extended hasher_signature_algorithm_to_oid() function
[strongswan.git] / src / scepclient / pkcs10.c
1 /**
2 * @file pkcs10.c
3 * @brief Functions to build PKCS#10 requests
4 *
5 * Contains functions to build DER encoded pkcs#10 certificate requests
6 */
7
8 /* Copyright (C) 2005 Jan Hutter, Martin Willi
9 * Hochschule fuer Technik Rapperswil
10 *
11 * This program is free software; you can redistribute it and/or modify it
12 * under the terms of the GNU General Public License as published by the
13 * Free Software Foundation; either version 2 of the License, or (at your
14 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
15 *
16 * This program is distributed in the hope that it will be useful, but
17 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
18 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
19 * for more details.
20 */
21
22 #include <stdlib.h>
23 #include <string.h>
24 #include <sys/socket.h>
25 #include <netinet/in.h>
26 #include <arpa/inet.h>
27
28 #include <freeswan.h>
29 #include <asn1/asn1.h>
30 #include <asn1/oid.h>
31
32 #include "../pluto/constants.h"
33 #include "../pluto/defs.h"
34 #include "../pluto/log.h"
35 #include "../pluto/x509.h"
36
37 #include "pkcs10.h"
38
39 /* some pre-coded OIDs */
40 static chunk_t ASN1_challengePassword_oid = chunk_from_chars(
41 0x06,0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x07
42 );
43 static const chunk_t ASN1_extensionRequest_oid = chunk_from_chars(
44 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x0E
45 );
46
47 /**
48 * @brief Adds a subjectAltName in DER-coded form to a linked list
49 *
50 * @param[in,out] subjectAltNames head of the linked list of subjectAltNames
51 * @param[in] kind type of the subjectAltName (which is a generalName)
52 * @param[in] value value of the subjectAltName as an ASCII string
53 */
54 void
55 pkcs10_add_subjectAltName(generalName_t **subjectAltNames, generalNames_t kind
56 , char *value)
57 {
58 generalName_t *gn;
59 asn1_t asn1_type = ASN1_EOC;
60 chunk_t name = { value, strlen(value) };
61
62 switch (kind)
63 {
64 case GN_RFC822_NAME:
65 asn1_type = ASN1_CONTEXT_S_1;
66 break;
67 case GN_DNS_NAME:
68 asn1_type = ASN1_CONTEXT_S_2;
69 break;
70 case GN_IP_ADDRESS:
71 {
72 struct in_addr addr;
73
74 /* convert an ASCII dotted IPv4 address (e.g. 123.456.78.90)
75 * to a byte representation in network order
76 */
77 if (!inet_aton(value, &addr))
78 {
79 fprintf(stderr, "error in IPv4 subjectAltName\n");
80 return;
81 }
82 asn1_type = ASN1_CONTEXT_S_7;
83 name.ptr = (u_char *) &addr.s_addr;
84 name.len = sizeof(addr.s_addr);
85 break;
86 }
87 default:
88 break;
89 }
90
91 gn = malloc_thing(generalName_t);
92 gn->kind = kind;
93 gn->name = asn1_simple_object(asn1_type, name);
94 gn->next = *subjectAltNames;
95 *subjectAltNames = gn;
96 }
97
98 /**
99 * @brief Builds the requestInfoAttributes of the certificationRequestInfo-field
100 *
101 * challenge password ans subjectAltNames are only included,
102 * when avaiable in given #pkcs10_t structure
103 *
104 * @param[in] pkcs10 Pointer to a #pkcs10_t structure
105 * @return 1 if succeeded, 0 otherwise
106 */
107 static chunk_t
108 build_req_info_attributes(pkcs10_t* pkcs10)
109 {
110
111 chunk_t subjectAltNames = chunk_empty;
112 chunk_t challengePassword = chunk_empty;
113
114 if (pkcs10->subjectAltNames != NULL)
115 {
116
117 subjectAltNames = asn1_wrap(ASN1_SEQUENCE, "cm"
118 , ASN1_extensionRequest_oid
119 , asn1_wrap(ASN1_SET, "m"
120 , asn1_wrap(ASN1_SEQUENCE, "m"
121 , build_subjectAltNames(pkcs10->subjectAltNames)
122 )
123 )
124 );
125 }
126
127 if (pkcs10->challengePassword.len > 0)
128 {
129 asn1_t type = asn1_is_printablestring(pkcs10->challengePassword)
130 ? ASN1_PRINTABLESTRING : ASN1_T61STRING;
131
132 challengePassword = asn1_wrap(ASN1_SEQUENCE, "cm"
133 , ASN1_challengePassword_oid
134 , asn1_wrap(ASN1_SET, "m"
135 , asn1_simple_object(type, pkcs10->challengePassword)
136 )
137 );
138 }
139
140 return asn1_wrap(ASN1_CONTEXT_C_0, "mm"
141 , subjectAltNames
142 , challengePassword);
143 }
144
145 /**
146 * @brief Builds a DER-code pkcs#10 certificate request
147 *
148 * @param[in] pkcs10 pointer to a pkcs10_t struct
149 * @return DER-code pkcs10 request
150 */
151 static chunk_t
152 pkcs10_build_request(pkcs10_t *pkcs10, int signature_alg)
153 {
154 chunk_t key = chunk_empty;
155
156 pkcs10->public_key->get_encoding(pkcs10->public_key, KEY_PUB_ASN1_DER, &key);
157
158 chunk_t keyInfo = asn1_wrap(ASN1_SEQUENCE, "mm",
159 asn1_algorithmIdentifier(OID_RSA_ENCRYPTION),
160 asn1_bitstring("m", key));
161
162 chunk_t cert_req_info = asn1_wrap(ASN1_SEQUENCE, "ccmm",
163 ASN1_INTEGER_0,
164 pkcs10->subject,
165 keyInfo,
166 build_req_info_attributes(pkcs10));
167
168 chunk_t signature = x509_build_signature(cert_req_info, signature_alg,
169 pkcs10->private_key, TRUE);
170
171 return asn1_wrap(ASN1_SEQUENCE, "mmm",
172 cert_req_info,
173 asn1_algorithmIdentifier(signature_alg),
174 signature);
175 }
176
177 /**
178 * @brief Creates a pkcs#10 certificate request object
179 *
180 * To create a certificate request, the RSA key and the
181 * names to be included as subject in the certificate request
182 * (e.g. commonName, organization) are needed. An optional challenge
183 * password or some subjectAltNames may be included.
184 *
185 * @param[in] key rsakey of type #rsakey_t
186 * @param[in] subject DER-coded subject distinguished name
187 * @param[in] challengePassword challenge password or chunk_empty
188 * @param[in] subjectAltNames linked list of subjectAltNames or NULL
189 * @return pointer to a #pkcs10_t object
190 */
191 pkcs10_t* pkcs10_build(private_key_t *private, public_key_t *public,
192 chunk_t subject, chunk_t challengePassword,
193 generalName_t *subjectAltNames, int signature_alg)
194 {
195 pkcs10_t *pkcs10 = malloc_thing(pkcs10_t);
196
197 pkcs10->subject = subject;
198 pkcs10->private_key = private;
199 pkcs10->public_key = public;
200 pkcs10->challengePassword = challengePassword;
201 pkcs10->subjectAltNames = subjectAltNames;
202
203 pkcs10->request = pkcs10_build_request(pkcs10, signature_alg);
204 return pkcs10;
205 }
206
207 /**
208 * @brief Frees the resources used by an #pkcs10_t object
209 *
210 * @param[in] pkcs10 #pkcs10_t to free
211 */
212 void
213 pkcs10_free(pkcs10_t *pkcs10)
214 {
215 if (pkcs10 != NULL)
216 {
217 free(pkcs10->request.ptr);
218 free(pkcs10);
219 }
220 }