Added policyMappings support to pki tool
[strongswan.git] / src / pki / commands / self.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <credentials/certificates/certificate.h>
22 #include <credentials/certificates/x509.h>
23 #include <asn1/asn1.h>
24
25 /**
26 * Free cert policy with OID
27 */
28 static void destroy_cert_policy(x509_cert_policy_t *policy)
29 {
30 free(policy->oid.ptr);
31 free(policy);
32 }
33
34 /**
35 * Free policy mapping
36 */
37 static void destroy_policy_mapping(x509_policy_mapping_t *mapping)
38 {
39 free(mapping->issuer.ptr);
40 free(mapping->subject.ptr);
41 free(mapping);
42 }
43
44 /**
45 * Create a self signed certificate.
46 */
47 static int self()
48 {
49 cred_encoding_type_t form = CERT_ASN1_DER;
50 key_type_t type = KEY_RSA;
51 hash_algorithm_t digest = HASH_SHA1;
52 certificate_t *cert = NULL;
53 private_key_t *private = NULL;
54 public_key_t *public = NULL;
55 char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL, *keyid = NULL;
56 identification_t *id = NULL;
57 linked_list_t *san, *ocsp, *permitted, *excluded, *policies, *mappings;
58 int lifetime = 1095;
59 int pathlen = X509_NO_PATH_LEN_CONSTRAINT;
60 chunk_t serial = chunk_empty;
61 chunk_t encoding = chunk_empty;
62 time_t not_before, not_after;
63 x509_flag_t flags = 0;
64 x509_cert_policy_t *policy = NULL;
65 char *arg;
66
67 san = linked_list_create();
68 ocsp = linked_list_create();
69 permitted = linked_list_create();
70 excluded = linked_list_create();
71 policies = linked_list_create();
72 mappings = linked_list_create();
73
74 while (TRUE)
75 {
76 switch (command_getopt(&arg))
77 {
78 case 'h':
79 goto usage;
80 case 't':
81 if (streq(arg, "rsa"))
82 {
83 type = KEY_RSA;
84 }
85 else if (streq(arg, "ecdsa"))
86 {
87 type = KEY_ECDSA;
88 }
89 else
90 {
91 error = "invalid input type";
92 goto usage;
93 }
94 continue;
95 case 'g':
96 digest = get_digest(arg);
97 if (digest == HASH_UNKNOWN)
98 {
99 error = "invalid --digest type";
100 goto usage;
101 }
102 continue;
103 case 'i':
104 file = arg;
105 continue;
106 case 'x':
107 keyid = arg;
108 continue;
109 case 'd':
110 dn = arg;
111 continue;
112 case 'a':
113 san->insert_last(san, identification_create_from_string(arg));
114 continue;
115 case 'l':
116 lifetime = atoi(arg);
117 if (!lifetime)
118 {
119 error = "invalid --lifetime value";
120 goto usage;
121 }
122 continue;
123 case 's':
124 hex = arg;
125 continue;
126 case 'b':
127 flags |= X509_CA;
128 continue;
129 case 'p':
130 pathlen = atoi(arg);
131 continue;
132 case 'n':
133 permitted->insert_last(permitted,
134 identification_create_from_string(arg));
135 continue;
136 case 'N':
137 excluded->insert_last(excluded,
138 identification_create_from_string(arg));
139 continue;
140 case 'P':
141 {
142 chunk_t oid;
143
144 oid = asn1_oid_from_string(arg);
145 if (!oid.len)
146 {
147 error = "--cert-policy OID invalid";
148 goto usage;
149 }
150 INIT(policy,
151 .oid = oid,
152 );
153 policies->insert_last(policies, policy);
154 continue;
155 }
156 case 'C':
157 if (!policy)
158 {
159 error = "--cps-uri must follow a --cert-policy";
160 goto usage;
161 }
162 policy->cps_uri = arg;
163 continue;
164 case 'U':
165 if (!policy)
166 {
167 error = "--user-notice must follow a --cert-policy";
168 goto usage;
169 }
170 policy->unotice_text = arg;
171 continue;
172 case 'M':
173 {
174 char *pos = strchr(arg, ':');
175 x509_policy_mapping_t *mapping;
176 chunk_t subject_oid, issuer_oid;
177
178 if (pos)
179 {
180 *pos++ = '\0';
181 issuer_oid = asn1_oid_from_string(arg);
182 subject_oid = asn1_oid_from_string(pos);
183 }
184 if (!pos || !issuer_oid.len || !subject_oid.len)
185 {
186 error = "--policy-map OIDs invalid";
187 goto usage;
188 }
189 INIT(mapping,
190 .issuer = issuer_oid,
191 .subject = subject_oid,
192 );
193 mappings->insert_last(mappings, mapping);
194 continue;
195 }
196 case 'e':
197 if (streq(arg, "serverAuth"))
198 {
199 flags |= X509_SERVER_AUTH;
200 }
201 else if (streq(arg, "clientAuth"))
202 {
203 flags |= X509_CLIENT_AUTH;
204 }
205 else if (streq(arg, "crlSign"))
206 {
207 flags |= X509_CRL_SIGN;
208 }
209 else if (streq(arg, "ocspSigning"))
210 {
211 flags |= X509_OCSP_SIGNER;
212 }
213 continue;
214 case 'f':
215 if (!get_form(arg, &form, CRED_CERTIFICATE))
216 {
217 error = "invalid output format";
218 goto usage;
219 }
220 continue;
221 case 'o':
222 ocsp->insert_last(ocsp, arg);
223 continue;
224 case EOF:
225 break;
226 default:
227 error = "invalid --self option";
228 goto usage;
229 }
230 break;
231 }
232
233 if (!dn)
234 {
235 error = "--dn is required";
236 goto usage;
237 }
238 id = identification_create_from_string(dn);
239 if (id->get_type(id) != ID_DER_ASN1_DN)
240 {
241 error = "supplied --dn is not a distinguished name";
242 goto end;
243 }
244 if (file)
245 {
246 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
247 BUILD_FROM_FILE, file, BUILD_END);
248 }
249 else if (keyid)
250 {
251 chunk_t chunk;
252
253 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
254 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
255 BUILD_PKCS11_KEYID, chunk, BUILD_END);
256 free(chunk.ptr);
257 }
258 else
259 {
260 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
261 BUILD_FROM_FD, 0, BUILD_END);
262 }
263 if (!private)
264 {
265 error = "loading private key failed";
266 goto end;
267 }
268 public = private->get_public_key(private);
269 if (!public)
270 {
271 error = "extracting public key failed";
272 goto end;
273 }
274 if (hex)
275 {
276 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
277 }
278 else
279 {
280 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
281
282 if (!rng)
283 {
284 error = "no random number generator found";
285 goto end;
286 }
287 rng->allocate_bytes(rng, 8, &serial);
288 while (*serial.ptr == 0x00)
289 {
290 /* we don't accept a serial number with leading zeroes */
291 rng->get_bytes(rng, 1, serial.ptr);
292 }
293 rng->destroy(rng);
294 }
295 not_before = time(NULL);
296 not_after = not_before + lifetime * 24 * 60 * 60;
297 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
298 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
299 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
300 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
301 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
302 BUILD_PATHLEN, pathlen, BUILD_SUBJECT_ALTNAMES, san,
303 BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
304 BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
305 BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
306 BUILD_CERTIFICATE_POLICIES, policies,
307 BUILD_POLICY_MAPPINGS, mappings, BUILD_END);
308 if (!cert)
309 {
310 error = "generating certificate failed";
311 goto end;
312 }
313 if (!cert->get_encoding(cert, form, &encoding))
314 {
315 error = "encoding certificate failed";
316 goto end;
317 }
318 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
319 {
320 error = "writing certificate key failed";
321 goto end;
322 }
323
324 end:
325 DESTROY_IF(id);
326 DESTROY_IF(cert);
327 DESTROY_IF(public);
328 DESTROY_IF(private);
329 san->destroy_offset(san, offsetof(identification_t, destroy));
330 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
331 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
332 policies->destroy_function(policies, (void*)destroy_cert_policy);
333 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
334 ocsp->destroy(ocsp);
335 free(encoding.ptr);
336 free(serial.ptr);
337
338 if (error)
339 {
340 fprintf(stderr, "%s\n", error);
341 return 1;
342 }
343 return 0;
344
345 usage:
346 san->destroy_offset(san, offsetof(identification_t, destroy));
347 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
348 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
349 policies->destroy_function(policies, (void*)destroy_cert_policy);
350 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
351 ocsp->destroy(ocsp);
352 return command_usage(error);
353 }
354
355 /**
356 * Register the command.
357 */
358 static void __attribute__ ((constructor))reg()
359 {
360 command_register((command_t) {
361 self, 's', "self",
362 "create a self signed certificate",
363 {"[--in file | --keyid hex] [--type rsa|ecdsa]",
364 " --dn distinguished-name [--san subjectAltName]+",
365 "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
366 "[--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
367 "[--nc-permitted name] [--nc-excluded name]",
368 "[--cert-policy oid [--cps-uri uri] [--user-notice text] ]+",
369 "[--policy-map issuer-oid:subject-oid]",
370 "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
371 {
372 {"help", 'h', 0, "show usage information"},
373 {"in", 'i', 1, "private key input file, default: stdin"},
374 {"keyid", 'x', 1, "keyid on smartcard of private key"},
375 {"type", 't', 1, "type of input key, default: rsa"},
376 {"dn", 'd', 1, "subject and issuer distinguished name"},
377 {"san", 'a', 1, "subjectAltName to include in certificate"},
378 {"lifetime", 'l', 1, "days the certificate is valid, default: 1095"},
379 {"serial", 's', 1, "serial number in hex, default: random"},
380 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
381 {"pathlen", 'p', 1, "set path length constraint"},
382 {"nc-permitted",'n', 1, "add permitted NameConstraint"},
383 {"nc-excluded", 'N', 1, "add excluded NameConstraint"},
384 {"cert-policy", 'P', 1, "certificatePolicy OID to include"},
385 {"cps-uri", 'C', 1, "Certification Practice statement URI for certificatePolicy"},
386 {"user-notice", 'U', 1, "user notice for certificatePolicy"},
387 {"policy-map", 'M', 1, "policyMapping from issuer to subject OID"},
388 {"flag", 'e', 1, "include extendedKeyUsage flag"},
389 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
390 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
391 {"outform", 'f', 1, "encoding of generated cert, default: der"},
392 }
393 });
394 }