4749032725ee6674ed4f5b35d12508fc41be11b2
[strongswan.git] / src / pki / commands / self.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <credentials/certificates/certificate.h>
22 #include <credentials/certificates/x509.h>
23 #include <asn1/asn1.h>
24
25 /**
26 * Free cert policy with OID
27 */
28 static void destroy_cert_policy(x509_cert_policy_t *policy)
29 {
30 free(policy->oid.ptr);
31 free(policy);
32 }
33
34 /**
35 * Create a self signed certificate.
36 */
37 static int self()
38 {
39 cred_encoding_type_t form = CERT_ASN1_DER;
40 key_type_t type = KEY_RSA;
41 hash_algorithm_t digest = HASH_SHA1;
42 certificate_t *cert = NULL;
43 private_key_t *private = NULL;
44 public_key_t *public = NULL;
45 char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL, *keyid = NULL;
46 identification_t *id = NULL;
47 linked_list_t *san, *ocsp, *permitted, *excluded, *policies;
48 int lifetime = 1095;
49 int pathlen = X509_NO_PATH_LEN_CONSTRAINT;
50 chunk_t serial = chunk_empty;
51 chunk_t encoding = chunk_empty;
52 time_t not_before, not_after;
53 x509_flag_t flags = 0;
54 x509_cert_policy_t *policy = NULL;
55 char *arg;
56
57 san = linked_list_create();
58 ocsp = linked_list_create();
59 permitted = linked_list_create();
60 excluded = linked_list_create();
61 policies = linked_list_create();
62
63 while (TRUE)
64 {
65 switch (command_getopt(&arg))
66 {
67 case 'h':
68 goto usage;
69 case 't':
70 if (streq(arg, "rsa"))
71 {
72 type = KEY_RSA;
73 }
74 else if (streq(arg, "ecdsa"))
75 {
76 type = KEY_ECDSA;
77 }
78 else
79 {
80 error = "invalid input type";
81 goto usage;
82 }
83 continue;
84 case 'g':
85 digest = get_digest(arg);
86 if (digest == HASH_UNKNOWN)
87 {
88 error = "invalid --digest type";
89 goto usage;
90 }
91 continue;
92 case 'i':
93 file = arg;
94 continue;
95 case 'x':
96 keyid = arg;
97 continue;
98 case 'd':
99 dn = arg;
100 continue;
101 case 'a':
102 san->insert_last(san, identification_create_from_string(arg));
103 continue;
104 case 'l':
105 lifetime = atoi(arg);
106 if (!lifetime)
107 {
108 error = "invalid --lifetime value";
109 goto usage;
110 }
111 continue;
112 case 's':
113 hex = arg;
114 continue;
115 case 'b':
116 flags |= X509_CA;
117 continue;
118 case 'p':
119 pathlen = atoi(arg);
120 continue;
121 case 'n':
122 permitted->insert_last(permitted,
123 identification_create_from_string(arg));
124 continue;
125 case 'N':
126 excluded->insert_last(excluded,
127 identification_create_from_string(arg));
128 continue;
129 case 'P':
130 {
131 chunk_t oid;
132
133 oid = asn1_oid_from_string(arg);
134 if (!oid.len)
135 {
136 return command_usage("--cert-policy OID invalid");
137 }
138 INIT(policy,
139 .oid = oid,
140 );
141 policies->insert_last(policies, policy);
142 continue;
143 }
144 case 'C':
145 if (!policy)
146 {
147 return command_usage("--cps-uri must follow a --cert-policy");
148 }
149 policy->cps_uri = arg;
150 continue;
151 case 'U':
152 if (!policy)
153 {
154 return command_usage("--user-notice must follow a --cert-policy");
155 }
156 policy->unotice_text = arg;
157 continue;
158 case 'e':
159 if (streq(arg, "serverAuth"))
160 {
161 flags |= X509_SERVER_AUTH;
162 }
163 else if (streq(arg, "clientAuth"))
164 {
165 flags |= X509_CLIENT_AUTH;
166 }
167 else if (streq(arg, "crlSign"))
168 {
169 flags |= X509_CRL_SIGN;
170 }
171 else if (streq(arg, "ocspSigning"))
172 {
173 flags |= X509_OCSP_SIGNER;
174 }
175 continue;
176 case 'f':
177 if (!get_form(arg, &form, CRED_CERTIFICATE))
178 {
179 return command_usage("invalid output format");
180 }
181 continue;
182 case 'o':
183 ocsp->insert_last(ocsp, arg);
184 continue;
185 case EOF:
186 break;
187 default:
188 error = "invalid --self option";
189 goto usage;
190 }
191 break;
192 }
193
194 if (!dn)
195 {
196 error = "--dn is required";
197 goto usage;
198 }
199 id = identification_create_from_string(dn);
200 if (id->get_type(id) != ID_DER_ASN1_DN)
201 {
202 error = "supplied --dn is not a distinguished name";
203 goto end;
204 }
205 if (file)
206 {
207 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
208 BUILD_FROM_FILE, file, BUILD_END);
209 }
210 else if (keyid)
211 {
212 chunk_t chunk;
213
214 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
215 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
216 BUILD_PKCS11_KEYID, chunk, BUILD_END);
217 free(chunk.ptr);
218 }
219 else
220 {
221 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
222 BUILD_FROM_FD, 0, BUILD_END);
223 }
224 if (!private)
225 {
226 error = "loading private key failed";
227 goto end;
228 }
229 public = private->get_public_key(private);
230 if (!public)
231 {
232 error = "extracting public key failed";
233 goto end;
234 }
235 if (hex)
236 {
237 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
238 }
239 else
240 {
241 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
242
243 if (!rng)
244 {
245 error = "no random number generator found";
246 goto end;
247 }
248 rng->allocate_bytes(rng, 8, &serial);
249 while (*serial.ptr == 0x00)
250 {
251 /* we don't accept a serial number with leading zeroes */
252 rng->get_bytes(rng, 1, serial.ptr);
253 }
254 rng->destroy(rng);
255 }
256 not_before = time(NULL);
257 not_after = not_before + lifetime * 24 * 60 * 60;
258 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
259 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
260 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
261 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
262 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
263 BUILD_PATHLEN, pathlen, BUILD_SUBJECT_ALTNAMES, san,
264 BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
265 BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
266 BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
267 BUILD_CERTIFICATE_POLICIES, policies, BUILD_END);
268 if (!cert)
269 {
270 error = "generating certificate failed";
271 goto end;
272 }
273 if (!cert->get_encoding(cert, form, &encoding))
274 {
275 error = "encoding certificate failed";
276 goto end;
277 }
278 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
279 {
280 error = "writing certificate key failed";
281 goto end;
282 }
283
284 end:
285 DESTROY_IF(id);
286 DESTROY_IF(cert);
287 DESTROY_IF(public);
288 DESTROY_IF(private);
289 san->destroy_offset(san, offsetof(identification_t, destroy));
290 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
291 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
292 policies->destroy_function(policies, (void*)destroy_cert_policy);
293 ocsp->destroy(ocsp);
294 free(encoding.ptr);
295 free(serial.ptr);
296
297 if (error)
298 {
299 fprintf(stderr, "%s\n", error);
300 return 1;
301 }
302 return 0;
303
304 usage:
305 san->destroy_offset(san, offsetof(identification_t, destroy));
306 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
307 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
308 policies->destroy_function(policies, (void*)destroy_cert_policy);
309 ocsp->destroy(ocsp);
310 return command_usage(error);
311 }
312
313 /**
314 * Register the command.
315 */
316 static void __attribute__ ((constructor))reg()
317 {
318 command_register((command_t) {
319 self, 's', "self",
320 "create a self signed certificate",
321 {"[--in file | --keyid hex] [--type rsa|ecdsa]",
322 " --dn distinguished-name [--san subjectAltName]+",
323 "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
324 "[--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
325 "[--nc-permitted name] [--nc-excluded name]",
326 "[--cert-policy oid [--cps-uri uri] [--user-notice text] ]+",
327 "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
328 {
329 {"help", 'h', 0, "show usage information"},
330 {"in", 'i', 1, "private key input file, default: stdin"},
331 {"keyid", 'x', 1, "keyid on smartcard of private key"},
332 {"type", 't', 1, "type of input key, default: rsa"},
333 {"dn", 'd', 1, "subject and issuer distinguished name"},
334 {"san", 'a', 1, "subjectAltName to include in certificate"},
335 {"lifetime", 'l', 1, "days the certificate is valid, default: 1095"},
336 {"serial", 's', 1, "serial number in hex, default: random"},
337 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
338 {"pathlen", 'p', 1, "set path length constraint"},
339 {"nc-permitted",'n', 1, "add permitted NameConstraint"},
340 {"nc-excluded", 'N', 1, "add excluded NameConstraint"},
341 {"cert-policy", 'P', 1, "certificatePolicy OID to include"},
342 {"cps-uri", 'C', 1, "Certification Practice statement URI for certificatePolicy"},
343 {"user-notice", 'U', 1, "user notice for certificatePolicy"},
344 {"flag", 'e', 1, "include extendedKeyUsage flag"},
345 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
346 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
347 {"outform", 'f', 1, "encoding of generated cert, default: der"},
348 }
349 });
350 }