libekmfweb: Add EKMFWeb client library

The EKMFWeb client library provides functions to communicate
with an EKMF Web server via REST calls over HTTPS. EKMF Web stands
for IBM Enterprise Key Management Foundation - Web Edition and is
used to manage keys in an enterprise.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

libekmfweb/Makefile

@@ -0,0 +1,84 @@
+include ../common.mak
+
+ifneq (${HAVE_OPENSSL},0)
+	ifneq (${HAVE_JSONC},0)
+		ifneq (${HAVE_LIBCURL},0)
+			BUILD_TARGETS += libekmfweb.so
+			INSTALL_TARGETS += install-libekmfweb.so
+		else
+			BUILD_TARGETS += skip-libekmfweb-curl
+			INSTALL_TARGETS += skip-libekmfweb-curl
+		endif
+	else
+		BUILD_TARGETS += skip-libekmfweb-jsonc
+		INSTALL_TARGETS += skip-libekmfweb-jsonc
+	endif
+else
+	BUILD_TARGETS += skip-libekmfweb-openssl
+	INSTALL_TARGETS += skip-libekmfweb-openssl
+endif
+
+libs = $(rootdir)/libutil/libutil.a
+
+detect-openssl-version.dep:
+	echo "#include <openssl/opensslv.h>" > detect-openssl-version.dep
+	echo "#include <openssl/evp.h>" >> detect-openssl-version.dep
+	echo "#if OPENSSL_VERSION_NUMBER < 0x10101000L" >> detect-openssl-version.dep
+	echo "  #error openssl version 1.1.1 is required" >> detect-openssl-version.dep
+	echo "#endif" >> detect-openssl-version.dep
+	echo "static void __attribute__((unused)) test(void) {" >> detect-openssl-version.dep
+	echo "    EVP_PKEY_meth_remove(NULL);" >> detect-openssl-version.dep
+	echo "}" >> detect-openssl-version.dep
+
+check-dep-libekmfweb: detect-openssl-version.dep
+	$(call check_dep, \
+		"libekmfweb", \
+		"detect-openssl-version.dep", \
+		"openssl-devel version >= 1.1.1", \
+		"HAVE_OPENSSL=0", \
+		-I. -lcrypto)
+	$(call check_dep, \
+		"libekmfweb", \
+		"json-c/json.h", \
+		"json-c-devel", \
+		"HAVE_JSONC=0")
+	$(call check_dep, \
+		"libekmfweb", \
+		"curl/curl.h", \
+		"libcurl-devel", \
+		"HAVE_LIBCURL=0")
+	touch check-dep-libekmfweb
+
+skip-libekmfweb-openssl:
+	echo "  SKIP    libekmfweb due to HAVE_OPENSSL=0"
+
+skip-libekmfweb-jsonc:
+	echo "  SKIP    libekmfweb due to HAVE_JSONC=0"
+
+skip-libekmfweb-curl:
+	echo "  SKIP    libekmfweb due to HAVE_LIBCURL=0"
+
+all: $(BUILD_TARGETS)
+
+ekmfweb.o: check-dep-libekmfweb ekmfweb.c utilities.h $(rootdir)include/ekmfweb/ekmfweb.h
+utilities.o: check-dep-libekmfweb utilities.c utilities.h
+
+libekmfweb.so: ALL_CFLAGS += -fPIC
+libekmfweb.so: LDLIBS = -ljson-c -lcrypto -lssl -lcurl -shared
+libekmfweb.so: LDFLAGS = -shared -Wl,--version-script=libekmfweb.map \
+	-Wl,-z,defs,-Bsymbolic
+libekmfweb.so: ekmfweb.o utilities.o
+	$(LINK) $(ALL_LDFLAGS) $^ $(LDLIBS) -o $@
+
+install-libekmfweb.so: libekmfweb.so
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 -T libekmfweb.so $(DESTDIR)$(LIB64DIR)/libekmfweb.so
+	$(INSTALL) -d -m 770 $(DESTDIR)$(USRINCLUDEDIR)/ekmfweb
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 $(rootdir)include/ekmfweb/ekmfweb.h $(DESTDIR)$(USRINCLUDEDIR)/ekmfweb
+
+install: all $(INSTALL_TARGETS)
+
+clean:
+	rm -f *.o libekmfweb.so check-dep-libekmfweb detect-openssl-version.dep
+
+.PHONY: all install clean skip-libekmfweb-openssl skip-libekmfweb-jsonc \
+	skip-libekmfweb-curl install-libekmfweb.so

libekmfweb/libekmfweb.map

@@ -0,0 +1,6 @@
+LIBEKMFWEB_1.0 {
+    global:
+        ekmf_get_server_cert_chain;
+        ekmf_print_certificates;
+    local: *;
+};

libekmfweb/utilities.c

@@ -0,0 +1,48 @@
+/*
+ * libekmfweb - EKMFWeb client library
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+
+#include "utilities.h"
+
+/**
+ * Reads a X.509 certificate from the specified PEM file.
+ *
+ * @param pem_filename       the name of the PEM file to read
+ * @param cert               on Return: the X.509 certificate object
+ *
+ * @returns zero for success, a negative errno in case of an error:
+ *          -EINVAL: invalid parameter
+ *          -EIO: error during reading in the certificate
+ *          any other errno as returned by fopen
+ */
+int read_x509_certificate(const char *pem_filename, X509 **cert)
+{
+	FILE *fp;
+
+	if (pem_filename == NULL || cert == NULL)
+		return -EINVAL;
+
+	fp = fopen(pem_filename, "r");
+	if (fp == NULL)
+		return -errno;
+
+	*cert = PEM_read_X509(fp, NULL, NULL, NULL);
+
+	fclose(fp);
+
+	if (*cert == NULL)
+		return -EIO;
+
+	return 0;
+}

libekmfweb/utilities.h

@@ -0,0 +1,20 @@
+/*
+ * libekmfweb - EKMFWeb client library
+ *
+ * Copyright IBM Corp. 2020
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef UTILITIES_H
+#define UTILITIES_H
+
+#include <stddef.h>
+#include <stdbool.h>
+
+#include <openssl/x509.h>
+
+int read_x509_certificate(const char *pem_filename, X509 **cert);
+
+#endif