pki tool supports subjectAltNames in certificates

diff --git a/src/pki/pki.c b/src/pki/pki.c
index f99b8ecdf564bb09a08e6380f9e758ad2cd31880..4223deec8d48e6b714801acb60e060cbb2f50757 100644 (file)
--- a/src/pki/pki.c
+++ b/src/pki/pki.c
@@ -26,6 +26,7 @@
 #include <time.h>
 
 #include <library.h>
+#include <utils/linked_list.h>
 #include <credentials/keys/private_key.h>
 #include <credentials/certificates/certificate.h>
 #include <credentials/certificates/x509.h>
@@ -57,20 +58,23 @@ static int usage(char *error)
        fprintf(out, "      calculate key identifiers of a key/certificate\n");
        fprintf(out, "        --in       input file, default: stdin\n");
        fprintf(out, "        --type     type of key, default: rsa-priv\n");
-       fprintf(out, "  pki --self [--in file] [--type rsa|ecdsa] --dn distinguished-name\n");
-       fprintf(out, "             [--lifetime days] [--serial hex]\n");
+       fprintf(out, "  pki --self [--in file] [--type rsa|ecdsa]\n");
+       fprintf(out, "             --dn distinguished-name [--san subjectAltName]+\n");
+       fprintf(out, "             [--lifetime days] [--serial hex] [--ca]\n");
        fprintf(out, "             [--digest md5|sha1|sha224|sha256|sha384|sha512\n");
        fprintf(out, "      create a self signed certificate\n");
        fprintf(out, "        --in       private key input file, default: stdin\n");
        fprintf(out, "        --type     type of input key, default: rsa\n");
        fprintf(out, "        --dn       subject and issuer distinguished name\n");
+       fprintf(out, "        --san      subjectAltName to include in certificate\n");
        fprintf(out, "        --lifetime days the certificate is valid, default: 1080\n");
        fprintf(out, "        --serial   serial number in hex, default: random\n");
-       fprintf(out, "        --digest   digest for signature creation, default: sha1\n");
        fprintf(out, "        --ca       include CA basicConstraint, default: no\n");
+       fprintf(out, "        --digest   digest for signature creation, default: sha1\n");
        fprintf(out, "  pki --issue [--in file] [--type pub|pkcs10]\n");
-       fprintf(out, "              --cacert file --cakey file --dn subject-dn\n");
-       fprintf(out, "              [--lifetime days] [--serial hex]\n");
+       fprintf(out, "              --cacert file --cakey file\n");
+       fprintf(out, "              --dn subject-dn [--san subjectAltName]+\n");
+       fprintf(out, "              [--lifetime days] [--serial hex] [--ca]\n");
        fprintf(out, "              [--digest md5|sha1|sha224|sha256|sha384|sha512\n");
        fprintf(out, "      issue a certificate using a CA certificate and key\n");
        fprintf(out, "        --in       public key/request file to issue, default: stdin\n");
@@ -78,10 +82,11 @@ static int usage(char *error)
        fprintf(out, "        --cacert   CA certificate file\n");
        fprintf(out, "        --cakey    CA private key file\n");
        fprintf(out, "        --dn       distinguished name to include as subject\n");
+       fprintf(out, "        --san      subjectAltName to include in certificate\n");
        fprintf(out, "        --lifetime days the certificate is valid, default: 1080\n");
        fprintf(out, "        --serial   serial number in hex, default: random\n");
-       fprintf(out, "        --digest   digest for signature creation, default: sha1\n");
        fprintf(out, "        --ca       include CA basicConstraint, default: no\n");
+       fprintf(out, "        --digest   digest for signature creation, default: sha1\n");
        fprintf(out, "  pki --verify [--in file] [--ca file]\n");
        fprintf(out, "      verify a certificate using the CA certificate\n");
        fprintf(out, "        --in       x509 certifcate to verify, default: stdin\n");
@@ -493,6 +498,7 @@ static int self(int argc, char *argv[])
        public_key_t *public;
        char *file = NULL, *dn = NULL, *hex = NULL;
        identification_t *id;
+       linked_list_t *san;
        int lifetime = 1080;
        chunk_t serial, encoding;
        time_t not_before, not_after;
@@ -502,6 +508,7 @@ static int self(int argc, char *argv[])
                { "type", required_argument, NULL, 't' },
                { "in", required_argument, NULL, 'i' },
                { "dn", required_argument, NULL, 'd' },
+               { "san", required_argument, NULL, 'a' },
                { "lifetime", required_argument, NULL, 'l' },
                { "serial", required_argument, NULL, 's' },
                { "digest", required_argument, NULL, 'h' },
@@ -509,6 +516,8 @@ static int self(int argc, char *argv[])
                { 0,0,0,0 }
        };
 
+       san = linked_list_create();
+
        while (TRUE)
        {
                switch (getopt_long(argc, argv, "", long_opts, NULL))
@@ -524,6 +533,7 @@ static int self(int argc, char *argv[])
                                }
                                else
                                {
+                                       san->destroy_offset(san, offsetof(identification_t, destroy));
                                        return usage("invalid input type");
                                }
                                continue;
@@ -531,6 +541,7 @@ static int self(int argc, char *argv[])
                                digest = get_digest(optarg);
                                if (digest == HASH_UNKNOWN)
                                {
+                                       san->destroy_offset(san, offsetof(identification_t, destroy));
                                        return usage("invalid --digest type");
                                }
                                continue;
@@ -540,6 +551,9 @@ static int self(int argc, char *argv[])
                        case 'd':
                                dn = optarg;
                                continue;
+                       case 'a':
+                               san->insert_last(san, identification_create_from_string(optarg));
+                               continue;
                        case 'l':
                                lifetime = atoi(optarg);
                                if (!lifetime)
@@ -556,6 +570,7 @@ static int self(int argc, char *argv[])
                        case EOF:
                                break;
                        default:
+                               san->destroy_offset(san, offsetof(identification_t, destroy));
                                return usage("invalid --self option");
                }
                break;
@@ -563,12 +578,14 @@ static int self(int argc, char *argv[])
 
        if (!dn)
        {
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                return usage("--dn is required");
        }
        id = identification_create_from_string(dn);
        if (id->get_type(id) != ID_DER_ASN1_DN)
        {
                id->destroy(id);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "supplied --dn is not a distinguished name\n");
                return 1;
        }
@@ -585,6 +602,7 @@ static int self(int argc, char *argv[])
        if (!private)
        {
                id->destroy(id);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "parsing private key failed\n");
                return 1;
        }
@@ -593,6 +611,7 @@ static int self(int argc, char *argv[])
        {
                private->destroy(private);
                id->destroy(id);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "extracting public key failed\n");
                return 1;
        }
@@ -608,6 +627,7 @@ static int self(int argc, char *argv[])
                        id->destroy(id);
                        private->destroy(private);
                        public->destroy(public);
+                       san->destroy_offset(san, offsetof(identification_t, destroy));
                        fprintf(stderr, "no random number generator found\n");
                        return 1;
                }
@@ -621,10 +641,11 @@ static int self(int argc, char *argv[])
                                                BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
                                                BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
                                                BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
-                                               BUILD_END);
+                                               BUILD_SUBJECT_ALTNAMES, san, BUILD_END);
        private->destroy(private);
        public->destroy(public);
        id->destroy(id);
+       san->destroy_offset(san, offsetof(identification_t, destroy));
        free(serial.ptr);
        if (!cert)
        {
@@ -660,6 +681,7 @@ static int issue(int argc, char *argv[])
        public_key_t *public;
        char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
        identification_t *id;
+       linked_list_t *san;
        int lifetime = 1080;
        chunk_t serial, encoding;
        time_t not_before, not_after;
@@ -672,6 +694,7 @@ static int issue(int argc, char *argv[])
                { "cacert", required_argument, NULL, 'c' },
                { "cakey", required_argument, NULL, 'k' },
                { "dn", required_argument, NULL, 'd' },
+               { "san", required_argument, NULL, 'a' },
                { "lifetime", required_argument, NULL, 'l' },
                { "serial", required_argument, NULL, 's' },
                { "digest", required_argument, NULL, 'h' },
@@ -679,6 +702,8 @@ static int issue(int argc, char *argv[])
                { 0,0,0,0 }
        };
 
+       san = linked_list_create();
+
        while (TRUE)
        {
                switch (getopt_long(argc, argv, "", long_opts, NULL))
@@ -686,6 +711,7 @@ static int issue(int argc, char *argv[])
                        case 't':
                                if (!streq(optarg, "pub"))
                                {
+                                       san->destroy_offset(san, offsetof(identification_t, destroy));
                                        return usage("invalid input type");
                                }
                                continue;
@@ -693,6 +719,7 @@ static int issue(int argc, char *argv[])
                                digest = get_digest(optarg);
                                if (digest == HASH_UNKNOWN)
                                {
+                                       san->destroy_offset(san, offsetof(identification_t, destroy));
                                        return usage("invalid --digest type");
                                }
                                continue;
@@ -708,10 +735,14 @@ static int issue(int argc, char *argv[])
                        case 'd':
                                dn = optarg;
                                continue;
+                       case 'a':
+                               san->insert_last(san, identification_create_from_string(optarg));
+                               continue;
                        case 'l':
                                lifetime = atoi(optarg);
                                if (!lifetime)
                                {
+                                       san->destroy_offset(san, offsetof(identification_t, destroy));
                                        return usage("invalid --lifetime value");
                                }
                                continue;
@@ -724,6 +755,7 @@ static int issue(int argc, char *argv[])
                        case EOF:
                                break;
                        default:
+                               san->destroy_offset(san, offsetof(identification_t, destroy));
                                return usage("invalid --issue option");
                }
                break;
@@ -731,20 +763,24 @@ static int issue(int argc, char *argv[])
 
        if (!dn)
        {
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                return usage("--dn is required");
        }
        if (!cacert)
        {
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                return usage("--cacert is required");
        }
        if (!cakey)
        {
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                return usage("--cakey is required");
        }
        id = identification_create_from_string(dn);
        if (id->get_type(id) != ID_DER_ASN1_DN)
        {
                id->destroy(id);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "supplied --dn is not a distinguished name\n");
                return 1;
        }
@@ -753,6 +789,7 @@ static int issue(int argc, char *argv[])
        if (!ca)
        {
                id->destroy(id);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "parsing CA certificate failed\n");
                return 1;
        }
@@ -761,6 +798,7 @@ static int issue(int argc, char *argv[])
        {
                id->destroy(id);
                ca->destroy(ca);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "CA certificate misses CA basicConstraint\n");
                return 1;
        }
@@ -770,6 +808,7 @@ static int issue(int argc, char *argv[])
        {
                id->destroy(id);
                ca->destroy(ca);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "extracting CA certificate public key failed\n");
                return 1;
        }
@@ -781,6 +820,7 @@ static int issue(int argc, char *argv[])
                id->destroy(id);
                ca->destroy(ca);
                public->destroy(public);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "parsing CA private key failed\n");
                return 1;
        }
@@ -790,6 +830,7 @@ static int issue(int argc, char *argv[])
                ca->destroy(ca);
                public->destroy(public);
                private->destroy(private);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "CA private key does not match CA certificate\n");
                return 1;
        }
@@ -809,6 +850,7 @@ static int issue(int argc, char *argv[])
                id->destroy(id);
                ca->destroy(ca);
                private->destroy(private);
+               san->destroy_offset(san, offsetof(identification_t, destroy));
                fprintf(stderr, "parsing public key failed\n");
                return 1;
        }
@@ -826,6 +868,7 @@ static int issue(int argc, char *argv[])
                        ca->destroy(ca);
                        private->destroy(private);
                        public->destroy(public);
+                       san->destroy_offset(san, offsetof(identification_t, destroy));
                        fprintf(stderr, "no random number generator found\n");
                        return 1;
                }
@@ -839,11 +882,13 @@ static int issue(int argc, char *argv[])
                                        BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
                                        BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
                                        BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
-                                       BUILD_X509_FLAG, flags, BUILD_END);
+                                       BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
+                                       BUILD_END);
        private->destroy(private);
        public->destroy(public);
        ca->destroy(ca);
        id->destroy(id);
+       san->destroy_offset(san, offsetof(identification_t, destroy));
        free(serial.ptr);
        if (!cert)
        {