pki: Optionally generate RSA/PSS signatures
[strongswan.git] / src / pki / commands / issue.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Copyright (C) 2015-2017 Andreas Steffen
4 * HSR Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include <time.h>
18 #include <errno.h>
19
20 #include "pki.h"
21
22 #include <utils/debug.h>
23 #include <asn1/asn1.h>
24 #include <collections/linked_list.h>
25 #include <credentials/certificates/certificate.h>
26 #include <credentials/certificates/x509.h>
27 #include <credentials/certificates/pkcs10.h>
28
29 /**
30 * Free cert policy with OID
31 */
32 static void destroy_cert_policy(x509_cert_policy_t *policy)
33 {
34 free(policy->oid.ptr);
35 free(policy);
36 }
37
38 /**
39 * Free policy mapping
40 */
41 static void destroy_policy_mapping(x509_policy_mapping_t *mapping)
42 {
43 free(mapping->issuer.ptr);
44 free(mapping->subject.ptr);
45 free(mapping);
46 }
47
48 /**
49 * Free a CRL DistributionPoint
50 */
51 static void destroy_cdp(x509_cdp_t *this)
52 {
53 DESTROY_IF(this->issuer);
54 free(this);
55 }
56
57 /**
58 * Issue a certificate using a CA certificate and key
59 */
60 static int issue()
61 {
62 cred_encoding_type_t form = CERT_ASN1_DER;
63 hash_algorithm_t digest = HASH_UNKNOWN;
64 signature_params_t *scheme = NULL;
65 certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
66 private_key_t *private = NULL;
67 public_key_t *public = NULL;
68 credential_type_t type = CRED_PUBLIC_KEY;
69 key_type_t subtype = KEY_ANY;
70 bool pkcs10 = FALSE, pss = FALSE;
71 char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
72 char *error = NULL, *keyid = NULL;
73 identification_t *id = NULL;
74 linked_list_t *san, *cdps, *ocsp, *permitted, *excluded, *policies, *mappings;
75 linked_list_t *addrblocks;
76 int pathlen = X509_NO_CONSTRAINT, inhibit_any = X509_NO_CONSTRAINT;
77 int inhibit_mapping = X509_NO_CONSTRAINT, require_explicit = X509_NO_CONSTRAINT;
78 chunk_t serial = chunk_empty;
79 chunk_t encoding = chunk_empty;
80 time_t not_before, not_after, lifetime = 1095 * 24 * 60 * 60;
81 char *datenb = NULL, *datena = NULL, *dateform = NULL;
82 x509_flag_t flags = 0;
83 x509_t *x509;
84 x509_cdp_t *cdp = NULL;
85 x509_cert_policy_t *policy = NULL;
86 traffic_selector_t *ts;
87 char *arg;
88
89 san = linked_list_create();
90 cdps = linked_list_create();
91 ocsp = linked_list_create();
92 permitted = linked_list_create();
93 excluded = linked_list_create();
94 policies = linked_list_create();
95 mappings = linked_list_create();
96 addrblocks = linked_list_create();
97
98 while (TRUE)
99 {
100 switch (command_getopt(&arg))
101 {
102 case 'h':
103 goto usage;
104 case 't':
105 if (streq(arg, "pkcs10"))
106 {
107 pkcs10 = TRUE;
108 }
109 else if (streq(arg, "rsa"))
110 {
111 type = CRED_PRIVATE_KEY;
112 subtype = KEY_RSA;
113 }
114 else if (streq(arg, "ecdsa"))
115 {
116 type = CRED_PRIVATE_KEY;
117 subtype = KEY_ECDSA;
118 }
119 else if (streq(arg, "ed25519"))
120 {
121 type = CRED_PRIVATE_KEY;
122 subtype = KEY_ED25519;
123 }
124 else if (streq(arg, "bliss"))
125 {
126 type = CRED_PRIVATE_KEY;
127 subtype = KEY_BLISS;
128 }
129 else if (streq(arg, "priv"))
130 {
131 type = CRED_PRIVATE_KEY;
132 subtype = KEY_ANY;
133 }
134 else if (!streq(arg, "pub"))
135 {
136 error = "invalid input type";
137 goto usage;
138 }
139 continue;
140 case 'g':
141 if (!enum_from_name(hash_algorithm_short_names, arg, &digest))
142 {
143 error = "invalid --digest type";
144 goto usage;
145 }
146 continue;
147 case 'R':
148 if (streq(arg, "pss"))
149 {
150 pss = TRUE;
151 }
152 else if (!streq(arg, "pkcs1"))
153 {
154 error = "invalid RSA padding";
155 goto usage;
156 }
157 continue;
158 case 'i':
159 file = arg;
160 continue;
161 case 'c':
162 cacert = arg;
163 continue;
164 case 'k':
165 cakey = arg;
166 continue;
167 case 'x':
168 keyid = arg;
169 continue;
170 case 'd':
171 dn = arg;
172 continue;
173 case 'a':
174 san->insert_last(san, identification_create_from_string(arg));
175 continue;
176 case 'l':
177 lifetime = atoi(arg) * 24 * 60 * 60;
178 if (!lifetime)
179 {
180 error = "invalid --lifetime value";
181 goto usage;
182 }
183 continue;
184 case 'D':
185 dateform = arg;
186 continue;
187 case 'F':
188 datenb = arg;
189 continue;
190 case 'T':
191 datena = arg;
192 continue;
193 case 's':
194 hex = arg;
195 continue;
196 case 'b':
197 flags |= X509_CA;
198 continue;
199 case 'p':
200 pathlen = atoi(arg);
201 continue;
202 case 'B':
203 ts = parse_ts(arg);
204 if (!ts)
205 {
206 error = "invalid addressBlock";
207 goto usage;
208 }
209 addrblocks->insert_last(addrblocks, ts);
210 continue;
211 case 'n':
212 permitted->insert_last(permitted,
213 identification_create_from_string(arg));
214 continue;
215 case 'N':
216 excluded->insert_last(excluded,
217 identification_create_from_string(arg));
218 continue;
219 case 'P':
220 {
221 chunk_t oid;
222
223 oid = asn1_oid_from_string(arg);
224 if (!oid.len)
225 {
226 error = "--cert-policy OID invalid";
227 goto usage;
228 }
229 INIT(policy,
230 .oid = oid,
231 );
232 policies->insert_last(policies, policy);
233 continue;
234 }
235 case 'C':
236 if (!policy)
237 {
238 error = "--cps-uri must follow a --cert-policy";
239 goto usage;
240 }
241 policy->cps_uri = arg;
242 continue;
243 case 'U':
244 if (!policy)
245 {
246 error = "--user-notice must follow a --cert-policy";
247 goto usage;
248 }
249 policy->unotice_text = arg;
250 continue;
251 case 'M':
252 {
253 char *pos = strchr(arg, ':');
254 x509_policy_mapping_t *mapping;
255 chunk_t subject_oid, issuer_oid;
256
257 if (pos)
258 {
259 *pos++ = '\0';
260 issuer_oid = asn1_oid_from_string(arg);
261 subject_oid = asn1_oid_from_string(pos);
262 }
263 if (!pos || !issuer_oid.len || !subject_oid.len)
264 {
265 error = "--policy-map OIDs invalid";
266 goto usage;
267 }
268 INIT(mapping,
269 .issuer = issuer_oid,
270 .subject = subject_oid,
271 );
272 mappings->insert_last(mappings, mapping);
273 continue;
274 }
275 case 'E':
276 require_explicit = atoi(arg);
277 continue;
278 case 'H':
279 inhibit_mapping = atoi(arg);
280 continue;
281 case 'A':
282 inhibit_any = atoi(arg);
283 continue;
284 case 'e':
285 if (streq(arg, "serverAuth"))
286 {
287 flags |= X509_SERVER_AUTH;
288 }
289 else if (streq(arg, "clientAuth"))
290 {
291 flags |= X509_CLIENT_AUTH;
292 }
293 else if (streq(arg, "ikeIntermediate"))
294 {
295 flags |= X509_IKE_INTERMEDIATE;
296 }
297 else if (streq(arg, "crlSign"))
298 {
299 flags |= X509_CRL_SIGN;
300 }
301 else if (streq(arg, "ocspSigning"))
302 {
303 flags |= X509_OCSP_SIGNER;
304 }
305 else if (streq(arg, "msSmartcardLogon"))
306 {
307 flags |= X509_MS_SMARTCARD_LOGON;
308 }
309 continue;
310 case 'f':
311 if (!get_form(arg, &form, CRED_CERTIFICATE))
312 {
313 error = "invalid output format";
314 goto usage;
315 }
316 continue;
317 case 'u':
318 INIT(cdp,
319 .uri = arg,
320 );
321 cdps->insert_last(cdps, cdp);
322 continue;
323 case 'I':
324 if (!cdp || cdp->issuer)
325 {
326 error = "--crlissuer must follow a --crl";
327 goto usage;
328 }
329 cdp->issuer = identification_create_from_string(arg);
330 continue;
331 case 'o':
332 ocsp->insert_last(ocsp, arg);
333 continue;
334 case EOF:
335 break;
336 default:
337 error = "invalid --issue option";
338 goto usage;
339 }
340 break;
341 }
342
343 if (!cacert)
344 {
345 error = "--cacert is required";
346 goto usage;
347 }
348 if (!cakey && !keyid)
349 {
350 error = "--cakey or --keyid is required";
351 goto usage;
352 }
353 if (!calculate_lifetime(dateform, datenb, datena, lifetime,
354 &not_before, &not_after))
355 {
356 error = "invalid --not-before/after datetime";
357 goto usage;
358 }
359 if (dn && *dn)
360 {
361 id = identification_create_from_string(dn);
362 if (id->get_type(id) != ID_DER_ASN1_DN)
363 {
364 error = "supplied --dn is not a distinguished name";
365 goto end;
366 }
367 }
368
369 DBG2(DBG_LIB, "Reading ca certificate:");
370 ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
371 BUILD_FROM_FILE, cacert, BUILD_END);
372 if (!ca)
373 {
374 error = "parsing CA certificate failed";
375 goto end;
376 }
377 x509 = (x509_t*)ca;
378 if (!(x509->get_flags(x509) & X509_CA))
379 {
380 error = "CA certificate misses CA basicConstraint";
381 goto end;
382 }
383 public = ca->get_public_key(ca);
384 if (!public)
385 {
386 error = "extracting CA certificate public key failed";
387 goto end;
388 }
389
390 DBG2(DBG_LIB, "Reading ca private key:");
391 if (cakey)
392 {
393 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
394 public->get_type(public),
395 BUILD_FROM_FILE, cakey, BUILD_END);
396 }
397 else
398 {
399 chunk_t chunk;
400
401 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
402 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
403 BUILD_PKCS11_KEYID, chunk, BUILD_END);
404 free(chunk.ptr);
405 }
406 if (!private)
407 {
408 error = "loading CA private key failed";
409 goto end;
410 }
411 if (!private->belongs_to(private, public))
412 {
413 error = "CA private key does not match CA certificate";
414 goto end;
415 }
416 public->destroy(public);
417 public = NULL;
418
419 if (hex)
420 {
421 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
422 }
423 else
424 {
425 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
426
427 if (!rng)
428 {
429 error = "no random number generator found";
430 goto end;
431 }
432 if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
433 {
434 error = "failed to generate serial number";
435 rng->destroy(rng);
436 goto end;
437 }
438 serial.ptr[0] &= 0x7F;
439 rng->destroy(rng);
440 }
441
442 if (pkcs10)
443 {
444 enumerator_t *enumerator;
445 identification_t *subjectAltName;
446 pkcs10_t *req;
447
448 DBG2(DBG_LIB, "Reading certificate request");
449 if (file)
450 {
451 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
452 CERT_PKCS10_REQUEST,
453 BUILD_FROM_FILE, file, BUILD_END);
454 }
455 else
456 {
457 chunk_t chunk;
458
459 set_file_mode(stdin, CERT_ASN1_DER);
460 if (!chunk_from_fd(0, &chunk))
461 {
462 fprintf(stderr, "%s: ", strerror(errno));
463 error = "reading certificate request failed";
464 goto end;
465 }
466 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
467 CERT_PKCS10_REQUEST,
468 BUILD_BLOB, chunk, BUILD_END);
469 free(chunk.ptr);
470 }
471 if (!cert_req)
472 {
473 error = "parsing certificate request failed";
474 goto end;
475 }
476
477 /* If not set yet use subject from PKCS#10 certificate request as DN */
478 if (!id)
479 {
480 id = cert_req->get_subject(cert_req);
481 id = id->clone(id);
482 }
483
484 /* Add subjectAltNames from PKCS#10 certificate request */
485 req = (pkcs10_t*)cert_req;
486 enumerator = req->create_subjectAltName_enumerator(req);
487 while (enumerator->enumerate(enumerator, &subjectAltName))
488 {
489 san->insert_last(san, subjectAltName->clone(subjectAltName));
490 }
491 enumerator->destroy(enumerator);
492
493 /* Use public key from PKCS#10 certificate request */
494 public = cert_req->get_public_key(cert_req);
495 }
496 else
497 {
498 DBG2(DBG_LIB, "Reading key:");
499 if (file)
500 {
501 public = lib->creds->create(lib->creds, type, subtype,
502 BUILD_FROM_FILE, file, BUILD_END);
503 }
504 else
505 {
506 chunk_t chunk;
507
508 if (!chunk_from_fd(0, &chunk))
509 {
510 fprintf(stderr, "%s: ", strerror(errno));
511 error = "reading key failed";
512 goto end;
513 }
514 public = lib->creds->create(lib->creds, type, subtype,
515 BUILD_BLOB, chunk, BUILD_END);
516 free(chunk.ptr);
517 }
518 if (public && type == CRED_PRIVATE_KEY)
519 {
520 private_key_t *priv = (private_key_t*)public;
521 public = priv->get_public_key(priv);
522 priv->destroy(priv);
523 }
524 }
525 if (!public)
526 {
527 error = "parsing public key failed";
528 goto end;
529 }
530
531 if (!id)
532 {
533 id = identification_create_from_encoding(ID_DER_ASN1_DN,
534 chunk_from_chars(ASN1_SEQUENCE, 0));
535 }
536 scheme = get_signature_scheme(private, digest, pss);
537
538 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
539 BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
540 BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
541 BUILD_NOT_BEFORE_TIME, not_before,
542 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
543 BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
544 BUILD_PATHLEN, pathlen, BUILD_ADDRBLOCKS, addrblocks,
545 BUILD_CRL_DISTRIBUTION_POINTS, cdps,
546 BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
547 BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
548 BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
549 BUILD_CERTIFICATE_POLICIES, policies,
550 BUILD_POLICY_MAPPINGS, mappings,
551 BUILD_POLICY_REQUIRE_EXPLICIT, require_explicit,
552 BUILD_POLICY_INHIBIT_MAPPING, inhibit_mapping,
553 BUILD_POLICY_INHIBIT_ANY, inhibit_any,
554 BUILD_SIGNATURE_SCHEME, scheme,
555 BUILD_END);
556 if (!cert)
557 {
558 error = "generating certificate failed";
559 goto end;
560 }
561 if (!cert->get_encoding(cert, form, &encoding))
562 {
563 error = "encoding certificate failed";
564 goto end;
565 }
566 set_file_mode(stdout, form);
567 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
568 {
569 error = "writing certificate key failed";
570 goto end;
571 }
572
573 end:
574 DESTROY_IF(id);
575 DESTROY_IF(cert_req);
576 DESTROY_IF(cert);
577 DESTROY_IF(ca);
578 DESTROY_IF(public);
579 DESTROY_IF(private);
580 san->destroy_offset(san, offsetof(identification_t, destroy));
581 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
582 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
583 addrblocks->destroy_offset(addrblocks, offsetof(traffic_selector_t, destroy));
584 policies->destroy_function(policies, (void*)destroy_cert_policy);
585 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
586 cdps->destroy_function(cdps, (void*)destroy_cdp);
587 ocsp->destroy(ocsp);
588 signature_params_destroy(scheme);
589 free(encoding.ptr);
590 free(serial.ptr);
591
592 if (error)
593 {
594 fprintf(stderr, "%s\n", error);
595 return 1;
596 }
597 return 0;
598
599 usage:
600 san->destroy_offset(san, offsetof(identification_t, destroy));
601 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
602 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
603 addrblocks->destroy_offset(addrblocks, offsetof(traffic_selector_t, destroy));
604 policies->destroy_function(policies, (void*)destroy_cert_policy);
605 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
606 cdps->destroy_function(cdps, (void*)destroy_cdp);
607 ocsp->destroy(ocsp);
608 return command_usage(error);
609 }
610
611 /**
612 * Register the command.
613 */
614 static void __attribute__ ((constructor))reg()
615 {
616 command_register((command_t) {
617 issue, 'i', "issue",
618 "issue a certificate using a CA certificate and key",
619 {"[--in file] [--type pub|pkcs10|priv|rsa|ecdsa|ed25519|bliss] --cakey file|--cakeyid hex",
620 " --cacert file [--dn subject-dn] [--san subjectAltName]+",
621 "[--lifetime days] [--serial hex] [--ca] [--pathlen len]",
622 "[--flag serverAuth|clientAuth|crlSign|ocspSigning|msSmartcardLogon]+",
623 "[--crl uri [--crlissuer i]]+ [--ocsp uri]+ [--nc-permitted name]",
624 "[--nc-excluded name] [--policy-mapping issuer-oid:subject-oid]",
625 "[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
626 "[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
627 "[--digest md5|sha1|sha224|sha256|sha384|sha512|sha3_224|sha3_256|sha3_384|sha3_512]",
628 "[--rsa-padding pkcs1|pss]",
629 "[--outform der|pem]"},
630 {
631 {"help", 'h', 0, "show usage information"},
632 {"in", 'i', 1, "key/request file to issue, default: stdin"},
633 {"type", 't', 1, "type of input, default: pub"},
634 {"cacert", 'c', 1, "CA certificate file"},
635 {"cakey", 'k', 1, "CA private key file"},
636 {"cakeyid", 'x', 1, "smartcard or TPM CA private key object handle"},
637 {"dn", 'd', 1, "distinguished name to include as subject"},
638 {"san", 'a', 1, "subjectAltName to include in certificate"},
639 {"lifetime", 'l', 1, "days the certificate is valid, default: 1095"},
640 {"not-before", 'F', 1, "date/time the validity of the cert starts"},
641 {"not-after", 'T', 1, "date/time the validity of the cert ends"},
642 {"dateform", 'D', 1, "strptime(3) input format, default: %d.%m.%y %T"},
643 {"serial", 's', 1, "serial number in hex, default: random"},
644 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
645 {"pathlen", 'p', 1, "set path length constraint"},
646 {"addrblock", 'B', 1, "RFC 3779 addrBlock to include"},
647 {"nc-permitted", 'n', 1, "add permitted NameConstraint"},
648 {"nc-excluded", 'N', 1, "add excluded NameConstraint"},
649 {"cert-policy", 'P', 1, "certificatePolicy OID to include"},
650 {"cps-uri", 'C', 1, "Certification Practice statement URI for certificatePolicy"},
651 {"user-notice", 'U', 1, "user notice for certificatePolicy"},
652 {"policy-mapping", 'M', 1, "policyMapping from issuer to subject OID"},
653 {"policy-explicit", 'E', 1, "requireExplicitPolicy constraint"},
654 {"policy-inhibit", 'H', 1, "inhibitPolicyMapping constraint"},
655 {"policy-any", 'A', 1, "inhibitAnyPolicy constraint"},
656 {"flag", 'e', 1, "include extendedKeyUsage flag"},
657 {"crl", 'u', 1, "CRL distribution point URI to include"},
658 {"crlissuer", 'I', 1, "CRL Issuer for CRL at distribution point"},
659 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
660 {"digest", 'g', 1, "digest for signature creation, default: key-specific"},
661 {"rsa-padding", 'R', 1, "padding for RSA signatures, default: pkcs1"},
662 {"outform", 'f', 1, "encoding of generated cert, default: der"},
663 }
664 });
665 }