Added policyMappings support to pki tool
[strongswan.git] / src / pki / commands / issue.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <debug.h>
21 #include <asn1/asn1.h>
22 #include <utils/linked_list.h>
23 #include <credentials/certificates/certificate.h>
24 #include <credentials/certificates/x509.h>
25 #include <credentials/certificates/pkcs10.h>
26
27 /**
28 * Free cert policy with OID
29 */
30 static void destroy_cert_policy(x509_cert_policy_t *policy)
31 {
32 free(policy->oid.ptr);
33 free(policy);
34 }
35
36 /**
37 * Free policy mapping
38 */
39 static void destroy_policy_mapping(x509_policy_mapping_t *mapping)
40 {
41 free(mapping->issuer.ptr);
42 free(mapping->subject.ptr);
43 free(mapping);
44 }
45
46 /**
47 * Issue a certificate using a CA certificate and key
48 */
49 static int issue()
50 {
51 cred_encoding_type_t form = CERT_ASN1_DER;
52 hash_algorithm_t digest = HASH_SHA1;
53 certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
54 private_key_t *private = NULL;
55 public_key_t *public = NULL;
56 bool pkcs10 = FALSE;
57 char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
58 char *error = NULL, *keyid = NULL;
59 identification_t *id = NULL, *crl_issuer = NULL;;
60 linked_list_t *san, *cdps, *ocsp, *permitted, *excluded, *policies, *mappings;
61 int lifetime = 1095;
62 int pathlen = X509_NO_PATH_LEN_CONSTRAINT;
63 chunk_t serial = chunk_empty;
64 chunk_t encoding = chunk_empty;
65 time_t not_before, not_after;
66 x509_flag_t flags = 0;
67 x509_t *x509;
68 x509_cert_policy_t *policy = NULL;
69 char *arg;
70
71 san = linked_list_create();
72 cdps = linked_list_create();
73 ocsp = linked_list_create();
74 permitted = linked_list_create();
75 excluded = linked_list_create();
76 policies = linked_list_create();
77 mappings = linked_list_create();
78
79 while (TRUE)
80 {
81 switch (command_getopt(&arg))
82 {
83 case 'h':
84 goto usage;
85 case 't':
86 if (streq(arg, "pkcs10"))
87 {
88 pkcs10 = TRUE;
89 }
90 else if (!streq(arg, "pub"))
91 {
92 error = "invalid input type";
93 goto usage;
94 }
95 continue;
96 case 'g':
97 digest = get_digest(arg);
98 if (digest == HASH_UNKNOWN)
99 {
100 error = "invalid --digest type";
101 goto usage;
102 }
103 continue;
104 case 'i':
105 file = arg;
106 continue;
107 case 'c':
108 cacert = arg;
109 continue;
110 case 'k':
111 cakey = arg;
112 continue;
113 case 'x':
114 keyid = arg;
115 continue;
116 case 'd':
117 dn = arg;
118 continue;
119 case 'a':
120 san->insert_last(san, identification_create_from_string(arg));
121 continue;
122 case 'l':
123 lifetime = atoi(arg);
124 if (!lifetime)
125 {
126 error = "invalid --lifetime value";
127 goto usage;
128 }
129 continue;
130 case 's':
131 hex = arg;
132 continue;
133 case 'b':
134 flags |= X509_CA;
135 continue;
136 case 'p':
137 pathlen = atoi(arg);
138 continue;
139 case 'n':
140 permitted->insert_last(permitted,
141 identification_create_from_string(arg));
142 continue;
143 case 'N':
144 excluded->insert_last(excluded,
145 identification_create_from_string(arg));
146 continue;
147 case 'P':
148 {
149 chunk_t oid;
150
151 oid = asn1_oid_from_string(arg);
152 if (!oid.len)
153 {
154 error = "--cert-policy OID invalid";
155 goto usage;
156 }
157 INIT(policy,
158 .oid = oid,
159 );
160 policies->insert_last(policies, policy);
161 continue;
162 }
163 case 'C':
164 if (!policy)
165 {
166 error = "--cps-uri must follow a --cert-policy";
167 goto usage;
168 }
169 policy->cps_uri = arg;
170 continue;
171 case 'U':
172 if (!policy)
173 {
174 error = "--user-notice must follow a --cert-policy";
175 goto usage;
176 }
177 policy->unotice_text = arg;
178 continue;
179 case 'M':
180 {
181 char *pos = strchr(arg, ':');
182 x509_policy_mapping_t *mapping;
183 chunk_t subject_oid, issuer_oid;
184
185 if (pos)
186 {
187 *pos++ = '\0';
188 issuer_oid = asn1_oid_from_string(arg);
189 subject_oid = asn1_oid_from_string(pos);
190 }
191 if (!pos || !issuer_oid.len || !subject_oid.len)
192 {
193 error = "--policy-map OIDs invalid";
194 goto usage;
195 }
196 INIT(mapping,
197 .issuer = issuer_oid,
198 .subject = subject_oid,
199 );
200 mappings->insert_last(mappings, mapping);
201 continue;
202 }
203 case 'e':
204 if (streq(arg, "serverAuth"))
205 {
206 flags |= X509_SERVER_AUTH;
207 }
208 else if (streq(arg, "clientAuth"))
209 {
210 flags |= X509_CLIENT_AUTH;
211 }
212 else if (streq(arg, "crlSign"))
213 {
214 flags |= X509_CRL_SIGN;
215 }
216 else if (streq(arg, "ocspSigning"))
217 {
218 flags |= X509_OCSP_SIGNER;
219 }
220 continue;
221 case 'f':
222 if (!get_form(arg, &form, CRED_CERTIFICATE))
223 {
224 error = "invalid output format";
225 goto usage;
226 }
227 continue;
228 case 'u':
229 cdps->insert_last(cdps, arg);
230 continue;
231 case 'I':
232 crl_issuer = identification_create_from_string(arg);
233 continue;
234 case 'o':
235 ocsp->insert_last(ocsp, arg);
236 continue;
237 case EOF:
238 break;
239 default:
240 error = "invalid --issue option";
241 goto usage;
242 }
243 break;
244 }
245
246 if (!pkcs10 && !dn)
247 {
248 error = "--dn is required";
249 goto usage;
250 }
251 if (!cacert)
252 {
253 error = "--cacert is required";
254 goto usage;
255 }
256 if (!cakey && !keyid)
257 {
258 error = "--cakey or --keyid is required";
259 goto usage;
260 }
261 if (dn)
262 {
263 id = identification_create_from_string(dn);
264 if (id->get_type(id) != ID_DER_ASN1_DN)
265 {
266 error = "supplied --dn is not a distinguished name";
267 goto end;
268 }
269 }
270
271 DBG2(DBG_LIB, "Reading ca certificate:");
272 ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
273 BUILD_FROM_FILE, cacert, BUILD_END);
274 if (!ca)
275 {
276 error = "parsing CA certificate failed";
277 goto end;
278 }
279 x509 = (x509_t*)ca;
280 if (!(x509->get_flags(x509) & X509_CA))
281 {
282 error = "CA certificate misses CA basicConstraint";
283 goto end;
284 }
285 public = ca->get_public_key(ca);
286 if (!public)
287 {
288 error = "extracting CA certificate public key failed";
289 goto end;
290 }
291
292 DBG2(DBG_LIB, "Reading ca private key:");
293 if (cakey)
294 {
295 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
296 public->get_type(public),
297 BUILD_FROM_FILE, cakey, BUILD_END);
298 }
299 else
300 {
301 chunk_t chunk;
302
303 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
304 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
305 BUILD_PKCS11_KEYID, chunk, BUILD_END);
306 free(chunk.ptr);
307 }
308 if (!private)
309 {
310 error = "loading CA private key failed";
311 goto end;
312 }
313 if (!private->belongs_to(private, public))
314 {
315 error = "CA private key does not match CA certificate";
316 goto end;
317 }
318 public->destroy(public);
319
320 if (hex)
321 {
322 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
323 }
324 else
325 {
326 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
327
328 if (!rng)
329 {
330 error = "no random number generator found";
331 goto end;
332 }
333 rng->allocate_bytes(rng, 8, &serial);
334 while (*serial.ptr == 0x00)
335 {
336 /* we don't accept a serial number with leading zeroes */
337 rng->get_bytes(rng, 1, serial.ptr);
338 }
339 rng->destroy(rng);
340 }
341
342 if (pkcs10)
343 {
344 enumerator_t *enumerator;
345 identification_t *subjectAltName;
346 pkcs10_t *req;
347
348 DBG2(DBG_LIB, "Reading certificate request");
349 if (file)
350 {
351 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
352 CERT_PKCS10_REQUEST,
353 BUILD_FROM_FILE, file, BUILD_END);
354 }
355 else
356 {
357 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
358 CERT_PKCS10_REQUEST,
359 BUILD_FROM_FD, 0, BUILD_END);
360 }
361 if (!cert_req)
362 {
363 error = "parsing certificate request failed";
364 goto end;
365 }
366
367 /* If not set yet use subject from PKCS#10 certificate request as DN */
368 if (!id)
369 {
370 id = cert_req->get_subject(cert_req);
371 id = id->clone(id);
372 }
373
374 /* Add subjectAltNames from PKCS#10 certificate request */
375 req = (pkcs10_t*)cert_req;
376 enumerator = req->create_subjectAltName_enumerator(req);
377 while (enumerator->enumerate(enumerator, &subjectAltName))
378 {
379 san->insert_last(san, subjectAltName->clone(subjectAltName));
380 }
381 enumerator->destroy(enumerator);
382
383 /* Use public key from PKCS#10 certificate request */
384 public = cert_req->get_public_key(cert_req);
385 }
386 else
387 {
388 DBG2(DBG_LIB, "Reading public key:");
389 if (file)
390 {
391 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
392 BUILD_FROM_FILE, file, BUILD_END);
393 }
394 else
395 {
396 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
397 BUILD_FROM_FD, 0, BUILD_END);
398 }
399 }
400 if (!public)
401 {
402 error = "parsing public key failed";
403 goto end;
404 }
405
406 not_before = time(NULL);
407 not_after = not_before + lifetime * 24 * 60 * 60;
408
409 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
410 BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
411 BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
412 BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
413 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
414 BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
415 BUILD_PATHLEN, pathlen,
416 BUILD_CRL_ISSUER, crl_issuer,
417 BUILD_CRL_DISTRIBUTION_POINTS, cdps,
418 BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
419 BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
420 BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
421 BUILD_CERTIFICATE_POLICIES, policies,
422 BUILD_POLICY_MAPPINGS, mappings,
423 BUILD_END);
424 if (!cert)
425 {
426 error = "generating certificate failed";
427 goto end;
428 }
429 if (!cert->get_encoding(cert, form, &encoding))
430 {
431 error = "encoding certificate failed";
432 goto end;
433 }
434 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
435 {
436 error = "writing certificate key failed";
437 goto end;
438 }
439
440 end:
441 DESTROY_IF(id);
442 DESTROY_IF(cert_req);
443 DESTROY_IF(cert);
444 DESTROY_IF(ca);
445 DESTROY_IF(public);
446 DESTROY_IF(private);
447 san->destroy_offset(san, offsetof(identification_t, destroy));
448 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
449 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
450 policies->destroy_function(policies, (void*)destroy_cert_policy);
451 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
452 cdps->destroy(cdps);
453 ocsp->destroy(ocsp);
454 DESTROY_IF(crl_issuer);
455 free(encoding.ptr);
456 free(serial.ptr);
457
458 if (error)
459 {
460 fprintf(stderr, "%s\n", error);
461 return 1;
462 }
463 return 0;
464
465 usage:
466 san->destroy_offset(san, offsetof(identification_t, destroy));
467 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
468 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
469 policies->destroy_function(policies, (void*)destroy_cert_policy);
470 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
471 cdps->destroy(cdps);
472 ocsp->destroy(ocsp);
473 DESTROY_IF(crl_issuer);
474 return command_usage(error);
475 }
476
477 /**
478 * Register the command.
479 */
480 static void __attribute__ ((constructor))reg()
481 {
482 command_register((command_t) {
483 issue, 'i', "issue",
484 "issue a certificate using a CA certificate and key",
485 {"[--in file] [--type pub|pkcs10] --cakey file | --cakeyid hex",
486 " --cacert file --dn subject-dn [--san subjectAltName]+",
487 "[--lifetime days] [--serial hex] [--crl uri]+ [--ocsp uri]+",
488 "[--ca] [--pathlen len] [--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
489 "[--nc-permitted name] [--nc-excluded name]",
490 "[--cert-policy oid [--cps-uri uri] [--user-notice text] ]+",
491 "[--policy-map issuer-oid:subject-oid]",
492 "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
493 {
494 {"help", 'h', 0, "show usage information"},
495 {"in", 'i', 1, "public key/request file to issue, default: stdin"},
496 {"type", 't', 1, "type of input, default: pub"},
497 {"cacert", 'c', 1, "CA certificate file"},
498 {"cakey", 'k', 1, "CA private key file"},
499 {"cakeyid", 'x', 1, "keyid on smartcard of CA private key"},
500 {"dn", 'd', 1, "distinguished name to include as subject"},
501 {"san", 'a', 1, "subjectAltName to include in certificate"},
502 {"lifetime", 'l', 1, "days the certificate is valid, default: 1095"},
503 {"serial", 's', 1, "serial number in hex, default: random"},
504 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
505 {"pathlen", 'p', 1, "set path length constraint"},
506 {"nc-permitted",'n', 1, "add permitted NameConstraint"},
507 {"nc-excluded", 'N', 1, "add excluded NameConstraint"},
508 {"cert-policy", 'P', 1, "certificatePolicy OID to include"},
509 {"cps-uri", 'C', 1, "Certification Practice statement URI for certificatePolicy"},
510 {"user-notice", 'U', 1, "user notice for certificatePolicy"},
511 {"policy-map", 'M', 1, "policyMapping from issuer to subject OID"},
512 {"flag", 'e', 1, "include extendedKeyUsage flag"},
513 {"crl", 'u', 1, "CRL distribution point URI to include"},
514 {"crlissuer", 'I', 1, "CRL Issuer for CRL at distribution point"},
515 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
516 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
517 {"outform", 'f', 1, "encoding of generated cert, default: der"},
518 }
519 });
520 }
521