basic x509 certificate generation

src/charon/plugins/unit_tester/Makefile.am

@@ -14,6 +14,7 @@ libstrongswan_unit_tester_la_SOURCES = unit_tester.c unit_tester.h tests.h \
   tests/test_sqlite.c \
   tests/test_mutex.c \
   tests/test_rsa_gen.c \
+  tests/test_cert.c \
   tests/test_med_db.c \
   tests/test_aes.c \
   tests/test_chunk.c \

src/charon/plugins/unit_tester/tests.h

@@ -33,9 +33,10 @@ DEFINE_TEST("SQLite operations", test_sqlite, FALSE)
 DEFINE_TEST("mutex primitive", test_mutex, FALSE)
 DEFINE_TEST("RSA key generation", test_rsa_gen, FALSE)
 DEFINE_TEST("RSA subjectPublicKeyInfo loading", test_rsa_load_any, FALSE)
+DEFINE_TEST("X509 certificate", test_cert_x509, TRUE)
 DEFINE_TEST("Mediation database key fetch", test_med_db, FALSE)
 DEFINE_TEST("AES-128 encryption", test_aes128, FALSE)
 DEFINE_TEST("AES-XCBC", test_aes_xcbc, FALSE)
 DEFINE_TEST("Base64 converter", test_chunk_base64, FALSE)
 DEFINE_TEST("IP pool", test_pool, FALSE)
-DEFINE_TEST("SSH agent", test_agent, TRUE)
+DEFINE_TEST("SSH agent", test_agent, FALSE)

src/charon/plugins/unit_tester/tests/test_cert.c

@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2008 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include <library.h>
+#include <daemon.h>
+#include <credentials/certificates/x509.h>
+
+/*******************************************************************************
+ * X509 certificate generation and parsing
+ ******************************************************************************/
+bool test_cert_x509()
+{
+	private_key_t *ca_key, *peer_key;
+	public_key_t *public;
+	certificate_t *ca_cert, *peer_cert, *parsed;
+	identification_t *issuer, *subject;
+	u_int32_t serial = htonl(0);
+	chunk_t encoding;
+	
+	issuer = identification_create_from_string("CN=CA, OU=Test, O=strongSwan");
+	subject = identification_create_from_string("CN=Peer, OU=Test, O=strongSwan");
+	
+	ca_key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
+						BUILD_KEY_SIZE, 1024, BUILD_END);
+	peer_key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
+						BUILD_KEY_SIZE, 1024, BUILD_END);
+	if (!ca_key)
+	{
+		return FALSE;
+	}
+	ca_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
+						BUILD_SIGNING_KEY, ca_key,
+						BUILD_SUBJECT, issuer,
+						BUILD_SERIAL, chunk_from_thing(serial),
+						BUILD_X509_FLAG, X509_CA,
+						BUILD_END);
+	if (!ca_cert)
+	{
+		return FALSE;
+	}
+	
+	encoding = ca_cert->get_encoding(ca_cert);
+	parsed = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
+						BUILD_BLOB_ASN1_DER, encoding,
+						BUILD_END);
+	chunk_free(&encoding);
+	if (!parsed)
+	{
+		return FALSE;
+	}
+	if (!parsed->issued_by(parsed, ca_cert))
+	{
+		return FALSE;
+	}
+	parsed->destroy(parsed);
+	
+	serial = htonl(ntohl(serial) + 1);
+	public = peer_key->get_public_key(peer_key);
+	peer_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
+						BUILD_SIGNING_KEY, ca_key,
+						BUILD_SIGNING_CERT, ca_cert,
+						BUILD_PUBLIC_KEY, public,
+						BUILD_SUBJECT, subject,
+						BUILD_SERIAL, chunk_from_thing(serial),
+						BUILD_END);
+	public->destroy(public);
+	if (!peer_cert)
+	{
+		return FALSE;
+	}
+	
+	encoding = peer_cert->get_encoding(peer_cert);
+	parsed = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
+						BUILD_BLOB_ASN1_DER, encoding,
+						BUILD_END);
+	chunk_free(&encoding);
+	if (!parsed)
+	{
+		return FALSE;
+	}
+	if (!parsed->issued_by(parsed, ca_cert))
+	{
+		return FALSE;
+	}
+	parsed->destroy(parsed);
+	
+	ca_cert->destroy(ca_cert);
+	ca_key->destroy(ca_key);
+	peer_cert->destroy(peer_cert);
+	peer_key->destroy(peer_key);
+	issuer->destroy(issuer);
+	subject->destroy(subject);
+	return TRUE;
+}
+
+

src/libstrongswan/plugins/x509/x509_cert.c

@@ -162,6 +162,11 @@ struct private_x509_cert_t {
 	 */
 	chunk_t signature;
 	
+	/**
+	 * Certificate parsed from blob/file?
+	 */
+	bool parsed;
+	
 	/**
 	 * reference count
 	 */
@@ -329,7 +334,7 @@ static identification_t *parse_generalName(chunk_t blob, int level0)
 				break;
 			case GN_OBJ_DIRECTORY_NAME:
 				id_type = ID_DER_ASN1_DN;
-	    		break;
+				break;
 			case GN_OBJ_IP_ADDRESS:
 				id_type = ID_IPV4_ADDR;
 				break;
@@ -350,12 +355,12 @@ static identification_t *parse_generalName(chunk_t blob, int level0)
 			gn = identification_create_from_encoding(id_type, object);
 			DBG2("  '%D'", gn);
 			goto end;
-        }
-   }
+		}
+	}
 	
 end:
 	parser->destroy(parser);
-    return gn;
+	return gn;
 }
 
 /**
@@ -895,10 +900,12 @@ static bool issued_by(private_x509_cert_t *this, certificate_t *issuer)
 	{
 		if (issuer->get_type(issuer) != CERT_X509)
 		{
+			POS;
 			return FALSE;
 		}
 		if (!(x509->get_flags(x509) & X509_CA))
 		{
+			POS;
 			return FALSE;
 		}
 	}
@@ -928,11 +935,13 @@ static bool issued_by(private_x509_cert_t *this, certificate_t *issuer)
 			scheme = SIGN_ECDSA_WITH_SHA1;
 			break;
 		default:
+			POS;
 			return FALSE;
 	}
 	key = issuer->get_public_key(issuer);
 	if (key == NULL)
 	{
+		POS;
 		return FALSE;
 	}
 	/* TODO: add a lightweight check option (comparing auth/subject keyids only) */
@@ -1102,6 +1111,12 @@ static void destroy(private_x509_cert_t *this)
 		DESTROY_IF(this->authKeyIdentifier);
 		chunk_free(&this->encoding);
 		chunk_free(&this->encoding_hash);
+		if (!this->parsed)
+		{	/* only parsed certificates point these fields to "encoded" */
+			chunk_free(&this->signature);
+			chunk_free(&this->serialNumber);
+			chunk_free(&this->tbsCertificate);
+		}
 		free(this);
 	}
 }
@@ -1135,6 +1150,11 @@ static private_x509_cert_t* create_empty(void)
 	
 	this->encoding = chunk_empty;
 	this->encoding_hash = chunk_empty;
+	this->tbsCertificate = chunk_empty;
+	this->version = 3;
+	this->serialNumber = chunk_empty;	
+	this->notBefore = 0;
+	this->notAfter = 0;
 	this->public_key = NULL;
 	this->subject = NULL;
 	this->issuer = NULL;
@@ -1144,8 +1164,11 @@ static private_x509_cert_t* create_empty(void)
 	this->subjectKeyID = chunk_empty;
 	this->authKeyIdentifier = NULL;
 	this->authKeySerialNumber = chunk_empty;
+	this->algorithm = 0;
+	this->signature = chunk_empty;
 	this->flags = 0;
 	this->ref = 1;
+	this->parsed = FALSE;
 	
 	return this;
 }
@@ -1155,6 +1178,7 @@ static private_x509_cert_t* create_empty(void)
  */
 static private_x509_cert_t *create_from_chunk(chunk_t chunk)
 {
+	hasher_t *hasher;
 	private_x509_cert_t *this = create_empty();
 	
 	this->encoding = chunk;
@@ -1170,7 +1194,7 @@ static private_x509_cert_t *create_from_chunk(chunk_t chunk)
 		this->flags |= X509_SELF_SIGNED;
 	}
 	
-	hasher_t *hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
+	hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
 	if (hasher != NULL)
 	{
 		hasher->allocate_hash(hasher, this->encoding, &this->encoding_hash);
@@ -1181,6 +1205,7 @@ static private_x509_cert_t *create_from_chunk(chunk_t chunk)
 		DBG1("  unable to create hash of certificate, SHA1 not supported");		
 	}
 	
+	this->parsed = TRUE;
 	return this;
 }
 
@@ -1207,7 +1232,6 @@ static private_x509_cert_t *create_from_file(char *path)
 	}
 	DBG1("  loaded certificate file '%s'",  path);
 	return this;
-
 }
 
 typedef struct private_builder_t private_builder_t;
@@ -1221,21 +1245,137 @@ struct private_builder_t {
 	private_x509_cert_t *cert;
 	/** additional flags to enforce */
 	x509_flag_t flags;
+	/** certificate to sign, if we generate a new cert */
+	certificate_t *sign_cert;
+	/** private key to sign, if we generate a new cert */
+	private_key_t *sign_key;
 };
 
+/**
+ * Generate and sign a new certificate
+ */
+static bool generate(private_builder_t *this)
+{
+	chunk_t extensions = chunk_empty;
+	identification_t *issuer, *subject;
+	chunk_t key_info, key;
+	signature_scheme_t scheme;
+	hasher_t *hasher;
+	
+	subject = this->cert->subject;
+	if (this->sign_cert)
+	{
+		issuer = this->sign_cert->get_subject(this->sign_cert);
+		if (!this->cert->public_key)
+		{
+			return FALSE;
+		}
+	}
+	else
+	{	/* self signed */
+		issuer = subject;
+		if (!this->cert->public_key)
+		{
+			this->cert->public_key = this->sign_key->get_public_key(this->sign_key);
+		}
+		this->flags |= X509_SELF_SIGNED;
+	}
+	this->cert->issuer = issuer->clone(issuer);
+	if (!this->cert->notBefore)
+	{
+		this->cert->notBefore = time(NULL);
+	}
+	if (!this->cert->notAfter)
+	{	/* defaults to 1 years from now on */
+		this->cert->notAfter = this->cert->notBefore + 60 * 60 * 24 * 365;
+	}
+	this->cert->flags = this->flags;
+	
+	switch (this->sign_key->get_type(this->sign_key))
+	{
+		case KEY_RSA:
+			this->cert->algorithm = OID_SHA1_WITH_RSA;
+			scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
+			break;
+		default:
+			return FALSE;
+	}
+	
+	switch (this->cert->public_key->get_type(this->cert->public_key))
+	{
+		case KEY_RSA:
+			key = this->cert->public_key->get_encoding(this->cert->public_key);
+			key_info = asn1_wrap(ASN1_SEQUENCE, "cm",
+							asn1_algorithmIdentifier(OID_RSA_ENCRYPTION), 
+							asn1_bitstring("m", key));	
+			break;
+		default:
+			return FALSE;
+	}
+	
+	if (this->cert->subjectAltNames->get_count(this->cert->subjectAltNames))
+	{
+		/* TODO: encode subjectAltNames */
+	}
+	
+	this->cert->tbsCertificate = asn1_wrap(ASN1_SEQUENCE, "mmccmcmm", 
+		asn1_simple_object(ASN1_CONTEXT_C_0, ASN1_INTEGER_2),
+		asn1_simple_object(ASN1_INTEGER, this->cert->serialNumber),
+		asn1_algorithmIdentifier(this->cert->algorithm),
+		issuer->get_encoding(issuer),
+		asn1_wrap(ASN1_SEQUENCE, "mm",
+			asn1_from_time(&this->cert->notBefore, ASN1_UTCTIME),
+			asn1_from_time(&this->cert->notAfter, ASN1_UTCTIME)),
+		subject->get_encoding(subject),
+		key_info, extensions);
+	
+	if (!this->sign_key->sign(this->sign_key, scheme, 
+							this->cert->tbsCertificate, &this->cert->signature))
+	{
+		return FALSE;
+	}
+	this->cert->encoding = asn1_wrap(ASN1_SEQUENCE, "ccm",
+								this->cert->tbsCertificate,
+								asn1_algorithmIdentifier(this->cert->algorithm),
+								asn1_bitstring("c", this->cert->signature));
+	
+	hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
+	if (!hasher)
+	{
+		return FALSE;
+	}
+	hasher->allocate_hash(hasher, this->cert->encoding,
+						  &this->cert->encoding_hash);
+	hasher->destroy(hasher);
+	return TRUE;
+}
+
 /**
  * Implementation of builder_t.build
  */
 static private_x509_cert_t *build(private_builder_t *this)
 {
-	private_x509_cert_t *cert = this->cert;
-	x509_flag_t flags = this->flags;
+	private_x509_cert_t *cert;
+	x509_flag_t flags;
 	
+	if (this->cert && !this->cert->encoding.ptr)
+	{
+		if (!this->sign_key || !this->cert ||
+			!generate(this))
+		{
+			destroy(this->cert);
+			free(this);
+			return NULL;
+		}
+	}
+	cert = this->cert;
+	flags =  this->flags;
 	free(this);
 	if (cert == NULL)
 	{
 		return NULL;
 	}
+	
 	if ((flags & X509_CA) && !(cert->flags & X509_CA))
 	{
 		DBG1("  ca certificate must have ca basic constraint set, discarded");
@@ -1253,6 +1393,7 @@ static void add(private_builder_t *this, builder_part_t part, ...)
 {
 	va_list args;
 	chunk_t chunk;
+	bool handled = TRUE;
 	
 	va_start(args, part);
 	switch (part)
@@ -1267,6 +1408,60 @@ static void add(private_builder_t *this, builder_part_t part, ...)
 		case BUILD_X509_FLAG:
 			this->flags = va_arg(args, x509_flag_t);
 			break;
+		case BUILD_SIGNING_KEY:
+			this->sign_key = va_arg(args, private_key_t*);
+			break;
+		case BUILD_SIGNING_CERT:
+			this->sign_cert = va_arg(args, certificate_t*);
+			break;
+		default:
+			/* all other parts need an empty cert */
+			if (!this->cert)
+			{
+				this->cert = create_empty();
+			}
+			handled = FALSE;
+			break;
+	}
+	if (handled)
+	{
+		va_end(args);
+		return;
+	}
+	
+	switch (part)
+	{
+		case BUILD_PUBLIC_KEY:
+		{
+			public_key_t *key = va_arg(args, public_key_t*);
+			this->cert->public_key = key->get_ref(key);
+			break;
+		}
+		case BUILD_SUBJECT:
+		{
+			identification_t *id = va_arg(args, identification_t*);
+			this->cert->subject = id->clone(id);
+			break;
+		}
+		case BUILD_SUBJECT_ALTNAME:
+		{
+			identification_t *id = va_arg(args, identification_t*);
+			this->cert->subjectAltNames->insert_last(
+									this->cert->subjectAltNames, id->clone(id));
+			break;
+		}
+		case BUILD_NOT_BEFORE_TIME:
+			this->cert->notBefore = va_arg(args, time_t);
+			break;
+		case BUILD_NOT_AFTER_TIME:
+			this->cert->notAfter = va_arg(args, time_t);
+			break;
+		case BUILD_SERIAL:
+		{
+			chunk_t serial = va_arg(args, chunk_t);
+			this->cert->serialNumber = chunk_clone(serial);
+			break;
+		}
 		default:
 			/* abort if unsupported option */
 			if (this->cert)
@@ -1295,6 +1490,8 @@ builder_t *x509_cert_builder(certificate_type_t type)
 	
 	this->cert = NULL;
 	this->flags = 0;
+	this->sign_cert = NULL;
+	this->sign_key = NULL;
 	this->public.add = (void(*)(builder_t *this, builder_part_t part, ...))add;
 	this->public.build = (void*(*)(builder_t *this))build;