Added CLI to manage certs in PKCS #12 file.

New CLIs have been added to add a certificate from NSS database and
to remove a certificate from the PKCS #12 file.

https://fedorahosted.org/pki/ticket/1742

6 files changed, 368 insertions, 10 deletions

diff --git a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
index bcc4252ba..187ff7667 100644
--- a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
+++ b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
@@ -127,7 +127,8 @@ public class PKCS12Export {
 
         try {
             PKCS12Util util = new PKCS12Util();
-            PKCS12 pkcs12 = util.loadFromNSS();
+            PKCS12 pkcs12 = new PKCS12();
+            util.loadFromNSS(pkcs12);
             util.storeIntoFile(pkcs12, pkcs12OutputFilename, password);
 
         } finally {
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertAddCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertAddCLI.java
new file mode 100644
index 000000000..6c9d8032e
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertAddCLI.java
@@ -0,0 +1,168 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileReader;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+import org.apache.commons.cli.ParseException;
+import org.mozilla.jss.util.Password;
+
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+import netscape.security.pkcs.PKCS12;
+import netscape.security.pkcs.PKCS12Util;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12CertAddCLI extends CLI {
+
+    public PKCS12CertAddCLI(PKCS12CertCLI certCLI) {
+        super("add", "Add certificate into PKCS #12 file", certCLI);
+
+        createOptions();
+    }
+
+    public void printHelp() {
+        formatter.printHelp(getFullName() + " <nickname> [OPTIONS...]", options);
+    }
+
+    public void createOptions() {
+        Option option = new Option(null, "pkcs12", true, "PKCS #12 file");
+        option.setArgName("path");
+        options.addOption(option);
+
+        option = new Option(null, "pkcs12-password", true, "PKCS #12 password");
+        option.setArgName("password");
+        options.addOption(option);
+
+        option = new Option(null, "pkcs12-password-file", true, "PKCS #12 password file");
+        option.setArgName("path");
+        options.addOption(option);
+
+        options.addOption(null, "no-trust-flags", false, "Do not include trust flags");
+        options.addOption(null, "no-cert", false, "Do not include certificate itself");
+        options.addOption(null, "no-key", false, "Do not include certificate key");
+        options.addOption(null, "no-chain", false, "Do not include certificate chain");
+
+        options.addOption("v", "verbose", false, "Run in verbose mode.");
+        options.addOption(null, "debug", false, "Run in debug mode.");
+        options.addOption(null, "help", false, "Show help message.");
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        CommandLine cmd = null;
+
+        try {
+            cmd = parser.parse(options, args);
+        } catch (ParseException e) {
+            System.err.println("Error: " + e.getMessage());
+            printHelp();
+            System.exit(-1);
+        }
+
+        if (cmd.hasOption("help")) {
+            printHelp();
+            System.exit(0);
+        }
+
+        if (cmd.hasOption("verbose")) {
+            Logger.getLogger("org.dogtagpki").setLevel(Level.INFO);
+            Logger.getLogger("com.netscape").setLevel(Level.INFO);
+            Logger.getLogger("netscape").setLevel(Level.INFO);
+
+        } else if (cmd.hasOption("debug")) {
+            Logger.getLogger("org.dogtagpki").setLevel(Level.FINE);
+            Logger.getLogger("com.netscape").setLevel(Level.FINE);
+            Logger.getLogger("netscape").setLevel(Level.FINE);
+        }
+
+        String[] cmdArgs = cmd.getArgs();
+
+        if (cmdArgs.length == 0) {
+            System.err.println("Error: Missing certificate nickname.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        String nickname = cmdArgs[0];
+
+        String filename = cmd.getOptionValue("pkcs12");
+
+        if (filename == null) {
+            System.err.println("Error: Missing PKCS #12 file.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        String passwordString = cmd.getOptionValue("pkcs12-password");
+
+        if (passwordString == null) {
+
+            String passwordFile = cmd.getOptionValue("pkcs12-password-file");
+            if (passwordFile != null) {
+                try (BufferedReader in = new BufferedReader(new FileReader(passwordFile))) {
+                    passwordString = in.readLine();
+                }
+            }
+        }
+
+        if (passwordString == null) {
+            System.err.println("Error: Missing PKCS #12 password.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        Password password = new Password(passwordString.toCharArray());
+
+        boolean includeTrustFlags = !cmd.hasOption("no-trust-flags");
+        boolean includeCert = !cmd.hasOption("no-cert");
+        boolean includeKey = !cmd.hasOption("no-key");
+        boolean includeChain = !cmd.hasOption("no-chain");
+
+        try {
+            PKCS12Util util = new PKCS12Util();
+            util.setTrustFlagsEnabled(includeTrustFlags);
+
+            PKCS12 pkcs12;
+
+            if (new File(filename).exists()) {
+                pkcs12 = util.loadFromFile(filename, password);
+            } else {
+                pkcs12 = new PKCS12();
+            }
+
+            util.loadFromNSS(pkcs12, nickname, includeCert, includeKey, includeChain);
+            util.storeIntoFile(pkcs12, filename, password);
+
+        } finally {
+            password.clear();
+        }
+
+        MainCLI.printMessage("Added certificate \"" + nickname + "\"");
+    }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
index 807404749..934b799dc 100644
--- a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertCLI.java
@@ -31,7 +31,9 @@ public class PKCS12CertCLI extends CLI {
     public PKCS12CertCLI(PKCS12CLI parent) {
         super("cert", "PKCS #12 certificate management commands", parent);
 
+        addModule(new PKCS12CertAddCLI(this));
         addModule(new PKCS12CertFindCLI(this));
+        addModule(new PKCS12CertRemoveCLI(this));
     }
 
     public static void printCertInfo(PKCS12CertInfo certInfo) throws Exception {
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertRemoveCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertRemoveCLI.java
new file mode 100644
index 000000000..9dbf767ef
--- /dev/null
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12CertRemoveCLI.java
@@ -0,0 +1,149 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cmstools.pkcs12;
+
+import java.io.BufferedReader;
+import java.io.FileReader;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+import org.apache.commons.cli.ParseException;
+import org.mozilla.jss.util.Password;
+
+import com.netscape.cmstools.cli.CLI;
+import com.netscape.cmstools.cli.MainCLI;
+
+import netscape.security.pkcs.PKCS12;
+import netscape.security.pkcs.PKCS12Util;
+
+/**
+ * @author Endi S. Dewata
+ */
+public class PKCS12CertRemoveCLI extends CLI {
+
+    public PKCS12CertRemoveCLI(PKCS12CertCLI certCLI) {
+        super("del", "Remove certificate from PKCS #12 file", certCLI);
+
+        createOptions();
+    }
+
+    public void printHelp() {
+        formatter.printHelp(getFullName() + " <nickname> [OPTIONS...]", options);
+    }
+
+    public void createOptions() {
+        Option option = new Option(null, "pkcs12", true, "PKCS #12 file");
+        option.setArgName("path");
+        options.addOption(option);
+
+        option = new Option(null, "pkcs12-password", true, "PKCS #12 password");
+        option.setArgName("password");
+        options.addOption(option);
+
+        option = new Option(null, "pkcs12-password-file", true, "PKCS #12 password file");
+        option.setArgName("path");
+        options.addOption(option);
+
+        options.addOption("v", "verbose", false, "Run in verbose mode.");
+        options.addOption(null, "debug", false, "Run in debug mode.");
+        options.addOption(null, "help", false, "Show help message.");
+    }
+
+    public void execute(String[] args) throws Exception {
+
+        CommandLine cmd = null;
+
+        try {
+            cmd = parser.parse(options, args);
+        } catch (ParseException e) {
+            System.err.println("Error: " + e.getMessage());
+            printHelp();
+            System.exit(-1);
+        }
+
+        if (cmd.hasOption("help")) {
+            printHelp();
+            System.exit(0);
+        }
+
+        if (cmd.hasOption("verbose")) {
+            Logger.getLogger("org.dogtagpki").setLevel(Level.INFO);
+            Logger.getLogger("com.netscape").setLevel(Level.INFO);
+            Logger.getLogger("netscape").setLevel(Level.INFO);
+
+        } else if (cmd.hasOption("debug")) {
+            Logger.getLogger("org.dogtagpki").setLevel(Level.FINE);
+            Logger.getLogger("com.netscape").setLevel(Level.FINE);
+            Logger.getLogger("netscape").setLevel(Level.FINE);
+        }
+
+        String[] cmdArgs = cmd.getArgs();
+
+        if (cmdArgs.length == 0) {
+            System.err.println("Error: Missing certificate nickname.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        String nickname = cmdArgs[0];
+
+        String filename = cmd.getOptionValue("pkcs12");
+
+        if (filename == null) {
+            System.err.println("Error: Missing PKCS #12 file.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        String passwordString = cmd.getOptionValue("pkcs12-password");
+
+        if (passwordString == null) {
+
+            String passwordFile = cmd.getOptionValue("pkcs12-password-file");
+            if (passwordFile != null) {
+                try (BufferedReader in = new BufferedReader(new FileReader(passwordFile))) {
+                    passwordString = in.readLine();
+                }
+            }
+        }
+
+        if (passwordString == null) {
+            System.err.println("Error: Missing PKCS #12 password.");
+            printHelp();
+            System.exit(-1);
+        }
+
+        Password password = new Password(passwordString.toCharArray());
+
+        try {
+            PKCS12Util util = new PKCS12Util();
+
+            PKCS12 pkcs12 = util.loadFromFile(filename, password);
+            pkcs12.removeCertInfoByNickname(nickname);
+            util.storeIntoFile(pkcs12, filename, password);
+
+        } finally {
+            password.clear();
+        }
+
+        MainCLI.printMessage("Deleted certificate \"" + nickname + "\"");
+    }
+}
diff --git a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ExportCLI.java b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ExportCLI.java
index 174748262..a5c9e2823 100644
--- a/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ExportCLI.java
+++ b/base/java-tools/src/com/netscape/cmstools/pkcs12/PKCS12ExportCLI.java
@@ -18,6 +18,7 @@
 package com.netscape.cmstools.pkcs12;
 
 import java.io.BufferedReader;
+import java.io.File;
 import java.io.FileReader;
 import java.util.logging.Level;
 import java.util.logging.Logger;
@@ -129,7 +130,15 @@ public class PKCS12ExportCLI extends CLI {
             PKCS12Util util = new PKCS12Util();
             util.setTrustFlagsEnabled(trustFlagsEnabled);
 
-            PKCS12 pkcs12 = util.loadFromNSS();
+            PKCS12 pkcs12;
+
+            if (new File(filename).exists()) {
+                pkcs12 = util.loadFromFile(filename, password);
+            } else {
+                pkcs12 = new PKCS12();
+            }
+
+            util.loadFromNSS(pkcs12);
             util.storeIntoFile(pkcs12, filename, password);
 
         } finally {
diff --git a/base/util/src/netscape/security/pkcs/PKCS12Util.java b/base/util/src/netscape/security/pkcs/PKCS12Util.java
index c5173a208..8d189a9d7 100644
--- a/base/util/src/netscape/security/pkcs/PKCS12Util.java
+++ b/base/util/src/netscape/security/pkcs/PKCS12Util.java
@@ -232,24 +232,36 @@ public class PKCS12Util {
         return attrs;
     }
 
-    public PKCS12 loadFromNSS() throws Exception {
+    public void loadFromNSS(PKCS12 pkcs12) throws Exception {
 
-        logger.info("Loading data from NSS database");
+        logger.info("Loading all certificate and keys from NSS database");
 
         CryptoManager cm = CryptoManager.getInstance();
         CryptoToken token = cm.getInternalKeyStorageToken();
         CryptoStore store = token.getCryptoStore();
 
-        PKCS12 pkcs12 = new PKCS12();
-
+        // load all certs
         for (X509Certificate cert : store.getCertificates()) {
-            loadCertAndKeyFromNSS(pkcs12, cert);
+            loadCertFromNSS(pkcs12, cert, true); // load cert with private key
         }
+    }
 
-        return pkcs12;
+    public void loadFromNSS(PKCS12 pkcs12, String nickname, boolean includeCert, boolean includeKey, boolean includeChain) throws Exception {
+
+        CryptoManager cm = CryptoManager.getInstance();
+
+        X509Certificate cert = cm.findCertByNickname(nickname);
+
+        if (includeCert) {
+            loadCertFromNSS(pkcs12, cert, includeKey);
+        }
+
+        if (includeChain) {
+            loadCertChainFromNSS(pkcs12, cert);
+        }
     }
 
-    public void loadCertAndKeyFromNSS(PKCS12 pkcs12, X509Certificate cert) throws Exception {
+    public void loadCertFromNSS(PKCS12 pkcs12, X509Certificate cert, boolean includeKey) throws Exception {
 
         String nickname = cert.getNickname();
         logger.info("Loading certificate \"" + nickname + "\" from NSS database");
@@ -265,9 +277,12 @@ public class PKCS12Util {
         certInfo.trustFlags = getTrustFlags(cert);
         pkcs12.addCertInfo(certInfo);
 
+        if (!includeKey) return;
+
+        logger.info("Loading private key for certificate \"" + nickname + "\" from NSS database");
+
         try {
             PrivateKey privateKey = cm.findPrivKeyByCert(cert);
-
             logger.fine("Certificate \"" + nickname + "\" has private key");
 
             PKCS12KeyInfo keyInfo = new PKCS12KeyInfo();
@@ -285,6 +300,20 @@ public class PKCS12Util {
         }
     }
 
+    public void loadCertChainFromNSS(PKCS12 pkcs12, X509Certificate cert) throws Exception {
+
+        logger.info("Loading certificate chain for \"" + cert.getNickname() + "\"");
+
+        CryptoManager cm = CryptoManager.getInstance();
+        X509Certificate[] certChain = cm.buildCertificateChain(cert);
+
+        // load parent certificates only
+        for (int i = 1; i < certChain.length; i++) {
+            X509Certificate c = certChain[i];
+            loadCertFromNSS(pkcs12, c, false); // do not include private key
+        }
+    }
+
     public void storeIntoFile(PKCS12 pkcs12, String filename, Password password) throws Exception {
 
         logger.info("Storing data into PKCS #12 file");