src/pki/commands/self.c

   1 /*
   2  * Copyright (C) 2009 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <time.h>
  17
  18 #include "pki.h"
  19
  20 #include <utils/linked_list.h>
  21 #include <utils/optionsfrom.h>
  22 #include <credentials/certificates/certificate.h>
  23 #include <credentials/certificates/x509.h>
  24
  25 /**
  26  * Create a self signed certificate.
  27  */
  28 static int self(int argc, char *argv[])
  29 {
  30         key_type_t type = KEY_RSA;
  31         hash_algorithm_t digest = HASH_SHA1;
  32         certificate_t *cert = NULL;
  33         private_key_t *private = NULL;
  34         public_key_t *public = NULL;
  35         char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL;
  36         identification_t *id = NULL;
  37         linked_list_t *san, *ocsp;
  38         int lifetime = 1080;
  39         chunk_t serial = chunk_empty;
  40         chunk_t encoding = chunk_empty;
  41         time_t not_before, not_after;
  42         x509_flag_t flags = 0;
  43         options_t *options;
  44
  45         options = options_create();
  46         san = linked_list_create();
  47         ocsp = linked_list_create();
  48
  49         while (TRUE)
  50         {
  51                 switch (getopt_long(argc, argv, "", command_opts, NULL))
  52                 {
  53                         case 'h':
  54                                 goto usage;
  55                         case 'v':
  56                                 dbg_level = atoi(optarg);
  57                                 continue;
  58                         case '+':
  59                                 if (!options->from(options, optarg, &argc, &argv, optind))
  60                                 {
  61                                         error = "invalid options file";
  62                                         goto usage;
  63                                 }
  64                                 continue;
  65                         case 't':
  66                                 if (streq(optarg, "rsa"))
  67                                 {
  68                                         type = KEY_RSA;
  69                                 }
  70                                 else if (streq(optarg, "ecdsa"))
  71                                 {
  72                                         type = KEY_ECDSA;
  73                                 }
  74                                 else
  75                                 {
  76                                         error = "invalid input type";
  77                                         goto usage;
  78                                 }
  79                                 continue;
  80                         case 'g':
  81                                 digest = get_digest(optarg);
  82                                 if (digest == HASH_UNKNOWN)
  83                                 {
  84                                         error = "invalid --digest type";
  85                                         goto usage;
  86                                 }
  87                                 continue;
  88                         case 'i':
  89                                 file = optarg;
  90                                 continue;
  91                         case 'd':
  92                                 dn = optarg;
  93                                 continue;
  94                         case 'a':
  95                                 san->insert_last(san, identification_create_from_string(optarg));
  96                                 continue;
  97                         case 'l':
  98                                 lifetime = atoi(optarg);
  99                                 if (!lifetime)
 100                                 {
 101                                         error = "invalid --lifetime value";
 102                                         goto usage;
 103                                 }
 104                                 continue;
 105                         case 's':
 106                                 hex = optarg;
 107                                 continue;
 108                         case 'b':
 109                                 flags |= X509_CA;
 110                                 continue;
 111                         case 'o':
 112                                 ocsp->insert_last(ocsp, optarg);
 113                                 continue;
 114                         case EOF:
 115                                 break;
 116                         default:
 117                                 error = "invalid --self option";
 118                                 goto usage;
 119                 }
 120                 break;
 121         }
 122
 123         if (!dn)
 124         {
 125                 error = "--dn is required";
 126                 goto usage;
 127         }
 128         id = identification_create_from_string(dn);
 129         if (id->get_type(id) != ID_DER_ASN1_DN)
 130         {
 131                 error = "supplied --dn is not a distinguished name";
 132                 goto end;
 133         }
 134         if (file)
 135         {
 136                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
 137                                                                          BUILD_FROM_FILE, file, BUILD_END);
 138         }
 139         else
 140         {
 141                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
 142                                                                          BUILD_FROM_FD, 0, BUILD_END);
 143         }
 144         if (!private)
 145         {
 146                 error = "parsing private key failed";
 147                 goto end;
 148         }
 149         public = private->get_public_key(private);
 150         if (!public)
 151         {
 152                 error = "extracting public key failed";
 153                 goto end;
 154         }
 155         if (hex)
 156         {
 157                 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
 158         }
 159         else
 160         {
 161                 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 162
 163                 if (!rng)
 164                 {
 165                         error = "no random number generator found";
 166                         goto end;
 167                 }
 168                 rng->allocate_bytes(rng, 8, &serial);
 169                 rng->destroy(rng);
 170         }
 171         not_before = time(NULL);
 172         not_after = not_before + lifetime * 24 * 60 * 60;
 173         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 174                                                 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
 175                                                 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
 176                                                 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
 177                                                 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
 178                                                 BUILD_SUBJECT_ALTNAMES, san,
 179                                                 BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_END);
 180         if (!cert)
 181         {
 182                 error = "generating certificate failed";
 183                 goto end;
 184         }
 185         encoding = cert->get_encoding(cert);
 186         if (!encoding.ptr)
 187         {
 188                 error = "encoding certificate failed";
 189                 goto end;
 190         }
 191         if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
 192         {
 193                 error = "writing certificate key failed";
 194                 goto end;
 195         }
 196
 197 end:
 198         DESTROY_IF(id);
 199         DESTROY_IF(cert);
 200         DESTROY_IF(public);
 201         DESTROY_IF(private);
 202         san->destroy_offset(san, offsetof(identification_t, destroy));
 203         ocsp->destroy(ocsp);
 204         options->destroy(options);
 205         free(encoding.ptr);
 206         free(serial.ptr);
 207
 208         if (error)
 209         {
 210                 fprintf(stderr, "%s\n", error);
 211                 return 1;
 212         }
 213         return 0;
 214
 215 usage:
 216         san->destroy_offset(san, offsetof(identification_t, destroy));
 217         ocsp->destroy(ocsp);
 218         options->destroy(options);
 219         return command_usage(error);
 220 }
 221
 222 /**
 223  * Register the command.
 224  */
 225 static void __attribute__ ((constructor))reg()
 226 {
 227         command_register((command_t) {
 228                 self, 's', "self",
 229                 "create a self signed certificate",
 230                 {"[--in file] [--type rsa|ecdsa]",
 231                  " --dn distinguished-name [--san subjectAltName]+",
 232                  "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
 233                  "[--digest md5|sha1|sha224|sha256|sha384|sha512]",
 234                  "[--options file]"},
 235                 {
 236                         {"help",        'h', 0, "show usage information"},
 237                         {"in",          'i', 1, "private key input file, default: stdin"},
 238                         {"type",        't', 1, "type of input key, default: rsa"},
 239                         {"dn",          'd', 1, "subject and issuer distinguished name"},
 240                         {"san",         'a', 1, "subjectAltName to include in certificate"},
 241                         {"lifetime",'l', 1, "days the certificate is valid, default: 1080"},
 242                         {"serial",      's', 1, "serial number in hex, default: random"},
 243                         {"ca",          'b', 0, "include CA basicConstraint, default: no"},
 244                         {"ocsp",        'o', 1, "OCSP AuthorityInfoAccess URI to include"},
 245                         {"digest",      'g', 1, "digest for signature creation, default: sha1"},
 246                         {"debug",       'v', 1, "set debug level, default: 1"},
 247                         {"options",     '+', 1, "read command line options from file"},
 248                 }
 249         });
 250 }