Use dynamic registration/usage invocation of command types
[strongswan.git] / src / pki / commands / self.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <utils/optionsfrom.h>
22 #include <credentials/certificates/certificate.h>
23 #include <credentials/certificates/x509.h>
24
25 /**
26 * Create a self signed certificate.
27 */
28 static int self(int argc, char *argv[])
29 {
30 key_type_t type = KEY_RSA;
31 hash_algorithm_t digest = HASH_SHA1;
32 certificate_t *cert = NULL;
33 private_key_t *private = NULL;
34 public_key_t *public = NULL;
35 char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL;
36 identification_t *id = NULL;
37 linked_list_t *san;
38 int lifetime = 1080;
39 chunk_t serial = chunk_empty;
40 chunk_t encoding = chunk_empty;
41 time_t not_before, not_after;
42 x509_flag_t flags = 0;
43 options_t *options;
44
45 options = options_create();
46 san = linked_list_create();
47
48 while (TRUE)
49 {
50 switch (getopt_long(argc, argv, "", command_opts, NULL))
51 {
52 case 'h':
53 goto usage;
54 case '+':
55 if (!options->from(options, optarg, &argc, &argv, optind))
56 {
57 error = "invalid options file";
58 goto usage;
59 }
60 continue;
61 case 't':
62 if (streq(optarg, "rsa"))
63 {
64 type = KEY_RSA;
65 }
66 else if (streq(optarg, "ecdsa"))
67 {
68 type = KEY_ECDSA;
69 }
70 else
71 {
72 error = "invalid input type";
73 goto usage;
74 }
75 continue;
76 case 'g':
77 digest = get_digest(optarg);
78 if (digest == HASH_UNKNOWN)
79 {
80 error = "invalid --digest type";
81 goto usage;
82 }
83 continue;
84 case 'i':
85 file = optarg;
86 continue;
87 case 'd':
88 dn = optarg;
89 continue;
90 case 'a':
91 san->insert_last(san, identification_create_from_string(optarg));
92 continue;
93 case 'l':
94 lifetime = atoi(optarg);
95 if (!lifetime)
96 {
97 error = "invalid --lifetime value";
98 goto usage;
99 }
100 continue;
101 case 's':
102 hex = optarg;
103 continue;
104 case 'c':
105 flags |= X509_CA;
106 continue;
107 case EOF:
108 break;
109 default:
110 error = "invalid --self option";
111 goto usage;
112 }
113 break;
114 }
115
116 if (!dn)
117 {
118 error = "--dn is required";
119 goto usage;
120 }
121 id = identification_create_from_string(dn);
122 if (id->get_type(id) != ID_DER_ASN1_DN)
123 {
124 error = "supplied --dn is not a distinguished name";
125 goto end;
126 }
127 if (file)
128 {
129 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
130 BUILD_FROM_FILE, file, BUILD_END);
131 }
132 else
133 {
134 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
135 BUILD_FROM_FD, 0, BUILD_END);
136 }
137 if (!private)
138 {
139 error = "parsing private key failed";
140 goto end;
141 }
142 public = private->get_public_key(private);
143 if (!public)
144 {
145 error = "extracting public key failed";
146 goto end;
147 }
148 if (hex)
149 {
150 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
151 }
152 else
153 {
154 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
155
156 if (!rng)
157 {
158 error = "no random number generator found";
159 goto end;
160 }
161 rng->allocate_bytes(rng, 8, &serial);
162 rng->destroy(rng);
163 }
164 not_before = time(NULL);
165 not_after = not_before + lifetime * 24 * 60 * 60;
166 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
167 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
168 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
169 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
170 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
171 BUILD_SUBJECT_ALTNAMES, san, BUILD_END);
172 if (!cert)
173 {
174 error = "generating certificate failed";
175 goto end;
176 }
177 encoding = cert->get_encoding(cert);
178 if (!encoding.ptr)
179 {
180 error = "encoding certificate failed";
181 goto end;
182 }
183 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
184 {
185 error = "writing certificate key failed";
186 goto end;
187 }
188
189 end:
190 DESTROY_IF(id);
191 DESTROY_IF(cert);
192 DESTROY_IF(public);
193 DESTROY_IF(private);
194 san->destroy_offset(san, offsetof(identification_t, destroy));
195 options->destroy(options);
196 free(encoding.ptr);
197 free(serial.ptr);
198
199 if (error)
200 {
201 fprintf(stderr, "%s\n", error);
202 return 1;
203 }
204 return 0;
205
206 usage:
207 san->destroy_offset(san, offsetof(identification_t, destroy));
208 options->destroy(options);
209 return command_usage(error);
210 }
211
212 /**
213 * Register the command.
214 */
215 static void __attribute__ ((constructor))reg()
216 {
217 command_register((command_t) {
218 self, 's', "self",
219 "create a self signed certificate",
220 {"[--in file] [--type rsa|ecdsa]",
221 " --dn distinguished-name [--san subjectAltName]+",
222 "[--lifetime days] [--serial hex] [--ca]",
223 "[--digest md5|sha1|sha224|sha256|sha384|sha512]",
224 "[--options file]"},
225 {
226 {"help", 'h', 0, "show usage information"},
227 {"in", 'i', 1, "private key input file, default: stdin"},
228 {"type", 't', 1, "type of input key, default: rsa"},
229 {"dn", 'd', 1, "subject and issuer distinguished name"},
230 {"san", 'a', 1, "subjectAltName to include in certificate"},
231 {"lifetime",'l', 1, "days the certificate is valid, default: 1080"},
232 {"serial", 's', 1, "serial number in hex, default: random"},
233 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
234 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
235 {"options", '+', 1, "read command line options from file"},
236 }
237 });
238 }