px5g: rename the old package to px5g-standalone, add a new one that links against...
[openwrt/svn-archive/archive.git] / package / utils / px5g / px5g.c
1 /*
2 * px5g - Embedded x509 key and certificate generator based on PolarSSL
3 *
4 * Copyright (C) 2009 Steven Barth <steven@midlink.org>
5 * Copyright (C) 2014 Felix Fietkau <nbd@openwrt.org>
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License, version 2.1 as published by the Free Software Foundation.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
19 * MA 02110-1301 USA
20 */
21
22 #include <sys/types.h>
23
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <time.h>
28 #include <limits.h>
29 #include <unistd.h>
30 #include <fcntl.h>
31 #include <stdbool.h>
32
33 #include <polarssl/bignum.h>
34 #include <polarssl/x509_crt.h>
35 #include <polarssl/rsa.h>
36
37 #define PX5G_VERSION "0.2"
38 #define PX5G_COPY "Copyright (c) 2009 Steven Barth <steven@midlink.org>"
39 #define PX5G_LICENSE "Licensed under the GNU Lesser General Public License v2.1"
40
41 static int urandom_fd;
42 static char buf[16384];
43
44 static int _urandom(void *ctx, unsigned char *out, size_t len)
45 {
46 read(urandom_fd, out, len);
47 return 0;
48 }
49
50 static void write_file(const char *path, int len, bool pem)
51 {
52 FILE *f = stdout;
53 const char *buf_start = buf;
54
55 if (!pem)
56 buf_start += sizeof(buf) - len;
57
58 if (!len) {
59 fprintf(stderr, "No data to write\n");
60 exit(1);
61 }
62
63 if (!f) {
64 fprintf(stderr, "error: I/O error\n");
65 exit(1);
66 }
67
68 if (path)
69 f = fopen(path, "w");
70
71 fwrite(buf_start, 1, len, f);
72 fclose(f);
73 }
74
75 static void write_key(pk_context *key, const char *path, bool pem)
76 {
77 int len = 0;
78
79 if (pem) {
80 if (pk_write_key_pem(key, (void *) buf, sizeof(buf)) == 0)
81 len = strlen(buf);
82 } else {
83 len = pk_write_key_der(key, (void *) buf, sizeof(buf));
84 if (len < 0)
85 len = 0;
86 }
87
88 write_file(path, len, pem);
89 }
90
91 static void gen_key(pk_context *key, int ksize, int exp, bool pem)
92 {
93 pk_init(key);
94 pk_init_ctx(key, pk_info_from_type(POLARSSL_PK_RSA));
95 fprintf(stderr, "Generating RSA private key, %i bit long modulus\n", ksize);
96 if (rsa_gen_key(pk_rsa(*key), _urandom, NULL, ksize, exp)) {
97 fprintf(stderr, "error: key generation failed\n");
98 exit(1);
99 }
100 }
101
102 int rsakey(char **arg)
103 {
104 pk_context key;
105 unsigned int ksize = 512;
106 int exp = 65537;
107 char *path = NULL;
108 bool pem = true;
109
110 while (*arg && **arg == '-') {
111 if (!strcmp(*arg, "-out") && arg[1]) {
112 path = arg[1];
113 arg++;
114 } else if (!strcmp(*arg, "-3")) {
115 exp = 3;
116 } else if (!strcmp(*arg, "-der")) {
117 pem = false;
118 }
119 arg++;
120 }
121
122 if (*arg)
123 ksize = (unsigned int)atoi(*arg);
124
125 gen_key(&key, ksize, exp, pem);
126 write_key(&key, path, pem);
127
128 pk_free(&key);
129
130 return 0;
131 }
132
133 int selfsigned(char **arg)
134 {
135 pk_context key;
136 x509write_cert cert;
137 mpi serial;
138
139 char *subject = "";
140 unsigned int ksize = 512;
141 int exp = 65537;
142 unsigned int days = 30;
143 char *keypath = NULL, *certpath = NULL;
144 bool pem = true;
145 time_t from = time(NULL), to;
146 char fstr[20], tstr[20];
147 int len;
148
149 while (*arg && **arg == '-') {
150 if (!strcmp(*arg, "-der")) {
151 pem = false;
152 } else if (!strcmp(*arg, "-newkey") && arg[1]) {
153 if (strncmp(arg[1], "rsa:", 4)) {
154 fprintf(stderr, "error: invalid algorithm");
155 return 1;
156 }
157 ksize = (unsigned int)atoi(arg[1] + 4);
158 arg++;
159 } else if (!strcmp(*arg, "-days") && arg[1]) {
160 days = (unsigned int)atoi(arg[1]);
161 arg++;
162 } else if (!strcmp(*arg, "-keyout") && arg[1]) {
163 keypath = arg[1];
164 arg++;
165 } else if (!strcmp(*arg, "-out") && arg[1]) {
166 certpath = arg[1];
167 arg++;
168 } else if (!strcmp(*arg, "-subj") && arg[1]) {
169 if (arg[1][0] != '/' || strchr(arg[1], ';')) {
170 fprintf(stderr, "error: invalid subject");
171 return 1;
172 }
173 subject = calloc(strlen(arg[1]) + 1, 1);
174 char *oldc = arg[1] + 1, *newc = subject, *delim;
175 do {
176 delim = strchr(oldc, '=');
177 if (!delim) {
178 fprintf(stderr, "error: invalid subject");
179 return 1;
180 }
181 memcpy(newc, oldc, delim - oldc + 1);
182 newc += delim - oldc + 1;
183 oldc = delim + 1;
184
185 delim = strchr(oldc, '/');
186 if (!delim) {
187 delim = arg[1] + strlen(arg[1]);
188 }
189 memcpy(newc, oldc, delim - oldc);
190 newc += delim - oldc;
191 *newc++ = ';';
192 oldc = delim + 1;
193 } while(*delim);
194 arg++;
195 }
196 arg++;
197 }
198
199 gen_key(&key, ksize, exp, pem);
200
201 if (keypath)
202 write_key(&key, keypath, pem);
203
204 from = (from < 1000000000) ? 1000000000 : from;
205 strftime(fstr, sizeof(fstr), "%Y%m%d%H%M%S", gmtime(&from));
206 to = from + 60 * 60 * 24 * days;
207 if (to < from)
208 to = INT_MAX;
209 strftime(tstr, sizeof(tstr), "%Y%m%d%H%M%S", gmtime(&to));
210
211 fprintf(stderr, "Generating selfsigned certificate with subject '%s'"
212 " and validity %s-%s\n", subject, fstr, tstr);
213
214 x509write_crt_init(&cert);
215 x509write_crt_set_md_alg(&cert, POLARSSL_MD_SHA1);
216 x509write_crt_set_issuer_key(&cert, &key);
217 x509write_crt_set_subject_key(&cert, &key);
218 x509write_crt_set_subject_name(&cert, subject);
219 x509write_crt_set_issuer_name(&cert, subject);
220 x509write_crt_set_validity(&cert, fstr, tstr);
221 x509write_crt_set_basic_constraints(&cert, 0, -1);
222 x509write_crt_set_subject_key_identifier(&cert);
223 x509write_crt_set_authority_key_identifier(&cert);
224
225 mpi_init(&serial);
226 mpi_read_string(&serial, 10, "1");
227 x509write_crt_set_serial(&cert, &serial);
228
229 if (pem) {
230 if (x509write_crt_pem(&cert, (void *) buf, sizeof(buf), _urandom, NULL) < 0) {
231 fprintf(stderr, "Failed to generate certificate\n");
232 return 1;
233 }
234
235 len = strlen(buf);
236 } else {
237 len = x509write_crt_der(&cert, (void *) buf, sizeof(buf), _urandom, NULL);
238 if (len < 0) {
239 fprintf(stderr, "Failed to generate certificate: %d\n", len);
240 return 1;
241 }
242 }
243 write_file(certpath, len, pem);
244
245 x509write_crt_free(&cert);
246 mpi_free(&serial);
247 pk_free(&key);
248
249 return 0;
250 }
251
252 int main(int argc, char *argv[])
253 {
254 urandom_fd = open("/dev/urandom", O_RDONLY);
255
256 if (!argv[1]) {
257 //Usage
258 } else if (!strcmp(argv[1], "rsakey")) {
259 return rsakey(argv+2);
260 } else if (!strcmp(argv[1], "selfsigned")) {
261 return selfsigned(argv+2);
262 }
263
264 fprintf(stderr,
265 "PX5G X.509 Certificate Generator Utility v" PX5G_VERSION "\n" PX5G_COPY
266 "\nbased on PolarSSL by Christophe Devine and Paul Bakker\n\n");
267 fprintf(stderr, "Usage: %s [rsakey|selfsigned]\n", *argv);
268 return 1;
269 }