src/pki/commands/self.c

   1 /*
   2  * Copyright (C) 2009 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <time.h>
  17
  18 #include "pki.h"
  19
  20 #include <utils/linked_list.h>
  21 #include <credentials/certificates/certificate.h>
  22 #include <credentials/certificates/x509.h>
  23
  24 /**
  25  * Create a self signed certificate.
  26  */
  27 static int self()
  28 {
  29         cred_encoding_type_t form = CERT_ASN1_DER;
  30         key_type_t type = KEY_RSA;
  31         hash_algorithm_t digest = HASH_SHA1;
  32         certificate_t *cert = NULL;
  33         private_key_t *private = NULL;
  34         public_key_t *public = NULL;
  35         char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL, *keyid = NULL;
  36         identification_t *id = NULL;
  37         linked_list_t *san, *ocsp;
  38         int lifetime = 1095;
  39         int pathlen = X509_NO_PATH_LEN_CONSTRAINT;
  40         chunk_t serial = chunk_empty;
  41         chunk_t encoding = chunk_empty;
  42         time_t not_before, not_after;
  43         x509_flag_t flags = 0;
  44         char *arg;
  45
  46         san = linked_list_create();
  47         ocsp = linked_list_create();
  48
  49         while (TRUE)
  50         {
  51                 switch (command_getopt(&arg))
  52                 {
  53                         case 'h':
  54                                 goto usage;
  55                         case 't':
  56                                 if (streq(arg, "rsa"))
  57                                 {
  58                                         type = KEY_RSA;
  59                                 }
  60                                 else if (streq(arg, "ecdsa"))
  61                                 {
  62                                         type = KEY_ECDSA;
  63                                 }
  64                                 else
  65                                 {
  66                                         error = "invalid input type";
  67                                         goto usage;
  68                                 }
  69                                 continue;
  70                         case 'g':
  71                                 digest = get_digest(arg);
  72                                 if (digest == HASH_UNKNOWN)
  73                                 {
  74                                         error = "invalid --digest type";
  75                                         goto usage;
  76                                 }
  77                                 continue;
  78                         case 'i':
  79                                 file = arg;
  80                                 continue;
  81                         case 'x':
  82                                 keyid = arg;
  83                                 continue;
  84                         case 'd':
  85                                 dn = arg;
  86                                 continue;
  87                         case 'a':
  88                                 san->insert_last(san, identification_create_from_string(arg));
  89                                 continue;
  90                         case 'l':
  91                                 lifetime = atoi(arg);
  92                                 if (!lifetime)
  93                                 {
  94                                         error = "invalid --lifetime value";
  95                                         goto usage;
  96                                 }
  97                                 continue;
  98                         case 's':
  99                                 hex = arg;
 100                                 continue;
 101                         case 'b':
 102                                 flags |= X509_CA;
 103                                 continue;
 104                         case 'p':
 105                                 pathlen = atoi(arg);
 106                                 continue;
 107                         case 'e':
 108                                 if (streq(arg, "serverAuth"))
 109                                 {
 110                                         flags |= X509_SERVER_AUTH;
 111                                 }
 112                                 else if (streq(arg, "clientAuth"))
 113                                 {
 114                                         flags |= X509_CLIENT_AUTH;
 115                                 }
 116                                 else if (streq(arg, "crlSign"))
 117                                 {
 118                                         flags |= X509_CRL_SIGN;
 119                                 }
 120                                 else if (streq(arg, "ocspSigning"))
 121                                 {
 122                                         flags |= X509_OCSP_SIGNER;
 123                                 }
 124                                 continue;
 125                         case 'f':
 126                                 if (!get_form(arg, &form, CRED_CERTIFICATE))
 127                                 {
 128                                         return command_usage("invalid output format");
 129                                 }
 130                                 continue;
 131                         case 'o':
 132                                 ocsp->insert_last(ocsp, arg);
 133                                 continue;
 134                         case EOF:
 135                                 break;
 136                         default:
 137                                 error = "invalid --self option";
 138                                 goto usage;
 139                 }
 140                 break;
 141         }
 142
 143         if (!dn)
 144         {
 145                 error = "--dn is required";
 146                 goto usage;
 147         }
 148         id = identification_create_from_string(dn);
 149         if (id->get_type(id) != ID_DER_ASN1_DN)
 150         {
 151                 error = "supplied --dn is not a distinguished name";
 152                 goto end;
 153         }
 154         if (file)
 155         {
 156                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
 157                                                                          BUILD_FROM_FILE, file, BUILD_END);
 158         }
 159         else if (keyid)
 160         {
 161                 chunk_t chunk;
 162
 163                 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
 164                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
 165                                                                          BUILD_PKCS11_KEYID, chunk, BUILD_END);
 166                 free(chunk.ptr);
 167         }
 168         else
 169         {
 170                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
 171                                                                          BUILD_FROM_FD, 0, BUILD_END);
 172         }
 173         if (!private)
 174         {
 175                 error = "loading private key failed";
 176                 goto end;
 177         }
 178         public = private->get_public_key(private);
 179         if (!public)
 180         {
 181                 error = "extracting public key failed";
 182                 goto end;
 183         }
 184         if (hex)
 185         {
 186                 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
 187         }
 188         else
 189         {
 190                 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 191
 192                 if (!rng)
 193                 {
 194                         error = "no random number generator found";
 195                         goto end;
 196                 }
 197                 rng->allocate_bytes(rng, 8, &serial);
 198                 while (*serial.ptr == 0x00)
 199                 {
 200                         /* we don't accept a serial number with leading zeroes */
 201                         rng->get_bytes(rng, 1, serial.ptr);
 202                 }
 203                 rng->destroy(rng);
 204         }
 205         not_before = time(NULL);
 206         not_after = not_before + lifetime * 24 * 60 * 60;
 207         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 208                                                 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
 209                                                 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
 210                                                 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
 211                                                 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
 212                                                 BUILD_PATHLEN, pathlen, BUILD_SUBJECT_ALTNAMES, san,
 213                                                 BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_END);
 214         if (!cert)
 215         {
 216                 error = "generating certificate failed";
 217                 goto end;
 218         }
 219         if (!cert->get_encoding(cert, form, &encoding))
 220         {
 221                 error = "encoding certificate failed";
 222                 goto end;
 223         }
 224         if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
 225         {
 226                 error = "writing certificate key failed";
 227                 goto end;
 228         }
 229
 230 end:
 231         DESTROY_IF(id);
 232         DESTROY_IF(cert);
 233         DESTROY_IF(public);
 234         DESTROY_IF(private);
 235         san->destroy_offset(san, offsetof(identification_t, destroy));
 236         ocsp->destroy(ocsp);
 237         free(encoding.ptr);
 238         free(serial.ptr);
 239
 240         if (error)
 241         {
 242                 fprintf(stderr, "%s\n", error);
 243                 return 1;
 244         }
 245         return 0;
 246
 247 usage:
 248         san->destroy_offset(san, offsetof(identification_t, destroy));
 249         ocsp->destroy(ocsp);
 250         return command_usage(error);
 251 }
 252
 253 /**
 254  * Register the command.
 255  */
 256 static void __attribute__ ((constructor))reg()
 257 {
 258         command_register((command_t) {
 259                 self, 's', "self",
 260                 "create a self signed certificate",
 261                 {"[--in file | --keyid hex] [--type rsa|ecdsa]",
 262                  " --dn distinguished-name [--san subjectAltName]+",
 263                  "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
 264                  "[--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
 265                  "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
 266                 {
 267                         {"help",        'h', 0, "show usage information"},
 268                         {"in",          'i', 1, "private key input file, default: stdin"},
 269                         {"keyid",       'x', 1, "keyid on smartcard of private key"},
 270                         {"type",        't', 1, "type of input key, default: rsa"},
 271                         {"dn",          'd', 1, "subject and issuer distinguished name"},
 272                         {"san",         'a', 1, "subjectAltName to include in certificate"},
 273                         {"lifetime",'l', 1, "days the certificate is valid, default: 1095"},
 274                         {"serial",      's', 1, "serial number in hex, default: random"},
 275                         {"ca",          'b', 0, "include CA basicConstraint, default: no"},
 276                         {"pathlen",     'p', 1, "set path length constraint"},
 277                         {"flag",        'e', 1, "include extendedKeyUsage flag"},
 278                         {"ocsp",        'o', 1, "OCSP AuthorityInfoAccess URI to include"},
 279                         {"digest",      'g', 1, "digest for signature creation, default: sha1"},
 280                         {"outform",     'f', 1, "encoding of generated cert, default: der"},
 281                 }
 282         });
 283 }