diff --git a/src/pki/pki.c b/src/pki/pki.c index f99b8ecdf..4223deec8 100644 --- a/src/pki/pki.c +++ b/src/pki/pki.c @@ -26,6 +26,7 @@ #include #include +#include #include #include #include @@ -57,20 +58,23 @@ static int usage(char *error) fprintf(out, " calculate key identifiers of a key/certificate\n"); fprintf(out, " --in input file, default: stdin\n"); fprintf(out, " --type type of key, default: rsa-priv\n"); - fprintf(out, " pki --self [--in file] [--type rsa|ecdsa] --dn distinguished-name\n"); - fprintf(out, " [--lifetime days] [--serial hex]\n"); + fprintf(out, " pki --self [--in file] [--type rsa|ecdsa]\n"); + fprintf(out, " --dn distinguished-name [--san subjectAltName]+\n"); + fprintf(out, " [--lifetime days] [--serial hex] [--ca]\n"); fprintf(out, " [--digest md5|sha1|sha224|sha256|sha384|sha512\n"); fprintf(out, " create a self signed certificate\n"); fprintf(out, " --in private key input file, default: stdin\n"); fprintf(out, " --type type of input key, default: rsa\n"); fprintf(out, " --dn subject and issuer distinguished name\n"); + fprintf(out, " --san subjectAltName to include in certificate\n"); fprintf(out, " --lifetime days the certificate is valid, default: 1080\n"); fprintf(out, " --serial serial number in hex, default: random\n"); - fprintf(out, " --digest digest for signature creation, default: sha1\n"); fprintf(out, " --ca include CA basicConstraint, default: no\n"); + fprintf(out, " --digest digest for signature creation, default: sha1\n"); fprintf(out, " pki --issue [--in file] [--type pub|pkcs10]\n"); - fprintf(out, " --cacert file --cakey file --dn subject-dn\n"); - fprintf(out, " [--lifetime days] [--serial hex]\n"); + fprintf(out, " --cacert file --cakey file\n"); + fprintf(out, " --dn subject-dn [--san subjectAltName]+\n"); + fprintf(out, " [--lifetime days] [--serial hex] [--ca]\n"); fprintf(out, " [--digest md5|sha1|sha224|sha256|sha384|sha512\n"); fprintf(out, " issue a certificate using a CA certificate and key\n"); fprintf(out, " --in public key/request file to issue, default: stdin\n"); @@ -78,10 +82,11 @@ static int usage(char *error) fprintf(out, " --cacert CA certificate file\n"); fprintf(out, " --cakey CA private key file\n"); fprintf(out, " --dn distinguished name to include as subject\n"); + fprintf(out, " --san subjectAltName to include in certificate\n"); fprintf(out, " --lifetime days the certificate is valid, default: 1080\n"); fprintf(out, " --serial serial number in hex, default: random\n"); - fprintf(out, " --digest digest for signature creation, default: sha1\n"); fprintf(out, " --ca include CA basicConstraint, default: no\n"); + fprintf(out, " --digest digest for signature creation, default: sha1\n"); fprintf(out, " pki --verify [--in file] [--ca file]\n"); fprintf(out, " verify a certificate using the CA certificate\n"); fprintf(out, " --in x509 certifcate to verify, default: stdin\n"); @@ -493,6 +498,7 @@ static int self(int argc, char *argv[]) public_key_t *public; char *file = NULL, *dn = NULL, *hex = NULL; identification_t *id; + linked_list_t *san; int lifetime = 1080; chunk_t serial, encoding; time_t not_before, not_after; @@ -502,6 +508,7 @@ static int self(int argc, char *argv[]) { "type", required_argument, NULL, 't' }, { "in", required_argument, NULL, 'i' }, { "dn", required_argument, NULL, 'd' }, + { "san", required_argument, NULL, 'a' }, { "lifetime", required_argument, NULL, 'l' }, { "serial", required_argument, NULL, 's' }, { "digest", required_argument, NULL, 'h' }, @@ -509,6 +516,8 @@ static int self(int argc, char *argv[]) { 0,0,0,0 } }; + san = linked_list_create(); + while (TRUE) { switch (getopt_long(argc, argv, "", long_opts, NULL)) @@ -524,6 +533,7 @@ static int self(int argc, char *argv[]) } else { + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("invalid input type"); } continue; @@ -531,6 +541,7 @@ static int self(int argc, char *argv[]) digest = get_digest(optarg); if (digest == HASH_UNKNOWN) { + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("invalid --digest type"); } continue; @@ -540,6 +551,9 @@ static int self(int argc, char *argv[]) case 'd': dn = optarg; continue; + case 'a': + san->insert_last(san, identification_create_from_string(optarg)); + continue; case 'l': lifetime = atoi(optarg); if (!lifetime) @@ -556,6 +570,7 @@ static int self(int argc, char *argv[]) case EOF: break; default: + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("invalid --self option"); } break; @@ -563,12 +578,14 @@ static int self(int argc, char *argv[]) if (!dn) { + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("--dn is required"); } id = identification_create_from_string(dn); if (id->get_type(id) != ID_DER_ASN1_DN) { id->destroy(id); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "supplied --dn is not a distinguished name\n"); return 1; } @@ -585,6 +602,7 @@ static int self(int argc, char *argv[]) if (!private) { id->destroy(id); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "parsing private key failed\n"); return 1; } @@ -593,6 +611,7 @@ static int self(int argc, char *argv[]) { private->destroy(private); id->destroy(id); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "extracting public key failed\n"); return 1; } @@ -608,6 +627,7 @@ static int self(int argc, char *argv[]) id->destroy(id); private->destroy(private); public->destroy(public); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "no random number generator found\n"); return 1; } @@ -621,10 +641,11 @@ static int self(int argc, char *argv[]) BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before, BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial, BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags, - BUILD_END); + BUILD_SUBJECT_ALTNAMES, san, BUILD_END); private->destroy(private); public->destroy(public); id->destroy(id); + san->destroy_offset(san, offsetof(identification_t, destroy)); free(serial.ptr); if (!cert) { @@ -660,6 +681,7 @@ static int issue(int argc, char *argv[]) public_key_t *public; char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL; identification_t *id; + linked_list_t *san; int lifetime = 1080; chunk_t serial, encoding; time_t not_before, not_after; @@ -672,6 +694,7 @@ static int issue(int argc, char *argv[]) { "cacert", required_argument, NULL, 'c' }, { "cakey", required_argument, NULL, 'k' }, { "dn", required_argument, NULL, 'd' }, + { "san", required_argument, NULL, 'a' }, { "lifetime", required_argument, NULL, 'l' }, { "serial", required_argument, NULL, 's' }, { "digest", required_argument, NULL, 'h' }, @@ -679,6 +702,8 @@ static int issue(int argc, char *argv[]) { 0,0,0,0 } }; + san = linked_list_create(); + while (TRUE) { switch (getopt_long(argc, argv, "", long_opts, NULL)) @@ -686,6 +711,7 @@ static int issue(int argc, char *argv[]) case 't': if (!streq(optarg, "pub")) { + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("invalid input type"); } continue; @@ -693,6 +719,7 @@ static int issue(int argc, char *argv[]) digest = get_digest(optarg); if (digest == HASH_UNKNOWN) { + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("invalid --digest type"); } continue; @@ -708,10 +735,14 @@ static int issue(int argc, char *argv[]) case 'd': dn = optarg; continue; + case 'a': + san->insert_last(san, identification_create_from_string(optarg)); + continue; case 'l': lifetime = atoi(optarg); if (!lifetime) { + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("invalid --lifetime value"); } continue; @@ -724,6 +755,7 @@ static int issue(int argc, char *argv[]) case EOF: break; default: + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("invalid --issue option"); } break; @@ -731,20 +763,24 @@ static int issue(int argc, char *argv[]) if (!dn) { + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("--dn is required"); } if (!cacert) { + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("--cacert is required"); } if (!cakey) { + san->destroy_offset(san, offsetof(identification_t, destroy)); return usage("--cakey is required"); } id = identification_create_from_string(dn); if (id->get_type(id) != ID_DER_ASN1_DN) { id->destroy(id); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "supplied --dn is not a distinguished name\n"); return 1; } @@ -753,6 +789,7 @@ static int issue(int argc, char *argv[]) if (!ca) { id->destroy(id); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "parsing CA certificate failed\n"); return 1; } @@ -761,6 +798,7 @@ static int issue(int argc, char *argv[]) { id->destroy(id); ca->destroy(ca); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "CA certificate misses CA basicConstraint\n"); return 1; } @@ -770,6 +808,7 @@ static int issue(int argc, char *argv[]) { id->destroy(id); ca->destroy(ca); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "extracting CA certificate public key failed\n"); return 1; } @@ -781,6 +820,7 @@ static int issue(int argc, char *argv[]) id->destroy(id); ca->destroy(ca); public->destroy(public); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "parsing CA private key failed\n"); return 1; } @@ -790,6 +830,7 @@ static int issue(int argc, char *argv[]) ca->destroy(ca); public->destroy(public); private->destroy(private); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "CA private key does not match CA certificate\n"); return 1; } @@ -809,6 +850,7 @@ static int issue(int argc, char *argv[]) id->destroy(id); ca->destroy(ca); private->destroy(private); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "parsing public key failed\n"); return 1; } @@ -826,6 +868,7 @@ static int issue(int argc, char *argv[]) ca->destroy(ca); private->destroy(private); public->destroy(public); + san->destroy_offset(san, offsetof(identification_t, destroy)); fprintf(stderr, "no random number generator found\n"); return 1; } @@ -839,11 +882,13 @@ static int issue(int argc, char *argv[]) BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest, BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial, - BUILD_X509_FLAG, flags, BUILD_END); + BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags, + BUILD_END); private->destroy(private); public->destroy(public); ca->destroy(ca); id->destroy(id); + san->destroy_offset(san, offsetof(identification_t, destroy)); free(serial.ptr); if (!cert) {