+/* process revoker certificate */
+static int cert_process_revoker(const char *certfile, const char *pubkeydir) {
+ static LIST_HEAD(certchain);
+ struct cert_object *cobj;
+ struct blob_attr *containertb[CERT_CT_ATTR_MAX];
+ struct blob_attr *payloadtb[CERT_PL_ATTR_MAX];
+ struct stat st;
+ struct timeval tv;
+ time_t validfrom;
+ enum certtype_id certtype;
+ char *fingerprint;
+ char rfname[512];
+
+ int ret = -1;
+
+ if (cert_load(certfile, &certchain)) {
+ DPRINTF("cannot parse cert\n");
+ return 1;
+ }
+
+ gettimeofday(&tv, NULL);
+
+ list_for_each_entry(cobj, &certchain, list) {
+ if (!cobj->cert[CERT_ATTR_PAYLOAD])
+ return 2;
+
+ /* blob has payload, verify that using signature */
+ ret = cert_verify_blob(cobj->cert, NULL, pubkeydir);
+ if (ret)
+ return ret;
+
+ blobmsg_parse(cert_cont_policy,
+ ARRAY_SIZE(cert_cont_policy),
+ containertb,
+ blob_data(cobj->cert[CERT_ATTR_PAYLOAD]),
+ blob_len(cobj->cert[CERT_ATTR_PAYLOAD]));
+ if (!containertb[CERT_CT_ATTR_PAYLOAD]) {
+ DPRINTF("no ucert in signed payload\n");
+ return 2;
+ }
+
+ blobmsg_parse(cert_payload_policy,
+ ARRAY_SIZE(cert_payload_policy),
+ payloadtb,
+ blobmsg_data(containertb[CERT_CT_ATTR_PAYLOAD]),
+ blobmsg_data_len(containertb[CERT_CT_ATTR_PAYLOAD]));
+
+ if (!payloadtb[CERT_PL_ATTR_CERTTYPE] ||
+ !payloadtb[CERT_PL_ATTR_VALIDFROMTIME] ||
+ !payloadtb[CERT_PL_ATTR_KEY_FINGERPRINT]) {
+ DPRINTF("missing mandatory ucert attributes\n");
+ return 2;
+ }
+
+ certtype = blobmsg_get_u32(payloadtb[CERT_PL_ATTR_CERTTYPE]);
+ validfrom = blobmsg_get_u64(payloadtb[CERT_PL_ATTR_VALIDFROMTIME]);
+ fingerprint = blobmsg_get_string(payloadtb[CERT_PL_ATTR_KEY_FINGERPRINT]);
+
+ if (certtype != CERTTYPE_REVOKE) {
+ DPRINTF("wrong certificate type\n");
+ return 2;
+ }
+
+ if (tv.tv_sec < validfrom) {
+ return 3;
+ }
+
+ snprintf(rfname, sizeof(rfname)-1, "%s/%s", pubkeydir, fingerprint);
+ /* check if entry in pubkeydir exists */
+ if (stat(rfname, &st) == 0) {
+ if (_usign_key_is_revoked(fingerprint, pubkeydir)) {
+ DPRINTF("existing revoker deadlink for key %s\n", fingerprint);
+ continue;
+ };
+
+ /* remove any other entry */
+ if (unlink(rfname))
+ return -1;
+ }
+
+ ret = symlink(".revoked.", rfname);
+ if (ret)
+ return ret;
+
+ DPRINTF("created revoker deadlink for key %s\n", fingerprint);
+ };
+
+ return ret;