c2a120fca315ce0a665809210c944507eb0d0bba
[strongswan.git] / src / pki / commands / issue.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17 #include <errno.h>
18
19 #include "pki.h"
20
21 #include <utils/debug.h>
22 #include <asn1/asn1.h>
23 #include <collections/linked_list.h>
24 #include <credentials/certificates/certificate.h>
25 #include <credentials/certificates/x509.h>
26 #include <credentials/certificates/pkcs10.h>
27
28 /**
29 * Free cert policy with OID
30 */
31 static void destroy_cert_policy(x509_cert_policy_t *policy)
32 {
33 free(policy->oid.ptr);
34 free(policy);
35 }
36
37 /**
38 * Free policy mapping
39 */
40 static void destroy_policy_mapping(x509_policy_mapping_t *mapping)
41 {
42 free(mapping->issuer.ptr);
43 free(mapping->subject.ptr);
44 free(mapping);
45 }
46
47 /**
48 * Free a CRL DistributionPoint
49 */
50 static void destroy_cdp(x509_cdp_t *this)
51 {
52 DESTROY_IF(this->issuer);
53 free(this);
54 }
55
56 /**
57 * Issue a certificate using a CA certificate and key
58 */
59 static int issue()
60 {
61 cred_encoding_type_t form = CERT_ASN1_DER;
62 hash_algorithm_t digest = HASH_SHA1;
63 certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
64 private_key_t *private = NULL;
65 public_key_t *public = NULL;
66 bool pkcs10 = FALSE;
67 char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
68 char *error = NULL, *keyid = NULL;
69 identification_t *id = NULL;
70 linked_list_t *san, *cdps, *ocsp, *permitted, *excluded, *policies, *mappings;
71 int pathlen = X509_NO_CONSTRAINT, inhibit_any = X509_NO_CONSTRAINT;
72 int inhibit_mapping = X509_NO_CONSTRAINT, require_explicit = X509_NO_CONSTRAINT;
73 chunk_t serial = chunk_empty;
74 chunk_t encoding = chunk_empty;
75 time_t lifetime = 1095;
76 time_t not_before, not_after;
77 x509_flag_t flags = 0;
78 x509_t *x509;
79 x509_cdp_t *cdp = NULL;
80 x509_cert_policy_t *policy = NULL;
81 char *arg;
82
83 san = linked_list_create();
84 cdps = linked_list_create();
85 ocsp = linked_list_create();
86 permitted = linked_list_create();
87 excluded = linked_list_create();
88 policies = linked_list_create();
89 mappings = linked_list_create();
90
91 while (TRUE)
92 {
93 switch (command_getopt(&arg))
94 {
95 case 'h':
96 goto usage;
97 case 't':
98 if (streq(arg, "pkcs10"))
99 {
100 pkcs10 = TRUE;
101 }
102 else if (!streq(arg, "pub"))
103 {
104 error = "invalid input type";
105 goto usage;
106 }
107 continue;
108 case 'g':
109 digest = enum_from_name(hash_algorithm_short_names, arg);
110 if (digest == -1)
111 {
112 error = "invalid --digest type";
113 goto usage;
114 }
115 continue;
116 case 'i':
117 file = arg;
118 continue;
119 case 'c':
120 cacert = arg;
121 continue;
122 case 'k':
123 cakey = arg;
124 continue;
125 case 'x':
126 keyid = arg;
127 continue;
128 case 'd':
129 dn = arg;
130 continue;
131 case 'a':
132 san->insert_last(san, identification_create_from_string(arg));
133 continue;
134 case 'l':
135 lifetime = atoi(arg);
136 if (!lifetime)
137 {
138 error = "invalid --lifetime value";
139 goto usage;
140 }
141 continue;
142 case 's':
143 hex = arg;
144 continue;
145 case 'b':
146 flags |= X509_CA;
147 continue;
148 case 'p':
149 pathlen = atoi(arg);
150 continue;
151 case 'n':
152 permitted->insert_last(permitted,
153 identification_create_from_string(arg));
154 continue;
155 case 'N':
156 excluded->insert_last(excluded,
157 identification_create_from_string(arg));
158 continue;
159 case 'P':
160 {
161 chunk_t oid;
162
163 oid = asn1_oid_from_string(arg);
164 if (!oid.len)
165 {
166 error = "--cert-policy OID invalid";
167 goto usage;
168 }
169 INIT(policy,
170 .oid = oid,
171 );
172 policies->insert_last(policies, policy);
173 continue;
174 }
175 case 'C':
176 if (!policy)
177 {
178 error = "--cps-uri must follow a --cert-policy";
179 goto usage;
180 }
181 policy->cps_uri = arg;
182 continue;
183 case 'U':
184 if (!policy)
185 {
186 error = "--user-notice must follow a --cert-policy";
187 goto usage;
188 }
189 policy->unotice_text = arg;
190 continue;
191 case 'M':
192 {
193 char *pos = strchr(arg, ':');
194 x509_policy_mapping_t *mapping;
195 chunk_t subject_oid, issuer_oid;
196
197 if (pos)
198 {
199 *pos++ = '\0';
200 issuer_oid = asn1_oid_from_string(arg);
201 subject_oid = asn1_oid_from_string(pos);
202 }
203 if (!pos || !issuer_oid.len || !subject_oid.len)
204 {
205 error = "--policy-map OIDs invalid";
206 goto usage;
207 }
208 INIT(mapping,
209 .issuer = issuer_oid,
210 .subject = subject_oid,
211 );
212 mappings->insert_last(mappings, mapping);
213 continue;
214 }
215 case 'E':
216 require_explicit = atoi(arg);
217 continue;
218 case 'H':
219 inhibit_mapping = atoi(arg);
220 continue;
221 case 'A':
222 inhibit_any = atoi(arg);
223 continue;
224 case 'e':
225 if (streq(arg, "serverAuth"))
226 {
227 flags |= X509_SERVER_AUTH;
228 }
229 else if (streq(arg, "clientAuth"))
230 {
231 flags |= X509_CLIENT_AUTH;
232 }
233 else if (streq(arg, "ikeIntermediate"))
234 {
235 flags |= X509_IKE_INTERMEDIATE;
236 }
237 else if (streq(arg, "crlSign"))
238 {
239 flags |= X509_CRL_SIGN;
240 }
241 else if (streq(arg, "ocspSigning"))
242 {
243 flags |= X509_OCSP_SIGNER;
244 }
245 continue;
246 case 'f':
247 if (!get_form(arg, &form, CRED_CERTIFICATE))
248 {
249 error = "invalid output format";
250 goto usage;
251 }
252 continue;
253 case 'u':
254 INIT(cdp,
255 .uri = arg,
256 );
257 cdps->insert_last(cdps, cdp);
258 continue;
259 case 'I':
260 if (!cdp || cdp->issuer)
261 {
262 error = "--crlissuer must follow a --crl";
263 goto usage;
264 }
265 cdp->issuer = identification_create_from_string(arg);
266 continue;
267 case 'o':
268 ocsp->insert_last(ocsp, arg);
269 continue;
270 case EOF:
271 break;
272 default:
273 error = "invalid --issue option";
274 goto usage;
275 }
276 break;
277 }
278 if (!cacert)
279 {
280 error = "--cacert is required";
281 goto usage;
282 }
283 if (!cakey && !keyid)
284 {
285 error = "--cakey or --keyid is required";
286 goto usage;
287 }
288 if (dn && *dn)
289 {
290 id = identification_create_from_string(dn);
291 if (id->get_type(id) != ID_DER_ASN1_DN)
292 {
293 error = "supplied --dn is not a distinguished name";
294 goto end;
295 }
296 }
297
298 DBG2(DBG_LIB, "Reading ca certificate:");
299 ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
300 BUILD_FROM_FILE, cacert, BUILD_END);
301 if (!ca)
302 {
303 error = "parsing CA certificate failed";
304 goto end;
305 }
306 x509 = (x509_t*)ca;
307 if (!(x509->get_flags(x509) & X509_CA))
308 {
309 error = "CA certificate misses CA basicConstraint";
310 goto end;
311 }
312 public = ca->get_public_key(ca);
313 if (!public)
314 {
315 error = "extracting CA certificate public key failed";
316 goto end;
317 }
318
319 DBG2(DBG_LIB, "Reading ca private key:");
320 if (cakey)
321 {
322 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
323 public->get_type(public),
324 BUILD_FROM_FILE, cakey, BUILD_END);
325 }
326 else
327 {
328 chunk_t chunk;
329
330 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
331 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
332 BUILD_PKCS11_KEYID, chunk, BUILD_END);
333 free(chunk.ptr);
334 }
335 if (!private)
336 {
337 error = "loading CA private key failed";
338 goto end;
339 }
340 if (!private->belongs_to(private, public))
341 {
342 error = "CA private key does not match CA certificate";
343 goto end;
344 }
345 public->destroy(public);
346
347 if (hex)
348 {
349 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
350 }
351 else
352 {
353 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
354
355 if (!rng)
356 {
357 error = "no random number generator found";
358 goto end;
359 }
360 if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
361 {
362 error = "failed to generate serial number";
363 rng->destroy(rng);
364 goto end;
365 }
366 serial.ptr[0] &= 0x7F;
367 rng->destroy(rng);
368 }
369
370 if (pkcs10)
371 {
372 enumerator_t *enumerator;
373 identification_t *subjectAltName;
374 pkcs10_t *req;
375
376 DBG2(DBG_LIB, "Reading certificate request");
377 if (file)
378 {
379 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
380 CERT_PKCS10_REQUEST,
381 BUILD_FROM_FILE, file, BUILD_END);
382 }
383 else
384 {
385 chunk_t chunk;
386
387 if (!chunk_from_fd(0, &chunk))
388 {
389 fprintf(stderr, "%s: ", strerror(errno));
390 error = "reading certificate request failed";
391 goto end;
392 }
393 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
394 CERT_PKCS10_REQUEST,
395 BUILD_BLOB, chunk, BUILD_END);
396 free(chunk.ptr);
397 }
398 if (!cert_req)
399 {
400 error = "parsing certificate request failed";
401 goto end;
402 }
403
404 /* If not set yet use subject from PKCS#10 certificate request as DN */
405 if (!id)
406 {
407 id = cert_req->get_subject(cert_req);
408 id = id->clone(id);
409 }
410
411 /* Add subjectAltNames from PKCS#10 certificate request */
412 req = (pkcs10_t*)cert_req;
413 enumerator = req->create_subjectAltName_enumerator(req);
414 while (enumerator->enumerate(enumerator, &subjectAltName))
415 {
416 san->insert_last(san, subjectAltName->clone(subjectAltName));
417 }
418 enumerator->destroy(enumerator);
419
420 /* Use public key from PKCS#10 certificate request */
421 public = cert_req->get_public_key(cert_req);
422 }
423 else
424 {
425 DBG2(DBG_LIB, "Reading public key:");
426 if (file)
427 {
428 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
429 BUILD_FROM_FILE, file, BUILD_END);
430 }
431 else
432 {
433 chunk_t chunk;
434
435 if (!chunk_from_fd(0, &chunk))
436 {
437 fprintf(stderr, "%s: ", strerror(errno));
438 error = "reading public key failed";
439 goto end;
440 }
441 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
442 BUILD_BLOB, chunk, BUILD_END);
443 free(chunk.ptr);
444 }
445 }
446 if (!public)
447 {
448 error = "parsing public key failed";
449 goto end;
450 }
451
452 if (!id)
453 {
454 id = identification_create_from_encoding(ID_DER_ASN1_DN,
455 chunk_from_chars(ASN1_SEQUENCE, 0));
456 }
457
458 not_before = time(NULL);
459 not_after = not_before + lifetime * 24 * 60 * 60;
460
461 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
462 BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
463 BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
464 BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
465 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
466 BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
467 BUILD_PATHLEN, pathlen,
468 BUILD_CRL_DISTRIBUTION_POINTS, cdps,
469 BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
470 BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
471 BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
472 BUILD_CERTIFICATE_POLICIES, policies,
473 BUILD_POLICY_MAPPINGS, mappings,
474 BUILD_POLICY_REQUIRE_EXPLICIT, require_explicit,
475 BUILD_POLICY_INHIBIT_MAPPING, inhibit_mapping,
476 BUILD_POLICY_INHIBIT_ANY, inhibit_any,
477 BUILD_END);
478 if (!cert)
479 {
480 error = "generating certificate failed";
481 goto end;
482 }
483 if (!cert->get_encoding(cert, form, &encoding))
484 {
485 error = "encoding certificate failed";
486 goto end;
487 }
488 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
489 {
490 error = "writing certificate key failed";
491 goto end;
492 }
493
494 end:
495 DESTROY_IF(id);
496 DESTROY_IF(cert_req);
497 DESTROY_IF(cert);
498 DESTROY_IF(ca);
499 DESTROY_IF(public);
500 DESTROY_IF(private);
501 san->destroy_offset(san, offsetof(identification_t, destroy));
502 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
503 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
504 policies->destroy_function(policies, (void*)destroy_cert_policy);
505 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
506 cdps->destroy_function(cdps, (void*)destroy_cdp);
507 ocsp->destroy(ocsp);
508 free(encoding.ptr);
509 free(serial.ptr);
510
511 if (error)
512 {
513 fprintf(stderr, "%s\n", error);
514 return 1;
515 }
516 return 0;
517
518 usage:
519 san->destroy_offset(san, offsetof(identification_t, destroy));
520 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
521 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
522 policies->destroy_function(policies, (void*)destroy_cert_policy);
523 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
524 cdps->destroy_function(cdps, (void*)destroy_cdp);
525 ocsp->destroy(ocsp);
526 return command_usage(error);
527 }
528
529 /**
530 * Register the command.
531 */
532 static void __attribute__ ((constructor))reg()
533 {
534 command_register((command_t) {
535 issue, 'i', "issue",
536 "issue a certificate using a CA certificate and key",
537 {"[--in file] [--type pub|pkcs10] --cakey file|--cakeyid hex",
538 " --cacert file [--dn subject-dn] [--san subjectAltName]+",
539 "[--lifetime days] [--serial hex] [--ca] [--pathlen len]",
540 "[--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
541 "[--crl uri [--crlissuer i]]+ [--ocsp uri]+ [--nc-permitted name]",
542 "[--nc-excluded name] [--policy-mapping issuer-oid:subject-oid]",
543 "[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
544 "[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
545 "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
546 {
547 {"help", 'h', 0, "show usage information"},
548 {"in", 'i', 1, "public key/request file to issue, default: stdin"},
549 {"type", 't', 1, "type of input, default: pub"},
550 {"cacert", 'c', 1, "CA certificate file"},
551 {"cakey", 'k', 1, "CA private key file"},
552 {"cakeyid", 'x', 1, "keyid on smartcard of CA private key"},
553 {"dn", 'd', 1, "distinguished name to include as subject"},
554 {"san", 'a', 1, "subjectAltName to include in certificate"},
555 {"lifetime", 'l', 1, "days the certificate is valid, default: 1095"},
556 {"serial", 's', 1, "serial number in hex, default: random"},
557 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
558 {"pathlen", 'p', 1, "set path length constraint"},
559 {"nc-permitted", 'n', 1, "add permitted NameConstraint"},
560 {"nc-excluded", 'N', 1, "add excluded NameConstraint"},
561 {"cert-policy", 'P', 1, "certificatePolicy OID to include"},
562 {"cps-uri", 'C', 1, "Certification Practice statement URI for certificatePolicy"},
563 {"user-notice", 'U', 1, "user notice for certificatePolicy"},
564 {"policy-mapping", 'M', 1, "policyMapping from issuer to subject OID"},
565 {"policy-explicit", 'E', 1, "requireExplicitPolicy constraint"},
566 {"policy-inhibit", 'H', 1, "inhibitPolicyMapping constraint"},
567 {"policy-any", 'A', 1, "inhibitAnyPolicy constraint"},
568 {"flag", 'e', 1, "include extendedKeyUsage flag"},
569 {"crl", 'u', 1, "CRL distribution point URI to include"},
570 {"crlissuer", 'I', 1, "CRL Issuer for CRL at distribution point"},
571 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
572 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
573 {"outform", 'f', 1, "encoding of generated cert, default: der"},
574 }
575 });
576 }