3dbbd2a6507e1ec1f1e4b25433a9becd194d7407
[strongswan.git] / src / openac / openac.c
1 /* Generation of X.509 attribute certificates
2 * Copyright (C) 2002 Ueli Galizzi, Ariane Seiler
3 * Copyright (C) 2004 Andreas Steffen
4 * Zuercher Hochschule Winterthur, Switzerland
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 *
16 * RCSID $Id: openac.c,v 1.18 2006/01/04 21:12:33 as Exp $
17 */
18
19 #include <stdio.h>
20 #include <stdlib.h>
21 #include <string.h>
22 #include <unistd.h>
23 #include <getopt.h>
24 #include <ctype.h>
25 #include <time.h>
26 #include <gmp.h>
27
28 #include <debug.h>
29 #include <asn1/asn1.h>
30 #include <asn1/ttodata.h>
31 #include <crypto/ac.h>
32 #include <utils/optionsfrom.h>
33
34 #include "build.h"
35
36 #define OPENAC_PATH IPSEC_CONFDIR "/openac"
37 #define OPENAC_SERIAL IPSEC_CONFDIR "/openac/serial"
38
39 const char openac_version[] = "openac 0.4";
40
41 static void usage(const char *mess)
42 {
43 if (mess != NULL && *mess != '\0')
44 {
45 fprintf(stderr, "%s\n", mess);
46 }
47 fprintf(stderr, "Usage: openac"
48 " [--help]"
49 " [--version]"
50 " [--optionsfrom <filename>]"
51 " [--quiet]"
52 #ifdef DEBUG
53 " \\\n\t"
54 " [--debug-all]"
55 " [--debug-parsing]"
56 " [--debug-raw]"
57 " [--debug-private]"
58 #endif
59 " \\\n\t"
60 " [--days <days>]"
61 " [--hours <hours>]"
62 " \\\n\t"
63 " [--startdate <YYYYMMDDHHMMSSZ>]"
64 " [--enddate <YYYYMMDDHHMMSSZ>]"
65 " \\\n\t"
66 " --cert <certfile>"
67 " --key <keyfile>"
68 " [--password <password>]"
69 " \\\n\t"
70 " --usercert <certfile>"
71 " --groups <attr1,attr2,..>"
72 " --out <filename>"
73 "\n"
74 );
75 exit(mess == NULL? 0 : 1);
76 }
77
78 /**
79 * convert a chunk into a multi-precision integer
80 */
81 static void chunk_to_mpz(chunk_t chunk, mpz_t number)
82 {
83 mpz_import(number, chunk.len, 1, 1, 1, 0, chunk.ptr);
84 }
85
86 /**
87 * convert a multi-precision integer into a chunk
88 */
89 static chunk_t mpz_to_chunk(mpz_t number)
90 {
91 chunk_t chunk;
92
93 chunk.len = 1 + mpz_sizeinbase(number, 2)/BITS_PER_BYTE;
94 chunk.ptr = mpz_export(NULL, NULL, 1, chunk.len, 1, 0, number);
95 return chunk;
96 }
97
98 /**
99 * read the last serial number from file
100 */
101 static chunk_t read_serial(void)
102 {
103 mpz_t number;
104
105 char buf[BUF_LEN], buf1[BUF_LEN];
106 chunk_t last_serial = { buf1, BUF_LEN};
107 chunk_t serial;
108
109 FILE *fd = fopen(OPENAC_SERIAL, "r");
110
111 /* last serial number defaults to 0 */
112 *last_serial.ptr = 0x00;
113 last_serial.len = 1;
114
115 if (fd)
116 {
117 if (fscanf(fd, "%s", buf))
118 {
119 err_t ugh = ttodata(buf, 0, 16, last_serial.ptr, BUF_LEN, &last_serial.len);
120
121 if (ugh != NULL)
122 {
123 DBG1(" error reading serial number from %s: %s",
124 OPENAC_SERIAL, ugh);
125 }
126 }
127 fclose(fd);
128 }
129 else
130 {
131 DBG1(" file '%s' does not exist yet - serial number set to 01",
132 OPENAC_SERIAL);
133 }
134
135 /**
136 * conversion of read serial number to a multiprecision integer
137 * and incrementing it by one
138 * and representing it as a two's complement octet string
139 */
140 mpz_init(number);
141 chunk_to_mpz(last_serial, number);
142 mpz_add_ui(number, number, 0x01);
143 serial = mpz_to_chunk(number);
144 mpz_clear(number);
145
146 return serial;
147 }
148
149 /**
150 * write back the last serial number to file
151 */
152 static void write_serial(chunk_t serial)
153 {
154 char buf[BUF_LEN];
155
156 FILE *fd = fopen(OPENAC_SERIAL, "w");
157
158 if (fd)
159 {
160 DBG1(" serial number is %#B", &serial);
161 fprintf(fd, "%#B\n", &serial);
162 fclose(fd);
163 }
164 else
165 {
166 DBG1(" could not open file '%s' for writing", OPENAC_SERIAL);
167 }
168 }
169
170 /**
171 * global variables accessible by both main() and build.c
172 */
173 x509_t *usercert = NULL;
174 x509_t *signercert = NULL;
175
176 linked_list_t *groups = NULL;
177 rsa_private_key_t *signerkey = NULL;
178
179 time_t notBefore = UNDEFINED_TIME;
180 time_t notAfter = UNDEFINED_TIME;
181
182 chunk_t serial;
183
184 int main(int argc, char **argv)
185 {
186 char *keyfile = NULL;
187 char *certfile = NULL;
188 char *usercertfile = NULL;
189 char *outfile = NULL;
190 char buf[BUF_LEN];
191
192 chunk_t passphrase = { buf, 0 };
193 chunk_t attr_cert = chunk_empty;
194 x509ac_t *ac = NULL;
195
196 const time_t default_validity = 24*3600; /* 24 hours */
197 time_t validity = 0;
198
199 passphrase.ptr[0] = '\0';
200
201 groups = linked_list_create();
202
203 /* handle arguments */
204 for (;;)
205 {
206 # define DBG_OFFSET 256
207 static const struct option long_opts[] = {
208 /* name, has_arg, flag, val */
209 { "help", no_argument, NULL, 'h' },
210 { "version", no_argument, NULL, 'v' },
211 { "optionsfrom", required_argument, NULL, '+' },
212 { "quiet", no_argument, NULL, 'q' },
213 { "cert", required_argument, NULL, 'c' },
214 { "key", required_argument, NULL, 'k' },
215 { "password", required_argument, NULL, 'p' },
216 { "usercert", required_argument, NULL, 'u' },
217 { "groups", required_argument, NULL, 'g' },
218 { "days", required_argument, NULL, 'D' },
219 { "hours", required_argument, NULL, 'H' },
220 { "startdate", required_argument, NULL, 'S' },
221 { "enddate", required_argument, NULL, 'E' },
222 { "out", required_argument, NULL, 'o' },
223 #ifdef DEBUG
224 { "debug-all", no_argument, NULL, 'A' },
225 { "debug-raw", no_argument, NULL, DBG_RAW + DBG_OFFSET },
226 { "debug-parsing", no_argument, NULL, DBG_PARSING + DBG_OFFSET },
227 { "debug-private", no_argument, NULL, DBG_PRIVATE + DBG_OFFSET },
228 #endif
229 { 0,0,0,0 }
230 };
231
232 int c = getopt_long(argc, argv, "hv+:qc:k:p;u:g:D:H:S:E:o:", long_opts, NULL);
233
234 /* Note: "breaking" from case terminates loop */
235 switch (c)
236 {
237 case EOF: /* end of flags */
238 break;
239
240 case 0: /* long option already handled */
241 continue;
242
243 case ':': /* diagnostic already printed by getopt_long */
244 case '?': /* diagnostic already printed by getopt_long */
245 usage(NULL);
246 break; /* not actually reached */
247
248 case 'h': /* --help */
249 usage(NULL);
250 break; /* not actually reached */
251
252 case 'v': /* --version */
253 printf("%s\n", openac_version);
254 exit(0);
255 break; /* not actually reached */
256
257 case '+': /* --optionsfrom <filename> */
258 {
259 char path[BUF_LEN];
260
261 if (*optarg == '/') /* absolute pathname */
262 {
263 strncpy(path, optarg, BUF_LEN);
264 }
265 else /* relative pathname */
266 {
267 snprintf(path, BUF_LEN, "%s/%s", OPENAC_PATH, optarg);
268 }
269 optionsfrom(path, &argc, &argv, optind, stderr);
270 /* does not return on error */
271 }
272 continue;
273
274 case 'q': /* --quiet */
275 /* TODO log to syslog only */
276 continue;
277
278 case 'c': /* --cert */
279 certfile = optarg;
280 continue;
281
282 case 'k': /* --key */
283 keyfile = optarg;
284 continue;
285
286 case 'p': /* --key */
287 if (strlen(optarg) > BUF_LEN)
288 {
289 usage("passphrase too long");
290 }
291 strncpy(passphrase.ptr, optarg, BUF_LEN);
292 passphrase.len = min(strlen(optarg), BUF_LEN);
293 continue;
294
295 case 'u': /* --usercert */
296 usercertfile = optarg;
297 continue;
298
299 case 'g': /* --groups */
300 ietfAttr_list_create_from_string(optarg, groups);
301 continue;
302
303 case 'D': /* --days */
304 if (optarg == NULL || !isdigit(optarg[0]))
305 {
306 usage("missing number of days");
307 }
308 else
309 {
310 char *endptr;
311 long days = strtol(optarg, &endptr, 0);
312
313 if (*endptr != '\0' || endptr == optarg || days <= 0)
314 {
315 usage("<days> must be a positive number");
316 }
317 validity += 24*3600*days;
318 }
319 continue;
320
321 case 'H': /* --hours */
322 if (optarg == NULL || !isdigit(optarg[0]))
323 {
324 usage("missing number of hours");
325 }
326 else
327 {
328 char *endptr;
329 long hours = strtol(optarg, &endptr, 0);
330
331 if (*endptr != '\0' || endptr == optarg || hours <= 0)
332 {
333 usage("<hours> must be a positive number");
334 }
335 validity += 3600*hours;
336 }
337 continue;
338
339 case 'S': /* --startdate */
340 if (optarg == NULL || strlen(optarg) != 15 || optarg[14] != 'Z')
341 {
342 usage("date format must be YYYYMMDDHHMMSSZ");
343 }
344 else
345 {
346 chunk_t date = { optarg, 15 };
347
348 notBefore = asn1totime(&date, ASN1_GENERALIZEDTIME);
349 }
350 continue;
351
352 case 'E': /* --enddate */
353 if (optarg == NULL || strlen(optarg) != 15 || optarg[14] != 'Z')
354 {
355 usage("date format must be YYYYMMDDHHMMSSZ");
356 }
357 else
358 {
359 chunk_t date = { optarg, 15 };
360 notAfter = asn1totime(&date, ASN1_GENERALIZEDTIME);
361 }
362 continue;
363
364 case 'o': /* --outt */
365 outfile = optarg;
366 continue;
367
368 #ifdef DEBUG
369 case 'A': /* --debug-all */
370 base_debugging = DBG_ALL;
371 continue;
372 #endif
373 default:
374 usage("");
375 }
376 break;
377 }
378
379 if (optind != argc)
380 {
381 usage("unexpected argument");
382 }
383
384 /* load the signer's RSA private key */
385 if (keyfile != NULL)
386 {
387 err_t ugh = NULL;
388
389 signerkey = rsa_private_key_create_from_file(keyfile, &passphrase);
390
391 if (signerkey == NULL)
392 {
393 exit(1);
394 }
395 }
396
397 /* load the signer's X.509 certificate */
398 if (certfile != NULL)
399 {
400 signercert = x509_create_from_file(certfile, "signer cert");
401
402 if (signercert == NULL)
403 {
404 exit(1);
405 }
406 }
407
408 /* load the users's X.509 certificate */
409 if (usercertfile != NULL)
410 {
411 usercert = x509_create_from_file(usercertfile, "signer cert");
412 if (usercert == NULL)
413 {
414 exit(1);
415 }
416 }
417
418 /* compute validity interval */
419 validity = (validity)? validity : default_validity;
420 notBefore = (notBefore) ? notBefore : time(NULL);
421 notAfter = (notAfter) ? notAfter : notBefore + validity;
422
423 /* build and parse attribute certificate */
424 if (usercert != NULL && signercert != NULL && signerkey != NULL)
425 {
426 /* read the serial number and increment it by one */
427 serial = read_serial();
428
429 attr_cert = build_attr_cert();
430 ac = x509ac_create_from_chunk(attr_cert);
431
432 /* write the attribute certificate to file */
433 if (chunk_write(attr_cert, outfile, "attribute cert", 0022, TRUE))
434 {
435 write_serial(serial);
436 }
437 }
438
439 /* delete all dynamically allocated objects */
440 DESTROY_IF(signerkey);
441 DESTROY_IF(signercert);
442 DESTROY_IF(usercert);
443 DESTROY_IF(ac);
444 ietfAttr_list_destroy(groups);
445 free(serial.ptr);
446
447 exit(0);
448 }