src/pki/commands/acert.c

   1 /*
   2  * Copyright (C) 2009 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <time.h>
  17 #include <errno.h>
  18
  19 #include "pki.h"
  20
  21 #include <utils/debug.h>
  22 #include <asn1/asn1.h>
  23 #include <collections/linked_list.h>
  24 #include <credentials/certificates/certificate.h>
  25 #include <credentials/certificates/x509.h>
  26 #include <credentials/certificates/ac.h>
  27
  28 /**
  29  * Issue an attribute certificate
  30  */
  31 static int acert()
  32 {
  33         cred_encoding_type_t form = CERT_ASN1_DER;
  34         hash_algorithm_t digest = HASH_SHA1;
  35         certificate_t *ac = NULL, *cert = NULL, *issuer =NULL;
  36         private_key_t *private = NULL;
  37         public_key_t *public = NULL;
  38         char *file = NULL, *hex = NULL, *issuercert = NULL, *issuerkey = NULL;
  39         char *error = NULL, *keyid = NULL;
  40         linked_list_t *groups;
  41         chunk_t serial = chunk_empty, encoding = chunk_empty;
  42         time_t not_before, not_after, lifetime = 24 * 60 * 60;
  43         char *datenb = NULL, *datena = NULL, *dateform = NULL;
  44         rng_t *rng;
  45         char *arg;
  46
  47         groups = linked_list_create();
  48
  49         while (TRUE)
  50         {
  51                 switch (command_getopt(&arg))
  52                 {
  53                         case 'h':
  54                                 goto usage;
  55                         case 'g':
  56                                 if (!enum_from_name(hash_algorithm_short_names, arg, &digest))
  57                                 {
  58                                         error = "invalid --digest type";
  59                                         goto usage;
  60                                 }
  61                                 continue;
  62                         case 'i':
  63                                 file = arg;
  64                                 continue;
  65                         case 'm':
  66                                 groups->insert_last(groups, arg);
  67                                 continue;
  68                         case 'c':
  69                                 issuercert = arg;
  70                                 continue;
  71                         case 'k':
  72                                 issuerkey = arg;
  73                                 continue;
  74                         case 'x':
  75                                 keyid = arg;
  76                                 continue;
  77                         case 'l':
  78                                 lifetime = atoi(arg) * 60 * 60;
  79                                 if (!lifetime)
  80                                 {
  81                                         error = "invalid --lifetime value";
  82                                         goto usage;
  83                                 }
  84                                 continue;
  85                         case 'D':
  86                                 dateform = arg;
  87                                 continue;
  88                         case 'F':
  89                                 datenb = arg;
  90                                 continue;
  91                         case 'T':
  92                                 datena = arg;
  93                                 continue;
  94                         case 's':
  95                                 hex = arg;
  96                                 continue;
  97                         case 'f':
  98                                 if (!get_form(arg, &form, CRED_CERTIFICATE))
  99                                 {
 100                                         error = "invalid output format";
 101                                         goto usage;
 102                                 }
 103                                 continue;
 104                         case EOF:
 105                                 break;
 106                         default:
 107                                 error = "invalid --acert option";
 108                                 goto usage;
 109                 }
 110                 break;
 111         }
 112
 113         if (!calculate_lifetime(dateform, datenb, datena, lifetime,
 114                                                         &not_before, &not_after))
 115         {
 116                 error = "invalid --not-before/after datetime";
 117                 goto usage;
 118         }
 119
 120         if (!issuercert)
 121         {
 122                 error = "--issuercert is required";
 123                 goto usage;
 124         }
 125         if (!issuerkey && !keyid)
 126         {
 127                 error = "--issuerkey or --issuerkeyid is required";
 128                 goto usage;
 129         }
 130
 131         issuer = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 132                                                                 BUILD_FROM_FILE, issuercert, BUILD_END);
 133         if (!issuer)
 134         {
 135                 error = "parsing issuer certificate failed";
 136                 goto end;
 137         }
 138         public = issuer->get_public_key(issuer);
 139         if (!public)
 140         {
 141                 error = "extracting issuer certificate public key failed";
 142                 goto end;
 143         }
 144         if (issuerkey)
 145         {
 146                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 147                                                                          public->get_type(public),
 148                                                                          BUILD_FROM_FILE, issuerkey, BUILD_END);
 149         }
 150         else
 151         {
 152                 chunk_t chunk;
 153
 154                 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
 155                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
 156                                                                          BUILD_PKCS11_KEYID, chunk, BUILD_END);
 157                 free(chunk.ptr);
 158         }
 159         if (!private)
 160         {
 161                 error = "loading issuer private key failed";
 162                 goto end;
 163         }
 164         if (!private->belongs_to(private, public))
 165         {
 166                 error = "issuer private key does not match issuer certificate";
 167                 goto end;
 168         }
 169
 170         if (hex)
 171         {
 172                 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
 173         }
 174         else
 175         {
 176                 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 177                 if (!rng)
 178                 {
 179                         error = "no random number generator found";
 180                         goto end;
 181                 }
 182                 if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
 183                 {
 184                         error = "failed to generate serial number";
 185                         rng->destroy(rng);
 186                         goto end;
 187                 }
 188                 serial.ptr[0] &= 0x7F;
 189                 rng->destroy(rng);
 190         }
 191
 192         if (file)
 193         {
 194                 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 195                                                                   BUILD_FROM_FILE, file, BUILD_END);
 196         }
 197         else
 198         {
 199                 set_file_mode(stdin, CERT_ASN1_DER);
 200                 if (!chunk_from_fd(0, &encoding))
 201                 {
 202                         fprintf(stderr, "%s: ", strerror(errno));
 203                         error = "reading public key failed";
 204                         goto end;
 205                 }
 206                 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 207                                                                   BUILD_BLOB, encoding, BUILD_END);
 208                 chunk_free(&encoding);
 209         }
 210         if (!cert)
 211         {
 212                 error = "parsing user certificate failed";
 213                 goto end;
 214         }
 215
 216         ac = lib->creds->create(lib->creds,
 217                                                         CRED_CERTIFICATE, CERT_X509_AC,
 218                                                         BUILD_CERT, cert,
 219                                                         BUILD_NOT_BEFORE_TIME, not_before,
 220                                                         BUILD_NOT_AFTER_TIME, not_after,
 221                                                         BUILD_SERIAL, serial,
 222                                                         BUILD_AC_GROUP_STRINGS, groups,
 223                                                         BUILD_SIGNING_CERT, issuer,
 224                                                         BUILD_SIGNING_KEY, private,
 225                                                         BUILD_END);
 226         if (!ac)
 227         {
 228                 error = "generating attribute certificate failed";
 229                 goto end;
 230         }
 231         if (!ac->get_encoding(ac, form, &encoding))
 232         {
 233                 error = "encoding attribute certificate failed";
 234                 goto end;
 235         }
 236         set_file_mode(stdout, form);
 237         if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
 238         {
 239                 error = "writing attribute certificate key failed";
 240                 goto end;
 241         }
 242
 243 end:
 244         DESTROY_IF(ac);
 245         DESTROY_IF(cert);
 246         DESTROY_IF(issuer);
 247         DESTROY_IF(public);
 248         DESTROY_IF(private);
 249         groups->destroy(groups);
 250         free(encoding.ptr);
 251         free(serial.ptr);
 252
 253         if (error)
 254         {
 255                 fprintf(stderr, "%s\n", error);
 256                 return 1;
 257         }
 258         return 0;
 259
 260 usage:
 261         groups->destroy(groups);
 262         return command_usage(error);
 263 }
 264
 265 /**
 266  * Register the command.
 267  */
 268 static void __attribute__ ((constructor))reg()
 269 {
 270         command_register((command_t) {
 271                 acert, 'z', "acert",
 272                 "issue an attribute certificate",
 273                 {"[--in file] [--group name]* --issuerkey file|--issuerkeyid hex",
 274                  " --issuercert file [--serial hex] [--lifetime hours]",
 275                  " [--not-before datetime] [--not-after datetime] [--dateform form]",
 276                  "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
 277                 {
 278                         {"help",                        'h', 0, "show usage information"},
 279                         {"in",                          'i', 1, "holder certificate, default: stdin"},
 280                         {"group",                       'm', 1, "group membership string to include"},
 281                         {"issuercert",          'c', 1, "issuer certificate file"},
 282                         {"issuerkey",           'k', 1, "issuer private key file"},
 283                         {"issuerkeyid",         'x', 1, "keyid on smartcard of issuer private key"},
 284                         {"serial",                      's', 1, "serial number in hex, default: random"},
 285                         {"lifetime",            'l', 1, "hours the acert is valid, default: 24"},
 286                         {"not-before",          'F', 1, "date/time the validity of the AC starts"},
 287                         {"not-after",           'T', 1, "date/time the validity of the AC ends"},
 288                         {"dateform",            'D', 1, "strptime(3) input format, default: %d.%m.%y %T"},
 289                         {"digest",                      'g', 1, "digest for signature creation, default: sha1"},
 290                         {"outform",                     'f', 1, "encoding of generated cert, default: der"},
 291                 }
 292         });
 293 }