Commit f05e4e4b0c for strongswan.org
commit f05e4e4b0c7bf0d5aaa84357cc23fcddc5fec45d
Author: Tobias Brunner <tobias@strongswan.org>
Date: Mon Sep 14 12:19:51 2026 +0200
pki: Add command to list/export certificates of a PEM bundle
Also adds the missing `-f/--outform` description in the `--pkcs12` man
page and adds it to the distribution and the main command's man page.
diff --git a/configure.ac b/configure.ac
index abea999f5d..0b5429e528 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2074,6 +2074,7 @@ AC_CONFIG_FILES([
src/charon-cmd/charon-cmd.8
src/pki/man/pki.1
src/pki/man/pki---acert.1
+ src/pki/man/pki---bundle.1
src/pki/man/pki---dn.1
src/pki/man/pki---est.1
src/pki/man/pki---estca.1
diff --git a/src/pki/Makefile.am b/src/pki/Makefile.am
index 8ba99746ca..04c03c005a 100644
--- a/src/pki/Makefile.am
+++ b/src/pki/Makefile.am
@@ -4,6 +4,7 @@ bin_PROGRAMS = pki
pki_SOURCES = pki.c pki.h pki_cert.c pki_cert.h command.c command.h \
commands/acert.c \
+ commands/bundle.c \
commands/dn.c \
commands/est.c \
commands/estca.c \
diff --git a/src/pki/command.h b/src/pki/command.h
index 112b197dbd..07734f30ce 100644
--- a/src/pki/command.h
+++ b/src/pki/command.h
@@ -26,7 +26,7 @@
/**
* Maximum number of commands (+2).
*/
-#define MAX_COMMANDS 21
+#define MAX_COMMANDS 22
/**
* Maximum number of options in a command (+2)
diff --git a/src/pki/commands/bundle.c b/src/pki/commands/bundle.c
new file mode 100644
index 0000000000..a0e5c71fdb
--- /dev/null
+++ b/src/pki/commands/bundle.c
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2026 Tobias Brunner
+ *
+ * Copyright (C) secunet Security Networks AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include <errno.h>
+
+#include "pki.h"
+
+#include <credentials/certificates/x509.h>
+#include <credentials/containers/pem.h>
+
+/**
+ * Show info about PEM certificate bundle
+ */
+static int show(pem_t *bundle)
+{
+ enumerator_t *enumerator;
+ certificate_t *cert;
+ int index = 1;
+
+ enumerator = bundle->create_cert_enumerator(bundle);
+ while (enumerator->enumerate(enumerator, &cert))
+ {
+ x509_t *x509 = (x509_t*)cert;
+
+ if (x509->get_flags(x509) & X509_CA)
+ {
+ printf("[%2d] \"%Y\" (CA)\n", index++, cert->get_subject(cert));
+ }
+ else
+ {
+ printf("[%2d] \"%Y\"\n", index++, cert->get_subject(cert));
+ }
+ }
+ enumerator->destroy(enumerator);
+ return 0;
+}
+
+/**
+ * Export a certificate from a PEM certificate bundle
+ */
+static int export(pem_t *bundle, int index, char *outform)
+{
+ cred_encoding_type_t form = CERT_ASN1_DER;
+ enumerator_t *enumerator;
+ certificate_t *cert;
+ chunk_t encoding;
+ int i = 1;
+
+ if (outform && !get_form(outform, &form, CRED_CERTIFICATE))
+ {
+ return command_usage("invalid output format");
+ }
+
+ enumerator = bundle->create_cert_enumerator(bundle);
+ while (enumerator->enumerate(enumerator, &cert))
+ {
+ if (i++ == index)
+ {
+ if (cert->get_encoding(cert, form, &encoding))
+ {
+ set_file_mode(stdout, form);
+ if (fwrite(encoding.ptr, encoding.len, 1, stdout) == 1)
+ {
+ free(encoding.ptr);
+ enumerator->destroy(enumerator);
+ return 0;
+ }
+ free(encoding.ptr);
+ }
+ fprintf(stderr, "certificate export failed\n");
+ enumerator->destroy(enumerator);
+ return 1;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ fprintf(stderr, "invalid index %d\n", index);
+ return 1;
+}
+
+/**
+ * Handle PEM certificate bundles
+ */
+static int bundle()
+{
+ char *arg, *file = NULL, *outform = NULL;
+ pem_t *pem = NULL;
+ int res = 1, index = 0;
+ enum {
+ OP_NONE,
+ OP_LIST,
+ OP_EXPORT,
+ } op = OP_NONE;
+
+ while (TRUE)
+ {
+ switch (command_getopt(&arg))
+ {
+ case 'h':
+ return command_usage(NULL);
+ case 'i':
+ file = arg;
+ continue;
+ case 'l':
+ if (op != OP_NONE)
+ {
+ goto invalid;
+ }
+ op = OP_LIST;
+ continue;
+ case 'e':
+ if (op != OP_NONE)
+ {
+ goto invalid;
+ }
+ op = OP_EXPORT;
+ index = atoi(arg);
+ continue;
+ case 'f':
+ outform = arg;
+ continue;
+ case EOF:
+ break;
+ default:
+ invalid:
+ return command_usage("invalid --bundle option");
+ }
+ break;
+ }
+
+ if (file)
+ {
+ pem = lib->creds->create(lib->creds, CRED_CONTAINER, CONTAINER_PEM,
+ BUILD_FROM_FILE, file, BUILD_END);
+ }
+ else
+ {
+ chunk_t chunk;
+
+ set_file_mode(stdin, CERT_ASN1_DER);
+ if (!chunk_from_fd(0, &chunk))
+ {
+ fprintf(stderr, "reading input failed: %s\n", strerror(errno));
+ return 1;
+ }
+ pem = lib->creds->create(lib->creds, CRED_CONTAINER, CONTAINER_PEM,
+ BUILD_BLOB, chunk, BUILD_END);
+ free(chunk.ptr);
+ }
+
+ if (!pem)
+ {
+ fprintf(stderr, "reading input failed!\n");
+ goto end;
+ }
+
+ switch (op)
+ {
+ case OP_LIST:
+ res = show(pem);
+ break;
+ case OP_EXPORT:
+ res = export(pem, index, outform);
+ break;
+ default:
+ pem->container.destroy(&pem->container);
+ return command_usage(NULL);
+ }
+
+end:
+ if (pem)
+ {
+ pem->container.destroy(&pem->container);
+ }
+ return res;
+}
+
+/**
+ * Register the command.
+ */
+static void __attribute__ ((constructor))reg()
+{
+ command_register((command_t) {
+ bundle, 'b', "bundle", "PEM certificate bundle functions",
+ {"--export index|--list [--in file]",
+ "[--outform der|pem]"},
+ {
+ {"help", 'h', 0, "show usage information"},
+ {"in", 'i', 1, "input file, default: stdin"},
+ {"list", 'l', 0, "list certificates"},
+ {"export", 'e', 1, "export the certificate with the given index"},
+ {"outform", 'f', 1, "encoding of exported certificate, default: der"},
+ }
+ });
+}
diff --git a/src/pki/man/Makefile.am b/src/pki/man/Makefile.am
index 3f64ab815a..47addfbbe4 100644
--- a/src/pki/man/Makefile.am
+++ b/src/pki/man/Makefile.am
@@ -1,6 +1,7 @@
man1_MANS = \
pki.1 \
pki---acert.1 \
+ pki---bundle.1 \
pki---dn.1 \
pki---est.1 \
pki---estca.1 \
@@ -9,6 +10,7 @@ man1_MANS = \
pki---keyid.1 \
pki---ocsp.1 \
pki---pkcs7.1 \
+ pki---pkcs12.1 \
pki---print.1 \
pki---pub.1 \
pki---req.1 \
diff --git a/src/pki/man/pki---bundle.1.in b/src/pki/man/pki---bundle.1.in
new file mode 100644
index 0000000000..e766b2edda
--- /dev/null
+++ b/src/pki/man/pki---bundle.1.in
@@ -0,0 +1,66 @@
+.TH "PKI \-\-BUNDLE" 1 "2026-09-14" "@PACKAGE_VERSION@" "strongSwan"
+.
+.SH "NAME"
+.
+pki \-\-bundle \- Provides PEM certificate bundle functions
+.
+.SH "SYNOPSIS"
+.
+.SY pki\ \-\-bundle
+.BR \-\-list
+.OP \-\-in file
+.OP \-\-debug level
+.YS
+.
+.SY pki\ \-\-bundle
+.BI \-\-export\~ index
+.OP \-\-in file
+.OP \-\-outform encoding
+.OP \-\-debug level
+.YS
+.
+.SY pki\ \-\-bundle
+.BI \-\-options\~ file
+.YS
+.
+.SY "pki \-\-bundle"
+.B \-h
+|
+.B \-\-help
+.YS
+.
+.SH "DESCRIPTION"
+.
+This sub-command of
+.BR pki (1)
+provides functions to work with PEM-encoded certificate bundles.
+.
+.SH "OPTIONS"
+.
+.TP
+.B "\-h, \-\-help"
+Print usage information with a summary of the available options.
+.TP
+.BI "\-v, \-\-debug " level
+Set debug level, default: 1.
+.TP
+.BI "\-+, \-\-options " file
+Read command line options from \fIfile\fR.
+.TP
+.BI "\-l, \-\-list"
+List certificates contained in a PEM-encoded certificate bundle.
+.TP
+.BI "\-e, \-\-export " index
+Export the certificate with the given \fIindex\fR. Use \fI\-\-list\fR to
+determine the index of certificates.
+.TP
+.BI "\-f, \-\-outform " encoding
+Encoding of the exported credential. Either \fIder\fR (ASN.1 DER) or
+\fIpem\fR (Base64 PEM), defaults to \fIder\fR.
+.TP
+.BI "\-i, \-\-in " file
+PEM input file. If not given the input is read from \fISTDIN\fR.
+.
+.SH "SEE ALSO"
+.
+.BR pki (1)
diff --git a/src/pki/man/pki---pkcs12.1.in b/src/pki/man/pki---pkcs12.1.in
index 470a66389b..d35d5d0e1f 100644
--- a/src/pki/man/pki---pkcs12.1.in
+++ b/src/pki/man/pki---pkcs12.1.in
@@ -54,9 +54,13 @@ List certificates and keys contained in a PKCS#12 container.
Export the credential with the given \fIindex\fR. Use \fI\-\-list\fR to
determine the index of certificates and keys.
.TP
+.BI "\-f, \-\-outform " encoding
+Encoding of the exported credential. Either \fIder\fR (ASN.1 DER) or
+\fIpem\fR (Base64 PEM), defaults to \fIder\fR.
+.TP
.BI "\-i, \-\-in " file
PKCS#12 input file. If not given the input is read from \fISTDIN\fR.
.
.SH "SEE ALSO"
.
-.BR pki (1)
\ No newline at end of file
+.BR pki (1)
diff --git a/src/pki/man/pki.1.in b/src/pki/man/pki.1.in
index 566918d141..7d744ed239 100644
--- a/src/pki/man/pki.1.in
+++ b/src/pki/man/pki.1.in
@@ -71,9 +71,15 @@ Issue an attribute certificate.
.B "\-r, \-\-req"
Create a PKCS#10 certificate request.
.TP
+.B "\-b, \-\-bundle"
+Provides PEM certificate bundle functions.
+.TP
.B "\-7, \-\-pkcs7"
Provides PKCS#7 wrap/unwrap functions.
.TP
+.B "\-u, \-\-pkcs12"
+Provides PKCS#12 functions.
+.TP
.B "\-k, \-\-keyid"
Calculate key identifiers of a key or certificate.
.TP
@@ -195,7 +201,9 @@ certificates with the \-\-crl option.
.BR pki\ \-\-signcrl (1),
.BR pki\ \-\-acert (1),
.BR pki\ \-\-req (1),
+.BR pki\ \-\-bundle (1),
.BR pki\ \-\-pkcs7 (1),
+.BR pki\ \-\-pkcs12 (1),
.BR pki\ \-\-keyid (1),
.BR pki\ \-\-print (1),
.BR pki\ \-\-dn (1),