px5g.c 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326
  1. /*
  2. * px5g - Embedded x509 key and certificate generator based on PolarSSL
  3. *
  4. * Copyright (C) 2009 Steven Barth <steven@midlink.org>
  5. * Copyright (C) 2014 Felix Fietkau <nbd@nbd.name>
  6. *
  7. * This library is free software; you can redistribute it and/or
  8. * modify it under the terms of the GNU Lesser General Public
  9. * License, version 2.1 as published by the Free Software Foundation.
  10. *
  11. * This library is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14. * Lesser General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU Lesser General Public
  17. * License along with this library; if not, write to the Free Software
  18. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  19. * MA 02110-1301 USA
  20. */
  21. #include <sys/types.h>
  22. #include <stdio.h>
  23. #include <stdlib.h>
  24. #include <string.h>
  25. #include <time.h>
  26. #include <limits.h>
  27. #include <unistd.h>
  28. #include <fcntl.h>
  29. #include <stdbool.h>
  30. #include <mbedtls/bignum.h>
  31. #include <mbedtls/x509_crt.h>
  32. #include <mbedtls/ecp.h>
  33. #include <mbedtls/rsa.h>
  34. #include <mbedtls/pk.h>
  35. #define PX5G_VERSION "0.2"
  36. #define PX5G_COPY "Copyright (c) 2009 Steven Barth <steven@midlink.org>"
  37. #define PX5G_LICENSE "Licensed under the GNU Lesser General Public License v2.1"
  38. static int urandom_fd;
  39. static char buf[16384];
  40. static int _urandom(void *ctx, unsigned char *out, size_t len)
  41. {
  42. read(urandom_fd, out, len);
  43. return 0;
  44. }
  45. static void write_file(const char *path, int len, bool pem)
  46. {
  47. FILE *f = stdout;
  48. const char *buf_start = buf;
  49. if (!pem)
  50. buf_start += sizeof(buf) - len;
  51. if (!len) {
  52. fprintf(stderr, "No data to write\n");
  53. exit(1);
  54. }
  55. if (!f) {
  56. fprintf(stderr, "error: I/O error\n");
  57. exit(1);
  58. }
  59. if (path)
  60. f = fopen(path, "w");
  61. fwrite(buf_start, 1, len, f);
  62. fclose(f);
  63. }
  64. static mbedtls_ecp_group_id ecp_curve(const char *name)
  65. {
  66. const mbedtls_ecp_curve_info *curve_info;
  67. if (!strcmp(name, "P-256"))
  68. return MBEDTLS_ECP_DP_SECP256R1;
  69. else if (!strcmp(name, "P-384"))
  70. return MBEDTLS_ECP_DP_SECP384R1;
  71. else if (!strcmp(name, "P-521"))
  72. return MBEDTLS_ECP_DP_SECP521R1;
  73. curve_info = mbedtls_ecp_curve_info_from_name(name);
  74. if (curve_info == NULL)
  75. return MBEDTLS_ECP_DP_NONE;
  76. else
  77. return curve_info->grp_id;
  78. }
  79. static void write_key(mbedtls_pk_context *key, const char *path, bool pem)
  80. {
  81. int len = 0;
  82. if (pem) {
  83. if (mbedtls_pk_write_key_pem(key, (void *) buf, sizeof(buf)) == 0)
  84. len = strlen(buf);
  85. } else {
  86. len = mbedtls_pk_write_key_der(key, (void *) buf, sizeof(buf));
  87. if (len < 0)
  88. len = 0;
  89. }
  90. write_file(path, len, pem);
  91. }
  92. static void gen_key(mbedtls_pk_context *key, bool rsa, int ksize, int exp,
  93. mbedtls_ecp_group_id curve, bool pem)
  94. {
  95. mbedtls_pk_init(key);
  96. if (rsa) {
  97. fprintf(stderr, "Generating RSA private key, %i bit long modulus\n", ksize);
  98. mbedtls_pk_setup(key, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA));
  99. if (!mbedtls_rsa_gen_key(mbedtls_pk_rsa(*key), _urandom, NULL, ksize, exp))
  100. return;
  101. } else {
  102. fprintf(stderr, "Generating EC private key\n");
  103. mbedtls_pk_setup(key, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY));
  104. if (!mbedtls_ecp_gen_key(curve, mbedtls_pk_ec(*key), _urandom, NULL))
  105. return;
  106. }
  107. fprintf(stderr, "error: key generation failed\n");
  108. exit(1);
  109. }
  110. int dokey(bool rsa, char **arg)
  111. {
  112. mbedtls_pk_context key;
  113. unsigned int ksize = 512;
  114. int exp = 65537;
  115. char *path = NULL;
  116. bool pem = true;
  117. mbedtls_ecp_group_id curve = MBEDTLS_ECP_DP_SECP256R1;
  118. while (*arg && **arg == '-') {
  119. if (!strcmp(*arg, "-out") && arg[1]) {
  120. path = arg[1];
  121. arg++;
  122. } else if (!strcmp(*arg, "-3")) {
  123. exp = 3;
  124. } else if (!strcmp(*arg, "-der")) {
  125. pem = false;
  126. }
  127. arg++;
  128. }
  129. if (*arg && rsa) {
  130. ksize = (unsigned int)atoi(*arg);
  131. } else if (*arg) {
  132. curve = ecp_curve((const char *)*arg);
  133. if (curve == MBEDTLS_ECP_DP_NONE) {
  134. fprintf(stderr, "error: invalid curve name: %s\n", *arg);
  135. return 1;
  136. }
  137. }
  138. gen_key(&key, rsa, ksize, exp, curve, pem);
  139. write_key(&key, path, pem);
  140. mbedtls_pk_free(&key);
  141. return 0;
  142. }
  143. int selfsigned(char **arg)
  144. {
  145. mbedtls_pk_context key;
  146. mbedtls_x509write_cert cert;
  147. mbedtls_mpi serial;
  148. char *subject = "";
  149. unsigned int ksize = 512;
  150. int exp = 65537;
  151. unsigned int days = 30;
  152. char *keypath = NULL, *certpath = NULL;
  153. bool pem = true;
  154. time_t from = time(NULL), to;
  155. char fstr[20], tstr[20], sstr[17];
  156. int len;
  157. bool rsa = true;
  158. mbedtls_ecp_group_id curve = MBEDTLS_ECP_DP_SECP256R1;
  159. while (*arg && **arg == '-') {
  160. if (!strcmp(*arg, "-der")) {
  161. pem = false;
  162. } else if (!strcmp(*arg, "-newkey") && arg[1]) {
  163. if (!strncmp(arg[1], "rsa:", 4)) {
  164. rsa = true;
  165. ksize = (unsigned int)atoi(arg[1] + 4);
  166. } else if (!strcmp(arg[1], "ec")) {
  167. rsa = false;
  168. } else {
  169. fprintf(stderr, "error: invalid algorithm\n");
  170. return 1;
  171. }
  172. arg++;
  173. } else if (!strcmp(*arg, "-days") && arg[1]) {
  174. days = (unsigned int)atoi(arg[1]);
  175. arg++;
  176. } else if (!strcmp(*arg, "-pkeyopt") && arg[1]) {
  177. if (strncmp(arg[1], "ec_paramgen_curve:", 18)) {
  178. fprintf(stderr, "error: invalid pkey option: %s\n", arg[1]);
  179. return 1;
  180. }
  181. curve = ecp_curve((const char *)(arg[1] + 18));
  182. if (curve == MBEDTLS_ECP_DP_NONE) {
  183. fprintf(stderr, "error: invalid curve name: %s\n", arg[1] + 18);
  184. return 1;
  185. }
  186. arg++;
  187. } else if (!strcmp(*arg, "-keyout") && arg[1]) {
  188. keypath = arg[1];
  189. arg++;
  190. } else if (!strcmp(*arg, "-out") && arg[1]) {
  191. certpath = arg[1];
  192. arg++;
  193. } else if (!strcmp(*arg, "-subj") && arg[1]) {
  194. if (arg[1][0] != '/' || strchr(arg[1], ';')) {
  195. fprintf(stderr, "error: invalid subject");
  196. return 1;
  197. }
  198. subject = calloc(strlen(arg[1]) + 1, 1);
  199. char *oldc = arg[1] + 1, *newc = subject, *delim;
  200. do {
  201. delim = strchr(oldc, '=');
  202. if (!delim) {
  203. fprintf(stderr, "error: invalid subject");
  204. return 1;
  205. }
  206. memcpy(newc, oldc, delim - oldc + 1);
  207. newc += delim - oldc + 1;
  208. oldc = delim + 1;
  209. delim = strchr(oldc, '/');
  210. if (!delim) {
  211. delim = arg[1] + strlen(arg[1]);
  212. }
  213. memcpy(newc, oldc, delim - oldc);
  214. newc += delim - oldc;
  215. *newc++ = ',';
  216. oldc = delim + 1;
  217. } while(*delim);
  218. arg++;
  219. }
  220. arg++;
  221. }
  222. gen_key(&key, rsa, ksize, exp, curve, pem);
  223. if (keypath)
  224. write_key(&key, keypath, pem);
  225. from = (from < 1000000000) ? 1000000000 : from;
  226. strftime(fstr, sizeof(fstr), "%Y%m%d%H%M%S", gmtime(&from));
  227. to = from + 60 * 60 * 24 * days;
  228. if (to < from)
  229. to = INT_MAX;
  230. strftime(tstr, sizeof(tstr), "%Y%m%d%H%M%S", gmtime(&to));
  231. fprintf(stderr, "Generating selfsigned certificate with subject '%s'"
  232. " and validity %s-%s\n", subject, fstr, tstr);
  233. mbedtls_x509write_crt_init(&cert);
  234. mbedtls_x509write_crt_set_md_alg(&cert, MBEDTLS_MD_SHA256);
  235. mbedtls_x509write_crt_set_issuer_key(&cert, &key);
  236. mbedtls_x509write_crt_set_subject_key(&cert, &key);
  237. mbedtls_x509write_crt_set_subject_name(&cert, subject);
  238. mbedtls_x509write_crt_set_issuer_name(&cert, subject);
  239. mbedtls_x509write_crt_set_validity(&cert, fstr, tstr);
  240. mbedtls_x509write_crt_set_basic_constraints(&cert, 0, -1);
  241. mbedtls_x509write_crt_set_subject_key_identifier(&cert);
  242. mbedtls_x509write_crt_set_authority_key_identifier(&cert);
  243. _urandom(NULL, (void *) buf, 8);
  244. for (len = 0; len < 8; len++)
  245. sprintf(sstr + len*2, "%02x", (unsigned char) buf[len]);
  246. mbedtls_mpi_init(&serial);
  247. mbedtls_mpi_read_string(&serial, 16, sstr);
  248. mbedtls_x509write_crt_set_serial(&cert, &serial);
  249. if (pem) {
  250. if (mbedtls_x509write_crt_pem(&cert, (void *) buf, sizeof(buf), _urandom, NULL) < 0) {
  251. fprintf(stderr, "Failed to generate certificate\n");
  252. return 1;
  253. }
  254. len = strlen(buf);
  255. } else {
  256. len = mbedtls_x509write_crt_der(&cert, (void *) buf, sizeof(buf), _urandom, NULL);
  257. if (len < 0) {
  258. fprintf(stderr, "Failed to generate certificate: %d\n", len);
  259. return 1;
  260. }
  261. }
  262. write_file(certpath, len, pem);
  263. mbedtls_x509write_crt_free(&cert);
  264. mbedtls_mpi_free(&serial);
  265. mbedtls_pk_free(&key);
  266. return 0;
  267. }
  268. int main(int argc, char *argv[])
  269. {
  270. urandom_fd = open("/dev/urandom", O_RDONLY);
  271. if (!argv[1]) {
  272. //Usage
  273. } else if (!strcmp(argv[1], "eckey")) {
  274. return dokey(false, argv+2);
  275. } else if (!strcmp(argv[1], "rsakey")) {
  276. return dokey(true, argv+2);
  277. } else if (!strcmp(argv[1], "selfsigned")) {
  278. return selfsigned(argv+2);
  279. }
  280. fprintf(stderr,
  281. "PX5G X.509 Certificate Generator Utility v" PX5G_VERSION "\n" PX5G_COPY
  282. "\nbased on PolarSSL by Christophe Devine and Paul Bakker\n\n");
  283. fprintf(stderr, "Usage: %s [eckey|rsakey|selfsigned]\n", *argv);
  284. return 1;
  285. }