Slightly renamed different policyConstraints to distinguish them better
[strongswan.git] / src / pki / commands / self.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <credentials/certificates/certificate.h>
22 #include <credentials/certificates/x509.h>
23 #include <asn1/asn1.h>
24
25 /**
26 * Free cert policy with OID
27 */
28 static void destroy_cert_policy(x509_cert_policy_t *policy)
29 {
30 free(policy->oid.ptr);
31 free(policy);
32 }
33
34 /**
35 * Free policy mapping
36 */
37 static void destroy_policy_mapping(x509_policy_mapping_t *mapping)
38 {
39 free(mapping->issuer.ptr);
40 free(mapping->subject.ptr);
41 free(mapping);
42 }
43
44 /**
45 * Create a self signed certificate.
46 */
47 static int self()
48 {
49 cred_encoding_type_t form = CERT_ASN1_DER;
50 key_type_t type = KEY_RSA;
51 hash_algorithm_t digest = HASH_SHA1;
52 certificate_t *cert = NULL;
53 private_key_t *private = NULL;
54 public_key_t *public = NULL;
55 char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL, *keyid = NULL;
56 identification_t *id = NULL;
57 linked_list_t *san, *ocsp, *permitted, *excluded, *policies, *mappings;
58 int lifetime = 1095;
59 int pathlen = X509_NO_CONSTRAINT, inhibit_any = X509_NO_CONSTRAINT;
60 int inhibit_mapping = X509_NO_CONSTRAINT, require_explicit = X509_NO_CONSTRAINT;
61 chunk_t serial = chunk_empty;
62 chunk_t encoding = chunk_empty;
63 time_t not_before, not_after;
64 x509_flag_t flags = 0;
65 x509_cert_policy_t *policy = NULL;
66 char *arg;
67
68 san = linked_list_create();
69 ocsp = linked_list_create();
70 permitted = linked_list_create();
71 excluded = linked_list_create();
72 policies = linked_list_create();
73 mappings = linked_list_create();
74
75 while (TRUE)
76 {
77 switch (command_getopt(&arg))
78 {
79 case 'h':
80 goto usage;
81 case 't':
82 if (streq(arg, "rsa"))
83 {
84 type = KEY_RSA;
85 }
86 else if (streq(arg, "ecdsa"))
87 {
88 type = KEY_ECDSA;
89 }
90 else
91 {
92 error = "invalid input type";
93 goto usage;
94 }
95 continue;
96 case 'g':
97 digest = get_digest(arg);
98 if (digest == HASH_UNKNOWN)
99 {
100 error = "invalid --digest type";
101 goto usage;
102 }
103 continue;
104 case 'i':
105 file = arg;
106 continue;
107 case 'x':
108 keyid = arg;
109 continue;
110 case 'd':
111 dn = arg;
112 continue;
113 case 'a':
114 san->insert_last(san, identification_create_from_string(arg));
115 continue;
116 case 'l':
117 lifetime = atoi(arg);
118 if (!lifetime)
119 {
120 error = "invalid --lifetime value";
121 goto usage;
122 }
123 continue;
124 case 's':
125 hex = arg;
126 continue;
127 case 'b':
128 flags |= X509_CA;
129 continue;
130 case 'p':
131 pathlen = atoi(arg);
132 continue;
133 case 'n':
134 permitted->insert_last(permitted,
135 identification_create_from_string(arg));
136 continue;
137 case 'N':
138 excluded->insert_last(excluded,
139 identification_create_from_string(arg));
140 continue;
141 case 'P':
142 {
143 chunk_t oid;
144
145 oid = asn1_oid_from_string(arg);
146 if (!oid.len)
147 {
148 error = "--cert-policy OID invalid";
149 goto usage;
150 }
151 INIT(policy,
152 .oid = oid,
153 );
154 policies->insert_last(policies, policy);
155 continue;
156 }
157 case 'C':
158 if (!policy)
159 {
160 error = "--cps-uri must follow a --cert-policy";
161 goto usage;
162 }
163 policy->cps_uri = arg;
164 continue;
165 case 'U':
166 if (!policy)
167 {
168 error = "--user-notice must follow a --cert-policy";
169 goto usage;
170 }
171 policy->unotice_text = arg;
172 continue;
173 case 'M':
174 {
175 char *pos = strchr(arg, ':');
176 x509_policy_mapping_t *mapping;
177 chunk_t subject_oid, issuer_oid;
178
179 if (pos)
180 {
181 *pos++ = '\0';
182 issuer_oid = asn1_oid_from_string(arg);
183 subject_oid = asn1_oid_from_string(pos);
184 }
185 if (!pos || !issuer_oid.len || !subject_oid.len)
186 {
187 error = "--policy-map OIDs invalid";
188 goto usage;
189 }
190 INIT(mapping,
191 .issuer = issuer_oid,
192 .subject = subject_oid,
193 );
194 mappings->insert_last(mappings, mapping);
195 continue;
196 }
197 case 'E':
198 require_explicit = atoi(arg);
199 continue;
200 case 'H':
201 inhibit_mapping = atoi(arg);
202 continue;
203 case 'A':
204 inhibit_any = atoi(arg);
205 continue;
206 case 'e':
207 if (streq(arg, "serverAuth"))
208 {
209 flags |= X509_SERVER_AUTH;
210 }
211 else if (streq(arg, "clientAuth"))
212 {
213 flags |= X509_CLIENT_AUTH;
214 }
215 else if (streq(arg, "crlSign"))
216 {
217 flags |= X509_CRL_SIGN;
218 }
219 else if (streq(arg, "ocspSigning"))
220 {
221 flags |= X509_OCSP_SIGNER;
222 }
223 continue;
224 case 'f':
225 if (!get_form(arg, &form, CRED_CERTIFICATE))
226 {
227 error = "invalid output format";
228 goto usage;
229 }
230 continue;
231 case 'o':
232 ocsp->insert_last(ocsp, arg);
233 continue;
234 case EOF:
235 break;
236 default:
237 error = "invalid --self option";
238 goto usage;
239 }
240 break;
241 }
242
243 if (!dn)
244 {
245 error = "--dn is required";
246 goto usage;
247 }
248 id = identification_create_from_string(dn);
249 if (id->get_type(id) != ID_DER_ASN1_DN)
250 {
251 error = "supplied --dn is not a distinguished name";
252 goto end;
253 }
254 if (file)
255 {
256 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
257 BUILD_FROM_FILE, file, BUILD_END);
258 }
259 else if (keyid)
260 {
261 chunk_t chunk;
262
263 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
264 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
265 BUILD_PKCS11_KEYID, chunk, BUILD_END);
266 free(chunk.ptr);
267 }
268 else
269 {
270 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
271 BUILD_FROM_FD, 0, BUILD_END);
272 }
273 if (!private)
274 {
275 error = "loading private key failed";
276 goto end;
277 }
278 public = private->get_public_key(private);
279 if (!public)
280 {
281 error = "extracting public key failed";
282 goto end;
283 }
284 if (hex)
285 {
286 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
287 }
288 else
289 {
290 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
291
292 if (!rng)
293 {
294 error = "no random number generator found";
295 goto end;
296 }
297 rng->allocate_bytes(rng, 8, &serial);
298 while (*serial.ptr == 0x00)
299 {
300 /* we don't accept a serial number with leading zeroes */
301 rng->get_bytes(rng, 1, serial.ptr);
302 }
303 rng->destroy(rng);
304 }
305 not_before = time(NULL);
306 not_after = not_before + lifetime * 24 * 60 * 60;
307 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
308 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
309 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
310 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
311 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
312 BUILD_PATHLEN, pathlen, BUILD_SUBJECT_ALTNAMES, san,
313 BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
314 BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
315 BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
316 BUILD_CERTIFICATE_POLICIES, policies,
317 BUILD_POLICY_MAPPINGS, mappings,
318 BUILD_POLICY_REQUIRE_EXPLICIT, require_explicit,
319 BUILD_POLICY_INHIBIT_MAPPING, inhibit_mapping,
320 BUILD_POLICY_INHIBIT_ANY, inhibit_any,
321 BUILD_END);
322 if (!cert)
323 {
324 error = "generating certificate failed";
325 goto end;
326 }
327 if (!cert->get_encoding(cert, form, &encoding))
328 {
329 error = "encoding certificate failed";
330 goto end;
331 }
332 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
333 {
334 error = "writing certificate key failed";
335 goto end;
336 }
337
338 end:
339 DESTROY_IF(id);
340 DESTROY_IF(cert);
341 DESTROY_IF(public);
342 DESTROY_IF(private);
343 san->destroy_offset(san, offsetof(identification_t, destroy));
344 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
345 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
346 policies->destroy_function(policies, (void*)destroy_cert_policy);
347 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
348 ocsp->destroy(ocsp);
349 free(encoding.ptr);
350 free(serial.ptr);
351
352 if (error)
353 {
354 fprintf(stderr, "%s\n", error);
355 return 1;
356 }
357 return 0;
358
359 usage:
360 san->destroy_offset(san, offsetof(identification_t, destroy));
361 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
362 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
363 policies->destroy_function(policies, (void*)destroy_cert_policy);
364 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
365 ocsp->destroy(ocsp);
366 return command_usage(error);
367 }
368
369 /**
370 * Register the command.
371 */
372 static void __attribute__ ((constructor))reg()
373 {
374 command_register((command_t) {
375 self, 's', "self",
376 "create a self signed certificate",
377 {"[--in file | --keyid hex] [--type rsa|ecdsa]",
378 " --dn distinguished-name [--san subjectAltName]+",
379 "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
380 "[--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
381 "[--nc-permitted name] [--nc-excluded name]",
382 "[--cert-policy oid [--cps-uri uri] [--user-notice text] ]+",
383 "[--policy-map issuer-oid:subject-oid]",
384 "[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
385 "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
386 {
387 {"help", 'h', 0, "show usage information"},
388 {"in", 'i', 1, "private key input file, default: stdin"},
389 {"keyid", 'x', 1, "keyid on smartcard of private key"},
390 {"type", 't', 1, "type of input key, default: rsa"},
391 {"dn", 'd', 1, "subject and issuer distinguished name"},
392 {"san", 'a', 1, "subjectAltName to include in certificate"},
393 {"lifetime", 'l', 1, "days the certificate is valid, default: 1095"},
394 {"serial", 's', 1, "serial number in hex, default: random"},
395 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
396 {"pathlen", 'p', 1, "set path length constraint"},
397 {"nc-permitted", 'n', 1, "add permitted NameConstraint"},
398 {"nc-excluded", 'N', 1, "add excluded NameConstraint"},
399 {"cert-policy", 'P', 1, "certificatePolicy OID to include"},
400 {"cps-uri", 'C', 1, "Certification Practice statement URI for certificatePolicy"},
401 {"user-notice", 'U', 1, "user notice for certificatePolicy"},
402 {"policy-mapping", 'M', 1, "policyMapping from issuer to subject OID"},
403 {"policy-explicit", 'E', 1, "requireExplicitPolicy constraint"},
404 {"policy-inhibit", 'H', 1, "inhibitPolicyMapping constraint"},
405 {"policy-any", 'A', 1, "inhibitAnyPolicy constraint"},
406 {"flag", 'e', 1, "include extendedKeyUsage flag"},
407 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
408 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
409 {"outform", 'f', 1, "encoding of generated cert, default: der"},
410 }
411 });
412 }