commit 58de07ae203500ea1778e80a0e7151c4525f461d
author Davide Pesavento <davidepesa@gmail.com> Wed Jun 08 00:02:02 2022 -0400
committer Davide Pesavento <davidepesa@gmail.com> Mon Jun 13 21:35:22 2022 -0400
tree bc8d11b374301030f9c02bc508567e0675549cf7
parent 9faf34bdf44c641d2df9e56bf2682be6d0c680e9

tools: relax restriction on KeyId component type in `ndnsec key-gen`

And add a similar check on the IssuerId in cert-gen

Change-Id: I6828287a8c2f97dacba3326f0579afc71d9c69a3

tools/ndnsec/cert-gen.cpp

diff --git a/tools/ndnsec/cert-gen.cpp b/tools/ndnsec/cert-gen.cpp
index 49b0362..cc77f02 100644
--- a/tools/ndnsec/cert-gen.cpp
+++ b/tools/ndnsec/cert-gen.cpp
@@ -25,7 +25,6 @@
 #include "ndn-cxx/security/additional-description.hpp"
 #include "ndn-cxx/security/transform/base64-encode.hpp"
 #include "ndn-cxx/security/transform/buffer-source.hpp"
-#include "ndn-cxx/security/transform/public-key.hpp"
 #include "ndn-cxx/security/transform/stream-sink.hpp"
 
 namespace ndn {
@@ -35,13 +34,14 @@
 ndnsec_cert_gen(int argc, char** argv)
 {
   namespace po = boost::program_options;
+  using security::Certificate;
 
   std::string requestFile;
   std::string notBeforeStr;
   std::string notAfterStr;
   std::vector<std::string> infos;
   Name signId;
-  std::string issuerId;
+  std::string issuer;
 
   po::options_description description(
     "Usage: ndnsec cert-gen [-h] [-S TIMESTAMP] [-E TIMESTAMP] [-I INFO]...\n"
@@ -51,22 +51,20 @@
   description.add_options()
     ("help,h", "produce help message")
     ("request,r",      po::value<std::string>(&requestFile)->default_value("-"),
-                       "request file name, '-' for stdin (the default)")
+                       "certificate request file name, '-' for stdin (the default)")
     ("not-before,S",   po::value<std::string>(&notBeforeStr),
                        "certificate validity start date/time in YYYYMMDDhhmmss format (default: now)")
     ("not-after,E",    po::value<std::string>(&notAfterStr),
                        "certificate validity end date/time in YYYYMMDDhhmmss format (default: "
                        "365 days after the --not-before timestamp)")
     ("info,I",         po::value<std::vector<std::string>>(&infos),
-                       "key and value (must be separated by a single space) of the additional "
-                       "description to be included in the issued certificate (e.g., "
-                       "\"affiliation University of California, Los Angeles\"); "
-                       "this option may be repeated multiple times")
+                       "key and value (separated by a single space) of the additional description "
+                       "to be included in the issued certificate (e.g., \"affiliation University of "
+                       "California, Los Angeles\"); this option may be repeated multiple times")
     ("sign-id,s",      po::value<Name>(&signId), "signing identity")
-    ("issuer-id,i",    po::value<std::string>(&issuerId),
-                       ("issuer's ID to be included in the issued certificate name, interpreted as "
-                        "name component in URI format (default: \"" +
-                        security::Certificate::DEFAULT_ISSUER_ID.toUri() + "\")").data())
+    ("issuer-id,i",    po::value<std::string>(&issuer)->default_value(Certificate::DEFAULT_ISSUER_ID.toUri()),
+                       "issuer's ID to be included in the issued certificate name, interpreted as a "
+                       "name component in URI format")
     ;
 
   po::positional_options_description p;
@@ -124,9 +122,17 @@
     }
   }
 
+  auto issuerId = name::Component::fromEscapedString(issuer);
+  if (issuerId.isImplicitSha256Digest() ||
+      issuerId.isParametersSha256Digest() ||
+      issuerId.isKeyword()) {
+    std::cerr << "ERROR: '" << issuerId << "' cannot be used as issuer ID" << std::endl;
+    return 2;
+  }
+
   KeyChain keyChain;
 
-  auto request = loadFromFile<security::Certificate>(requestFile);
+  auto request = loadFromFile<Certificate>(requestFile);
 
   security::SigningInfo signer;
   if (vm.count("sign-id") > 0) {
@@ -139,9 +145,7 @@
   }
 
   security::MakeCertificateOptions opts;
-  if (vm.count("issuer-id") > 0) {
-    opts.issuerId = name::Component::fromEscapedString(issuerId);
-  }
+  opts.issuerId = issuerId;
   opts.validity.emplace(notBefore, notAfter);
   auto cert = keyChain.makeCertificate(request, signer, opts);