splitted PKI tool to a file per command
[strongswan.git] / src / pki / commands / issue.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <utils/optionsfrom.h>
22 #include <credentials/certificates/certificate.h>
23 #include <credentials/certificates/x509.h>
24
25 /**
26 * Issue a certificate using a CA certificate and key
27 */
28 static int issue(int argc, char *argv[])
29 {
30 hash_algorithm_t digest = HASH_SHA1;
31 certificate_t *cert = NULL, *ca =NULL;
32 private_key_t *private = NULL;
33 public_key_t *public = NULL;
34 char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
35 char *error = NULL;
36 identification_t *id = NULL;
37 linked_list_t *san;
38 int lifetime = 1080;
39 chunk_t serial = chunk_empty;
40 chunk_t encoding = chunk_empty;
41 time_t not_before, not_after;
42 x509_flag_t flags = 0;
43 x509_t *x509;
44 options_t *options;
45
46 options = options_create();
47 san = linked_list_create();
48
49 while (TRUE)
50 {
51 switch (getopt_long(argc, argv, "", command_opts, NULL))
52 {
53 case 'h':
54 goto usage;
55 case '+':
56 if (!options->from(options, optarg, &argc, &argv, optind))
57 {
58 error = "invalid options file";
59 goto usage;
60 }
61 continue;
62 case 't':
63 if (!streq(optarg, "pub"))
64 {
65 error = "invalid input type";
66 goto usage;
67 }
68 continue;
69 case 'g':
70 digest = get_digest(optarg);
71 if (digest == HASH_UNKNOWN)
72 {
73 error = "invalid --digest type";
74 goto usage;
75 }
76 continue;
77 case 'i':
78 file = optarg;
79 continue;
80 case 'c':
81 cacert = optarg;
82 continue;
83 case 'k':
84 cakey = optarg;
85 continue;
86 case 'd':
87 dn = optarg;
88 continue;
89 case 'a':
90 san->insert_last(san, identification_create_from_string(optarg));
91 continue;
92 case 'l':
93 lifetime = atoi(optarg);
94 if (!lifetime)
95 {
96 error = "invalid --lifetime value";
97 goto usage;
98 }
99 continue;
100 case 's':
101 hex = optarg;
102 continue;
103 case 'b':
104 flags |= X509_CA;
105 continue;
106 case EOF:
107 break;
108 default:
109 error = "invalid --issue option";
110 goto usage;
111 }
112 break;
113 }
114
115 if (!dn)
116 {
117 error = "--dn is required";
118 goto usage;
119 }
120 if (!cacert)
121 {
122 error = "--cacert is required";
123 goto usage;
124 }
125 if (!cakey)
126 {
127 error = "--cakey is required";
128 goto usage;
129 }
130 id = identification_create_from_string(dn);
131 if (id->get_type(id) != ID_DER_ASN1_DN)
132 {
133 error = "supplied --dn is not a distinguished name";
134 goto end;
135 }
136 ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
137 BUILD_FROM_FILE, cacert, BUILD_END);
138 if (!ca)
139 {
140 error = "parsing CA certificate failed";
141 goto end;
142 }
143 x509 = (x509_t*)ca;
144 if (!(x509->get_flags(x509) & X509_CA))
145 {
146 error = "CA certificate misses CA basicConstraint";
147 goto end;
148 }
149
150 public = ca->get_public_key(ca);
151 if (!public)
152 {
153 error = "extracting CA certificate public key failed";
154 goto end;
155 }
156 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
157 public->get_type(public),
158 BUILD_FROM_FILE, cakey, BUILD_END);
159 if (!private)
160 {
161 error = "parsing CA private key failed";
162 goto end;
163 }
164 if (!private->belongs_to(private, public))
165 {
166 error = "CA private key does not match CA certificate";
167 goto end;
168 }
169 public->destroy(public);
170
171 if (file)
172 {
173 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
174 BUILD_FROM_FILE, file, BUILD_END);
175 }
176 else
177 {
178 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
179 BUILD_FROM_FD, 0, BUILD_END);
180 }
181 if (!public)
182 {
183 error = "parsing public key failed";
184 goto end;
185 }
186
187 if (hex)
188 {
189 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
190 }
191 else
192 {
193 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
194
195 if (!rng)
196 {
197 error = "no random number generator found";
198 goto end;
199 }
200 rng->allocate_bytes(rng, 8, &serial);
201 rng->destroy(rng);
202 }
203 not_before = time(NULL);
204 not_after = not_before + lifetime * 24 * 60 * 60;
205 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
206 BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
207 BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
208 BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
209 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
210 BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
211 BUILD_END);
212 if (!cert)
213 {
214 error = "generating certificate failed";
215 goto end;
216 }
217 encoding = cert->get_encoding(cert);
218 if (!encoding.ptr)
219 {
220 error = "encoding certificate failed";
221 goto end;
222 }
223 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
224 {
225 error = "writing certificate key failed";
226 goto end;
227 }
228
229 end:
230 DESTROY_IF(id);
231 DESTROY_IF(cert);
232 DESTROY_IF(ca);
233 DESTROY_IF(public);
234 DESTROY_IF(private);
235 san->destroy_offset(san, offsetof(identification_t, destroy));
236 options->destroy(options);
237 free(encoding.ptr);
238 free(serial.ptr);
239
240 if (error)
241 {
242 fprintf(stderr, "%s\n", error);
243 return 1;
244 }
245 return 0;
246
247 usage:
248 san->destroy_offset(san, offsetof(identification_t, destroy));
249 options->destroy(options);
250 return command_usage(CMD_ISSUE, error);
251 }
252
253 /**
254 * Register the command.
255 */
256 static void __attribute__ ((constructor))reg()
257 {
258 command_register(CMD_ISSUE, (command_t) {
259 issue, 'i', "issue",
260 "issue a certificate using a CA certificate and key",
261 {"[--in file] [--type pub|pkcs10]",
262 " --cacert file --cakey file",
263 " --dn subject-dn [--san subjectAltName]+",
264 "[--lifetime days] [--serial hex] [--ca]",
265 "[--digest md5|sha1|sha224|sha256|sha384|sha512]",
266 "[--options file]"},
267 {
268 {"help", 'h', 0, "show usage information"},
269 {"in", 'i', 1, "public key/request file to issue, default: stdin"},
270 {"type", 't', 1, "type of input, default: pub"},
271 {"cacert", 'c', 1, "CA certificate file"},
272 {"cakey", 'k', 1, "CA private key file"},
273 {"dn", 'd', 1, "distinguished name to include as subject"},
274 {"san", 'a', 1, "subjectAltName to include in certificate"},
275 {"lifetime",'l', 1, "days the certificate is valid, default: 1080"},
276 {"serial", 's', 1, "serial number in hex, default: random"},
277 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
278 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
279 {"options", '+', 1, "read command line options from file"},
280 }
281 });
282 }
283