package/utils/px5g/px5g.c

   1 /*
   2  * px5g - Embedded x509 key and certificate generator based on PolarSSL
   3  *
   4  *   Copyright (C) 2009 Steven Barth <steven@midlink.org>
   5  *   Copyright (C) 2014 Felix Fietkau <nbd@openwrt.org>
   6  *
   7  *  This library is free software; you can redistribute it and/or
   8  *  modify it under the terms of the GNU Lesser General Public
   9  *  License, version 2.1 as published by the Free Software Foundation.
  10  *
  11  *  This library is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  *  Lesser General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU Lesser General Public
  17  *  License along with this library; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  19  *  MA  02110-1301  USA
  20  */
  21
  22 #include <sys/types.h>
  23
  24 #include <stdio.h>
  25 #include <stdlib.h>
  26 #include <string.h>
  27 #include <time.h>
  28 #include <limits.h>
  29 #include <unistd.h>
  30 #include <fcntl.h>
  31 #include <stdbool.h>
  32
  33 #include <polarssl/bignum.h>
  34 #include <polarssl/x509_crt.h>
  35 #include <polarssl/rsa.h>
  36
  37 #define PX5G_VERSION "0.2"
  38 #define PX5G_COPY "Copyright (c) 2009 Steven Barth <steven@midlink.org>"
  39 #define PX5G_LICENSE "Licensed under the GNU Lesser General Public License v2.1"
  40
  41 static int urandom_fd;
  42 static char buf[16384];
  43
  44 static int _urandom(void *ctx, unsigned char *out, size_t len)
  45 {
  46         read(urandom_fd, out, len);
  47         return 0;
  48 }
  49
  50 static void write_file(const char *path, int len, bool pem)
  51 {
  52         FILE *f = stdout;
  53         const char *buf_start = buf;
  54
  55         if (!pem)
  56                 buf_start += sizeof(buf) - len;
  57
  58         if (!len) {
  59                 fprintf(stderr, "No data to write\n");
  60                 exit(1);
  61         }
  62
  63         if (!f) {
  64                 fprintf(stderr, "error: I/O error\n");
  65                 exit(1);
  66         }
  67
  68         if (path)
  69                 f = fopen(path, "w");
  70
  71         fwrite(buf_start, 1, len, f);
  72         fclose(f);
  73 }
  74
  75 static void write_key(pk_context *key, const char *path, bool pem)
  76 {
  77         int len = 0;
  78
  79         if (pem) {
  80                 if (pk_write_key_pem(key, (void *) buf, sizeof(buf)) == 0)
  81                         len = strlen(buf);
  82         } else {
  83                 len = pk_write_key_der(key, (void *) buf, sizeof(buf));
  84                 if (len < 0)
  85                         len = 0;
  86         }
  87
  88         write_file(path, len, pem);
  89 }
  90
  91 static void gen_key(pk_context *key, int ksize, int exp, bool pem)
  92 {
  93         pk_init(key);
  94         pk_init_ctx(key, pk_info_from_type(POLARSSL_PK_RSA));
  95         fprintf(stderr, "Generating RSA private key, %i bit long modulus\n", ksize);
  96         if (rsa_gen_key(pk_rsa(*key), _urandom, NULL, ksize, exp)) {
  97                 fprintf(stderr, "error: key generation failed\n");
  98                 exit(1);
  99         }
 100 }
 101
 102 int rsakey(char **arg)
 103 {
 104         pk_context key;
 105         unsigned int ksize = 512;
 106         int exp = 65537;
 107         char *path = NULL;
 108         bool pem = true;
 109
 110         while (*arg && **arg == '-') {
 111                 if (!strcmp(*arg, "-out") && arg[1]) {
 112                         path = arg[1];
 113                         arg++;
 114                 } else if (!strcmp(*arg, "-3")) {
 115                         exp = 3;
 116                 } else if (!strcmp(*arg, "-der")) {
 117                         pem = false;
 118                 }
 119                 arg++;
 120         }
 121
 122         if (*arg)
 123                 ksize = (unsigned int)atoi(*arg);
 124
 125         gen_key(&key, ksize, exp, pem);
 126         write_key(&key, path, pem);
 127
 128         pk_free(&key);
 129
 130         return 0;
 131 }
 132
 133 int selfsigned(char **arg)
 134 {
 135         pk_context key;
 136         x509write_cert cert;
 137         mpi serial;
 138
 139         char *subject = "";
 140         unsigned int ksize = 512;
 141         int exp = 65537;
 142         unsigned int days = 30;
 143         char *keypath = NULL, *certpath = NULL;
 144         bool pem = true;
 145         time_t from = time(NULL), to;
 146         char fstr[20], tstr[20], sstr[17];
 147         int len;
 148
 149         while (*arg && **arg == '-') {
 150                 if (!strcmp(*arg, "-der")) {
 151                         pem = false;
 152                 } else if (!strcmp(*arg, "-newkey") && arg[1]) {
 153                         if (strncmp(arg[1], "rsa:", 4)) {
 154                                 fprintf(stderr, "error: invalid algorithm");
 155                                 return 1;
 156                         }
 157                         ksize = (unsigned int)atoi(arg[1] + 4);
 158                         arg++;
 159                 } else if (!strcmp(*arg, "-days") && arg[1]) {
 160                         days = (unsigned int)atoi(arg[1]);
 161                         arg++;
 162                 } else if (!strcmp(*arg, "-keyout") && arg[1]) {
 163                         keypath = arg[1];
 164                         arg++;
 165                 } else if (!strcmp(*arg, "-out") && arg[1]) {
 166                         certpath = arg[1];
 167                         arg++;
 168                 } else if (!strcmp(*arg, "-subj") && arg[1]) {
 169                         if (arg[1][0] != '/' || strchr(arg[1], ';')) {
 170                                 fprintf(stderr, "error: invalid subject");
 171                                 return 1;
 172                         }
 173                         subject = calloc(strlen(arg[1]) + 1, 1);
 174                         char *oldc = arg[1] + 1, *newc = subject, *delim;
 175                         do {
 176                                 delim = strchr(oldc, '=');
 177                                 if (!delim) {
 178                                         fprintf(stderr, "error: invalid subject");
 179                                         return 1;
 180                                 }
 181                                 memcpy(newc, oldc, delim - oldc + 1);
 182                                 newc += delim - oldc + 1;
 183                                 oldc = delim + 1;
 184
 185                                 delim = strchr(oldc, '/');
 186                                 if (!delim) {
 187                                         delim = arg[1] + strlen(arg[1]);
 188                                 }
 189                                 memcpy(newc, oldc, delim - oldc);
 190                                 newc += delim - oldc;
 191                                 *newc++ = ',';
 192                                 oldc = delim + 1;
 193                         } while(*delim);
 194                         arg++;
 195                 }
 196                 arg++;
 197         }
 198
 199         gen_key(&key, ksize, exp, pem);
 200
 201         if (keypath)
 202                 write_key(&key, keypath, pem);
 203
 204         from = (from < 1000000000) ? 1000000000 : from;
 205         strftime(fstr, sizeof(fstr), "%Y%m%d%H%M%S", gmtime(&from));
 206         to = from + 60 * 60 * 24 * days;
 207         if (to < from)
 208                 to = INT_MAX;
 209         strftime(tstr, sizeof(tstr), "%Y%m%d%H%M%S", gmtime(&to));
 210
 211         fprintf(stderr, "Generating selfsigned certificate with subject '%s'"
 212                         " and validity %s-%s\n", subject, fstr, tstr);
 213
 214         x509write_crt_init(&cert);
 215         x509write_crt_set_md_alg(&cert, POLARSSL_MD_SHA256);
 216         x509write_crt_set_issuer_key(&cert, &key);
 217         x509write_crt_set_subject_key(&cert, &key);
 218         x509write_crt_set_subject_name(&cert, subject);
 219         x509write_crt_set_issuer_name(&cert, subject);
 220         x509write_crt_set_validity(&cert, fstr, tstr);
 221         x509write_crt_set_basic_constraints(&cert, 0, -1);
 222         x509write_crt_set_subject_key_identifier(&cert);
 223         x509write_crt_set_authority_key_identifier(&cert);
 224
 225         _urandom(NULL, buf, 8);
 226         for (len = 0; len < 8; len++)
 227                 sprintf(sstr + len*2, "%02x", (unsigned char) buf[len]);
 228
 229         mpi_init(&serial);
 230         mpi_read_string(&serial, 16, sstr);
 231         x509write_crt_set_serial(&cert, &serial);
 232
 233         if (pem) {
 234                 if (x509write_crt_pem(&cert, (void *) buf, sizeof(buf), _urandom, NULL) < 0) {
 235                         fprintf(stderr, "Failed to generate certificate\n");
 236                         return 1;
 237                 }
 238
 239                 len = strlen(buf);
 240         } else {
 241                 len = x509write_crt_der(&cert, (void *) buf, sizeof(buf), _urandom, NULL);
 242                 if (len < 0) {
 243                         fprintf(stderr, "Failed to generate certificate: %d\n", len);
 244                         return 1;
 245                 }
 246         }
 247         write_file(certpath, len, pem);
 248
 249         x509write_crt_free(&cert);
 250         mpi_free(&serial);
 251         pk_free(&key);
 252
 253         return 0;
 254 }
 255
 256 int main(int argc, char *argv[])
 257 {
 258         urandom_fd = open("/dev/urandom", O_RDONLY);
 259
 260         if (!argv[1]) {
 261                 //Usage
 262         } else if (!strcmp(argv[1], "rsakey")) {
 263                 return rsakey(argv+2);
 264         } else if (!strcmp(argv[1], "selfsigned")) {
 265                 return selfsigned(argv+2);
 266         }
 267
 268         fprintf(stderr,
 269                 "PX5G X.509 Certificate Generator Utility v" PX5G_VERSION "\n" PX5G_COPY
 270                 "\nbased on PolarSSL by Christophe Devine and Paul Bakker\n\n");
 271         fprintf(stderr, "Usage: %s [rsakey|selfsigned]\n", *argv);
 272         return 1;
 273 }