blob: 00163330cb8d04e83841e318e5febb2f289fda87 [file] [log] [blame]
Alexander Afanasyevc169a812014-05-20 20:37:29 -04001/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -07002/**
Alexander Afanasyevaf99f462015-01-19 21:43:09 -08003 * Copyright (c) 2013-2015 Regents of the University of California.
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -07004 *
5 * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -07006 *
Alexander Afanasyevc169a812014-05-20 20:37:29 -04007 * ndn-cxx library is free software: you can redistribute it and/or modify it under the
8 * terms of the GNU Lesser General Public License as published by the Free Software
9 * Foundation, either version 3 of the License, or (at your option) any later version.
10 *
11 * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
12 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
13 * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
14 *
15 * You should have received copies of the GNU General Public License and GNU Lesser
16 * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see
17 * <http://www.gnu.org/licenses/>.
18 *
19 * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
Alexander Afanasyevdfa52c42014-04-24 21:10:11 -070020 *
21 * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
Yingdi Yue6bfab22014-02-06 16:01:19 -080022 */
23
Alexander Afanasyevd7db8bf2015-01-04 15:31:02 -080024#ifndef NDN_TOOLS_NDNSEC_CERT_GEN_HPP
25#define NDN_TOOLS_NDNSEC_CERT_GEN_HPP
Yingdi Yue6bfab22014-02-06 16:01:19 -080026
Alexander Afanasyevd7db8bf2015-01-04 15:31:02 -080027#include "util.hpp"
Yingdi Yue6bfab22014-02-06 16:01:19 -080028
Yingdi Yub61f5402014-02-26 17:46:11 -080029int
Yingdi Yu8d7468f2014-02-21 14:49:45 -080030ndnsec_cert_gen(int argc, char** argv)
Yingdi Yue6bfab22014-02-06 16:01:19 -080031{
Yingdi Yu8d7468f2014-02-21 14:49:45 -080032 using boost::tokenizer;
33 using boost::escaped_list_separator;
Yingdi Yue6bfab22014-02-06 16:01:19 -080034
Yingdi Yu8d7468f2014-02-21 14:49:45 -080035 using namespace ndn;
Alexander Afanasyevb1db7c62014-04-03 14:57:25 -070036 using namespace ndn::time;
Yingdi Yu8d7468f2014-02-21 14:49:45 -080037 namespace po = boost::program_options;
Yingdi Yue6bfab22014-02-06 16:01:19 -080038
Alexander Afanasyev66cd4242014-10-18 22:39:49 -070039 KeyChain keyChain;
40
Yingdi Yue6bfab22014-02-06 16:01:19 -080041 std::string notBeforeStr;
42 std::string notAfterStr;
Yingdi Yub61f5402014-02-26 17:46:11 -080043 std::string subjectName;
44 std::string requestFile("-");
Yingdi Yuba8604d2014-10-13 19:03:12 -070045 Name signId;
Yingdi Yub61f5402014-02-26 17:46:11 -080046 std::string subjectInfo;
Alexander Afanasyev66cd4242014-10-18 22:39:49 -070047 std::vector<std::string> signedInfo;
48 Name certPrefix = KeyChain::DEFAULT_PREFIX; // to avoid displaying the default value
Yingdi Yue6bfab22014-02-06 16:01:19 -080049
Yingdi Yu0eb5d722014-06-10 15:06:25 -070050 po::options_description description(
51 "General Usage\n"
52 " ndnsec cert-gen [-h] [-S date] [-E date] [-N subject-name] [-I subject-info] "
53 "[-s sign-id] [-p cert-prefix] request\n"
54 "General options");
55
Yingdi Yub61f5402014-02-26 17:46:11 -080056 description.add_options()
Yingdi Yue6bfab22014-02-06 16:01:19 -080057 ("help,h", "produce help message")
Yingdi Yuba8604d2014-10-13 19:03:12 -070058 ("not-before,S", po::value<std::string>(&notBeforeStr),
59 "certificate starting date, YYYYMMDDhhmmss (default: now)")
60 ("not-after,E", po::value<std::string>(&notAfterStr),
61 "certificate ending date, YYYYMMDDhhmmss (default: now + 365 days)")
62 ("subject-name,N", po::value<std::string>(&subjectName),
63 "subject name")
64 ("subject-info,I", po::value<std::string>(&subjectInfo),
Alexander Afanasyev66cd4242014-10-18 22:39:49 -070065 "(deprecated, uses 'signed-info') subject info, pairs of OID and string "
66 " description: \"2.5.4.10 'University of California, Los Angeles'\"")
67 ("signed-info", po::value<std::vector<std::string> >(&signedInfo),
68 "a pair of OID and string (must be separated by a single space), e.g., "
69 "\"2.5.4.10 University of California, Los Angeles\". "
70 "May be repeated multiple times")
Yingdi Yuba8604d2014-10-13 19:03:12 -070071 ("sign-id,s", po::value<Name>(&signId)->default_value(keyChain.getDefaultIdentity()),
72 "signing identity")
Alexander Afanasyev66cd4242014-10-18 22:39:49 -070073 ("cert-prefix,p", po::value<Name>(&certPrefix),
Yingdi Yuba8604d2014-10-13 19:03:12 -070074 "cert prefix, which is the part of certificate name before "
75 "KEY component")
76 ("request,r", po::value<std::string>(&requestFile)->default_value("-"),
77 "request file name, - for stdin")
Yingdi Yue6bfab22014-02-06 16:01:19 -080078 ;
79
80 po::positional_options_description p;
81 p.add("request", 1);
82
83 po::variables_map vm;
84 try
85 {
Yingdi Yub61f5402014-02-26 17:46:11 -080086 po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(),
87 vm);
Yingdi Yue6bfab22014-02-06 16:01:19 -080088 po::notify(vm);
89 }
Yingdi Yub61f5402014-02-26 17:46:11 -080090 catch (const std::exception& e)
Yingdi Yue6bfab22014-02-06 16:01:19 -080091 {
92 std::cerr << "ERROR: " << e.what() << std::endl;
93 return 1;
94 }
95
Yingdi Yub61f5402014-02-26 17:46:11 -080096 if (vm.count("help") != 0)
Yingdi Yue6bfab22014-02-06 16:01:19 -080097 {
Yingdi Yuba8604d2014-10-13 19:03:12 -070098 std::cout << description << std::endl;
Yingdi Yu8d7468f2014-02-21 14:49:45 -080099 return 0;
Yingdi Yue6bfab22014-02-06 16:01:19 -0800100 }
101
Yingdi Yu0eb5d722014-06-10 15:06:25 -0700102 if (vm.count("subject-name") == 0)
Yingdi Yue6bfab22014-02-06 16:01:19 -0800103 {
Yingdi Yuba8604d2014-10-13 19:03:12 -0700104 std::cerr << "ERROR: subject name must be specified" << std::endl
105 << std::endl
106 << description << std::endl;
Yingdi Yu0eb5d722014-06-10 15:06:25 -0700107 return 1;
Yingdi Yue6bfab22014-02-06 16:01:19 -0800108 }
109
Yingdi Yu0eb5d722014-06-10 15:06:25 -0700110 std::vector<CertificateSubjectDescription> subjectDescription;
Yingdi Yu9d9d5992014-06-25 12:25:16 -0700111 subjectDescription.push_back(CertificateSubjectDescription(oid::ATTRIBUTE_NAME, subjectName));
Yingdi Yu0eb5d722014-06-10 15:06:25 -0700112
Alexander Afanasyev66cd4242014-10-18 22:39:49 -0700113 // 'subjectInfo' is deprecated and the following block will be removed eventually
Yingdi Yub61f5402014-02-26 17:46:11 -0800114 tokenizer<escaped_list_separator<char> > subjectInfoItems
Yingdi Yu9d9d5992014-06-25 12:25:16 -0700115 (subjectInfo, escaped_list_separator<char>("\\", " \t", "'\""));
Yingdi Yue6bfab22014-02-06 16:01:19 -0800116
Yingdi Yub61f5402014-02-26 17:46:11 -0800117 tokenizer<escaped_list_separator<char> >::iterator it =
118 subjectInfoItems.begin();
119
120 while (it != subjectInfoItems.end())
Yingdi Yue6bfab22014-02-06 16:01:19 -0800121 {
Yingdi Yub61f5402014-02-26 17:46:11 -0800122 std::string oid = *it;
123
124 it++;
125 if (it == subjectInfoItems.end())
Yingdi Yue6bfab22014-02-06 16:01:19 -0800126 {
Yingdi Yub61f5402014-02-26 17:46:11 -0800127 std::cerr << "ERROR: unmatched info for oid [" << oid << "]" << std::endl;
128 return 1;
Yingdi Yue6bfab22014-02-06 16:01:19 -0800129 }
Yingdi Yub61f5402014-02-26 17:46:11 -0800130
131 std::string value = *it;
132
Yingdi Yu9d9d5992014-06-25 12:25:16 -0700133 subjectDescription.push_back(CertificateSubjectDescription(OID(oid), value));
Yingdi Yub61f5402014-02-26 17:46:11 -0800134
135 it++;
Yingdi Yue6bfab22014-02-06 16:01:19 -0800136 }
137
Alexander Afanasyev66cd4242014-10-18 22:39:49 -0700138 // new 'signedInfo' processing
139 for (std::vector<std::string>::const_iterator info = signedInfo.begin();
140 info != signedInfo.end(); ++info) {
141 size_t pos = info->find(" ");
142 if (pos == std::string::npos) {
143 std::cerr << "ERROR: incorrectly formatted signed info block [" << *info << "]" << std::endl;
144 return 1;
145 }
146 OID oid(info->substr(0, pos));
147 std::string value = info->substr(pos + 1);
148
149 subjectDescription.push_back(CertificateSubjectDescription(oid, value));
150 }
151
Alexander Afanasyevb1db7c62014-04-03 14:57:25 -0700152 system_clock::TimePoint notBefore;
153 system_clock::TimePoint notAfter;
Yingdi Yue6bfab22014-02-06 16:01:19 -0800154
Yingdi Yub61f5402014-02-26 17:46:11 -0800155 if (vm.count("not-before") == 0)
156 {
Alexander Afanasyevb1db7c62014-04-03 14:57:25 -0700157 notBefore = system_clock::now();
Yingdi Yub61f5402014-02-26 17:46:11 -0800158 }
159 else
160 {
Alexander Afanasyevb1db7c62014-04-03 14:57:25 -0700161 notBefore = fromIsoString(notBeforeStr.substr(0, 8) + "T" +
162 notBeforeStr.substr(8, 6));
Yingdi Yub61f5402014-02-26 17:46:11 -0800163 }
Yingdi Yue6bfab22014-02-06 16:01:19 -0800164
Yingdi Yub61f5402014-02-26 17:46:11 -0800165 if (vm.count("not-after") == 0)
166 {
Alexander Afanasyevb1db7c62014-04-03 14:57:25 -0700167 notAfter = notBefore + days(365);
Yingdi Yub61f5402014-02-26 17:46:11 -0800168 }
169 else
170 {
Alexander Afanasyevb1db7c62014-04-03 14:57:25 -0700171 notAfter = fromIsoString(notAfterStr.substr(0, 8) + "T" +
172 notAfterStr.substr(8, 6));
Yingdi Yue6bfab22014-02-06 16:01:19 -0800173
Yingdi Yub61f5402014-02-26 17:46:11 -0800174 if (notAfter < notBefore)
175 {
Yingdi Yuba8604d2014-10-13 19:03:12 -0700176 std::cerr << "ERROR: not-before cannot be later than not-after" << std::endl
177 << std::endl
178 << description << std::endl;
Yingdi Yub61f5402014-02-26 17:46:11 -0800179 return 1;
180 }
181 }
182
183 if (vm.count("request") == 0)
Yingdi Yue6bfab22014-02-06 16:01:19 -0800184 {
Yingdi Yuba8604d2014-10-13 19:03:12 -0700185 std::cerr << "ERROR: request file must be specified" << std::endl
186 << std::endl
187 << description << std::endl;
Yingdi Yue6bfab22014-02-06 16:01:19 -0800188 return 1;
189 }
190
Yingdi Yub61f5402014-02-26 17:46:11 -0800191 shared_ptr<IdentityCertificate> selfSignedCertificate
192 = getIdentityCertificate(requestFile);
193
194 if (!static_cast<bool>(selfSignedCertificate))
Yingdi Yue6bfab22014-02-06 16:01:19 -0800195 {
196 std::cerr << "ERROR: input error" << std::endl;
197 return 1;
198 }
199
200 Name keyName = selfSignedCertificate->getPublicKeyName();
Yingdi Yu05842f22014-04-15 19:21:56 -0700201
Yingdi Yu0eb5d722014-06-10 15:06:25 -0700202 shared_ptr<IdentityCertificate> certificate =
203 keyChain.prepareUnsignedIdentityCertificate(keyName, selfSignedCertificate->getPublicKeyInfo(),
Yingdi Yuba8604d2014-10-13 19:03:12 -0700204 signId, notBefore, notAfter,
205 subjectDescription, certPrefix);
Yingdi Yu05842f22014-04-15 19:21:56 -0700206
Yingdi Yuc4c81202014-07-08 11:07:50 -0700207 if (!static_cast<bool>(certificate))
208 {
Yingdi Yuba8604d2014-10-13 19:03:12 -0700209 std::cerr << "ERROR: key name is not formated correctly or does not match certificate name"
Yingdi Yuc4c81202014-07-08 11:07:50 -0700210 << std::endl;
211 return 1;
212 }
213
Yingdi Yuba8604d2014-10-13 19:03:12 -0700214 keyChain.createIdentity(signId);
215 Name signingCertificateName = keyChain.getDefaultCertificateNameForIdentity(signId);
Yingdi Yu1b0311c2015-06-10 14:58:47 -0700216 keyChain.sign(*certificate,
217 security::SigningInfo(security::SigningInfo::SIGNER_TYPE_CERT,
218 signingCertificateName));
Yingdi Yue6bfab22014-02-06 16:01:19 -0800219
Yingdi Yu0eb5d722014-06-10 15:06:25 -0700220 Block wire = certificate->wireEncode();
Yingdi Yue6bfab22014-02-06 16:01:19 -0800221
Yingdi Yu8d7468f2014-02-21 14:49:45 -0800222 try
223 {
224 using namespace CryptoPP;
225 StringSource ss(wire.wire(), wire.size(), true,
226 new Base64Encoder(new FileSink(std::cout), true, 64));
227 }
Yingdi Yub61f5402014-02-26 17:46:11 -0800228 catch (const CryptoPP::Exception& e)
Yingdi Yu8d7468f2014-02-21 14:49:45 -0800229 {
230 std::cerr << "ERROR: " << e.what() << std::endl;
231 return 1;
232 }
Yingdi Yue6bfab22014-02-06 16:01:19 -0800233
234 return 0;
235}
Yingdi Yu8d7468f2014-02-21 14:49:45 -0800236
Alexander Afanasyevd7db8bf2015-01-04 15:31:02 -0800237#endif // NDN_TOOLS_NDNSEC_CERT_GEN_HPP