src/pki/commands/issue.c

   1 /*
   2  * Copyright (C) 2009 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <time.h>
  17
  18 #include "pki.h"
  19
  20 #include <utils/linked_list.h>
  21 #include <utils/optionsfrom.h>
  22 #include <credentials/certificates/certificate.h>
  23 #include <credentials/certificates/x509.h>
  24
  25 /**
  26  * Issue a certificate using a CA certificate and key
  27  */
  28 static int issue(int argc, char *argv[])
  29 {
  30         hash_algorithm_t digest = HASH_SHA1;
  31         certificate_t *cert = NULL, *ca =NULL;
  32         private_key_t *private = NULL;
  33         public_key_t *public = NULL;
  34         char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
  35         char *error = NULL;
  36         identification_t *id = NULL;
  37         linked_list_t *san;
  38         int lifetime = 1080;
  39         chunk_t serial = chunk_empty;
  40         chunk_t encoding = chunk_empty;
  41         time_t not_before, not_after;
  42         x509_flag_t flags = 0;
  43         x509_t *x509;
  44         options_t *options;
  45
  46         options = options_create();
  47         san = linked_list_create();
  48
  49         while (TRUE)
  50         {
  51                 switch (getopt_long(argc, argv, "", command_opts, NULL))
  52                 {
  53                         case 'h':
  54                                 goto usage;
  55                         case '+':
  56                                 if (!options->from(options, optarg, &argc, &argv, optind))
  57                                 {
  58                                         error = "invalid options file";
  59                                         goto usage;
  60                                 }
  61                                 continue;
  62                         case 't':
  63                                 if (!streq(optarg, "pub"))
  64                                 {
  65                                         error = "invalid input type";
  66                                         goto usage;
  67                                 }
  68                                 continue;
  69                         case 'g':
  70                                 digest = get_digest(optarg);
  71                                 if (digest == HASH_UNKNOWN)
  72                                 {
  73                                         error = "invalid --digest type";
  74                                         goto usage;
  75                                 }
  76                                 continue;
  77                         case 'i':
  78                                 file = optarg;
  79                                 continue;
  80                         case 'c':
  81                                 cacert = optarg;
  82                                 continue;
  83                         case 'k':
  84                                 cakey = optarg;
  85                                 continue;
  86                         case 'd':
  87                                 dn = optarg;
  88                                 continue;
  89                         case 'a':
  90                                 san->insert_last(san, identification_create_from_string(optarg));
  91                                 continue;
  92                         case 'l':
  93                                 lifetime = atoi(optarg);
  94                                 if (!lifetime)
  95                                 {
  96                                         error = "invalid --lifetime value";
  97                                         goto usage;
  98                                 }
  99                                 continue;
 100                         case 's':
 101                                 hex = optarg;
 102                                 continue;
 103                         case 'b':
 104                                 flags |= X509_CA;
 105                                 continue;
 106                         case EOF:
 107                                 break;
 108                         default:
 109                                 error = "invalid --issue option";
 110                                 goto usage;
 111                 }
 112                 break;
 113         }
 114
 115         if (!dn)
 116         {
 117                 error = "--dn is required";
 118                 goto usage;
 119         }
 120         if (!cacert)
 121         {
 122                 error = "--cacert is required";
 123                 goto usage;
 124         }
 125         if (!cakey)
 126         {
 127                 error = "--cakey is required";
 128                 goto usage;
 129         }
 130         id = identification_create_from_string(dn);
 131         if (id->get_type(id) != ID_DER_ASN1_DN)
 132         {
 133                 error = "supplied --dn is not a distinguished name";
 134                 goto end;
 135         }
 136         ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 137                                                         BUILD_FROM_FILE, cacert, BUILD_END);
 138         if (!ca)
 139         {
 140                 error = "parsing CA certificate failed";
 141                 goto end;
 142         }
 143         x509 = (x509_t*)ca;
 144         if (!(x509->get_flags(x509) & X509_CA))
 145         {
 146                 error = "CA certificate misses CA basicConstraint";
 147                 goto end;
 148         }
 149
 150         public = ca->get_public_key(ca);
 151         if (!public)
 152         {
 153                 error = "extracting CA certificate public key failed";
 154                 goto end;
 155         }
 156         private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 157                                                                  public->get_type(public),
 158                                                                  BUILD_FROM_FILE, cakey, BUILD_END);
 159         if (!private)
 160         {
 161                 error = "parsing CA private key failed";
 162                 goto end;
 163         }
 164         if (!private->belongs_to(private, public))
 165         {
 166                 error = "CA private key does not match CA certificate";
 167                 goto end;
 168         }
 169         public->destroy(public);
 170
 171         if (file)
 172         {
 173                 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
 174                                                                          BUILD_FROM_FILE, file, BUILD_END);
 175         }
 176         else
 177         {
 178                 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
 179                                                                          BUILD_FROM_FD, 0, BUILD_END);
 180         }
 181         if (!public)
 182         {
 183                 error = "parsing public key failed";
 184                 goto end;
 185         }
 186
 187         if (hex)
 188         {
 189                 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
 190         }
 191         else
 192         {
 193                 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 194
 195                 if (!rng)
 196                 {
 197                         error = "no random number generator found";
 198                         goto end;
 199                 }
 200                 rng->allocate_bytes(rng, 8, &serial);
 201                 rng->destroy(rng);
 202         }
 203         not_before = time(NULL);
 204         not_after = not_before + lifetime * 24 * 60 * 60;
 205         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 206                                         BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
 207                                         BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
 208                                         BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
 209                                         BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
 210                                         BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
 211                                         BUILD_END);
 212         if (!cert)
 213         {
 214                 error = "generating certificate failed";
 215                 goto end;
 216         }
 217         encoding = cert->get_encoding(cert);
 218         if (!encoding.ptr)
 219         {
 220                 error = "encoding certificate failed";
 221                 goto end;
 222         }
 223         if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
 224         {
 225                 error = "writing certificate key failed";
 226                 goto end;
 227         }
 228
 229 end:
 230         DESTROY_IF(id);
 231         DESTROY_IF(cert);
 232         DESTROY_IF(ca);
 233         DESTROY_IF(public);
 234         DESTROY_IF(private);
 235         san->destroy_offset(san, offsetof(identification_t, destroy));
 236         options->destroy(options);
 237         free(encoding.ptr);
 238         free(serial.ptr);
 239
 240         if (error)
 241         {
 242                 fprintf(stderr, "%s\n", error);
 243                 return 1;
 244         }
 245         return 0;
 246
 247 usage:
 248         san->destroy_offset(san, offsetof(identification_t, destroy));
 249         options->destroy(options);
 250         return command_usage(error);
 251 }
 252
 253 /**
 254  * Register the command.
 255  */
 256 static void __attribute__ ((constructor))reg()
 257 {
 258         command_register((command_t) {
 259                 issue, 'i', "issue",
 260                 "issue a certificate using a CA certificate and key",
 261                 {"[--in file] [--type pub|pkcs10]",
 262                  " --cacert file --cakey file",
 263                  " --dn subject-dn [--san subjectAltName]+",
 264                  "[--lifetime days] [--serial hex] [--ca]",
 265                  "[--digest md5|sha1|sha224|sha256|sha384|sha512]",
 266                  "[--options file]"},
 267                 {
 268                         {"help",        'h', 0, "show usage information"},
 269                         {"in",          'i', 1, "public key/request file to issue, default: stdin"},
 270                         {"type",        't', 1, "type of input, default: pub"},
 271                         {"cacert",      'c', 1, "CA certificate file"},
 272                         {"cakey",       'k', 1, "CA private key file"},
 273                         {"dn",          'd', 1, "distinguished name to include as subject"},
 274                         {"san",         'a', 1, "subjectAltName to include in certificate"},
 275                         {"lifetime",'l', 1, "days the certificate is valid, default: 1080"},
 276                         {"serial",      's', 1, "serial number in hex, default: random"},
 277                         {"ca",          'b', 0, "include CA basicConstraint, default: no"},
 278                         {"digest",      'g', 1, "digest for signature creation, default: sha1"},
 279                         {"options",     '+', 1, "read command line options from file"},
 280                 }
 281         });
 282 }
 283