/master/config
import sys
import os
import re
# -- Path setup --------------------------------------------------------------
# If extensions (or modules to document with autodoc) are in another directory,
# add these directories to sys.path here. If the directory is relative to the
# documentation root, use os.path.abspath to make it absolute, like shown here.
sys.path.insert(0, os.path.abspath('.'))
#
import os
import sys
# sys.path.insert(0, os.path.abspath('.'))
# -- General configuration ------------------------------------------------
# -- Project information -----------------------------------------------------
project = u'ndn-cxx: NDN C++ library with eXperimental eXtensions'
copyright = u'Copyright © 2013-2019 Regents of the University of California.'
author = u'Named Data Networking Project'
# The short X.Y version
#version = ''
# The full version, including alpha/beta/rc tags
#release = ''
# There are two options for replacing |today|: either, you set today to some
# non-false value, then it is used:
#today = ''
# Else, today_fmt is used as the format for a strftime call.
today_fmt = '%Y-%m-%d'
# -- General configuration ---------------------------------------------------
# If your documentation needs a minimal Sphinx version, state it here.
#needs_sphinx = '1.0'
#
needs_sphinx = '1.1'
# Add any Sphinx extension module names here, as strings. They can be
# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
# ones.
extensions = [
'sphinx.ext.extlinks',
'sphinx.ext.todo',
'redmine_issue',
]
def addExtensionIfExists(extension):
@@ -39,10 +55,8 @@ def addExtensionIfExists(extension):
__import__(extension)
extensions.append(extension)
except ImportError:
sys.stderr.write("Extension '%s' in not available. "
sys.stderr.write("Extension '%s' not found. "
"Some documentation may not build correctly.\n" % extension)
sys.stderr.write("To install, use \n"
" sudo pip install %s\n" % extension.replace('.', '-'))
if sys.version_info[0] >= 3:
addExtensionIfExists('sphinxcontrib.doxylink')
@@ -51,232 +65,99 @@ if sys.version_info[0] >= 3:
# if os.getenv('GOOGLE_ANALYTICS', None):
# addExtensionIfExists('sphinxcontrib.googleanalytics')
# Add any paths that contain templates here, relative to this directory.
templates_path = ['_templates']
# The suffix of source filenames.
source_suffix = '.rst'
# The encoding of source files.
#source_encoding = 'utf-8-sig'
# The master toctree document.
master_doc = 'index'
# General information about the project.
project = u'ndn-cxx: NDN C++ library with eXperimental eXtensions'
copyright = u'Copyright (c) 2013-2019 Regents of the University of California.'
# The language for content autogenerated by Sphinx. Refer to documentation
# for a list of supported languages.
#language = None
# There are two options for replacing |today|: either, you set today to some
# non-false value, then it is used:
#today = ''
# Else, today_fmt is used as the format for a strftime call.
#today_fmt = '%B %d, %Y'
# Add any paths that contain templates here, relative to this directory.
templates_path = ['_templates']
# List of patterns, relative to source directory, that match files and
# directories to ignore when looking for source files.
# This pattern also affects html_static_path and html_extra_path.
exclude_patterns = []
# The reST default role (used for this markup: `text`) to use for all
# documents.
#default_role = None
# If true, '()' will be appended to :func: etc. cross-reference text.
#add_function_parentheses = True
# If true, the current module name will be prepended to all description
# unit titles (such as .. function::).
#add_module_names = True
# If true, sectionauthor and moduleauthor directives will be shown in the
# output. They are ignored by default.
#show_authors = False
# The name of the Pygments (syntax highlighting) style to use.
pygments_style = 'sphinx'
# A list of ignored prefixes for module index sorting.
#modindex_common_prefix = []
# If true, keep warnings as "system message" paragraphs in the built documents.
#keep_warnings = False
# -- Options for HTML output ----------------------------------------------
# -- Options for HTML output -------------------------------------------------
# The theme to use for HTML and HTML Help pages. See the documentation for
# a list of builtin themes.
# html_theme = 'default'
#
html_theme = 'named_data_theme'
# Theme options are theme-specific and customize the look and feel of a theme
# further. For a list of options available for each theme, see the
# documentation.
#html_theme_options = {}
# Add any paths that contain custom themes here, relative to this directory.
html_theme_path = ['./']
# The name for this set of Sphinx documents. If None, it defaults to
# "<project> v<release> documentation".
#html_title = None
# A shorter title for the navigation bar. Default is the same as html_title.
#html_short_title = None
# The name of an image file (relative to this directory) to place at the top
# of the sidebar.
#html_logo = None
# The name of an image file (within the static path) to use as favicon of the
# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32
# pixels large.
#html_favicon = None
html_theme_path = ['.']
# Add any paths that contain custom static files (such as style sheets) here,
# relative to this directory. They are copied after the builtin static files,
# so a file named "default.css" will overwrite the builtin "default.css".
html_static_path = ['_static']
# Add any extra paths that contain custom files (such as robots.txt or
# .htaccess) here, relative to this directory. These files are copied
# directly to the root of the documentation.
#html_extra_path = []
# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
# using the given strftime format.
#html_last_updated_fmt = '%b %d, %Y'
# If true, SmartyPants will be used to convert quotes and dashes to
# typographically correct entities.
#html_use_smartypants = True
# Custom sidebar templates, maps document names to template names.
#html_sidebars = {}
# Additional templates that should be rendered to pages, maps page names to
# template names.
#html_additional_pages = {}
# If false, no module index is generated.
#html_domain_indices = True
# If false, no index is generated.
#html_use_index = True
# If true, the index is split into individual pages for each letter.
#html_split_index = False
# If true, links to the reST sources are added to the pages.
#html_show_sourcelink = True
# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
#html_show_sphinx = True
# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
#html_show_copyright = True
# If true, an OpenSearch description file will be output, and all pages will
# contain a <link> tag referring to it. The value of this option must be the
# base URL from which the finished HTML is served.
#html_use_opensearch = ''
# This is the file name suffix for HTML files (e.g. ".xhtml").
html_file_suffix = ".html"
# Output file base name for HTML help builder.
htmlhelp_basename = 'ndn-cxx-docs'
# -- Options for LaTeX output ---------------------------------------------
# -- Options for LaTeX output ------------------------------------------------
latex_elements = {
# The paper size ('letterpaper' or 'a4paper').
#'papersize': 'letterpaper',
# The paper size ('letterpaper' or 'a4paper').
#
# 'papersize': 'letterpaper',
# The font size ('10pt', '11pt' or '12pt').
#'pointsize': '10pt',
# The font size ('10pt', '11pt' or '12pt').
#
# 'pointsize': '10pt',
# Additional stuff for the LaTeX preamble.
#'preamble': '',
# Additional stuff for the LaTeX preamble.
#
# 'preamble': '',
# Latex figure (float) alignment
#
# 'figure_align': 'htbp',
}
# Grouping the document tree into LaTeX files. List of tuples
# (source start file, target name, title,
# author, documentclass [howto, manual, or own class]).
latex_documents = [
('index', 'ndn-cxx-docs.tex', u'NDN C++ library with eXperimental eXtensions',
u'Named Data Networking Project', 'manual'),
('index', 'ndn-cxx-docs.tex', u'NDN C++ library with eXperimental eXtensions',
author, 'manual'),
]
# The name of an image file (relative to this directory) to place at the top of
# the title page.
#latex_logo = None
# For "manual" documents, if this is true, then toplevel headings are parts,
# not chapters.
#latex_use_parts = False
# If true, show page references after internal links.
#latex_show_pagerefs = False
# If true, show URL addresses after external links.
#latex_show_urls = False
# Documents to append as an appendix to all manuals.
#latex_appendices = []
# If false, no module index is generated.
#latex_domain_indices = True
# -- Options for manual page output ---------------------------------------
# -- Options for manual page output ------------------------------------------
# One entry per manual page. List of tuples
# (source start file, name, description, authors, manual section).
man_pages = [
('manpages/ndnsec', 'ndnsec', 'NDN security toolkit', None, 1),
('manpages/ndnsec-cert-dump', 'ndnsec-cert-dump', 'export an NDN certificate', None, 1),
('manpages/ndnsec-cert-gen', 'ndnsec-cert-gen', 'create an NDN certificate for an identity', None, 1),
('manpages/ndnsec-cert-install', 'ndnsec-cert-install', 'import an NDN certificate from a file', None, 1),
('manpages/ndnsec-delete', 'ndnsec-delete', 'delete an NDN identity, key, or certificate', None, 1),
('manpages/ndnsec-export', 'ndnsec-export',
'export an NDN certificate and its private key to a file', None, 1),
('manpages/ndnsec-get-default', 'ndnsec-get-default',
'show the default NDN identity, key, and certificate for the current user', None, 1),
('manpages/ndnsec-import', 'ndnsec-import',
'import an NDN certificate and its private key from a file', None, 1),
('manpages/ndnsec-key-gen', 'ndnsec-key-gen',
'generate an NDN key for an identity', None, 1),
('manpages/ndnsec-list', 'ndnsec-list',
'list all known NDN identities, keys, and certificates', None, 1),
('manpages/ndnsec-set-default', 'ndnsec-set-default',
'change the default NDN identity, key, or certificate for the current user', None, 1),
('manpages/ndnsec-sign-req', 'ndnsec-sign-req', 'generate an NDN certificate signing request', None, 1),
('manpages/ndnsec-unlock-tpm', 'ndnsec-unlock-tpm', 'unlock the TPM', None, 1),
('manpages/ndn-client.conf', 'ndn-client.conf', 'configuration file for NDN platform', None, 5),
('manpages/ndn-log', 'ndn-log', 'ndn-cxx logging', None, 7),
('manpages/ndnsec', 'ndnsec', 'NDN security toolkit', None, 1),
('manpages/ndnsec-cert-dump', 'ndnsec-cert-dump', 'export an NDN certificate', None, 1),
('manpages/ndnsec-cert-gen', 'ndnsec-cert-gen', 'create an NDN certificate for an identity', None, 1),
('manpages/ndnsec-cert-install', 'ndnsec-cert-install', 'import an NDN certificate from a file', None, 1),
('manpages/ndnsec-delete', 'ndnsec-delete', 'delete an NDN identity, key, or certificate', None, 1),
('manpages/ndnsec-export', 'ndnsec-export', 'export an NDN certificate and its private key to a file', None, 1),
('manpages/ndnsec-get-default', 'ndnsec-get-default', 'show the default NDN identity, key, and certificate for the current user', None, 1),
('manpages/ndnsec-import', 'ndnsec-import', 'import an NDN certificate and its private key from a file', None, 1),
('manpages/ndnsec-key-gen', 'ndnsec-key-gen', 'generate an NDN key for an identity', None, 1),
('manpages/ndnsec-list', 'ndnsec-list', 'list all known NDN identities, keys, and certificates', None, 1),
('manpages/ndnsec-set-default', 'ndnsec-set-default', 'change the default NDN identity, key, or certificate for the current user', None, 1),
('manpages/ndnsec-sign-req', 'ndnsec-sign-req', 'generate an NDN certificate signing request', None, 1),
('manpages/ndnsec-unlock-tpm', 'ndnsec-unlock-tpm', 'unlock the TPM', None, 1),
('manpages/ndn-client.conf', 'ndn-client.conf', 'configuration file for NDN platform', None, 5),
('manpages/ndn-log', 'ndn-log', 'ndn-cxx logging', None, 7),
]
# If true, show URL addresses after external links.
man_show_urls = True
#man_show_urls = True
# ---- Custom options --------
# -- Custom options ----------------------------------------------------------
doxylink = {
'ndn-cxx' : ('ndn-cxx.tag', 'doxygen/'),
'ndn-cxx': ('ndn-cxx.tag', 'doxygen/'),
}
extlinks = {
'issue': ('https://redmine.named-data.net/issues/%s', 'issue #'),
}
if os.getenv('GOOGLE_ANALYTICS', None):
googleanalytics_id = os.environ['GOOGLE_ANALYTICS']
googleanalytics_enabled = True
# exclude_patterns = ['RELEASE_NOTES.rst']
redmine_project_url = "https://redmine.named-data.net/"
docs/index.rst
+3 -3
View File
@@ -1,9 +1,9 @@
ndn-cxx: NDN C++ library with eXperimental eXtensions
=====================================================
ndn-cxx is a C++14 library, implementing Named Data Networking (NDN) primitives
that can be used to write various NDN applications. The library is currently
being used by the following projects:
**ndn-cxx** is a C++14 library implementing Named Data Networking (NDN) primitives
that can be used to write various NDN applications. The library is currently being
used by the following projects:
* `NFD - NDN Forwarding Daemon <https://github.com/named-data/NFD>`_
* `NLSR - Named-data Link-State Routing protocol <https://github.com/named-data/NLSR>`_
docs/manpages/ndnsec-cert-dump.rst
+26 -28
View File
@@ -1,52 +1,50 @@
ndnsec-cert-dump
================
``ndnsec-cert-dump`` is a tool to dump a certificate from **Public Info Base** or file and output
it to standard output.
Synopsis
--------
Usage
-----
::
ndnsec-cert-dump [-h] [-p] [-ikf] name
**ndnsec-cert-dump** [**-h**] [**-p**] [**-r** [**-H** *host*] [**-P** *port*]]
[**-i**\|\ **-k**\|\ **-f**] *name*
Description
-----------
``ndnsec-cert-dump`` can read a certificate from **Public Info Base (PIB)** or a file and output
the certificate to standard output.
:program:`ndnsec-cert-dump` reads a certificate from the **Public Info Base (PIB)**
or from a file, and prints it on the standard output.
By default, ``name`` is interpreted as a certificate name.
By default, *name* is interpreted as a certificate name.
Options
-------
``-i``
Interpret ``name`` as an identity name. If specified, the certificate to dump is the default
certificate of the identity.
.. option:: -i, --identity
``-k``
Interpret ``name`` as a key name. If specified, the certificate to dump is the default certificate
of the key.
Interpret *name* as an identity name. If specified, the certificate to dump
is the default certificate of the identity.
``-f``
Interpret ``name`` as a path to a file containing the certificate. If ``name`` is ``-``,
certificate will be read from standard input.
.. option:: -k, --key
``-p``
Print out the certificate to a human-readable format.
Interpret *name* as a key name. If specified, the certificate to dump is the
default certificate of the key.
Examples
--------
.. option:: -f, --file
Dump a certificate from PIB to standard output:
::
Interpret *name* as a path to a file containing the certificate. If *name*
is "-", the certificate will be read from the standard input.
.. option:: -p, --pretty
Print the certificate in a human-readable format.
Example
-------
Dump a certificate from PIB to standard output::
$ ndnsec-cert-dump /ndn/test/david/KEY/ksk-1396913058196/ID-CERT/%00%00%01E%3E%9D%A0%DE
Dump a certificate to a human-readable format:
::
Dump a certificate in human-readable format::
$ ndnsec-cert-dump -p /ndn/test/david/KEY/ksk-1396913058196/ID-CERT/%00%00%01E%3E%9D%A0%DE
Certificate name:
docs/manpages/ndnsec-cert-gen.rst
+34 -30
View File
@@ -1,60 +1,64 @@
ndnsec-cert-gen
===============
``ndnsec-cert-gen`` is a tool to issue an identity certificate.
Synopsis
--------
Usage
-----
::
ndnsec-cert-gen [-h] [-S timestamp] [-E timestamp] [-I info] [-s sign-id] [-i issuer-id] request
**ndnsec-cert-gen** [**-h**] [**-S** *timestamp*] [**-E** *timestamp*]
[**-I** *info*]... [**-s** *signer*] [**-i** *issuer*] *file*
Description
-----------
``ndnsec-cert-gen`` takes signing request as input and issues an identity certificate for the key in
the signing request. The signing request can be created during ``ndnsec-keygen`` and can be
re-generated with ``ndnsec-sign-req``.
:program:`ndnsec-cert-gen` takes a signing request as input and issues an
identity certificate for the key in the signing request. The signing request
can be created with :program:`ndnsec-key-gen` and can be re-generated with
:program:`ndnsec-sign-req`.
By default, the default key/certificate will be used to sign the issued certificate.
By default, the default key is used to sign the issued certificate.
``request`` could be a path to a file that contains the signing request. If ``request`` is ``-``,
then signing request will be read from standard input.
*file* is the name of a file that contains the signing request. If *file* is
"-", the signing request is read from the standard input.
The generated certificate will be written to standard output in base64 encoding.
The generated certificate is written to the standard output in base64 encoding.
Options
-------
``-S timestamp``
Timestamp when the certificate becomes valid. The default value is now.
.. option:: -S <timestamp>, --not-before <timestamp>
``-E timestamp``
Timestamp when the certificate expires. The default value is one year from now.
Date and time when the certificate becomes valid, in "YYYYMMDDhhmmss" format.
The default value is now.
``-I info``
Other information to be included in the issued certificate. For example,
.. option:: -E <timestamp>, --not-after <timestamp>
::
Date and time when the certificate expires, in "YYYYMMDDhhmmss" format.
The default value is 365 days after the **--not-before** timestamp.
.. option:: -I <info>, --info <info>
Other information to be included in the issued certificate. For example::
-I "affiliation Some Organization" -I "homepage http://home.page/"
``-s sign-id``
Signing identity. The default key/certificate of ``sign-id`` will be used to sign the requested
certificate. If this option is not specified, the system default identity will be used.
.. option:: -s <signer>, --sign-id <signer>
``-s issuer-id``
Issuer's ID to be included as part of the issued certificate name. If not specified, "NA"
value will be used
Signing identity. The default key/certificate of *signer* will be used to
sign the requested certificate. If this option is not specified, the system
default identity will be used.
Examples
--------
.. option:: -i <issuer>, --issuer-id <issuer>
Issuer's ID to be included in the issued certificate name. The default
value is "NA".
Example
-------
::
$ ndnsec-cert-gen -S 20140401000000 -E 20150331235959 -N "David"
-I "2.5.4.10 'Some Organization'" -s /ndn/test sign_request.cert
-I "2.5.4.10 'Some Organization'" -s /ndn/test request.cert
Bv0C9wc9CANuZG4IBHRlc3QIA0tFWQgFZGF2aWQIEWtzay0xMzk2OTEzMDU4MTk2
CAdJRC1DRVJUCAgAAAFFPp2g3hQDGAECFf0BdjCCAXIwIhgPMjAxNDA0MDEwMDAw
MDBaGA8yMDE1MDMzMTIzNTk1OVowKDAMBgNVBCkTBURhdmlkMBgGA1UEChMRU29t
docs/manpages/ndnsec-cert-install.rst
+24 -30
View File
@@ -1,56 +1,50 @@
ndnsec-cert-install
===================
``ndnsec-cert-install`` is a tool to install a certificate into **Public Information Base (PIB)**.
Synopsis
--------
Usage
-----
::
ndnsec-cert-install [-h] [-IKN] cert-source
**ndnsec-cert-install** [**-h**] [**-I**\|\ **-K**\|\ **-N**] *file*
Description
-----------
``ndnsec-cert-install`` can insert a certificate into PIB. By default, the installed certificate
will be set as the default certificate of its corresponding identity and the identity is set as
the system default identity.
:program:`ndnsec-cert-install` allows importing a certificate into the
**Public Information Base (PIB)**. By default, the installed certificate
will be set as the default certificate for the corresponding identity and
the identity will be set as the user's default identity.
``cert-source`` could be a filesystem path or an HTTP URL of a file containing to certificate to
install or . If ``cert-file`` is ``-``, the certificate will be read from standard input.
*file* can be a filesystem path or an HTTP URL of a file containing the certificate
to install. If *file* is "-", the certificate will be read from the standard input.
Options
-------
``-I``
Set the certificate as the default certificate of its corresponding identity, but do not change
the system default identity.
.. option:: -I, --identity-default
``-K``
Set the certificate as the default certificate of its corresponding key, but do not change the
corresponding identity's default key and the system default identity.
Set the certificate as the default certificate for the corresponding identity,
but do not change the user's default identity.
``-N``
Install the certificate but do not change any default settings.
.. option:: -K, --key-default
Examples
--------
Set the certificate as the default certificate for the corresponding key, but
do not change the identity's default key or the user's default identity.
Install a certificate and set it as the system default certificate:
.. option:: -N, --no-default
::
Install the certificate but do not change any default settings.
Example
-------
Install a certificate and set it as the default certificate::
$ ndnsec-cert-install cert_file.cert
Install a certificate with HTTP URL and set it as the system default certificate:
::
Install a certificate via HTTP and set it as the default certificate::
$ ndnsec-install-cert "http://ndncert.domain.com/cert/get/my-certificate.ndncert"
Install a certificate but do not change any default settings:
::
Install a certificate but do not change any default settings::
$ ndnsec-cert-install -N cert_file.cert
docs/manpages/ndnsec-delete.rst
+18 -20
View File
@@ -1,32 +1,32 @@
ndnsec-delete
=============
``ndnsec-delete`` is a tool to delete security data from both **Public Info Base** and
**Trusted Platform Module**.
Synopsis
--------
Usage
-----
::
ndnsec-delete [-h] [-kc] name
**ndnsec-delete** [**-h**] [**-k**\|\ **-c**] *name*
Description
-----------
By default, ``ndnsec-delete`` interpret ``name`` as an identity name. If an identity is deleted,
all the keys and certificates belonging to the identity will be deleted as well. If a key is
deleted, all the certificate belonging to the key will be deleted as well.
:program:`ndnsec-delete` allows to delete security data from both the
**Public Info Base (PIB)** and the **Trusted Platform Module (TPM)**.
By default, :program:`ndnsec-delete` will interpret *name* as an identity name.
If an identity is deleted, all keys and certificates belonging to that identity
will be deleted as well. If a key is deleted, all certificates associated with
that key will be deleted as well.
Options
-------
``-k``
Interpret ``name`` as a key name and delete the key and its related data.
.. option:: -k, --delete-key
``-c``
Interpret ``name`` as a certificate name and delete the certificate.
Interpret *name* as a key name and delete the key and its associated data.
.. option:: -c, --delete-cert
Interpret *name* as a certificate name and delete the certificate.
Exit Status
-----------
@@ -35,11 +35,9 @@ Normally, the exit status is 0 if the requested entity is deleted successfully.
If the entity to be deleted does not exist, the exit status is 1.
For other errors, the exit status is 2.
Examples
--------
Example
-------
Delete all data related to an identity:
::
Delete all data related to an identity::
$ ndnsec-delete /ndn/test/david
docs/manpages/ndnsec-export.rst
+17 -27
View File
@@ -1,49 +1,39 @@
ndnsec-export
=============
Usage
-----
Synopsis
--------
::
ndnsec-export [-h] [-o output] identity
**ndnsec-export** [**-h**] [**-o** *file*] [**-P** *passphrase*] *identity*
Description
-----------
``ndnsec-export`` exports the default certificate of an identity and its private key as a file. It
will ask for a passphrase to encrypt the private key. The output file can be imported again with
``ndnsec-import`` command.
:program:`ndnsec-export` exports the default certificate of *identity* and its
private key to a file. It will ask for a passphrase to encrypt the private key.
The resulting file can be imported again using :program:`ndnsec-import`.
Options
-------
``-h``
Print a help message.
.. option:: -o <file>, --output <file>
``-o output``
Write to an output file instead of the standard output.
Write to the specified output file instead of the standard output.
``-P passphrase``
Passphrase to use for the export. If not specified (or specified an empty passphrase), the
user is interactively asked to input the passphrase on the terminal. Note that specifying
passphrase via -P is insecure, as it can potentially end up in shell history, be visible in
ps output, etc.
.. option:: -P <passphrase>, --password <passphrase>
``identity``
The identity name.
Passphrase to use for the export. If empty or not specified, the user is
interactively asked to type the passphrase on the terminal. Note that
specifying the passphrase via this option is insecure, as it can potentially
end up in the shell's history, be visible in :command:`ps` output, and so on.
Examples
--------
Example
-------
Export an identity's default certificate and private key into a file:
::
Export an identity's default certificate and private key into a file::
$ ndnsec-export -o alice.ndnkey /ndn/test/alice
Export an identity's default certificate and private key to the standard output:
::
Export an identity's default certificate and private key to the standard output::
$ ndnsec-export /ndn/test/alice
docs/manpages/ndnsec-get-default.rst
+26 -31
View File
@@ -1,61 +1,56 @@
ndnsec-get-default
==================
``ndnsec-get-default`` is a tool to display the default setting of a particular entity.
Synopsis
--------
Usage
-----
::
ndnsec-get-default [-h] [-kc] [-i identity|-K key] [-q]
**ndnsec-get-default** [**-h**] [**-k**\|\ **-c**] [**-i** *identity*\|\ **-K** *key*] [**-q**]
Description
-----------
Given a particular entity, ``ndnsec-get-default`` can display its default setting as specified in
options. If ``identity`` is specified, the given entity becomes the identity. If ``key`` is
specified, the given identity becomes the key. If no entity is specified, the command will take the
system default identity as the given entity.
Given a particular entity, :program:`ndnsec-get-default` shows its default settings
according to the command-line options. By default, if neither **-i** nor **-K** is
given, the command displays the default identity or the default key/certificate of
the default identity.
Options
-------
``-k``
Display the given entity's default key name.
.. option:: -k, --default-key
``-c``
Display the given entity's default certificate name.
Display the chosen entity's default key name.
``-i identity``
Display default setting of the ``identity``
.. option:: -c, --default-cert
``-K key``
Display default setting of the ``key``.
Display the chosen entity's default certificate name.
``-q``
Disable trailling new line character.
.. option:: -i <identity>, --identity <identity>
Examples
--------
Display default settings of *identity*.
Display an identity's default key name.
.. option:: -K <key>, --key <key>
::
Display default settings of *key*.
.. option:: -q, --quiet
Disable printing the trailing newline character.
Example
-------
Display an identity's default key name::
$ ndnsec-get-default -k -i /ndn/test/alice
/ndn/test/alice/ksk-1394129695025
Display an identity's default certificate name.
::
Display an identity's default certificate name::
$ ndnsec-get-default -c -i /ndn/test/alice
/ndn/test/KEY/alice/ksk-1394129695025/ID-CERT/%FD%01D%98%9A%F2%3F
Display a key's default certificate name.
::
Display a key's default certificate name::
$ ndnsec-get-default -c -K /ndn/test/alice/ksk-1394129695025
/ndn/test/KEY/alice/ksk-1394129695025/ID-CERT/%FD%01D%98%9A%F2%3F
docs/manpages/ndnsec-import.rst
+16 -22
View File
@@ -1,39 +1,33 @@
ndnsec-import
=============
Usage
-----
Synopsis
--------
::
ndnsec-import [-h] input
**ndnsec-import** [**-h**] [**-P** *passphrase*] *file*
Description
-----------
``ndnsec-import`` imports a certificate and private key from a file created by ``ndnsec-export``. It
will ask for the passphrase used to encrypt the private key.
:program:`ndnsec-import` imports a certificate and its private key from a file
created by :program:`ndnsec-export`. It will ask for the passphrase used to
encrypt the private key.
If *file* is "-", read from the standard input.
Options
-------
``-h``
Print a help message.
.. option:: -P <passphrase>, --password <passphrase>
``-P passphrase``
Passphrase to use for the export. If not specified (or specified an empty passphrase), the
user is interactively asked to input the passphrase on the terminal. Note that specifying
passphrase via -P is insecure, as it can potentially end up in shell history, be visible in
ps output, etc.
Passphrase to use for the export. If empty or not specified, the user is
interactively asked to type the passphrase on the terminal. Note that
specifying the passphrase via this option is insecure, as it can potentially
end up in the shell's history, be visible in :command:`ps` output, and so on.
``input``
Read from an input file. Specify ``-`` to read from the standard input.
Example
-------
Examples
--------
Import a certificate and private key from a file:
::
Import a certificate and private key from a file::
$ ndnsec-import alice.ndnkey
docs/manpages/ndnsec-key-gen.rst
+23 -19
View File
@@ -1,38 +1,42 @@
ndnsec-key-gen
==============
``ndnsec-key-gen`` is tool to generate a pair of key.
Synopsis
--------
Usage
-----
::
ndnsec-key-gen [-h] [-n] [-d] [-t keyType] identity
**ndnsec-key-gen** [**-h**] [**-n**] [**-t** *type*] [**-k** *keyidtype*] *identity*
Description
-----------
``ndnsec-key-gen`` creates a key pair for the specified ``identity`` and sets the key as the
identity's default key. ``ndnsec-key-gen`` will also create a signing request for the generated key.
The signing request will be written to standard output in base64 encoding.
:program:`ndnsec-key-gen` generates a key pair for the specified *identity* and
sets the generated public key as the identity's default key.
:program:`ndnsec-key-gen` will also create a signing request for the generated key.
The signing request will be written to the standard output in base64 encoding.
By default, it will also set the identity as the system default identity.
By default, it will also set the identity as the user's default identity.
Options
-------
``-n``
Do not set the identity as the system default identity.
.. option:: -n, --not-default
Note that if it is the first identity/key/certificate, then it will be
set as default regardless of ``-n`` flag.
Do not set the identity as the user's default identity.
``-t keyType``
Specify the key type. ``r`` (default) for RSA key. ``e`` for ECDSA key.
Note that if no other identity/key/certificate exists, then the identity
will become the default regardless of this option.
Examples
--------
.. option:: -t <type>, --type <type>
Type of key to generate. "r" for RSA (default), "e" for ECDSA.
.. option:: -k <keyidtype>, --keyid-type <keyidtype>
Type of KeyId for the generated key. "r" for 64-bit random number (default),
"h" for SHA256 of the public key.
Example
-------
::
docs/manpages/ndnsec-list.rst
+19 -26
View File
@@ -1,24 +1,20 @@
ndnsec-list
===========
``ndnsec-list`` is a tool to display entities stored in **Public Information Base (PIB)**, such as
identities, keys, and certificates.
Synopsis
--------
Usage
-----
::
ndnsec-list [-h] [-KkCc]
**ndnsec-list** [**-h**] [**-k**\|\ **-c**]
Description
-----------
``ndnsec-list`` lists names of all the entities according to the granularity specified in options
(The default granularity is identity). The default entities will be marked with ``*`` in front of
their names. For example:
:program:`ndnsec-list` prints the names of all the entities stored in the
**Public Information Base (PIB)**, such as identities, keys, and certificates,
up to the given granularity level. By default, only the identity names are
shown. The default entities will be marked with a "*" in front of their names.
::
For example::
$ ndnsec list
* /ndn/edu/ucla/cs/yingdi
@@ -26,24 +22,23 @@ their names. For example:
/ndn/test/bob
/ndn/test/alice
Options
-------
``-K, -k``
Display key names for each identity. The key name with ``*`` in front is the default key name of
the corresponding identity.
.. option:: -k, --key
``-C, -c``
Display certificate names for each key. The certificate name with ``*`` in front is the default
certificate name of the corresponding key.
Display key names for each identity. The key name with a "*" in front is
the default key name of the corresponding identity.
Examples
--------
.. option:: -c, --cert
Display all the key names in PIB.
Display certificate names for each key. The certificate name with a "*"
in front is the default certificate name of the corresponding key.
::
Example
-------
Display all the key names in PIB::
$ ndnsec-list -k
* /ndn/edu/ucla/cs/yingdi
@@ -59,9 +54,7 @@ Display all the key names in PIB.
/ndn/test/alice
+->* /ndn/test/alice/ksk-1394129695025
Display all the certificate names in PIB.
::
Display all the certificate names in PIB::
$ ndnsec-list -c
* /ndn/edu/ucla/cs/yingdi
docs/manpages/ndnsec-set-default.rst
+19 -25
View File
@@ -1,49 +1,43 @@
ndnsec-set-default
==================
``ndnsec-set-default`` is a tool to change the default security settings.
Synopsis
--------
Usage
-----
::
ndnsec-set-default [-h] [-k|c] name
**ndnsec-set-default** [**-h**] [**-k**\|\ **-c**] *name*
Description
-----------
By default, ``ndnsec-set-default`` takes ``name`` as an identity name and sets the identity as the
system default identity.
:program:`ndnsec-set-default` allows changing the default security settings.
Without any options, *name*, which must be an identity name, is set as the
default identity for the current user.
Options
-------
``-k``
Set default key. ``name`` should be a key name, ``ndnsec-set-default`` can infer the corresponding
identity and set the key as the identity's default key.
.. option:: -k, --default-key
``-c``
Set default certificate. ``name`` should be a certificate name, ``ndnsec-set-default`` can
infer the corresponding key name and set the certificate as the key's default certificate.
Set *name*, which must be a key name, as the default key for the
corresponding identity.
Examples
--------
.. option:: -c, --default-cert
Set a key's default certificate:
Set *name*, which must be a certificate name, as the default certificate
for the corresponding key.
::
Example
-------
Set a key's default certificate::
$ ndnsec-set-default -c /ndn/test/KEY/alice/ksk-1394129695025/ID-CERT/%FD%01D%98%9A%F2%3F
Set an identity's default key:
::
Set an identity's default key::
$ ndnsec-set-default -k /ndn/test/alice/ksk-1394129695025
Set system default identity:
::
Set the user's default identity::
$ ndnsec-set-default /ndn/test/alice
docs/manpages/ndnsec-sign-req.rst
+17 -22
View File
@@ -1,37 +1,35 @@
ndnsec-sign-req
===============
``ndnsec-sign-req`` is a tool to generate a signing request for a particular key.
Synopsis
--------
Usage
-----
::
ndnsec-sign-req [-h] [-k] name
**ndnsec-sign-req** [**-h**] [**-k**] *name*
Description
-----------
The signing request of a key is actually a self-signed certificate. Given key's information,
``ndnsec-sign-req`` looks up the key in PIB. If such a key exists, a self-signed certificate of the
key, or its signing request, will be outputed to **stdout** with base64 encoding.
:program:`ndnsec-sign-req` generates a signing request for a key.
By default, ``name`` is interpreted as an identity name. ``ndnsec-sign-req`` will generate a
signing request for the identity's default key.
The signing request of a key is actually a self-signed certificate. Given the
key's information, :program:`ndnsec-sign-req` looks up the key in the PIB.
If such a key exists, a self-signed certificate for the key, i.e. its signing
request, is written to the standard output in base64 encoding.
By default, *name* is interpreted as an identity name, and the signing request
will be generated for that identity's default key.
Options
-------
``-k``
Interpret ``name`` as a key name.
.. option:: -k, --key
Examples
--------
Interpret *name* as a key name, instead of an identity name.
Create a signing request for an identity's default key.
Example
-------
::
Create a signing request for an identity's default key::
$ ndnsec-sign-req /ndn/test/david
Bv0DAAc9CANuZG4IBHRlc3QIBWRhdmlkCANLRVkIEWtzay0xMzk2OTk4Mzg5MjU3
@@ -52,10 +50,7 @@ Create a signing request for an identity's default key.
0wHjvDS1cuIH2j6XveoUYapRjZXaEZqB/YoBwRqEYq2KVn/ol5knLM6FIISXXjxn
cIh62A==
Create a signing request for a particular key.
::
Create a signing request for a particular key::
$ ndnsec-sign-req -k /ndn/test/david/ksk-1396913058196
Bv0DAAc9CANuZG4IBHRlc3QIBWRhdmlkCANLRVkIEWtzay0xMzk2OTEzMDU4MTk2
docs/manpages/ndnsec-unlock-tpm.rst
+5 -9
View File
@@ -1,17 +1,13 @@
ndnsec-unlock-tpm
=================
``ndnsec-unlock-tpm`` is a tool to (temporarily) unlock the **Trusted Platform Module (TPM)** that
manages private keys.
Synopsis
--------
Usage
-----
::
ndnsec-unlock-tpm [-h]
ndnsec-unlock-tpm [**-h**]
Description
-----------
``ndnsec-unlock-tpm`` will ask for password to unlock the TPM.
:program:`ndnsec-unlock-tpm` can be used to (temporarily) unlock the
**Trusted Platform Module (TPM)** that manages private keys.
docs/redmine_issue.py
-70
View File
@@ -1,70 +0,0 @@
# -*- Mode: python; py-indent-offset: 4; indent-tabs-mode: nil; coding: utf-8; -*-
# Based on http://doughellmann.com/2010/05/09/defining-custom-roles-in-sphinx.html
"""Integration of Sphinx with Redmine.
"""
from docutils import nodes, utils
from docutils.parsers.rst.roles import set_classes
def redmine_role(name, rawtext, text, lineno, inliner, options={}, content=[]):
"""Link to a Redmine issue.
Returns 2 part tuple containing list of nodes to insert into the
document and a list of system messages. Both are allowed to be
empty.
:param name: The role name used in the document.
:param rawtext: The entire markup snippet, with role.
:param text: The text marked with the role.
:param lineno: The line number where rawtext appears in the input.
:param inliner: The inliner instance that called us.
:param options: Directive options for customization.
:param content: The directive content for customization.
"""
try:
issue_num = int(text)
if issue_num <= 0:
raise ValueError
except ValueError:
msg = inliner.reporter.error(
'Redmine issue number must be a number greater than or equal to 1; '
'"%s" is invalid.' % text, line=lineno)
prb = inliner.problematic(rawtext, rawtext, msg)
return [prb], [msg]
app = inliner.document.settings.env.app
node = make_link_node(rawtext, app, 'issues', str(issue_num), options)
return [node], []
def make_link_node(rawtext, app, type, slug, options):
"""Create a link to a Redmine resource.
:param rawtext: Text being replaced with link node.
:param app: Sphinx application context
:param type: Link type (issue, changeset, etc.)
:param slug: ID of the thing to link to
:param options: Options dictionary passed to role func.
"""
#
try:
base = app.config.redmine_project_url
if not base:
raise AttributeError
except AttributeError:
raise ValueError('redmine_project_url configuration value is not set')
#
slash = '/' if base[-1] != '/' else ''
ref = base + slash + type + '/' + slug + '/'
set_classes(options)
node = nodes.reference(rawtext, 'Issue #' + utils.unescape(slug), refuri=ref,
**options)
return node
def setup(app):
"""Install the plugin.
:param app: Sphinx application context.
"""
app.add_role('issue', redmine_role)
app.add_config_value('redmine_project_url', None, 'env')
return
tools/ndnsec/cert-dump.cpp
+78 -111
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/*
* Copyright (c) 2013-2018 Regents of the University of California.
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -22,6 +22,7 @@
#include "ndnsec.hpp"
#include "util.hpp"
#include <boost/asio/ip/tcp.hpp>
#if BOOST_VERSION < 106700
#include <boost/date_time/posix_time/posix_time_duration.hpp>
#endif // BOOST_VERSION < 106700
@@ -35,39 +36,37 @@ ndnsec_cert_dump(int argc, char** argv)
namespace po = boost::program_options;
std::string name;
bool isKeyName = false;
bool isIdentityName = false;
bool isCertName = true;
// bool isFileName = false;
bool isKeyName = false;
bool isFileName = false;
bool isPretty = false;
bool isStdOut = true;
bool isRepoOut = false;
std::string repoHost;
std::string repoPort;
// bool isDnsOut = false;
po::options_description description("General Usage\n"
" ndnsec cert-dump [-h] [-p] [-d] [-r [-H repo-host] "
"[-P repo-port] ] [-i|k|f] name\n"
"General options");
po::options_description description(
"Usage: ndnsec cert-dump [-h] [-p] [-r [-H HOST] [-P PORT]] [-i|-k|-f] [-n] NAME\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("pretty,p", "display certificate in human readable format")
("identity,i", "treat the name parameter as identity name (e.g., /ndn/edu/ucla/alice")
("key,k", "treat the name parameter as key name "
"(e.g., /ndn/edu/ucla/alice/ksk-123456789)")
("file,f", "treat the name parameter as file name with base64 encoded certificate, "
"- for stdin")
("repo-output,r", "publish the certificate to the repo-ng")
("repo-host,H", po::value<std::string>(&repoHost)->default_value("localhost"),
"the repo host if repo-output is specified")
("repo-port,P", po::value<std::string>(&repoPort)->default_value("7376"),
"the repo port if repo-output is specified")
// ("dns-output,d", "published the certificate to NDNS")
("name,n", po::value<std::string>(&name),
"unless overridden with --identity or --key parameter, the certificate name, "
"for example, /ndn/edu/ucla/KEY/cs/alice/ksk-1234567890"
"/ID-CERT/%FD%FF%FF%FF%FF%FF%FF%FF")
("help,h", "produce help message")
("pretty,p", po::bool_switch(&isPretty), "display certificate in human readable format")
("identity,i", po::bool_switch(&isIdentityName),
"treat the NAME argument as an identity name (e.g., /ndn/edu/ucla/alice)")
("key,k", po::bool_switch(&isKeyName),
"treat the NAME argument as a key name (e.g., /ndn/edu/ucla/alice/ksk-123456789)")
("file,f", po::bool_switch(&isFileName),
"treat the NAME argument as the name of a file containing a base64-encoded "
"certificate, '-' for stdin")
("name,n", po::value<std::string>(&name),
"unless overridden by -i/-k/-f, the name of the certificate to be exported "
"(e.g., /ndn/edu/ucla/KEY/cs/alice/ksk-1234567890/ID-CERT/%FD%FF%FF%FF%FF%FF%FF%FF)")
("repo-output,r", po::bool_switch(&isRepoOut),
"publish the certificate into a repo-ng instance")
("repo-host,H", po::value<std::string>(&repoHost)->default_value("localhost"),
"repo hostname if --repo-output is specified")
("repo-port,P", po::value<std::string>(&repoPort)->default_value("7376"),
"repo port number if --repo-output is specified")
;
po::positional_options_description p;
@@ -79,119 +78,87 @@ ndnsec_cert_dump(int argc, char** argv)
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
if (vm.count("name") == 0) {
std::cerr << "identity_name must be specified" << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: you must specify a name" << std::endl;
return 2;
}
if (vm.count("key") != 0) {
isCertName = false;
isKeyName = true;
}
else if (vm.count("identity") != 0) {
isCertName = false;
isIdentityName = true;
}
else if (vm.count("file") != 0) {
isCertName = false;
// isFileName = true;
if (isIdentityName + isKeyName + isFileName > 1) {
std::cerr << "ERROR: at most one of '--identity', '--key', "
"or '--file' may be specified" << std::endl;
return 2;
}
if (vm.count("pretty") != 0)
isPretty = true;
if (vm.count("repo-output") != 0) {
isRepoOut = true;
isStdOut = false;
if (isPretty && isRepoOut) {
std::cerr << "ERROR: '--pretty' is incompatible with '--repo-output'" << std::endl;
return 2;
}
else if (vm.count("dns-output") != 0) {
// isDnsOut = true;
isStdOut = false;
std::cerr << "Error: DNS output is not supported yet!" << std::endl;
return 1;
}
if (isPretty && !isStdOut) {
std::cerr << "Error: pretty option can only be specified when other "
<< "output option is specified" << std::endl;
return 1;
}
security::v2::Certificate certificate;
security::v2::KeyChain keyChain;
security::v2::Certificate certificate;
try {
if (isIdentityName || isKeyName || isCertName) {
if (isIdentityName) {
certificate = keyChain.getPib()
.getIdentity(name)
.getDefaultKey()
.getDefaultCertificate();
}
else if (isKeyName) {
certificate = keyChain.getPib()
.getIdentity(security::v2::extractIdentityFromKeyName(name))
.getKey(name)
.getDefaultCertificate();
}
else {
certificate = keyChain.getPib()
.getIdentity(security::v2::extractIdentityFromCertName(name))
.getKey(security::v2::extractKeyNameFromCertName(name))
.getCertificate(name);
}
if (isIdentityName) {
certificate = keyChain.getPib()
.getIdentity(name)
.getDefaultKey()
.getDefaultCertificate();
}
else {
else if (isKeyName) {
certificate = keyChain.getPib()
.getIdentity(security::v2::extractIdentityFromKeyName(name))
.getKey(name)
.getDefaultCertificate();
}
else if (isFileName) {
certificate = loadCertificate(name);
}
}
catch (const security::Pib::Error& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
return 1;
else {
certificate = keyChain.getPib()
.getIdentity(security::v2::extractIdentityFromCertName(name))
.getKey(security::v2::extractKeyNameFromCertName(name))
.getCertificate(name);
}
}
catch (const CannotLoadCertificate&) {
std::cerr << "Cannot load certificate from `" << name << "`" << std::endl;
std::cerr << "ERROR: Cannot load the certificate from `" << name << "`" << std::endl;
return 1;
}
if (isPretty) {
std::cout << certificate << std::endl;
return 0;
}
else {
if (isStdOut) {
io::save(certificate, std::cout);
return 0;
}
if (isRepoOut) {
boost::asio::ip::tcp::iostream requestStream;
#if BOOST_VERSION >= 106700
requestStream.expires_after(std::chrono::seconds(3));
#else
requestStream.expires_from_now(boost::posix_time::seconds(3));
#endif // BOOST_VERSION >= 106700
requestStream.connect(repoHost, repoPort);
if (!requestStream) {
std::cerr << "fail to open the stream!" << std::endl;
return 1;
}
requestStream.write(reinterpret_cast<const char*>(certificate.wireEncode().wire()),
certificate.wireEncode().size());
return 0;
if (isRepoOut) {
boost::asio::ip::tcp::iostream requestStream;
#if BOOST_VERSION >= 106700
requestStream.expires_after(std::chrono::seconds(10));
#else
requestStream.expires_from_now(boost::posix_time::seconds(10));
#endif // BOOST_VERSION >= 106700
requestStream.connect(repoHost, repoPort);
if (!requestStream) {
std::cerr << "ERROR: Failed to connect to repo instance" << std::endl;
return 1;
}
requestStream.write(reinterpret_cast<const char*>(certificate.wireEncode().wire()),
certificate.wireEncode().size());
return 0;
}
io::save(certificate, std::cout);
return 0;
}
tools/ndnsec/cert-gen.cpp
+46 -61
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/*
* Copyright (c) 2013-2018 Regents of the University of California.
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -22,7 +22,10 @@
#include "ndnsec.hpp"
#include "util.hpp"
#include <boost/tokenizer.hpp>
#include "ndn-cxx/security/transform/base64-encode.hpp"
#include "ndn-cxx/security/transform/buffer-source.hpp"
#include "ndn-cxx/security/transform/public-key.hpp"
#include "ndn-cxx/security/transform/stream-sink.hpp"
namespace ndn {
namespace ndnsec {
@@ -30,43 +33,37 @@ namespace ndnsec {
int
ndnsec_cert_gen(int argc, char** argv)
{
using boost::tokenizer;
using boost::escaped_list_separator;
namespace po = boost::program_options;
namespace t = security::transform;
security::v2::KeyChain keyChain;
std::string requestFile;
std::string notBeforeStr;
std::string notAfterStr;
std::string requestFile("-");
Name signId;
std::vector<std::string> infos;
Name signId;
std::string issuerId;
po::options_description description(
"General Usage\n"
" ndnsec cert-gen [-h] [-S date] [-E date] [-I info] [-s sign-id] request\n"
"General options");
"Usage: ndnsec cert-gen [-h] [-S TIMESTAMP] [-E TIMESTAMP] [-I INFO]...\n"
" [-s IDENTITY] [-i ISSUER] [-r] FILE\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("request,r", po::value<std::string>(&requestFile)->default_value("-"),
"request file name, '-' for stdin (the default)")
("not-before,S", po::value<std::string>(&notBeforeStr),
"certificate starting date, YYYYMMDDhhmmss (default: now)")
"certificate validity start date/time in YYYYMMDDhhmmss format (default: now)")
("not-after,E", po::value<std::string>(&notAfterStr),
"certificate ending date, YYYYMMDDhhmmss (default: now + 365 days)")
"certificate validity end date/time in YYYYMMDDhhmmss format (default: "
"365 days after the --not-before timestamp)")
("info,I", po::value<std::vector<std::string>>(&infos),
"key and value (must be separated by a single space) of the additional "
"description to be included in the issued certificate, e.g., "
"\"affiliation University of California, Los Angeles\". "
"May be repeated multiple times")
("sign-id,s", po::value<Name>(&signId),
"signing identity")
("request,r", po::value<std::string>(&requestFile)->default_value("-"),
"request file name, - for stdin")
"description to be included in the issued certificate (e.g., "
"\"affiliation University of California, Los Angeles\"); "
"this option may be repeated multiple times")
("sign-id,s", po::value<Name>(&signId), "signing identity")
("issuer-id,i", po::value<std::string>(&issuerId)->default_value("NA"),
"issuer's ID to be included as part of the issued certificate name")
"issuer's ID to be included in the issued certificate name")
;
po::positional_options_description p;
@@ -78,11 +75,12 @@ ndnsec_cert_gen(int argc, char** argv)
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
@@ -90,10 +88,10 @@ ndnsec_cert_gen(int argc, char** argv)
security::v2::AdditionalDescription additionalDescription;
for (const auto& info : infos) {
size_t pos = info.find(" ");
auto pos = info.find(" ");
if (pos == std::string::npos) {
std::cerr << "ERROR: incorrectly formatted info block [" << info << "]" << std::endl;
return 1;
return 2;
}
std::string key = info.substr(0, pos);
std::string value = info.substr(pos + 1);
@@ -118,44 +116,36 @@ ndnsec_cert_gen(int argc, char** argv)
notAfter = time::fromIsoString(notAfterStr.substr(0, 8) + "T" + notAfterStr.substr(8, 6));
if (notAfter < notBefore) {
std::cerr << "ERROR: not-before cannot be later than not-after" << std::endl
<< std::endl
<< description << std::endl;
return 1;
std::cerr << "ERROR: '--not-before' cannot be later than '--not-after'" << std::endl;
return 2;
}
}
if (vm.count("request") == 0) {
std::cerr << "ERROR: request file must be specified" << std::endl
<< std::endl
<< description << std::endl;
security::v2::KeyChain keyChain;
security::v2::Certificate certRequest;
try {
certRequest = loadCertificate(requestFile);
}
catch (const CannotLoadCertificate&) {
std::cerr << "ERROR: Cannot load the request from `" << requestFile << "`" << std::endl;
return 1;
}
security::v2::Certificate certRequest = loadCertificate(requestFile);
// validate that the content is a public key
try {
Buffer keyContent = certRequest.getPublicKey();
t::PublicKey pubKey;
pubKey.loadPkcs8(keyContent.data(), keyContent.size());
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
return 1;
}
security::v2::Certificate cert;
Buffer keyContent = certRequest.getPublicKey();
security::transform::PublicKey pubKey;
pubKey.loadPkcs8(keyContent.data(), keyContent.size());
Name certName = certRequest.getKeyName();
certName
.append(issuerId)
.appendVersion();
security::v2::Certificate cert;
cert.setName(certName);
cert.setContent(certRequest.getContent());
// @TODO add ability to customize
// TODO: add ability to customize
cert.setFreshnessPeriod(1_h);
SignatureInfo signatureInfo;
@@ -174,15 +164,10 @@ ndnsec_cert_gen(int argc, char** argv)
keyChain.sign(cert, security::SigningInfo(identity).setSignatureInfo(signatureInfo));
Block wire = cert.wireEncode();
try {
t::bufferSource(wire.wire(), wire.size()) >> t::base64Encode(true) >> t::streamSink(std::cout);
}
catch (const t::Error& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
return 1;
const Block& wire = cert.wireEncode();
{
using namespace security::transform;
bufferSource(wire.wire(), wire.size()) >> base64Encode(true) >> streamSink(std::cout);
}
return 0;
tools/ndnsec/cert-install.cpp
+55 -54
View File
@@ -22,6 +22,12 @@
#include "ndnsec.hpp"
#include "util.hpp"
#include "ndn-cxx/encoding/buffer-stream.hpp"
#include "ndn-cxx/security/transform/base64-decode.hpp"
#include "ndn-cxx/security/transform/stream-sink.hpp"
#include "ndn-cxx/security/transform/stream-source.hpp"
#include <boost/asio/ip/tcp.hpp>
#if BOOST_VERSION < 106700
#include <boost/date_time/posix_time/posix_time_duration.hpp>
#endif // BOOST_VERSION < 106700
@@ -44,9 +50,9 @@ getCertificateHttp(const std::string& host, const std::string& port, const std::
{
boost::asio::ip::tcp::iostream requestStream;
#if BOOST_VERSION >= 106700
requestStream.expires_after(std::chrono::seconds(3));
requestStream.expires_after(std::chrono::seconds(10));
#else
requestStream.expires_from_now(boost::posix_time::seconds(3));
requestStream.expires_from_now(boost::posix_time::seconds(10));
#endif // BOOST_VERSION >= 106700
requestStream.connect(host, port);
@@ -85,7 +91,7 @@ getCertificateHttp(const std::string& host, const std::string& port, const std::
while (std::getline(requestStream, header) && header != "\r")
;
ndn::OBufferStream os;
OBufferStream os;
{
using namespace ndn::security::transform;
streamSource(requestStream) >> base64Decode(true) >> streamSink(os);
@@ -99,21 +105,29 @@ ndnsec_cert_install(int argc, char** argv)
{
namespace po = boost::program_options;
std::string certFileName;
bool isSystemDefault = true;
std::string certFile;
bool isIdentityDefault = false;
bool isKeyDefault = false;
bool isNoDefault = false;
po::options_description description("General Usage\n ndnsec cert-install [-h] [-I|K|N] cert-file\nGeneral options");
po::options_description description(
"Usage: ndnsec cert-install [-h] [-I|-K|-N] [-f] FILE\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("cert-file,f", po::value<std::string>(&certFileName), "file name of the ceritificate, - for stdin. "
"If starts with http://, will try to fetch "
"the certificate using HTTP GET request")
("identity-default,I", "optional, if specified, the certificate will be set as the default certificate of the identity")
("key-default,K", "optional, if specified, the certificate will be set as the default certificate of the key")
("no-default,N", "optional, if specified, the certificate will be simply installed")
("cert-file,f", po::value<std::string>(&certFile),
"file name of the certificate to be imported, '-' for stdin; "
"if it starts with 'http://', the certificate will be fetched "
"using a plain HTTP/1.0 GET request")
("identity-default,I", po::bool_switch(&isIdentityDefault),
"set the imported certificate as the default certificate for the identity")
("key-default,K", po::bool_switch(&isKeyDefault),
"set the imported certificate as the default certificate for the key")
("no-default,N", po::bool_switch(&isNoDefault),
"do not change any default settings")
;
po::positional_options_description p;
p.add("cert-file", 1);
@@ -123,97 +137,84 @@ ndnsec_cert_install(int argc, char** argv)
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
if (vm.count("cert-file") == 0) {
std::cerr << "cert_file must be specified" << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: you must specify a file name" << std::endl;
return 2;
}
if (vm.count("identity-default") != 0) {
isIdentityDefault = true;
isSystemDefault = false;
}
else if (vm.count("key-default") != 0) {
isKeyDefault = true;
isSystemDefault = false;
}
else if (vm.count("no-default") != 0) {
// noDefault = true;
isSystemDefault = false;
if (isIdentityDefault + isKeyDefault + isNoDefault > 1) {
std::cerr << "ERROR: at most one of '--identity-default', '--key-default', "
"or '--no-default' may be specified" << std::endl;
return 2;
}
security::v2::Certificate cert;
try {
if (certFileName.find("http://") == 0) {
if (certFile.find("http://") == 0) {
std::string host;
std::string port;
std::string path;
size_t pos = 7; // offset of "http://"
size_t posSlash = certFileName.find("/", pos);
size_t posSlash = certFile.find("/", pos);
if (posSlash == std::string::npos)
NDN_THROW(HttpException("Request line is not correctly formatted"));
size_t posPort = certFileName.find(":", pos);
size_t posPort = certFile.find(":", pos);
if (posPort != std::string::npos && posPort < posSlash) {
// port is specified
port = certFileName.substr(posPort + 1, posSlash - posPort - 1);
host = certFileName.substr(pos, posPort - pos);
port = certFile.substr(posPort + 1, posSlash - posPort - 1);
host = certFile.substr(pos, posPort - pos);
}
else {
port = "80";
host = certFileName.substr(pos, posSlash - pos);
host = certFile.substr(pos, posSlash - pos);
}
path = certFileName.substr(posSlash, certFileName.size() - posSlash);
path = certFile.substr(posSlash, certFile.size() - posSlash);
cert = getCertificateHttp(host, port, path);
}
else {
cert = loadCertificate(certFileName);
cert = loadCertificate(certFile);
}
}
catch (const CannotLoadCertificate&) {
std::cerr << "ERROR: Cannot load the certificate " << certFileName << std::endl;
std::cerr << "ERROR: Cannot load the certificate from `" << certFile << "`" << std::endl;
return 1;
}
security::v2::KeyChain keyChain;
security::Identity id;
security::Key key;
try {
id = keyChain.getPib().getIdentity(cert.getIdentity());
key = id.getKey(cert.getKeyName());
}
catch (const security::Pib::Error& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
}
auto id = keyChain.getPib().getIdentity(cert.getIdentity());
auto key = id.getKey(cert.getKeyName());
keyChain.addCertificate(key, cert);
if (isSystemDefault) {
keyChain.setDefaultIdentity(id);
keyChain.setDefaultKey(id, key);
keyChain.setDefaultCertificate(key, cert);
}
else if (isIdentityDefault) {
if (isIdentityDefault) {
keyChain.setDefaultKey(id, key);
keyChain.setDefaultCertificate(key, cert);
}
else if (isKeyDefault) {
keyChain.setDefaultCertificate(key, cert);
}
else if (!isNoDefault) {
keyChain.setDefaultIdentity(id);
keyChain.setDefaultKey(id, key);
keyChain.setDefaultCertificate(key, cert);
}
std::cerr << "OK: certificate with name [" << cert.getName().toUri() << "] "
<< "has been successfully installed" << std::endl;
tools/ndnsec/delete.cpp
+29 -34
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/**
* Copyright (c) 2013-2017 Regents of the University of California.
/*
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -30,20 +30,22 @@ ndnsec_delete(int argc, char** argv)
{
namespace po = boost::program_options;
bool isDeleteKey = false;
bool isDeleteCert = false;
bool wantDeleteKey = false;
bool wantDeleteCert = false;
std::string name;
po::options_description description("General Usage\n"
"ndnsec delete [-h] [-k|c] name\n"
"General options");
po::options_description description(
"Usage: ndnsec delete [-h] [-k|-c] [-n] NAME\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("delete-key,k", "(Optional) delete a key if specified.")
("delete-cert,c", "(Optional) delete a certificate if specified.")
("name,n", po::value<std::string>(&name), "By default, it refers to an identity."
"If -k is specified, it refers to a key."
"If -c is specified, it refers to a certificate.");
("delete-key,k", po::bool_switch(&wantDeleteKey), "delete a key")
("delete-cert,c", po::bool_switch(&wantDeleteCert), "delete a certificate")
("name,n", po::value<std::string>(&name),
"name of the item to delete. By default, it refers to an identity. "
"If -k is specified, it refers to a key. "
"If -c is specified, it refers to a certificate.");
;
po::positional_options_description p;
@@ -55,63 +57,56 @@ ndnsec_delete(int argc, char** argv)
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << description << std::endl;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
if (vm.count("name") == 0) {
std::cerr << "ERROR: name must be specified" << std::endl;
std::cerr << description << std::endl;
std::cerr << "ERROR: you must specify a name" << std::endl;
return 2;
}
if (vm.count("delete-cert") != 0) {
isDeleteCert = true;
}
else if (vm.count("delete-key") != 0) {
isDeleteKey = true;
if (wantDeleteKey && wantDeleteCert) {
std::cerr << "ERROR: cannot specify both '--delete-key' and '--delete-cert'" << std::endl;
return 2;
}
security::v2::KeyChain keyChain;
try {
if (isDeleteCert) {
if (wantDeleteCert) {
security::Key key = keyChain.getPib()
.getIdentity(security::v2::extractIdentityFromCertName(name))
.getKey(security::v2::extractKeyNameFromCertName(name));
keyChain.deleteCertificate(key, key.getCertificate(name).getName());
std::cerr << "OK: Delete certificate: " << name << std::endl;
std::cerr << "OK: certificate deleted: " << name << std::endl;
}
else if (isDeleteKey) {
else if (wantDeleteKey) {
security::Identity identity = keyChain.getPib()
.getIdentity(security::v2::extractIdentityFromKeyName(name));
keyChain.deleteKey(identity, identity.getKey(name));
std::cerr << "OK: Delete key: " << name << std::endl;
std::cerr << "OK: key deleted: " << name << std::endl;
}
else {
keyChain.deleteIdentity(keyChain.getPib().getIdentity(name));
std::cerr << "OK: Delete identity: " << name << std::endl;
std::cerr << "OK: identity deleted: " << name << std::endl;
}
}
catch (const security::Pib::Error& e) {
std::cerr << "ERROR: Cannot delete the item: " << e.what() << std::endl;
return 2;
return 1;
}
catch (const security::Tpm::Error& e) {
std::cerr << "ERROR: Cannot delete the item: " << e.what() << std::endl;
return 2;
}
catch (const security::v2::KeyChain::Error& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
return 2;
return 1;
}
return 0;
tools/ndnsec/export.cpp
+48 -49
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/*
* Copyright (c) 2013-2018 Regents of the University of California.
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -22,6 +22,10 @@
#include "ndnsec.hpp"
#include "util.hpp"
#include "ndn-cxx/security/impl/openssl.hpp"
#include <boost/scope_exit.hpp>
namespace ndn {
namespace ndnsec {
@@ -32,16 +36,23 @@ ndnsec_export(int argc, char** argv)
Name identityName;
std::string output;
std::string exportPassword;
std::string password;
po::options_description description("General Usage\n"
" ndnsec export [-h] [-o output] [-P passphrase] identity \n"
"General options");
BOOST_SCOPE_EXIT(&password) {
OPENSSL_cleanse(&password.front(), password.size());
} BOOST_SCOPE_EXIT_END
po::options_description description(
"Usage: ndnsec export [-h] [-o FILE] [-P PASSPHRASE] [-i] IDENTITY\n"
"\n"
"Options");
description.add_options()
("help,h", "Produce help message")
("output,o", po::value<std::string>(&output), "(Optional) output file, stdout if not specified")
("identity,i", po::value<Name>(&identityName), "Identity to export")
("password,P", po::value<std::string>(&exportPassword), "Passphrase (will prompt if empty or not specified)")
("help,h", "produce help message")
("identity,i", po::value<Name>(&identityName), "name of the identity to export")
("output,o", po::value<std::string>(&output)->default_value("-"),
"output file, '-' for stdout (the default)")
("password,P", po::value<std::string>(&password),
"passphrase, will prompt if empty or not specified")
;
po::positional_options_description p;
@@ -53,58 +64,46 @@ ndnsec_export(int argc, char** argv)
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
if (vm.count("identity") == 0) {
std::cerr << "ERROR: identity must be specified" << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: you must specify an identity" << std::endl;
return 2;
}
if (vm.count("output") == 0)
output = "-";
security::v2::KeyChain keyChain;
try {
if (exportPassword.empty()) {
int count = 3;
while (!getPassword(exportPassword, "Passphrase for the private key: ")) {
count--;
if (count <= 0) {
std::cerr << "ERROR: invalid password" << std::endl;
memset(const_cast<char*>(exportPassword.c_str()), 0, exportPassword.size());
return 1;
}
auto id = keyChain.getPib().getIdentity(identityName);
if (password.empty()) {
int count = 3;
while (!getPassword(password, "Passphrase for the private key: ")) {
count--;
if (count <= 0) {
std::cerr << "ERROR: invalid password" << std::endl;
return 1;
}
}
security::v2::KeyChain keyChain;
security::Identity id = keyChain.getPib().getIdentity(identityName);
// @TODO export all certificates, selected key pair, selected certificate
shared_ptr<security::SafeBag> safeBag = keyChain.exportSafeBag(id.getDefaultKey().getDefaultCertificate(),
exportPassword.c_str(), exportPassword.size());
memset(const_cast<char*>(exportPassword.c_str()), 0, exportPassword.size());
if (output == "-")
io::save(*safeBag, std::cout);
else
io::save(*safeBag, output);
return 0;
}
catch (const std::runtime_error& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
memset(const_cast<char*>(exportPassword.c_str()), 0, exportPassword.size());
return 1;
}
// TODO: export all certificates, selected key pair, selected certificate
auto safeBag = keyChain.exportSafeBag(id.getDefaultKey().getDefaultCertificate(),
password.data(), password.size());
if (output == "-")
io::save(*safeBag, std::cout);
else
io::save(*safeBag, output);
return 0;
}
} // namespace ndnsec
tools/ndnsec/get-default.cpp
+49 -60
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/**
* Copyright (c) 2013-2017 Regents of the University of California.
/*
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -30,23 +30,23 @@ ndnsec_get_default(int argc, char** argv)
{
namespace po = boost::program_options;
bool isGetDefaultId = true;
bool isGetDefaultKey = false;
bool isGetDefaultCert = false;
bool wantDefaultKey = false;
bool wantDefaultCert = false;
bool isQuiet = false;
Name identityName;
Name keyName;
po::options_description description("General Usage\n"
" ndnsec get-default [-h] [-k|c] [-i identity|-K key] [-q]\n"
"General options");
po::options_description description(
"Usage: ndnsec get-default [-h] [-k|-c] [-i ID|-K KEY] [-q]\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("default_key,k", "get default key")
("default_cert,c", "get default certificate")
("identity,i", po::value<Name>(&identityName), "target identity")
("key,K", po::value<Name>(&keyName), "target key")
("quiet,q", "don't output trailing newline")
("default-key,k", po::bool_switch(&wantDefaultKey), "show default key, instead of identity")
("default-cert,c", po::bool_switch(&wantDefaultCert), "show default certificate, instead of identity")
("identity,i", po::value<Name>(&identityName), "target identity")
("key,K", po::value<Name>(&keyName), "target key")
("quiet,q", po::bool_switch(&isQuiet), "do not print trailing newline")
;
po::variables_map vm;
@@ -55,86 +55,75 @@ ndnsec_get_default(int argc, char** argv)
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
if (vm.count("default_cert") != 0) {
isGetDefaultCert = true;
isGetDefaultId = false;
}
else if (vm.count("default_key") != 0) {
isGetDefaultKey = true;
isGetDefaultId = false;
if (wantDefaultKey && wantDefaultCert) {
std::cerr << "ERROR: cannot specify both '--default-key' and '--default-cert'" << std::endl;
return 2;
}
if (vm.count("quiet") != 0) {
isQuiet = true;
if (vm.count("identity") && vm.count("key")) {
std::cerr << "ERROR: cannot specify both '--identity' and '--key'" << std::endl;
return 2;
}
security::v2::KeyChain keyChain;
if (vm.count("key") != 0) {
if (isGetDefaultCert) {
std::cout << keyChain.getPib()
.getIdentity(security::v2::extractIdentityFromKeyName(keyName))
.getKey(keyName)
.getDefaultCertificate().getName();
if (vm.count("key") > 0) {
if (wantDefaultCert) {
auto cert = keyChain.getPib()
.getIdentity(security::v2::extractIdentityFromKeyName(keyName))
.getKey(keyName)
.getDefaultCertificate();
std::cout << cert.getName();
if (!isQuiet) {
std::cout << std::endl;
}
return 0;
}
return 1;
return 2;
}
else if (vm.count("identity") != 0) {
security::Key key = keyChain.getPib()
.getIdentity(identityName)
.getDefaultKey();
if (isGetDefaultKey) {
else if (vm.count("identity") > 0) {
auto key = keyChain.getPib()
.getIdentity(identityName)
.getDefaultKey();
if (wantDefaultKey) {
std::cout << key.getName();
if (!isQuiet)
std::cout << std::endl;
return 0;
}
if (isGetDefaultCert) {
if (wantDefaultCert) {
std::cout << key.getDefaultCertificate().getName();
if (!isQuiet)
std::cout << std::endl;
return 0;
}
return 1;
return 2;
}
else {
security::Identity identity = keyChain.getPib().getDefaultIdentity();
if (isGetDefaultId) {
std::cout << identity.getName();
if (!isQuiet)
std::cout << std::endl;
return 0;
}
if (isGetDefaultKey) {
auto identity = keyChain.getPib()
.getDefaultIdentity();
if (wantDefaultKey) {
std::cout << identity.getDefaultKey().getName();
if (!isQuiet)
std::cout << std::endl;
return 0;
}
if (isGetDefaultCert) {
else if (wantDefaultCert) {
std::cout << identity.getDefaultKey().getDefaultCertificate().getName();
if (!isQuiet)
std::cout << std::endl;
return 0;
}
return 1;
else {
std::cout << identity.getName();
}
if (!isQuiet)
std::cout << std::endl;
return 0;
}
}
tools/ndnsec/import.cpp
+41 -38
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/*
* Copyright (c) 2013-2018 Regents of the University of California.
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -22,6 +22,10 @@
#include "ndnsec.hpp"
#include "util.hpp"
#include "ndn-cxx/security/impl/openssl.hpp"
#include <boost/scope_exit.hpp>
namespace ndn {
namespace ndnsec {
@@ -30,16 +34,23 @@ ndnsec_import(int argc, char** argv)
{
namespace po = boost::program_options;
std::string input("-");
std::string importPassword;
std::string input;
std::string password;
po::options_description description("General Usage\n"
" ndnsec import [-h] [-P passphrase] input \n"
"General options");
BOOST_SCOPE_EXIT(&password) {
OPENSSL_cleanse(&password.front(), password.size());
} BOOST_SCOPE_EXIT_END
po::options_description description(
"Usage: ndnsec import [-h] [-P PASSPHRASE] [-i] FILE\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("input,i", po::value<std::string>(&input), "input source, stdin if -")
("password,P", po::value<std::string>(&importPassword), "Passphrase (will prompt if empty or not specified)")
("input,i", po::value<std::string>(&input)->default_value("-"),
"input file, '-' for stdin (the default)")
("password,P", po::value<std::string>(&password),
"passphrase, will prompt if empty or not specified")
;
po::positional_options_description p;
@@ -51,46 +62,38 @@ ndnsec_import(int argc, char** argv)
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
try {
security::v2::KeyChain keyChain;
security::v2::KeyChain keyChain;
shared_ptr<security::SafeBag> safeBag;
if (input == "-")
safeBag = io::load<security::SafeBag>(std::cin);
else
safeBag = io::load<security::SafeBag>(input);
shared_ptr<security::SafeBag> safeBag;
if (input == "-")
safeBag = io::load<security::SafeBag>(std::cin);
else
safeBag = io::load<security::SafeBag>(input);
if (importPassword.empty()) {
int count = 3;
while (!getPassword(importPassword, "Passphrase for the private key: ", false)) {
count--;
if (count <= 0) {
std::cerr << "ERROR: Fail to get password" << std::endl;
memset(const_cast<char*>(importPassword.c_str()), 0, importPassword.size());
return 1;
}
if (password.empty()) {
int count = 3;
while (!getPassword(password, "Passphrase for the private key: ", false)) {
count--;
if (count <= 0) {
std::cerr << "ERROR: invalid password" << std::endl;
return 1;
}
}
}
keyChain.importSafeBag(*safeBag, importPassword.c_str(), importPassword.size());
memset(const_cast<char*>(importPassword.c_str()), 0, importPassword.size());
return 0;
}
catch (const std::runtime_error& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
memset(const_cast<char*>(importPassword.c_str()), 0, importPassword.size());
return 1;
}
keyChain.importSafeBag(*safeBag, password.data(), password.size());
return 0;
}
} // namespace ndnsec
tools/ndnsec/key-gen.cpp
+90 -100
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/*
* Copyright (c) 2013-2018 Regents of the University of California.
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -28,37 +28,28 @@ namespace ndnsec {
int
ndnsec_key_gen(int argc, char** argv)
{
using namespace ndn;
namespace po = boost::program_options;
Name identityName;
bool isDefault = true;
bool isUserSpecified = false;
char keyType = 'r';
char keyIdTypeChoice = 'r';
std::string specifiedKeyId;
Name::Component specifiedKeyIdComponent;
std::string outputFilename;
KeyIdType keyIdType = KeyIdType::RANDOM;
bool wantNotDefault = false;
char keyTypeChoice;
char keyIdTypeChoice;
std::string userKeyId;
po::options_description description("General Usage\n"
" ndnsec key-gen [-h] [-n] identity\n"
"General options");
po::options_description description(
"Usage: ndnsec key-gen [-h] [-n] [-t TYPE] [-k IDTYPE] [-i] IDENTITY\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("identity,i", po::value<Name>(&identityName),
"identity name, for example, /ndn/edu/ucla/alice")
("not_default,n",
"optional, if not specified, the target identity will be set as "
"the default identity of the system")
("type,t", po::value<char>(&keyType),
"optional, key type, r for RSA key (default), e for EC key")
("key_id_type,k", po::value<char>(&keyIdTypeChoice),
"optional, key id type, r for 64-bit random number (default), h for SHA256 of the public key")
("key_id", po::value<std::string>(&specifiedKeyId),
"optional, user-specified key id, cannot be used with key_id_type")
// ("size,s", po::value<int>(&keySize)->default_value(2048),
// "optional, key size, 2048 (default)")
("identity,i", po::value<Name>(&identityName), "identity name, e.g., /ndn/edu/ucla/alice")
("not-default,n", po::bool_switch(&wantNotDefault), "do not set the identity as default")
("type,t", po::value<char>(&keyTypeChoice)->default_value('r'),
"key type, 'r' for RSA, 'e' for ECDSA")
("keyid-type,k", po::value<char>(&keyIdTypeChoice)->default_value('r'),
"key id type, 'r' for 64-bit random number, 'h' for SHA256 of the public key")
("keyid", po::value<std::string>(&userKeyId), "user-specified key id")
//("size,s", po::value<int>(&keySize)->default_value(2048), "key size in bits")
;
po::positional_options_description p;
@@ -70,101 +61,100 @@ ndnsec_key_gen(int argc, char** argv)
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
if (vm.count("identity") == 0) {
std::cerr << "identity must be specified\n" << description << std::endl;
return 1;
std::cerr << "ERROR: you must specify an identity" << std::endl;
return 2;
}
if (vm.count("not_default") != 0) {
isDefault = false;
}
KeyIdType keyIdType = KeyIdType::RANDOM;
Name::Component userKeyIdComponent;
if (vm.count("key_id_type") != 0) {
if (keyIdTypeChoice == 'r') {
// KeyIdType has already been set to KeyIdType::RANDOM
if (vm.count("keyid") > 0) {
keyIdType = KeyIdType::USER_SPECIFIED;
userKeyIdComponent = name::Component::fromEscapedString(userKeyId);
if (userKeyIdComponent.empty()) {
std::cerr << "ERROR: key id cannot be an empty name component" << std::endl;
return 2;
}
else if (keyIdTypeChoice == 'h') {
if (!userKeyIdComponent.isGeneric()) {
std::cerr << "ERROR: key id must be a GenericNameComponent" << std::endl;
return 2;
}
}
if (vm.count("keyid-type") > 0) {
if (keyIdType == KeyIdType::USER_SPECIFIED) {
std::cerr << "ERROR: cannot specify both '--keyid' and '--keyid-type'" << std::endl;
return 2;
}
switch (keyIdTypeChoice) {
case 'r':
// KeyIdType::RANDOM is the default
break;
case 'h':
keyIdType = KeyIdType::SHA256;
break;
default:
std::cerr << "ERROR: unrecognized key id type '" << keyIdTypeChoice << "'" << std::endl;
return 2;
}
}
unique_ptr<KeyParams> params;
switch (keyTypeChoice) {
case 'r':
if (keyIdType == KeyIdType::USER_SPECIFIED) {
params = make_unique<RsaKeyParams>(userKeyIdComponent);
}
else {
std::cerr << "Unrecognized key id type\n" << description << std::endl;
return 1;
params = make_unique<RsaKeyParams>(detail::RsaKeyParamsInfo::getDefaultSize(), keyIdType);
}
if (vm.count("key_id") != 0) {
std::cerr << "key_id cannot be used with key_id_type\n" << description << std::endl;
return 1;
break;
case 'e':
if (keyIdType == KeyIdType::USER_SPECIFIED) {
params = make_unique<EcKeyParams>(userKeyIdComponent);
}
else {
params = make_unique<EcKeyParams>(detail::EcKeyParamsInfo::getDefaultSize(), keyIdType);
}
break;
default:
std::cerr << "ERROR: unrecognized key type '" << keyTypeChoice << "'" << std::endl;
return 2;
}
if (vm.count("key_id") != 0) {
isUserSpecified = true;
specifiedKeyIdComponent = name::Component::fromEscapedString(specifiedKeyId);
if (specifiedKeyIdComponent.empty()) {
std::cerr << "Key id cannot be an empty name component\n" << description << std::endl;
return 1;
}
if (!specifiedKeyIdComponent.isGeneric()) {
std::cerr << "Key id must be a generic name component\n" << description << std::endl;
return 1;
}
}
security::v2::KeyChain keyChain;
security::Identity identity;
security::Key key;
try {
unique_ptr<KeyParams> params;
if (keyType == 'r') {
if (isUserSpecified) {
params = make_unique<RsaKeyParams>(specifiedKeyIdComponent);
}
else {
params = make_unique<RsaKeyParams>(detail::RsaKeyParamsInfo::getDefaultSize(), keyIdType);
}
}
else if (keyType == 'e') {
if (isUserSpecified) {
params = make_unique<EcKeyParams>(specifiedKeyIdComponent);
}
else {
params = make_unique<EcKeyParams>(detail::EcKeyParamsInfo::getDefaultSize(), keyIdType);
}
}
else {
std::cerr << "Unrecognized key type\n" << description << std::endl;
return 1;
}
security::v2::KeyChain keyChain;
security::Identity identity;
security::Key key;
try {
identity = keyChain.getPib().getIdentity(identityName);
key = keyChain.createKey(identity, *params);
}
catch (const security::Pib::Error&) {
// identity doesn't exist, so create it and generate key
identity = keyChain.createIdentity(identityName, *params);
key = identity.getDefaultKey();
}
if (isDefault) {
keyChain.setDefaultKey(identity, key);
keyChain.setDefaultIdentity(identity);
}
io::save(key.getDefaultCertificate(), std::cout);
identity = keyChain.getPib().getIdentity(identityName);
key = keyChain.createKey(identity, *params);
}
catch (const std::exception& e) {
std::cerr << "Error: " << e.what() << std::endl;
catch (const security::Pib::Error&) {
// identity doesn't exist, so create it and generate key
identity = keyChain.createIdentity(identityName, *params);
key = identity.getDefaultKey();
}
if (!wantNotDefault) {
keyChain.setDefaultKey(identity, key);
keyChain.setDefaultIdentity(identity);
}
io::save(key.getDefaultCertificate(), std::cout);
return 0;
}
tools/ndnsec/list.cpp
+27 -27
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/*
* Copyright (c) 2013-2018 Regents of the University of California.
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -30,13 +30,14 @@ namespace ndnsec {
class Printer
{
public:
explicit
Printer(int verboseLevel)
: m_verboseLevel(verboseLevel)
{
}
void
printIdentity(const security::Identity& identity, bool isDefault)
printIdentity(const security::Identity& identity, bool isDefault) const
{
if (isDefault)
std::cout << "* ";
@@ -63,7 +64,7 @@ public:
}
void
printKey(const security::Key& key, bool isDefault)
printKey(const security::Key& key, bool isDefault) const
{
if (isDefault)
std::cout << " +->* ";
@@ -88,7 +89,7 @@ public:
}
void
printCertificate(const security::v2::Certificate& cert, bool isDefault)
printCertificate(const security::v2::Certificate& cert, bool isDefault) const
{
if (isDefault)
std::cout << " +->* ";
@@ -110,52 +111,49 @@ private:
int
ndnsec_list(int argc, char** argv)
{
using namespace ndn;
namespace po = boost::program_options;
bool wantKey = false;
bool wantCert = false;
int verboseLevel = 0; // 0 print identity only
// 1 print key name
// 2 print cert name
// 3 print cert content
po::options_description options("General Usage\n ndnsec list [-h] [-k|c]\nGeneral options");
options.add_options()
("help,h", "produce help message")
("key,k", "granularity: key")
("cert,c", "granularity: certificate")
po::options_description description(
"Usage: ndnsec list [-h] [-k] [-c] [-v]\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("key,k", po::bool_switch(&wantKey), "list all keys associated with each identity")
("cert,c", po::bool_switch(&wantCert), "list all certificates associated with each key")
("verbose,v", accumulator<int>(&verboseLevel),
"verbose mode: -v is equivalent to -k, -vv is equivalent to -c")
"verbose mode, can be repeated for increased verbosity: -v is equivalent to -k, "
"-vv is equivalent to -c, -vvv shows detailed information for each certificate")
;
po::variables_map vm;
try {
po::store(po::parse_command_line(argc, argv, options), vm);
po::store(po::parse_command_line(argc, argv, description), vm);
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << options << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << options << std::endl;
;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
int tmpVerboseLevel = 0;
if (vm.count("cert") != 0)
tmpVerboseLevel = 2;
else if (vm.count("key") != 0)
tmpVerboseLevel = 1;
verboseLevel = std::max(verboseLevel, tmpVerboseLevel);
verboseLevel = std::max(verboseLevel, wantCert ? 2 : wantKey ? 1 : 0);
security::v2::KeyChain keyChain;
Printer printer(verboseLevel);
// TODO add API to check for default identity (may be from the identity itself)
// TODO: add API to check for default identity (may be from the identity itself)
security::Identity defaultIdentity;
try {
defaultIdentity = keyChain.getPib().getDefaultIdentity();
@@ -163,6 +161,8 @@ ndnsec_list(int argc, char** argv)
catch (const security::Pib::Error&) {
// no default identity
}
Printer printer(verboseLevel);
for (const auto& identity : keyChain.getPib().getIdentities()) {
printer.printIdentity(identity, identity == defaultIdentity);
}
tools/ndnsec/set-default.cpp
+35 -36
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/**
* Copyright (c) 2013-2017 Regents of the University of California.
/*
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -30,70 +30,69 @@ ndnsec_set_default(int argc, char** argv)
{
namespace po = boost::program_options;
std::string certFileName;
bool isSetDefaultId = true;
bool isSetDefaultKey = false;
bool isSetDefaultCert = false;
Name name;
bool wantSetDefaultKey = false;
bool wantSetDefaultCert = false;
po::options_description description("General Usage\n ndnsec set-default [-h] [-k|c] name\nGeneral options");
po::options_description description(
"Usage: ndnsec set-default [-h] [-k|-c] [-n] NAME\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("default_key,k", po::bool_switch(&isSetDefaultKey), "set default key of the identity")
("default_cert,c", po::bool_switch(&isSetDefaultCert), "set default certificate of the key")
("name,n", po::value<Name>(&name), "the identity/key/certificate name to set")
("name,n", po::value<Name>(&name), "the identity/key/certificate name to set")
("default-key,k", po::bool_switch(&wantSetDefaultKey), "set default key of the identity")
("default-cert,c", po::bool_switch(&wantSetDefaultCert), "set default certificate of the key")
;
po::positional_options_description p;
p.add("name", 1);
po::variables_map vm;
try {
po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
if (vm.count("name") == 0) {
std::cerr << "ERROR: name is required!" << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: you must specify a name" << std::endl;
return 2;
}
isSetDefaultId = !isSetDefaultKey && !isSetDefaultCert;
if (wantSetDefaultKey && wantSetDefaultCert) {
std::cerr << "ERROR: cannot specify both '--default-key' and '--default-cert'" << std::endl;
return 2;
}
security::v2::KeyChain keyChain;
if (isSetDefaultId) {
security::Identity identity = keyChain.getPib().getIdentity(name);
keyChain.setDefaultIdentity(identity);
return 0;
}
if (isSetDefaultKey) {
security::Identity identity = keyChain.getPib().getIdentity(security::v2::extractIdentityFromKeyName(name));
security::Key key = identity.getKey(name);
if (wantSetDefaultKey) {
auto identity = keyChain.getPib().getIdentity(security::v2::extractIdentityFromKeyName(name));
auto key = identity.getKey(name);
keyChain.setDefaultKey(identity, key);
return 0;
}
if (isSetDefaultCert) {
security::Identity identity = keyChain.getPib().getIdentity(security::v2::extractIdentityFromCertName(name));
security::Key key = identity.getKey(security::v2::extractKeyNameFromCertName(name));
security::v2::Certificate cert = key.getCertificate(name);
else if (wantSetDefaultCert) {
auto identity = keyChain.getPib().getIdentity(security::v2::extractIdentityFromCertName(name));
auto key = identity.getKey(security::v2::extractKeyNameFromCertName(name));
auto cert = key.getCertificate(name);
keyChain.setDefaultCertificate(key, cert);
return 0;
}
else {
auto identity = keyChain.getPib().getIdentity(name);
keyChain.setDefaultIdentity(identity);
}
return 1;
return 0;
}
} // namespace ndnsec
tools/ndnsec/sign-req.cpp
+16 -19
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/*
* Copyright (c) 2013-2018 Regents of the University of California.
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -34,13 +34,14 @@ ndnsec_sign_req(int argc, char** argv)
bool isKeyName = false;
po::options_description description(
"General Usage\n ndnsec sign-req [-h] [-k] name\nGeneral options");
description
.add_options()
"Usage: ndnsec sign-req [-h] [-k] [-n] NAME\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
("key,k", "optional, if specified, name is keyName (e.g., /ndn/edu/ucla/alice/KEY/ksk-123456789), "
"otherwise identity name")
("name,n", po::value<Name>(&name), "name, for example, /ndn/edu/ucla/alice");
("name,n", po::value<Name>(&name), "identity or key name, e.g., /ndn/edu/ucla/alice")
("key,k", po::bool_switch(&isKeyName), "the specified name is a key name rather than an identity")
;
po::positional_options_description p;
p.add("name", 1);
@@ -51,24 +52,19 @@ ndnsec_sign_req(int argc, char** argv)
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
if (vm.count("name") == 0) {
std::cerr << "ERROR: name must be specified" << std::endl;
std::cerr << description << std::endl;
return 1;
}
if (vm.count("key") != 0) {
isKeyName = true;
std::cerr << "ERROR: you must specify a name" << std::endl;
return 2;
}
security::v2::KeyChain keyChain;
@@ -109,6 +105,7 @@ ndnsec_sign_req(int argc, char** argv)
keyChain.sign(certificate, security::SigningInfo(key).setSignatureInfo(signatureInfo));
io::save(certificate, std::cout);
return 0;
}
tools/ndnsec/unlock-tpm.cpp
+29 -19
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/**
* Copyright (c) 2013-2017 Regents of the University of California.
/*
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -22,45 +22,55 @@
#include "ndnsec.hpp"
#include "util.hpp"
#include "ndn-cxx/security/impl/openssl.hpp"
#include <cerrno>
#include <cstring>
#include <unistd.h>
namespace ndn {
namespace ndnsec {
int
ndnsec_unlock_tpm(int argc, char** argv)
{
#ifdef NDN_CXX_HAVE_GETPASS
namespace po = boost::program_options;
std::string keyName;
po::options_description description("General Usage\n ndnsec unlock-tpm [-h] \nGeneral options");
description.add_options()("help,h", "produce help message");
po::options_description description(
"Usage: ndnsec unlock-tpm [-h]\n"
"\n"
"Options");
description.add_options()
("help,h", "produce help message")
;
po::variables_map vm;
try {
po::store(po::parse_command_line(argc, argv, description), vm);
po::notify(vm);
}
catch (const std::exception& e) {
std::cerr << "ERROR: " << e.what() << std::endl;
std::cerr << description << std::endl;
return 1;
std::cerr << "ERROR: " << e.what() << "\n\n"
<< description << std::endl;
return 2;
}
if (vm.count("help") != 0) {
std::cerr << description << std::endl;
if (vm.count("help") > 0) {
std::cout << description << std::endl;
return 0;
}
bool isUnlocked = false;
#ifdef NDN_CXX_HAVE_GETPASS
security::v2::KeyChain keyChain;
char* password;
password = getpass("Password to unlock the TPM: ");
isUnlocked = keyChain.getTpm().unlockTpm(password, strlen(password));
memset(password, 0, strlen(password));
char* password = ::getpass("Password to unlock the TPM: ");
if (password == nullptr) {
std::cerr << "ERROR: getpass() failed: " << std::strerror(errno) << std::endl;
return 1;
}
bool isUnlocked = keyChain.getTpm().unlockTpm(password, std::strlen(password));
OPENSSL_cleanse(password, std::strlen(password));
if (isUnlocked) {
std::cerr << "OK: TPM is unlocked" << std::endl;
tools/ndnsec/util.hpp
+1 -5
View File
@@ -1,6 +1,6 @@
/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
/*
* Copyright (c) 2013-2018 Regents of the University of California.
* Copyright (c) 2013-2019 Regents of the University of California.
*
* This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
*
@@ -22,9 +22,7 @@
#ifndef NDN_TOOLS_NDNSEC_UTIL_HPP
#define NDN_TOOLS_NDNSEC_UTIL_HPP
#include "ndn-cxx/encoding/buffer-stream.hpp"
#include "ndn-cxx/security/key-chain.hpp"
#include "ndn-cxx/security/transform.hpp"
#include "ndn-cxx/security/v2/additional-description.hpp"
#include "ndn-cxx/util/io.hpp"
@@ -32,8 +30,6 @@
#include <iostream>
#include <string>
#include <boost/asio.hpp>
#include <boost/exception/all.hpp>
#include <boost/program_options/options_description.hpp>
#include <boost/program_options/parsers.hpp>
#include <boost/program_options/variables_map.hpp>
wscript
+5 -3
View File
@@ -297,9 +297,10 @@ def build(bld):
builder='man',
config='docs/conf.py',
outdir='docs/manpages',
source=bld.path.ant_glob('docs/manpages/**/*.rst'),
source=bld.path.ant_glob('docs/manpages/*.rst'),
install_path='${MANDIR}',
VERSION=VERSION)
version=VERSION_BASE,
release=VERSION)
def docs(bld):
from waflib import Options
@@ -337,7 +338,8 @@ def sphinx(bld):
config='docs/conf.py',
outdir='docs',
source=bld.path.ant_glob('docs/**/*.rst'),
VERSION=VERSION)
version=VERSION_BASE,
release=VERSION)
def version(ctx):
# don't execute more than once