src/pki/commands/req.c

   1 /*
   2  * Copyright (C) 2009 Martin Willi
   3  * Copyright (C) 2009-2015 Andreas Steffen
   4  * HSR Hochschule fuer Technik Rapperswil
   5  *
   6  * HSR Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include <time.h>
  20 #include <errno.h>
  21
  22 #include "pki.h"
  23
  24 #include <collections/linked_list.h>
  25 #include <credentials/certificates/certificate.h>
  26
  27 /**
  28  * Create a self-signed PKCS#10 certificate requesst.
  29  */
  30 static int req()
  31 {
  32         cred_encoding_type_t form = CERT_ASN1_DER;
  33         key_type_t type = KEY_RSA;
  34         hash_algorithm_t digest = HASH_SHA256;
  35         certificate_t *cert = NULL;
  36         private_key_t *private = NULL;
  37         char *file = NULL, *dn = NULL, *error = NULL;
  38         identification_t *id = NULL;
  39         linked_list_t *san;
  40         chunk_t encoding = chunk_empty;
  41         chunk_t challenge_password = chunk_empty;
  42         char *arg;
  43
  44         san = linked_list_create();
  45
  46         while (TRUE)
  47         {
  48                 switch (command_getopt(&arg))
  49                 {
  50                         case 'h':
  51                                 goto usage;
  52                         case 't':
  53                                 if (streq(arg, "rsa"))
  54                                 {
  55                                         type = KEY_RSA;
  56                                 }
  57                                 else if (streq(arg, "ecdsa"))
  58                                 {
  59                                         type = KEY_ECDSA;
  60                                 }
  61                                 else if (streq(arg, "bliss"))
  62                                 {
  63                                         type = KEY_BLISS;
  64                                 }
  65                                 else
  66                                 {
  67                                         error = "invalid input type";
  68                                         goto usage;
  69                                 }
  70                                 continue;
  71                         case 'g':
  72                                 if (!enum_from_name(hash_algorithm_short_names, arg, &digest))
  73                                 {
  74                                         error = "invalid --digest type";
  75                                         goto usage;
  76                                 }
  77                                 continue;
  78                         case 'i':
  79                                 file = arg;
  80                                 continue;
  81                         case 'd':
  82                                 dn = arg;
  83                                 continue;
  84                         case 'a':
  85                                 san->insert_last(san, identification_create_from_string(arg));
  86                                 continue;
  87                         case 'p':
  88                                 challenge_password = chunk_create(arg, strlen(arg));
  89                                 continue;
  90                         case 'f':
  91                                 if (!get_form(arg, &form, CRED_CERTIFICATE))
  92                                 {
  93                                         error = "invalid output format";
  94                                         goto usage;
  95                                 }
  96                                 continue;
  97                         case EOF:
  98                                 break;
  99                         default:
 100                                 error = "invalid --req option";
 101                                 goto usage;
 102                 }
 103                 break;
 104         }
 105
 106         if (!dn)
 107         {
 108                 error = "--dn is required";
 109                 goto usage;
 110         }
 111         id = identification_create_from_string(dn);
 112         if (id->get_type(id) != ID_DER_ASN1_DN)
 113         {
 114                 error = "supplied --dn is not a distinguished name";
 115                 goto end;
 116         }
 117         if (file)
 118         {
 119                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
 120                                                                          BUILD_FROM_FILE, file, BUILD_END);
 121         }
 122         else
 123         {
 124                 chunk_t chunk;
 125
 126                 set_file_mode(stdin, CERT_ASN1_DER);
 127                 if (!chunk_from_fd(0, &chunk))
 128                 {
 129                         fprintf(stderr, "reading private key failed: %s\n", strerror(errno));
 130                         error = "";
 131                         goto end;
 132                 }
 133                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
 134                                                                          BUILD_BLOB, chunk, BUILD_END);
 135                 free(chunk.ptr);
 136         }
 137         if (!private)
 138         {
 139                 error = "parsing private key failed";
 140                 goto end;
 141         }
 142         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_PKCS10_REQUEST,
 143                                                           BUILD_SIGNING_KEY, private,
 144                                                           BUILD_SUBJECT, id,
 145                                                           BUILD_SUBJECT_ALTNAMES, san,
 146                                                           BUILD_CHALLENGE_PWD, challenge_password,
 147                                                           BUILD_DIGEST_ALG, digest,
 148                                                           BUILD_END);
 149         if (!cert)
 150         {
 151                 error = "generating certificate request failed";
 152                 goto end;
 153         }
 154         if (!cert->get_encoding(cert, form, &encoding))
 155         {
 156                 error = "encoding certificate request failed";
 157                 goto end;
 158         }
 159         set_file_mode(stdout, form);
 160         if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
 161         {
 162                 error = "writing certificate request failed";
 163                 goto end;
 164         }
 165
 166 end:
 167         DESTROY_IF(id);
 168         DESTROY_IF(cert);
 169         DESTROY_IF(private);
 170         san->destroy_offset(san, offsetof(identification_t, destroy));
 171         free(encoding.ptr);
 172
 173         if (error)
 174         {
 175                 fprintf(stderr, "%s\n", error);
 176                 return 1;
 177         }
 178         return 0;
 179
 180 usage:
 181         san->destroy_offset(san, offsetof(identification_t, destroy));
 182         return command_usage(error);
 183 }
 184
 185 /**
 186  * Register the command.
 187  */
 188 static void __attribute__ ((constructor))reg()
 189 {
 190         command_register((command_t) {
 191                 req, 'r', "req",
 192                 "create a PKCS#10 certificate request",
 193                 {"  [--in file] [--type rsa|ecdsa|bliss] --dn distinguished-name",
 194                  "[--san subjectAltName]+ [--password challengePassword]",
 195                  "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
 196                 {
 197                         {"help",        'h', 0, "show usage information"},
 198                         {"in",          'i', 1, "private key input file, default: stdin"},
 199                         {"type",        't', 1, "type of input key, default: rsa"},
 200                         {"dn",          'd', 1, "subject distinguished name"},
 201                         {"san",         'a', 1, "subjectAltName to include in cert request"},
 202                         {"password",'p', 1, "challengePassword to include in cert request"},
 203                         {"digest",      'g', 1, "digest for signature creation, default: sha256"},
 204                         {"outform",     'f', 1, "encoding of generated request, default: der"},
 205                 }
 206         });
 207 }