945b23c46f
We used to include platform.h only when MBEDTLS_PLATFORM_C was enabled, and to define ad hoc replacements for mbedtls_xxx functions on a case-by-case basis when MBEDTLS_PLATFORM_C was disabled. The only reason for this complication was to allow building individual source modules without copying platform.h. This is not something we support or recommend anymore, so get rid of the complication: include platform.h unconditionally. There should be no change in behavior since just including the header should not change the behavior of a program. This commit replaces most occurrences of conditional inclusion of platform.h, using the following code: ``` perl -i -0777 -pe 's!#if.*\n#include "mbedtls/platform.h"\n(#else.*\n(#define (mbedtls|MBEDTLS)_.*\n|#include <(stdarg|stddef|stdio|stdlib|string|time)\.h>\n)*)?#endif.*!#include "mbedtls/platform.h"!mg' $(git grep -l '#include "mbedtls/platform.h"') ``` Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
386 lines
13 KiB
C
386 lines
13 KiB
C
/*
|
|
* Certificate request generation
|
|
*
|
|
* Copyright The Mbed TLS Contributors
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
* not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#include "mbedtls/build_info.h"
|
|
|
|
#include "mbedtls/platform.h"
|
|
|
|
#if !defined(MBEDTLS_X509_CSR_WRITE_C) || !defined(MBEDTLS_FS_IO) || \
|
|
!defined(MBEDTLS_PK_PARSE_C) || !defined(MBEDTLS_SHA256_C) || \
|
|
!defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_CTR_DRBG_C) || \
|
|
!defined(MBEDTLS_PEM_WRITE_C)
|
|
int main( void )
|
|
{
|
|
mbedtls_printf( "MBEDTLS_X509_CSR_WRITE_C and/or MBEDTLS_FS_IO and/or "
|
|
"MBEDTLS_PK_PARSE_C and/or MBEDTLS_SHA256_C and/or "
|
|
"MBEDTLS_ENTROPY_C and/or MBEDTLS_CTR_DRBG_C "
|
|
"not defined.\n");
|
|
mbedtls_exit( 0 );
|
|
}
|
|
#else
|
|
|
|
#include "mbedtls/x509_csr.h"
|
|
#include "mbedtls/entropy.h"
|
|
#include "mbedtls/ctr_drbg.h"
|
|
#include "mbedtls/error.h"
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
|
|
#define DFL_FILENAME "keyfile.key"
|
|
#define DFL_PASSWORD NULL
|
|
#define DFL_DEBUG_LEVEL 0
|
|
#define DFL_OUTPUT_FILENAME "cert.req"
|
|
#define DFL_SUBJECT_NAME "CN=Cert,O=mbed TLS,C=UK"
|
|
#define DFL_KEY_USAGE 0
|
|
#define DFL_FORCE_KEY_USAGE 0
|
|
#define DFL_NS_CERT_TYPE 0
|
|
#define DFL_FORCE_NS_CERT_TYPE 0
|
|
#define DFL_MD_ALG MBEDTLS_MD_SHA256
|
|
|
|
#define USAGE \
|
|
"\n usage: cert_req param=<>...\n" \
|
|
"\n acceptable parameters:\n" \
|
|
" filename=%%s default: keyfile.key\n" \
|
|
" password=%%s default: NULL\n" \
|
|
" debug_level=%%d default: 0 (disabled)\n" \
|
|
" output_file=%%s default: cert.req\n" \
|
|
" subject_name=%%s default: CN=Cert,O=mbed TLS,C=UK\n" \
|
|
" key_usage=%%s default: (empty)\n" \
|
|
" Comma-separated-list of values:\n" \
|
|
" digital_signature\n" \
|
|
" non_repudiation\n" \
|
|
" key_encipherment\n" \
|
|
" data_encipherment\n" \
|
|
" key_agreement\n" \
|
|
" key_cert_sign\n" \
|
|
" crl_sign\n" \
|
|
" force_key_usage=0/1 default: off\n" \
|
|
" Add KeyUsage even if it is empty\n" \
|
|
" ns_cert_type=%%s default: (empty)\n" \
|
|
" Comma-separated-list of values:\n" \
|
|
" ssl_client\n" \
|
|
" ssl_server\n" \
|
|
" email\n" \
|
|
" object_signing\n" \
|
|
" ssl_ca\n" \
|
|
" email_ca\n" \
|
|
" object_signing_ca\n" \
|
|
" force_ns_cert_type=0/1 default: off\n" \
|
|
" Add NsCertType even if it is empty\n" \
|
|
" md=%%s default: SHA256\n" \
|
|
" possible values:\n" \
|
|
" MD5, RIPEMD160, SHA1,\n" \
|
|
" SHA224, SHA256, SHA384, SHA512\n" \
|
|
"\n"
|
|
|
|
|
|
/*
|
|
* global options
|
|
*/
|
|
struct options
|
|
{
|
|
const char *filename; /* filename of the key file */
|
|
const char *password; /* password for the key file */
|
|
int debug_level; /* level of debugging */
|
|
const char *output_file; /* where to store the constructed key file */
|
|
const char *subject_name; /* subject name for certificate request */
|
|
unsigned char key_usage; /* key usage flags */
|
|
int force_key_usage; /* Force adding the KeyUsage extension */
|
|
unsigned char ns_cert_type; /* NS cert type */
|
|
int force_ns_cert_type; /* Force adding NsCertType extension */
|
|
mbedtls_md_type_t md_alg; /* Hash algorithm used for signature. */
|
|
} opt;
|
|
|
|
int write_certificate_request( mbedtls_x509write_csr *req, const char *output_file,
|
|
int (*f_rng)(void *, unsigned char *, size_t),
|
|
void *p_rng )
|
|
{
|
|
int ret;
|
|
FILE *f;
|
|
unsigned char output_buf[4096];
|
|
size_t len = 0;
|
|
|
|
memset( output_buf, 0, 4096 );
|
|
if( ( ret = mbedtls_x509write_csr_pem( req, output_buf, 4096, f_rng, p_rng ) ) < 0 )
|
|
return( ret );
|
|
|
|
len = strlen( (char *) output_buf );
|
|
|
|
if( ( f = fopen( output_file, "w" ) ) == NULL )
|
|
return( -1 );
|
|
|
|
if( fwrite( output_buf, 1, len, f ) != len )
|
|
{
|
|
fclose( f );
|
|
return( -1 );
|
|
}
|
|
|
|
fclose( f );
|
|
|
|
return( 0 );
|
|
}
|
|
|
|
int main( int argc, char *argv[] )
|
|
{
|
|
int ret = 1;
|
|
int exit_code = MBEDTLS_EXIT_FAILURE;
|
|
mbedtls_pk_context key;
|
|
char buf[1024];
|
|
int i;
|
|
char *p, *q, *r;
|
|
mbedtls_x509write_csr req;
|
|
mbedtls_entropy_context entropy;
|
|
mbedtls_ctr_drbg_context ctr_drbg;
|
|
const char *pers = "csr example app";
|
|
|
|
/*
|
|
* Set to sane values
|
|
*/
|
|
mbedtls_x509write_csr_init( &req );
|
|
mbedtls_pk_init( &key );
|
|
mbedtls_ctr_drbg_init( &ctr_drbg );
|
|
memset( buf, 0, sizeof( buf ) );
|
|
|
|
if( argc == 0 )
|
|
{
|
|
usage:
|
|
mbedtls_printf( USAGE );
|
|
goto exit;
|
|
}
|
|
|
|
opt.filename = DFL_FILENAME;
|
|
opt.password = DFL_PASSWORD;
|
|
opt.debug_level = DFL_DEBUG_LEVEL;
|
|
opt.output_file = DFL_OUTPUT_FILENAME;
|
|
opt.subject_name = DFL_SUBJECT_NAME;
|
|
opt.key_usage = DFL_KEY_USAGE;
|
|
opt.force_key_usage = DFL_FORCE_KEY_USAGE;
|
|
opt.ns_cert_type = DFL_NS_CERT_TYPE;
|
|
opt.force_ns_cert_type = DFL_FORCE_NS_CERT_TYPE;
|
|
opt.md_alg = DFL_MD_ALG;
|
|
|
|
for( i = 1; i < argc; i++ )
|
|
{
|
|
|
|
p = argv[i];
|
|
if( ( q = strchr( p, '=' ) ) == NULL )
|
|
goto usage;
|
|
*q++ = '\0';
|
|
|
|
if( strcmp( p, "filename" ) == 0 )
|
|
opt.filename = q;
|
|
else if( strcmp( p, "password" ) == 0 )
|
|
opt.password = q;
|
|
else if( strcmp( p, "output_file" ) == 0 )
|
|
opt.output_file = q;
|
|
else if( strcmp( p, "debug_level" ) == 0 )
|
|
{
|
|
opt.debug_level = atoi( q );
|
|
if( opt.debug_level < 0 || opt.debug_level > 65535 )
|
|
goto usage;
|
|
}
|
|
else if( strcmp( p, "subject_name" ) == 0 )
|
|
{
|
|
opt.subject_name = q;
|
|
}
|
|
else if( strcmp( p, "md" ) == 0 )
|
|
{
|
|
const mbedtls_md_info_t *md_info =
|
|
mbedtls_md_info_from_string( q );
|
|
if( md_info == NULL )
|
|
{
|
|
mbedtls_printf( "Invalid argument for option %s\n", p );
|
|
goto usage;
|
|
}
|
|
opt.md_alg = mbedtls_md_get_type( md_info );
|
|
}
|
|
else if( strcmp( p, "key_usage" ) == 0 )
|
|
{
|
|
while( q != NULL )
|
|
{
|
|
if( ( r = strchr( q, ',' ) ) != NULL )
|
|
*r++ = '\0';
|
|
|
|
if( strcmp( q, "digital_signature" ) == 0 )
|
|
opt.key_usage |= MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
|
|
else if( strcmp( q, "non_repudiation" ) == 0 )
|
|
opt.key_usage |= MBEDTLS_X509_KU_NON_REPUDIATION;
|
|
else if( strcmp( q, "key_encipherment" ) == 0 )
|
|
opt.key_usage |= MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
|
|
else if( strcmp( q, "data_encipherment" ) == 0 )
|
|
opt.key_usage |= MBEDTLS_X509_KU_DATA_ENCIPHERMENT;
|
|
else if( strcmp( q, "key_agreement" ) == 0 )
|
|
opt.key_usage |= MBEDTLS_X509_KU_KEY_AGREEMENT;
|
|
else if( strcmp( q, "key_cert_sign" ) == 0 )
|
|
opt.key_usage |= MBEDTLS_X509_KU_KEY_CERT_SIGN;
|
|
else if( strcmp( q, "crl_sign" ) == 0 )
|
|
opt.key_usage |= MBEDTLS_X509_KU_CRL_SIGN;
|
|
else
|
|
goto usage;
|
|
|
|
q = r;
|
|
}
|
|
}
|
|
else if( strcmp( p, "force_key_usage" ) == 0 )
|
|
{
|
|
switch( atoi( q ) )
|
|
{
|
|
case 0: opt.force_key_usage = 0; break;
|
|
case 1: opt.force_key_usage = 1; break;
|
|
default: goto usage;
|
|
}
|
|
}
|
|
else if( strcmp( p, "ns_cert_type" ) == 0 )
|
|
{
|
|
while( q != NULL )
|
|
{
|
|
if( ( r = strchr( q, ',' ) ) != NULL )
|
|
*r++ = '\0';
|
|
|
|
if( strcmp( q, "ssl_client" ) == 0 )
|
|
opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT;
|
|
else if( strcmp( q, "ssl_server" ) == 0 )
|
|
opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER;
|
|
else if( strcmp( q, "email" ) == 0 )
|
|
opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_EMAIL;
|
|
else if( strcmp( q, "object_signing" ) == 0 )
|
|
opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING;
|
|
else if( strcmp( q, "ssl_ca" ) == 0 )
|
|
opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_SSL_CA;
|
|
else if( strcmp( q, "email_ca" ) == 0 )
|
|
opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA;
|
|
else if( strcmp( q, "object_signing_ca" ) == 0 )
|
|
opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA;
|
|
else
|
|
goto usage;
|
|
|
|
q = r;
|
|
}
|
|
}
|
|
else if( strcmp( p, "force_ns_cert_type" ) == 0 )
|
|
{
|
|
switch( atoi( q ) )
|
|
{
|
|
case 0: opt.force_ns_cert_type = 0; break;
|
|
case 1: opt.force_ns_cert_type = 1; break;
|
|
default: goto usage;
|
|
}
|
|
}
|
|
else
|
|
goto usage;
|
|
}
|
|
|
|
mbedtls_x509write_csr_set_md_alg( &req, opt.md_alg );
|
|
|
|
if( opt.key_usage || opt.force_key_usage == 1 )
|
|
mbedtls_x509write_csr_set_key_usage( &req, opt.key_usage );
|
|
|
|
if( opt.ns_cert_type || opt.force_ns_cert_type == 1 )
|
|
mbedtls_x509write_csr_set_ns_cert_type( &req, opt.ns_cert_type );
|
|
|
|
/*
|
|
* 0. Seed the PRNG
|
|
*/
|
|
mbedtls_printf( " . Seeding the random number generator..." );
|
|
fflush( stdout );
|
|
|
|
mbedtls_entropy_init( &entropy );
|
|
if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
|
|
(const unsigned char *) pers,
|
|
strlen( pers ) ) ) != 0 )
|
|
{
|
|
mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned %d", ret );
|
|
goto exit;
|
|
}
|
|
|
|
mbedtls_printf( " ok\n" );
|
|
|
|
/*
|
|
* 1.0. Check the subject name for validity
|
|
*/
|
|
mbedtls_printf( " . Checking subject name..." );
|
|
fflush( stdout );
|
|
|
|
if( ( ret = mbedtls_x509write_csr_set_subject_name( &req, opt.subject_name ) ) != 0 )
|
|
{
|
|
mbedtls_printf( " failed\n ! mbedtls_x509write_csr_set_subject_name returned %d", ret );
|
|
goto exit;
|
|
}
|
|
|
|
mbedtls_printf( " ok\n" );
|
|
|
|
/*
|
|
* 1.1. Load the key
|
|
*/
|
|
mbedtls_printf( " . Loading the private key ..." );
|
|
fflush( stdout );
|
|
|
|
ret = mbedtls_pk_parse_keyfile( &key, opt.filename, opt.password,
|
|
mbedtls_ctr_drbg_random, &ctr_drbg );
|
|
|
|
if( ret != 0 )
|
|
{
|
|
mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile returned %d", ret );
|
|
goto exit;
|
|
}
|
|
|
|
mbedtls_x509write_csr_set_key( &req, &key );
|
|
|
|
mbedtls_printf( " ok\n" );
|
|
|
|
/*
|
|
* 1.2. Writing the request
|
|
*/
|
|
mbedtls_printf( " . Writing the certificate request ..." );
|
|
fflush( stdout );
|
|
|
|
if( ( ret = write_certificate_request( &req, opt.output_file,
|
|
mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 )
|
|
{
|
|
mbedtls_printf( " failed\n ! write_certifcate_request %d", ret );
|
|
goto exit;
|
|
}
|
|
|
|
mbedtls_printf( " ok\n" );
|
|
|
|
exit_code = MBEDTLS_EXIT_SUCCESS;
|
|
|
|
exit:
|
|
|
|
if( exit_code != MBEDTLS_EXIT_SUCCESS )
|
|
{
|
|
#ifdef MBEDTLS_ERROR_C
|
|
mbedtls_strerror( ret, buf, sizeof( buf ) );
|
|
mbedtls_printf( " - %s\n", buf );
|
|
#else
|
|
mbedtls_printf("\n");
|
|
#endif
|
|
}
|
|
|
|
mbedtls_x509write_csr_free( &req );
|
|
mbedtls_pk_free( &key );
|
|
mbedtls_ctr_drbg_free( &ctr_drbg );
|
|
mbedtls_entropy_free( &entropy );
|
|
|
|
mbedtls_exit( exit_code );
|
|
}
|
|
#endif /* MBEDTLS_X509_CSR_WRITE_C && MBEDTLS_PK_PARSE_C && MBEDTLS_FS_IO &&
|
|
MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C && MBEDTLS_PEM_WRITE_C */
|