fixed typo
[strongswan.git] / src / pki / commands / issue.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <utils/optionsfrom.h>
22 #include <credentials/certificates/certificate.h>
23 #include <credentials/certificates/x509.h>
24
25 /**
26 * Issue a certificate using a CA certificate and key
27 */
28 static int issue(int argc, char *argv[])
29 {
30 hash_algorithm_t digest = HASH_SHA1;
31 certificate_t *cert = NULL, *ca =NULL;
32 private_key_t *private = NULL;
33 public_key_t *public = NULL;
34 char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
35 char *error = NULL;
36 identification_t *id = NULL;
37 linked_list_t *san, *cdps, *ocsp;
38 int lifetime = 1080;
39 chunk_t serial = chunk_empty;
40 chunk_t encoding = chunk_empty;
41 time_t not_before, not_after;
42 x509_flag_t flags = 0;
43 x509_t *x509;
44 options_t *options;
45
46 options = options_create();
47 san = linked_list_create();
48 cdps = linked_list_create();
49 ocsp = linked_list_create();
50
51 while (TRUE)
52 {
53 switch (getopt_long(argc, argv, "", command_opts, NULL))
54 {
55 case 'h':
56 goto usage;
57 case '+':
58 if (!options->from(options, optarg, &argc, &argv, optind))
59 {
60 error = "invalid options file";
61 goto usage;
62 }
63 continue;
64 case 't':
65 if (!streq(optarg, "pub"))
66 {
67 error = "invalid input type";
68 goto usage;
69 }
70 continue;
71 case 'g':
72 digest = get_digest(optarg);
73 if (digest == HASH_UNKNOWN)
74 {
75 error = "invalid --digest type";
76 goto usage;
77 }
78 continue;
79 case 'i':
80 file = optarg;
81 continue;
82 case 'c':
83 cacert = optarg;
84 continue;
85 case 'k':
86 cakey = optarg;
87 continue;
88 case 'd':
89 dn = optarg;
90 continue;
91 case 'a':
92 san->insert_last(san, identification_create_from_string(optarg));
93 continue;
94 case 'l':
95 lifetime = atoi(optarg);
96 if (!lifetime)
97 {
98 error = "invalid --lifetime value";
99 goto usage;
100 }
101 continue;
102 case 's':
103 hex = optarg;
104 continue;
105 case 'b':
106 flags |= X509_CA;
107 continue;
108 case 'u':
109 cdps->insert_last(cdps, optarg);
110 continue;
111 case 'o':
112 ocsp->insert_last(ocsp, optarg);
113 continue;
114 case EOF:
115 break;
116 default:
117 error = "invalid --issue option";
118 goto usage;
119 }
120 break;
121 }
122
123 if (!dn)
124 {
125 error = "--dn is required";
126 goto usage;
127 }
128 if (!cacert)
129 {
130 error = "--cacert is required";
131 goto usage;
132 }
133 if (!cakey)
134 {
135 error = "--cakey is required";
136 goto usage;
137 }
138 id = identification_create_from_string(dn);
139 if (id->get_type(id) != ID_DER_ASN1_DN)
140 {
141 error = "supplied --dn is not a distinguished name";
142 goto end;
143 }
144 ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
145 BUILD_FROM_FILE, cacert, BUILD_END);
146 if (!ca)
147 {
148 error = "parsing CA certificate failed";
149 goto end;
150 }
151 x509 = (x509_t*)ca;
152 if (!(x509->get_flags(x509) & X509_CA))
153 {
154 error = "CA certificate misses CA basicConstraint";
155 goto end;
156 }
157
158 public = ca->get_public_key(ca);
159 if (!public)
160 {
161 error = "extracting CA certificate public key failed";
162 goto end;
163 }
164 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
165 public->get_type(public),
166 BUILD_FROM_FILE, cakey, BUILD_END);
167 if (!private)
168 {
169 error = "parsing CA private key failed";
170 goto end;
171 }
172 if (!private->belongs_to(private, public))
173 {
174 error = "CA private key does not match CA certificate";
175 goto end;
176 }
177 public->destroy(public);
178
179 if (file)
180 {
181 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
182 BUILD_FROM_FILE, file, BUILD_END);
183 }
184 else
185 {
186 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
187 BUILD_FROM_FD, 0, BUILD_END);
188 }
189 if (!public)
190 {
191 error = "parsing public key failed";
192 goto end;
193 }
194
195 if (hex)
196 {
197 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
198 }
199 else
200 {
201 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
202
203 if (!rng)
204 {
205 error = "no random number generator found";
206 goto end;
207 }
208 rng->allocate_bytes(rng, 8, &serial);
209 rng->destroy(rng);
210 }
211 not_before = time(NULL);
212 not_after = not_before + lifetime * 24 * 60 * 60;
213 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
214 BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
215 BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
216 BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
217 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
218 BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
219 BUILD_CRL_DISTRIBUTION_POINTS, cdps,
220 BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_END);
221 if (!cert)
222 {
223 error = "generating certificate failed";
224 goto end;
225 }
226 encoding = cert->get_encoding(cert);
227 if (!encoding.ptr)
228 {
229 error = "encoding certificate failed";
230 goto end;
231 }
232 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
233 {
234 error = "writing certificate key failed";
235 goto end;
236 }
237
238 end:
239 DESTROY_IF(id);
240 DESTROY_IF(cert);
241 DESTROY_IF(ca);
242 DESTROY_IF(public);
243 DESTROY_IF(private);
244 san->destroy_offset(san, offsetof(identification_t, destroy));
245 cdps->destroy(cdps);
246 ocsp->destroy(ocsp);
247 options->destroy(options);
248 free(encoding.ptr);
249 free(serial.ptr);
250
251 if (error)
252 {
253 fprintf(stderr, "%s\n", error);
254 return 1;
255 }
256 return 0;
257
258 usage:
259 san->destroy_offset(san, offsetof(identification_t, destroy));
260 cdps->destroy(cdps);
261 ocsp->destroy(ocsp);
262 options->destroy(options);
263 return command_usage(error);
264 }
265
266 /**
267 * Register the command.
268 */
269 static void __attribute__ ((constructor))reg()
270 {
271 command_register((command_t) {
272 issue, 'i', "issue",
273 "issue a certificate using a CA certificate and key",
274 {"[--in file] [--type pub|pkcs10]",
275 " --cacert file --cakey file --dn subject-dn [--san subjectAltName]+",
276 "[--lifetime days] [--serial hex] [--ca] [--crl uri]+ [--ocsp uri]+",
277 "[--digest md5|sha1|sha224|sha256|sha384|sha512]",
278 "[--options file]"},
279 {
280 {"help", 'h', 0, "show usage information"},
281 {"in", 'i', 1, "public key/request file to issue, default: stdin"},
282 {"type", 't', 1, "type of input, default: pub"},
283 {"cacert", 'c', 1, "CA certificate file"},
284 {"cakey", 'k', 1, "CA private key file"},
285 {"dn", 'd', 1, "distinguished name to include as subject"},
286 {"san", 'a', 1, "subjectAltName to include in certificate"},
287 {"lifetime",'l', 1, "days the certificate is valid, default: 1080"},
288 {"serial", 's', 1, "serial number in hex, default: random"},
289 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
290 {"crl", 'u', 1, "CRL distribution point URI to include"},
291 {"ocsp", 'o', 1, "OCSP AuthoritiyInfoAccess URI to include"},
292 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
293 {"options", '+', 1, "read command line options from file"},
294 }
295 });
296 }
297