Added support for msSmartcardLogon EKU
[strongswan.git] / src / pki / commands / self.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17 #include <errno.h>
18
19 #include "pki.h"
20
21 #include <collections/linked_list.h>
22 #include <credentials/certificates/certificate.h>
23 #include <credentials/certificates/x509.h>
24 #include <asn1/asn1.h>
25
26 /**
27 * Free cert policy with OID
28 */
29 static void destroy_cert_policy(x509_cert_policy_t *policy)
30 {
31 free(policy->oid.ptr);
32 free(policy);
33 }
34
35 /**
36 * Free policy mapping
37 */
38 static void destroy_policy_mapping(x509_policy_mapping_t *mapping)
39 {
40 free(mapping->issuer.ptr);
41 free(mapping->subject.ptr);
42 free(mapping);
43 }
44
45 /**
46 * Create a self signed certificate.
47 */
48 static int self()
49 {
50 cred_encoding_type_t form = CERT_ASN1_DER;
51 key_type_t type = KEY_RSA;
52 hash_algorithm_t digest = HASH_SHA1;
53 certificate_t *cert = NULL;
54 private_key_t *private = NULL;
55 public_key_t *public = NULL;
56 char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL, *keyid = NULL;
57 identification_t *id = NULL;
58 linked_list_t *san, *ocsp, *permitted, *excluded, *policies, *mappings;
59 int pathlen = X509_NO_CONSTRAINT, inhibit_any = X509_NO_CONSTRAINT;
60 int inhibit_mapping = X509_NO_CONSTRAINT, require_explicit = X509_NO_CONSTRAINT;
61 chunk_t serial = chunk_empty;
62 chunk_t encoding = chunk_empty;
63 time_t not_before, not_after, lifetime = 1095 * 24 * 60 * 60;
64 char *datenb = NULL, *datena = NULL, *dateform = NULL;
65 x509_flag_t flags = 0;
66 x509_cert_policy_t *policy = NULL;
67 char *arg;
68
69 san = linked_list_create();
70 ocsp = linked_list_create();
71 permitted = linked_list_create();
72 excluded = linked_list_create();
73 policies = linked_list_create();
74 mappings = linked_list_create();
75
76 while (TRUE)
77 {
78 switch (command_getopt(&arg))
79 {
80 case 'h':
81 goto usage;
82 case 't':
83 if (streq(arg, "rsa"))
84 {
85 type = KEY_RSA;
86 }
87 else if (streq(arg, "ecdsa"))
88 {
89 type = KEY_ECDSA;
90 }
91 else
92 {
93 error = "invalid input type";
94 goto usage;
95 }
96 continue;
97 case 'g':
98 digest = enum_from_name(hash_algorithm_short_names, arg);
99 if (digest == -1)
100 {
101 error = "invalid --digest type";
102 goto usage;
103 }
104 continue;
105 case 'i':
106 file = arg;
107 continue;
108 case 'x':
109 keyid = arg;
110 continue;
111 case 'd':
112 dn = arg;
113 continue;
114 case 'a':
115 san->insert_last(san, identification_create_from_string(arg));
116 continue;
117 continue;
118 case 'l':
119 lifetime = atoi(arg) * 24 * 60 * 60;
120 if (!lifetime)
121 {
122 error = "invalid --lifetime value";
123 goto usage;
124 }
125 continue;
126 case 'D':
127 dateform = arg;
128 continue;
129 case 'F':
130 datenb = arg;
131 continue;
132 case 'T':
133 datena = arg;
134 continue;
135 case 's':
136 hex = arg;
137 continue;
138 case 'b':
139 flags |= X509_CA;
140 continue;
141 case 'p':
142 pathlen = atoi(arg);
143 continue;
144 case 'n':
145 permitted->insert_last(permitted,
146 identification_create_from_string(arg));
147 continue;
148 case 'N':
149 excluded->insert_last(excluded,
150 identification_create_from_string(arg));
151 continue;
152 case 'P':
153 {
154 chunk_t oid;
155
156 oid = asn1_oid_from_string(arg);
157 if (!oid.len)
158 {
159 error = "--cert-policy OID invalid";
160 goto usage;
161 }
162 INIT(policy,
163 .oid = oid,
164 );
165 policies->insert_last(policies, policy);
166 continue;
167 }
168 case 'C':
169 if (!policy)
170 {
171 error = "--cps-uri must follow a --cert-policy";
172 goto usage;
173 }
174 policy->cps_uri = arg;
175 continue;
176 case 'U':
177 if (!policy)
178 {
179 error = "--user-notice must follow a --cert-policy";
180 goto usage;
181 }
182 policy->unotice_text = arg;
183 continue;
184 case 'M':
185 {
186 char *pos = strchr(arg, ':');
187 x509_policy_mapping_t *mapping;
188 chunk_t subject_oid, issuer_oid;
189
190 if (pos)
191 {
192 *pos++ = '\0';
193 issuer_oid = asn1_oid_from_string(arg);
194 subject_oid = asn1_oid_from_string(pos);
195 }
196 if (!pos || !issuer_oid.len || !subject_oid.len)
197 {
198 error = "--policy-map OIDs invalid";
199 goto usage;
200 }
201 INIT(mapping,
202 .issuer = issuer_oid,
203 .subject = subject_oid,
204 );
205 mappings->insert_last(mappings, mapping);
206 continue;
207 }
208 case 'E':
209 require_explicit = atoi(arg);
210 continue;
211 case 'H':
212 inhibit_mapping = atoi(arg);
213 continue;
214 case 'A':
215 inhibit_any = atoi(arg);
216 continue;
217 case 'e':
218 if (streq(arg, "serverAuth"))
219 {
220 flags |= X509_SERVER_AUTH;
221 }
222 else if (streq(arg, "clientAuth"))
223 {
224 flags |= X509_CLIENT_AUTH;
225 }
226 else if (streq(arg, "ikeIntermediate"))
227 {
228 flags |= X509_IKE_INTERMEDIATE;
229 }
230 else if (streq(arg, "crlSign"))
231 {
232 flags |= X509_CRL_SIGN;
233 }
234 else if (streq(arg, "ocspSigning"))
235 {
236 flags |= X509_OCSP_SIGNER;
237 }
238 else if (streq(arg, "msSmartcardLogon"))
239 {
240 flags |= X509_MS_SMARTCARD_LOGON;
241 }
242 continue;
243 case 'f':
244 if (!get_form(arg, &form, CRED_CERTIFICATE))
245 {
246 error = "invalid output format";
247 goto usage;
248 }
249 continue;
250 case 'o':
251 ocsp->insert_last(ocsp, arg);
252 continue;
253 case EOF:
254 break;
255 default:
256 error = "invalid --self option";
257 goto usage;
258 }
259 break;
260 }
261
262 if (!dn)
263 {
264 error = "--dn is required";
265 goto usage;
266 }
267 if (!calculate_lifetime(dateform, datenb, datena, lifetime,
268 &not_before, &not_after))
269 {
270 error = "invalid --not-before/after datetime";
271 goto usage;
272 }
273 id = identification_create_from_string(dn);
274 if (id->get_type(id) != ID_DER_ASN1_DN)
275 {
276 error = "supplied --dn is not a distinguished name";
277 goto end;
278 }
279 if (file)
280 {
281 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
282 BUILD_FROM_FILE, file, BUILD_END);
283 }
284 else if (keyid)
285 {
286 chunk_t chunk;
287
288 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
289 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
290 BUILD_PKCS11_KEYID, chunk, BUILD_END);
291 free(chunk.ptr);
292 }
293 else
294 {
295 chunk_t chunk;
296
297 if (!chunk_from_fd(0, &chunk))
298 {
299 fprintf(stderr, "%s: ", strerror(errno));
300 error = "reading private key failed";
301 goto end;
302 }
303 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
304 BUILD_BLOB, chunk, BUILD_END);
305 free(chunk.ptr);
306 }
307 if (!private)
308 {
309 error = "loading private key failed";
310 goto end;
311 }
312 public = private->get_public_key(private);
313 if (!public)
314 {
315 error = "extracting public key failed";
316 goto end;
317 }
318 if (hex)
319 {
320 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
321 }
322 else
323 {
324 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
325
326 if (!rng)
327 {
328 error = "no random number generator found";
329 goto end;
330 }
331 if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
332 {
333 error = "failed to generate serial number";
334 rng->destroy(rng);
335 goto end;
336 }
337 serial.ptr[0] &= 0x7F;
338 rng->destroy(rng);
339 }
340 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
341 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
342 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
343 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
344 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
345 BUILD_PATHLEN, pathlen, BUILD_SUBJECT_ALTNAMES, san,
346 BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
347 BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
348 BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
349 BUILD_CERTIFICATE_POLICIES, policies,
350 BUILD_POLICY_MAPPINGS, mappings,
351 BUILD_POLICY_REQUIRE_EXPLICIT, require_explicit,
352 BUILD_POLICY_INHIBIT_MAPPING, inhibit_mapping,
353 BUILD_POLICY_INHIBIT_ANY, inhibit_any,
354 BUILD_END);
355 if (!cert)
356 {
357 error = "generating certificate failed";
358 goto end;
359 }
360 if (!cert->get_encoding(cert, form, &encoding))
361 {
362 error = "encoding certificate failed";
363 goto end;
364 }
365 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
366 {
367 error = "writing certificate key failed";
368 goto end;
369 }
370
371 end:
372 DESTROY_IF(id);
373 DESTROY_IF(cert);
374 DESTROY_IF(public);
375 DESTROY_IF(private);
376 san->destroy_offset(san, offsetof(identification_t, destroy));
377 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
378 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
379 policies->destroy_function(policies, (void*)destroy_cert_policy);
380 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
381 ocsp->destroy(ocsp);
382 free(encoding.ptr);
383 free(serial.ptr);
384
385 if (error)
386 {
387 fprintf(stderr, "%s\n", error);
388 return 1;
389 }
390 return 0;
391
392 usage:
393 san->destroy_offset(san, offsetof(identification_t, destroy));
394 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
395 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
396 policies->destroy_function(policies, (void*)destroy_cert_policy);
397 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
398 ocsp->destroy(ocsp);
399 return command_usage(error);
400 }
401
402 /**
403 * Register the command.
404 */
405 static void __attribute__ ((constructor))reg()
406 {
407 command_register((command_t) {
408 self, 's', "self",
409 "create a self signed certificate",
410 {" [--in file|--keyid hex] [--type rsa|ecdsa]",
411 " --dn distinguished-name [--san subjectAltName]+",
412 "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
413 "[--flag serverAuth|clientAuth|crlSign|ocspSigning|msSmartcardLogon]+",
414 "[--nc-permitted name] [--nc-excluded name]",
415 "[--policy-map issuer-oid:subject-oid]",
416 "[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
417 "[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
418 "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
419 {
420 {"help", 'h', 0, "show usage information"},
421 {"in", 'i', 1, "private key input file, default: stdin"},
422 {"keyid", 'x', 1, "keyid on smartcard of private key"},
423 {"type", 't', 1, "type of input key, default: rsa"},
424 {"dn", 'd', 1, "subject and issuer distinguished name"},
425 {"san", 'a', 1, "subjectAltName to include in certificate"},
426 {"lifetime", 'l', 1, "days the certificate is valid, default: 1095"},
427 {"not-before", 'F', 1, "date/time the validity of the cert starts"},
428 {"not-after", 'T', 1, "date/time the validity of the cert ends"},
429 {"dateform", 'D', 1, "strptime(3) input format, default: %d.%m.%y %T"},
430 {"serial", 's', 1, "serial number in hex, default: random"},
431 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
432 {"pathlen", 'p', 1, "set path length constraint"},
433 {"nc-permitted", 'n', 1, "add permitted NameConstraint"},
434 {"nc-excluded", 'N', 1, "add excluded NameConstraint"},
435 {"cert-policy", 'P', 1, "certificatePolicy OID to include"},
436 {"cps-uri", 'C', 1, "Certification Practice statement URI for certificatePolicy"},
437 {"user-notice", 'U', 1, "user notice for certificatePolicy"},
438 {"policy-mapping", 'M', 1, "policyMapping from issuer to subject OID"},
439 {"policy-explicit", 'E', 1, "requireExplicitPolicy constraint"},
440 {"policy-inhibit", 'H', 1, "inhibitPolicyMapping constraint"},
441 {"policy-any", 'A', 1, "inhibitAnyPolicy constraint"},
442 {"flag", 'e', 1, "include extendedKeyUsage flag"},
443 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
444 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
445 {"outform", 'f', 1, "encoding of generated cert, default: der"},
446 }
447 });
448 }