54ef2399b78caf06ccb6fb613b73062fb46e8767
[strongswan.git] / src / pki / commands / self.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <utils/optionsfrom.h>
22 #include <credentials/certificates/certificate.h>
23 #include <credentials/certificates/x509.h>
24
25 /**
26 * Create a self signed certificate.
27 */
28 static int self(int argc, char *argv[])
29 {
30 key_type_t type = KEY_RSA;
31 hash_algorithm_t digest = HASH_SHA1;
32 certificate_t *cert = NULL;
33 private_key_t *private = NULL;
34 public_key_t *public = NULL;
35 char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL;
36 identification_t *id = NULL;
37 linked_list_t *san, *ocsp;
38 int lifetime = 1080;
39 chunk_t serial = chunk_empty;
40 chunk_t encoding = chunk_empty;
41 time_t not_before, not_after;
42 x509_flag_t flags = 0;
43 options_t *options;
44
45 options = options_create();
46 san = linked_list_create();
47 ocsp = linked_list_create();
48
49 while (TRUE)
50 {
51 switch (getopt_long(argc, argv, "", command_opts, NULL))
52 {
53 case 'h':
54 goto usage;
55 case 'v':
56 dbg_level = atoi(optarg);
57 continue;
58 case '+':
59 if (!options->from(options, optarg, &argc, &argv, optind))
60 {
61 error = "invalid options file";
62 goto usage;
63 }
64 continue;
65 case 't':
66 if (streq(optarg, "rsa"))
67 {
68 type = KEY_RSA;
69 }
70 else if (streq(optarg, "ecdsa"))
71 {
72 type = KEY_ECDSA;
73 }
74 else
75 {
76 error = "invalid input type";
77 goto usage;
78 }
79 continue;
80 case 'g':
81 digest = get_digest(optarg);
82 if (digest == HASH_UNKNOWN)
83 {
84 error = "invalid --digest type";
85 goto usage;
86 }
87 continue;
88 case 'i':
89 file = optarg;
90 continue;
91 case 'd':
92 dn = optarg;
93 continue;
94 case 'a':
95 san->insert_last(san, identification_create_from_string(optarg));
96 continue;
97 case 'l':
98 lifetime = atoi(optarg);
99 if (!lifetime)
100 {
101 error = "invalid --lifetime value";
102 goto usage;
103 }
104 continue;
105 case 's':
106 hex = optarg;
107 continue;
108 case 'b':
109 flags |= X509_CA;
110 continue;
111 case 'o':
112 ocsp->insert_last(ocsp, optarg);
113 continue;
114 case EOF:
115 break;
116 default:
117 error = "invalid --self option";
118 goto usage;
119 }
120 break;
121 }
122
123 if (!dn)
124 {
125 error = "--dn is required";
126 goto usage;
127 }
128 id = identification_create_from_string(dn);
129 if (id->get_type(id) != ID_DER_ASN1_DN)
130 {
131 error = "supplied --dn is not a distinguished name";
132 goto end;
133 }
134 if (file)
135 {
136 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
137 BUILD_FROM_FILE, file, BUILD_END);
138 }
139 else
140 {
141 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
142 BUILD_FROM_FD, 0, BUILD_END);
143 }
144 if (!private)
145 {
146 error = "parsing private key failed";
147 goto end;
148 }
149 public = private->get_public_key(private);
150 if (!public)
151 {
152 error = "extracting public key failed";
153 goto end;
154 }
155 if (hex)
156 {
157 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
158 }
159 else
160 {
161 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
162
163 if (!rng)
164 {
165 error = "no random number generator found";
166 goto end;
167 }
168 rng->allocate_bytes(rng, 8, &serial);
169 rng->destroy(rng);
170 }
171 not_before = time(NULL);
172 not_after = not_before + lifetime * 24 * 60 * 60;
173 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
174 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
175 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
176 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
177 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
178 BUILD_SUBJECT_ALTNAMES, san,
179 BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_END);
180 if (!cert)
181 {
182 error = "generating certificate failed";
183 goto end;
184 }
185 encoding = cert->get_encoding(cert);
186 if (!encoding.ptr)
187 {
188 error = "encoding certificate failed";
189 goto end;
190 }
191 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
192 {
193 error = "writing certificate key failed";
194 goto end;
195 }
196
197 end:
198 DESTROY_IF(id);
199 DESTROY_IF(cert);
200 DESTROY_IF(public);
201 DESTROY_IF(private);
202 san->destroy_offset(san, offsetof(identification_t, destroy));
203 ocsp->destroy(ocsp);
204 options->destroy(options);
205 free(encoding.ptr);
206 free(serial.ptr);
207
208 if (error)
209 {
210 fprintf(stderr, "%s\n", error);
211 return 1;
212 }
213 return 0;
214
215 usage:
216 san->destroy_offset(san, offsetof(identification_t, destroy));
217 ocsp->destroy(ocsp);
218 options->destroy(options);
219 return command_usage(error);
220 }
221
222 /**
223 * Register the command.
224 */
225 static void __attribute__ ((constructor))reg()
226 {
227 command_register((command_t) {
228 self, 's', "self",
229 "create a self signed certificate",
230 {"[--in file] [--type rsa|ecdsa]",
231 " --dn distinguished-name [--san subjectAltName]+",
232 "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
233 "[--digest md5|sha1|sha224|sha256|sha384|sha512]",
234 "[--options file]"},
235 {
236 {"help", 'h', 0, "show usage information"},
237 {"in", 'i', 1, "private key input file, default: stdin"},
238 {"type", 't', 1, "type of input key, default: rsa"},
239 {"dn", 'd', 1, "subject and issuer distinguished name"},
240 {"san", 'a', 1, "subjectAltName to include in certificate"},
241 {"lifetime",'l', 1, "days the certificate is valid, default: 1080"},
242 {"serial", 's', 1, "serial number in hex, default: random"},
243 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
244 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
245 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
246 {"debug", 'v', 1, "set debug level, default: 1"},
247 {"options", '+', 1, "read command line options from file"},
248 }
249 });
250 }