src/pki/commands/issue.c

   1 /*
   2  * Copyright (C) 2009 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <time.h>
  17 #include <errno.h>
  18
  19 #include "pki.h"
  20
  21 #include <utils/debug.h>
  22 #include <asn1/asn1.h>
  23 #include <collections/linked_list.h>
  24 #include <credentials/certificates/certificate.h>
  25 #include <credentials/certificates/x509.h>
  26 #include <credentials/certificates/pkcs10.h>
  27
  28 /**
  29  * Free cert policy with OID
  30  */
  31 static void destroy_cert_policy(x509_cert_policy_t *policy)
  32 {
  33         free(policy->oid.ptr);
  34         free(policy);
  35 }
  36
  37 /**
  38  * Free policy mapping
  39  */
  40 static void destroy_policy_mapping(x509_policy_mapping_t *mapping)
  41 {
  42         free(mapping->issuer.ptr);
  43         free(mapping->subject.ptr);
  44         free(mapping);
  45 }
  46
  47 /**
  48  * Free a CRL DistributionPoint
  49  */
  50 static void destroy_cdp(x509_cdp_t *this)
  51 {
  52         DESTROY_IF(this->issuer);
  53         free(this);
  54 }
  55
  56 /**
  57  * Issue a certificate using a CA certificate and key
  58  */
  59 static int issue()
  60 {
  61         cred_encoding_type_t form = CERT_ASN1_DER;
  62         hash_algorithm_t digest = HASH_SHA1;
  63         certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
  64         private_key_t *private = NULL;
  65         public_key_t *public = NULL;
  66         bool pkcs10 = FALSE;
  67         char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
  68         char *error = NULL, *keyid = NULL;
  69         identification_t *id = NULL;
  70         linked_list_t *san, *cdps, *ocsp, *permitted, *excluded, *policies, *mappings;
  71         int pathlen = X509_NO_CONSTRAINT, inhibit_any = X509_NO_CONSTRAINT;
  72         int inhibit_mapping = X509_NO_CONSTRAINT, require_explicit = X509_NO_CONSTRAINT;
  73         chunk_t serial = chunk_empty;
  74         chunk_t encoding = chunk_empty;
  75         time_t not_before, not_after, lifetime = 1095 * 24 * 60 * 60;
  76         char *datenb = NULL, *datena = NULL, *dateform = NULL;
  77         x509_flag_t flags = 0;
  78         x509_t *x509;
  79         x509_cdp_t *cdp = NULL;
  80         x509_cert_policy_t *policy = NULL;
  81         char *arg;
  82
  83         san = linked_list_create();
  84         cdps = linked_list_create();
  85         ocsp = linked_list_create();
  86         permitted = linked_list_create();
  87         excluded = linked_list_create();
  88         policies = linked_list_create();
  89         mappings = linked_list_create();
  90
  91         while (TRUE)
  92         {
  93                 switch (command_getopt(&arg))
  94                 {
  95                         case 'h':
  96                                 goto usage;
  97                         case 't':
  98                                 if (streq(arg, "pkcs10"))
  99                                 {
 100                                         pkcs10 = TRUE;
 101                                 }
 102                                 else if (!streq(arg, "pub"))
 103                                 {
 104                                         error = "invalid input type";
 105                                         goto usage;
 106                                 }
 107                                 continue;
 108                         case 'g':
 109                                 digest = enum_from_name(hash_algorithm_short_names, arg);
 110                                 if (digest == -1)
 111                                 {
 112                                         error = "invalid --digest type";
 113                                         goto usage;
 114                                 }
 115                                 continue;
 116                         case 'i':
 117                                 file = arg;
 118                                 continue;
 119                         case 'c':
 120                                 cacert = arg;
 121                                 continue;
 122                         case 'k':
 123                                 cakey = arg;
 124                                 continue;
 125                         case 'x':
 126                                 keyid = arg;
 127                                 continue;
 128                         case 'd':
 129                                 dn = arg;
 130                                 continue;
 131                         case 'a':
 132                                 san->insert_last(san, identification_create_from_string(arg));
 133                                 continue;
 134                         case 'l':
 135                                 lifetime = atoi(arg) * 24 * 60 * 60;
 136                                 if (!lifetime)
 137                                 {
 138                                         error = "invalid --lifetime value";
 139                                         goto usage;
 140                                 }
 141                                 continue;
 142                         case 'D':
 143                                 dateform = arg;
 144                                 continue;
 145                         case 'F':
 146                                 datenb = arg;
 147                                 continue;
 148                         case 'T':
 149                                 datena = arg;
 150                                 continue;
 151                         case 's':
 152                                 hex = arg;
 153                                 continue;
 154                         case 'b':
 155                                 flags |= X509_CA;
 156                                 continue;
 157                         case 'p':
 158                                 pathlen = atoi(arg);
 159                                 continue;
 160                         case 'n':
 161                                 permitted->insert_last(permitted,
 162                                                                            identification_create_from_string(arg));
 163                                 continue;
 164                         case 'N':
 165                                 excluded->insert_last(excluded,
 166                                                                           identification_create_from_string(arg));
 167                                 continue;
 168                         case 'P':
 169                         {
 170                                 chunk_t oid;
 171
 172                                 oid = asn1_oid_from_string(arg);
 173                                 if (!oid.len)
 174                                 {
 175                                         error = "--cert-policy OID invalid";
 176                                         goto usage;
 177                                 }
 178                                 INIT(policy,
 179                                         .oid = oid,
 180                                 );
 181                                 policies->insert_last(policies, policy);
 182                                 continue;
 183                         }
 184                         case 'C':
 185                                 if (!policy)
 186                                 {
 187                                         error = "--cps-uri must follow a --cert-policy";
 188                                         goto usage;
 189                                 }
 190                                 policy->cps_uri = arg;
 191                                 continue;
 192                         case 'U':
 193                                 if (!policy)
 194                                 {
 195                                         error = "--user-notice must follow a --cert-policy";
 196                                         goto usage;
 197                                 }
 198                                 policy->unotice_text = arg;
 199                                 continue;
 200                         case 'M':
 201                         {
 202                                 char *pos = strchr(arg, ':');
 203                                 x509_policy_mapping_t *mapping;
 204                                 chunk_t subject_oid, issuer_oid;
 205
 206                                 if (pos)
 207                                 {
 208                                         *pos++ = '\0';
 209                                         issuer_oid = asn1_oid_from_string(arg);
 210                                         subject_oid = asn1_oid_from_string(pos);
 211                                 }
 212                                 if (!pos || !issuer_oid.len || !subject_oid.len)
 213                                 {
 214                                         error = "--policy-map OIDs invalid";
 215                                         goto usage;
 216                                 }
 217                                 INIT(mapping,
 218                                         .issuer = issuer_oid,
 219                                         .subject = subject_oid,
 220                                 );
 221                                 mappings->insert_last(mappings, mapping);
 222                                 continue;
 223                         }
 224                         case 'E':
 225                                 require_explicit = atoi(arg);
 226                                 continue;
 227                         case 'H':
 228                                 inhibit_mapping = atoi(arg);
 229                                 continue;
 230                         case 'A':
 231                                 inhibit_any = atoi(arg);
 232                                 continue;
 233                         case 'e':
 234                                 if (streq(arg, "serverAuth"))
 235                                 {
 236                                         flags |= X509_SERVER_AUTH;
 237                                 }
 238                                 else if (streq(arg, "clientAuth"))
 239                                 {
 240                                         flags |= X509_CLIENT_AUTH;
 241                                 }
 242                                 else if (streq(arg, "ikeIntermediate"))
 243                                 {
 244                                         flags |= X509_IKE_INTERMEDIATE;
 245                                 }
 246                                 else if (streq(arg, "crlSign"))
 247                                 {
 248                                         flags |= X509_CRL_SIGN;
 249                                 }
 250                                 else if (streq(arg, "ocspSigning"))
 251                                 {
 252                                         flags |= X509_OCSP_SIGNER;
 253                                 }
 254                                 else if (streq(arg, "msSmartcardLogon"))
 255                                 {
 256                                         flags |= X509_MS_SMARTCARD_LOGON;
 257                                 }
 258                                 continue;
 259                         case 'f':
 260                                 if (!get_form(arg, &form, CRED_CERTIFICATE))
 261                                 {
 262                                         error = "invalid output format";
 263                                         goto usage;
 264                                 }
 265                                 continue;
 266                         case 'u':
 267                                 INIT(cdp,
 268                                         .uri = arg,
 269                                 );
 270                                 cdps->insert_last(cdps, cdp);
 271                                 continue;
 272                         case 'I':
 273                                 if (!cdp || cdp->issuer)
 274                                 {
 275                                         error = "--crlissuer must follow a --crl";
 276                                         goto usage;
 277                                 }
 278                                 cdp->issuer = identification_create_from_string(arg);
 279                                 continue;
 280                         case 'o':
 281                                 ocsp->insert_last(ocsp, arg);
 282                                 continue;
 283                         case EOF:
 284                                 break;
 285                         default:
 286                                 error = "invalid --issue option";
 287                                 goto usage;
 288                 }
 289                 break;
 290         }
 291         if (!cacert)
 292         {
 293                 error = "--cacert is required";
 294                 goto usage;
 295         }
 296         if (!cakey && !keyid)
 297         {
 298                 error = "--cakey or --keyid is required";
 299                 goto usage;
 300         }
 301         if (!calculate_lifetime(dateform, datenb, datena, lifetime,
 302                                                         &not_before, &not_after))
 303         {
 304                 error = "invalid --not-before/after datetime";
 305                 goto usage;
 306         }
 307         if (dn && *dn)
 308         {
 309                 id = identification_create_from_string(dn);
 310                 if (id->get_type(id) != ID_DER_ASN1_DN)
 311                 {
 312                         error = "supplied --dn is not a distinguished name";
 313                         goto end;
 314                 }
 315         }
 316
 317         DBG2(DBG_LIB, "Reading ca certificate:");
 318         ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 319                                                         BUILD_FROM_FILE, cacert, BUILD_END);
 320         if (!ca)
 321         {
 322                 error = "parsing CA certificate failed";
 323                 goto end;
 324         }
 325         x509 = (x509_t*)ca;
 326         if (!(x509->get_flags(x509) & X509_CA))
 327         {
 328                 error = "CA certificate misses CA basicConstraint";
 329                 goto end;
 330         }
 331         public = ca->get_public_key(ca);
 332         if (!public)
 333         {
 334                 error = "extracting CA certificate public key failed";
 335                 goto end;
 336         }
 337
 338         DBG2(DBG_LIB, "Reading ca private key:");
 339         if (cakey)
 340         {
 341                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 342                                                                          public->get_type(public),
 343                                                                          BUILD_FROM_FILE, cakey, BUILD_END);
 344         }
 345         else
 346         {
 347                 chunk_t chunk;
 348
 349                 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
 350                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
 351                                                                          BUILD_PKCS11_KEYID, chunk, BUILD_END);
 352                 free(chunk.ptr);
 353         }
 354         if (!private)
 355         {
 356                 error = "loading CA private key failed";
 357                 goto end;
 358         }
 359         if (!private->belongs_to(private, public))
 360         {
 361                 error = "CA private key does not match CA certificate";
 362                 goto end;
 363         }
 364         public->destroy(public);
 365
 366         if (hex)
 367         {
 368                 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
 369         }
 370         else
 371         {
 372                 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 373
 374                 if (!rng)
 375                 {
 376                         error = "no random number generator found";
 377                         goto end;
 378                 }
 379                 if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
 380                 {
 381                         error = "failed to generate serial number";
 382                         rng->destroy(rng);
 383                         goto end;
 384                 }
 385                 serial.ptr[0] &= 0x7F;
 386                 rng->destroy(rng);
 387         }
 388
 389         if (pkcs10)
 390         {
 391                 enumerator_t *enumerator;
 392                 identification_t *subjectAltName;
 393                 pkcs10_t *req;
 394
 395                 DBG2(DBG_LIB, "Reading certificate request");
 396                 if (file)
 397                 {
 398                         cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
 399                                                                                   CERT_PKCS10_REQUEST,
 400                                                                                   BUILD_FROM_FILE, file, BUILD_END);
 401                 }
 402                 else
 403                 {
 404                         chunk_t chunk;
 405
 406                         if (!chunk_from_fd(0, &chunk))
 407                         {
 408                                 fprintf(stderr, "%s: ", strerror(errno));
 409                                 error = "reading certificate request failed";
 410                                 goto end;
 411                         }
 412                         cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
 413                                                                                   CERT_PKCS10_REQUEST,
 414                                                                                   BUILD_BLOB, chunk, BUILD_END);
 415                         free(chunk.ptr);
 416                 }
 417                 if (!cert_req)
 418                 {
 419                         error = "parsing certificate request failed";
 420                         goto end;
 421                 }
 422
 423                 /* If not set yet use subject from PKCS#10 certificate request as DN */
 424                 if (!id)
 425                 {
 426                         id = cert_req->get_subject(cert_req);
 427                         id = id->clone(id);
 428                 }
 429
 430                 /* Add subjectAltNames from PKCS#10 certificate request */
 431                 req = (pkcs10_t*)cert_req;
 432                 enumerator = req->create_subjectAltName_enumerator(req);
 433                 while (enumerator->enumerate(enumerator, &subjectAltName))
 434                 {
 435                         san->insert_last(san, subjectAltName->clone(subjectAltName));
 436                 }
 437                 enumerator->destroy(enumerator);
 438
 439                 /* Use public key from PKCS#10 certificate request */
 440                 public = cert_req->get_public_key(cert_req);
 441         }
 442         else
 443         {
 444                 DBG2(DBG_LIB, "Reading public key:");
 445                 if (file)
 446                 {
 447                         public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
 448                                                                                 BUILD_FROM_FILE, file, BUILD_END);
 449                 }
 450                 else
 451                 {
 452                         chunk_t chunk;
 453
 454                         if (!chunk_from_fd(0, &chunk))
 455                         {
 456                                 fprintf(stderr, "%s: ", strerror(errno));
 457                                 error = "reading public key failed";
 458                                 goto end;
 459                         }
 460                         public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
 461                                                                                  BUILD_BLOB, chunk, BUILD_END);
 462                         free(chunk.ptr);
 463                 }
 464         }
 465         if (!public)
 466         {
 467                 error = "parsing public key failed";
 468                 goto end;
 469         }
 470
 471         if (!id)
 472         {
 473                 id = identification_create_from_encoding(ID_DER_ASN1_DN,
 474                                                                                 chunk_from_chars(ASN1_SEQUENCE, 0));
 475         }
 476
 477         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 478                                         BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
 479                                         BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
 480                                         BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
 481                                         BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
 482                                         BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
 483                                         BUILD_PATHLEN, pathlen,
 484                                         BUILD_CRL_DISTRIBUTION_POINTS, cdps,
 485                                         BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
 486                                         BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
 487                                         BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
 488                                         BUILD_CERTIFICATE_POLICIES, policies,
 489                                         BUILD_POLICY_MAPPINGS, mappings,
 490                                         BUILD_POLICY_REQUIRE_EXPLICIT, require_explicit,
 491                                         BUILD_POLICY_INHIBIT_MAPPING, inhibit_mapping,
 492                                         BUILD_POLICY_INHIBIT_ANY, inhibit_any,
 493                                         BUILD_END);
 494         if (!cert)
 495         {
 496                 error = "generating certificate failed";
 497                 goto end;
 498         }
 499         if (!cert->get_encoding(cert, form, &encoding))
 500         {
 501                 error = "encoding certificate failed";
 502                 goto end;
 503         }
 504         if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
 505         {
 506                 error = "writing certificate key failed";
 507                 goto end;
 508         }
 509
 510 end:
 511         DESTROY_IF(id);
 512         DESTROY_IF(cert_req);
 513         DESTROY_IF(cert);
 514         DESTROY_IF(ca);
 515         DESTROY_IF(public);
 516         DESTROY_IF(private);
 517         san->destroy_offset(san, offsetof(identification_t, destroy));
 518         permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
 519         excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
 520         policies->destroy_function(policies, (void*)destroy_cert_policy);
 521         mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
 522         cdps->destroy_function(cdps, (void*)destroy_cdp);
 523         ocsp->destroy(ocsp);
 524         free(encoding.ptr);
 525         free(serial.ptr);
 526
 527         if (error)
 528         {
 529                 fprintf(stderr, "%s\n", error);
 530                 return 1;
 531         }
 532         return 0;
 533
 534 usage:
 535         san->destroy_offset(san, offsetof(identification_t, destroy));
 536         permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
 537         excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
 538         policies->destroy_function(policies, (void*)destroy_cert_policy);
 539         mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
 540         cdps->destroy_function(cdps, (void*)destroy_cdp);
 541         ocsp->destroy(ocsp);
 542         return command_usage(error);
 543 }
 544
 545 /**
 546  * Register the command.
 547  */
 548 static void __attribute__ ((constructor))reg()
 549 {
 550         command_register((command_t) {
 551                 issue, 'i', "issue",
 552                 "issue a certificate using a CA certificate and key",
 553                 {"[--in file] [--type pub|pkcs10] --cakey file|--cakeyid hex",
 554                  " --cacert file [--dn subject-dn] [--san subjectAltName]+",
 555                  "[--lifetime days] [--serial hex] [--ca] [--pathlen len]",
 556                  "[--flag serverAuth|clientAuth|crlSign|ocspSigning|msSmartcardLogon]+",
 557                  "[--crl uri [--crlissuer i]]+ [--ocsp uri]+ [--nc-permitted name]",
 558                  "[--nc-excluded name] [--policy-mapping issuer-oid:subject-oid]",
 559                  "[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
 560                  "[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
 561                  "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
 562                 {
 563                         {"help",                        'h', 0, "show usage information"},
 564                         {"in",                          'i', 1, "public key/request file to issue, default: stdin"},
 565                         {"type",                        't', 1, "type of input, default: pub"},
 566                         {"cacert",                      'c', 1, "CA certificate file"},
 567                         {"cakey",                       'k', 1, "CA private key file"},
 568                         {"cakeyid",                     'x', 1, "keyid on smartcard of CA private key"},
 569                         {"dn",                          'd', 1, "distinguished name to include as subject"},
 570                         {"san",                         'a', 1, "subjectAltName to include in certificate"},
 571                         {"lifetime",            'l', 1, "days the certificate is valid, default: 1095"},
 572                         {"not-before",          'F', 1, "date/time the validity of the cert starts"},
 573                         {"not-after",           'T', 1, "date/time the validity of the cert ends"},
 574                         {"dateform",            'D', 1, "strptime(3) input format, default: %d.%m.%y %T"},
 575                         {"serial",                      's', 1, "serial number in hex, default: random"},
 576                         {"ca",                          'b', 0, "include CA basicConstraint, default: no"},
 577                         {"pathlen",                     'p', 1, "set path length constraint"},
 578                         {"nc-permitted",        'n', 1, "add permitted NameConstraint"},
 579                         {"nc-excluded",         'N', 1, "add excluded NameConstraint"},
 580                         {"cert-policy",         'P', 1, "certificatePolicy OID to include"},
 581                         {"cps-uri",                     'C', 1, "Certification Practice statement URI for certificatePolicy"},
 582                         {"user-notice",         'U', 1, "user notice for certificatePolicy"},
 583                         {"policy-mapping",      'M', 1, "policyMapping from issuer to subject OID"},
 584                         {"policy-explicit",     'E', 1, "requireExplicitPolicy constraint"},
 585                         {"policy-inhibit",      'H', 1, "inhibitPolicyMapping constraint"},
 586                         {"policy-any",          'A', 1, "inhibitAnyPolicy constraint"},
 587                         {"flag",                        'e', 1, "include extendedKeyUsage flag"},
 588                         {"crl",                         'u', 1, "CRL distribution point URI to include"},
 589                         {"crlissuer",           'I', 1, "CRL Issuer for CRL at distribution point"},
 590                         {"ocsp",                        'o', 1, "OCSP AuthorityInfoAccess URI to include"},
 591                         {"digest",                      'g', 1, "digest for signature creation, default: sha1"},
 592                         {"outform",                     'f', 1, "encoding of generated cert, default: der"},
 593                 }
 594         });
 595 }