simpleca.c

simpleca 比起正式的CA来说功能简单

void print_semicolon_list(struct stringlist *lst)
{
  printf("%s\n", semicolon_list(lst));
}

/* Given a certificate, read key usage information from the certificate
   and print it as a list of usages separated by semicolons. */
char *dump_usage(CRYPT_CERTIFICATE cert)
{
  struct stringlist *lst;
  int i, res, val;
  lst = NULL;
  res = cryptGetAttribute(cert, CRYPT_CERTINFO_KEYUSAGE, &val);
  if(res) die("Could not retrieve key usage information.");
  for(i=0; i<NUM_USAGE; i++) {
    if(val & usagetable[i].code)
      stringlist_append(&lst, usagetable[i].txt);
  }
  return(semicolon_list(lst));
}

/* Given a certificate, read key usage information from the certificate
   and print it as a list of usages separated by semicolons. */
char *dump_ext_usage(CRYPT_CERTIFICATE cert)
{
  struct stringlist *lst;
  int i, res, val;
  lst = NULL;
  for(i=0; i<NUM_EXTUSAGE; i++) {
    res = cryptGetAttribute(cert, extusagetable[i].code, &val);
    if(!res)
      stringlist_append(&lst, extusagetable[i].txt);
  }
  return(semicolon_list(lst));
}

/* Given a number of seconds since 1970, print it as a nice
   local time (human readable). */
void print_time(long t) {
  struct tm *time;
  time = localtime(&t);
  printf("%s", asctime(time));
}

/* Given data in global variables, try to interpret
   and show the user the contents of a file.  The file
   may be a key, a certificate, a certificate request,
   or a CRL. 
*/
void view(void)
{
  int res;
  int isakeyset, length, selfsigned, ca;
  char buffer[MAXBUF];
  char *tmp;
  CRYPT_KEYSET keyset;
  CRYPT_CONTEXT pubkey;
  CRYPT_CERTIFICATE cert;
  int type, version;
  isakeyset=FALSE;
  /* Try to open it as a keyset */
  res = cryptKeysetOpen(&keyset, 
			CRYPT_UNUSED, 
			CRYPT_KEYSET_FILE, 
			inputfile, 
			CRYPT_KEYOPT_READONLY);
  if(!res) isakeyset=TRUE;
  if(isakeyset) {
    printf("KEY\n");
    res = cryptGetPublicKey(keyset, &pubkey, CRYPT_KEYID_NAME, "private");
    if(res) die("Could not retrieve public key from keyset.");
    res = cryptGetAttributeString(pubkey, CRYPT_CTXINFO_NAME_ALGO, buffer, &length);
    if(res) die("Could not get algorithm name.");
    buffer[length]=0;
    printf("Algorithm = %s\n", buffer);
    res = cryptGetAttribute(pubkey, CRYPT_CTXINFO_KEYSIZE, &length);
    if(res) die("Could not get key size.");
    printf("Key size = %d\n", length*8);
    res = cryptGetAttribute(pubkey, CRYPT_CERTINFO_CA, &length);
    if(!res && length>0)
      printf("CA = true\n");
    else
      printf("CA = false\n");
    res = cryptKeysetClose(keyset);
    if(res) die("Could not close keyset.");
    res = cryptDestroyContext(pubkey);
    if(res) die("Could not free public key.");
    return;
  } else {
    /* It is not a keyset. */
    /* Now try to import it as some sort of certificate. */
    cert = import_cert(inputfile);
    /* Determine which of certificate/request/crl it is. */
    res = cryptGetAttribute(cert, CRYPT_CERTINFO_CERTTYPE, &type);
    if(res) die("Could not determine certificate type.");
    switch(type) {
    case CRYPT_CERTTYPE_CERTREQUEST: printf("CERTIFICATE REQUEST\n"); break;
    case CRYPT_CERTTYPE_CERTIFICATE: printf("CERTIFICATE\n"); break;
    case CRYPT_CERTTYPE_CRL: printf("CERTIFICATE REVOCATION LIST\n"); break;
    }
    /* Depending on the type, extract and display different information. */
    if(type==CRYPT_CERTTYPE_CERTIFICATE) {
      res = cryptGetAttribute(cert, CRYPT_CERTINFO_VERSION, &version);
      if(res) die("Could not determine certificate version.");
      printf("Version = X509v%d\n", version);
      res = cryptGetAttributeString(cert, CRYPT_CERTINFO_SERIALNUMBER, buffer, &length);
      if(res) die("Could not retrieve certificate serial number.");
      printf("Serial number = %s\n", sn_to_string((unsigned char *)buffer));
    }

    if(type==CRYPT_CERTTYPE_CERTIFICATE || type==CRYPT_CERTTYPE_CERTREQUEST) {
      res=cryptGetAttributeString(cert, CRYPT_CTXINFO_NAME_ALGO, buffer, &length);
      if(res) die("Could not get algorithm name.");
      buffer[length]=0;
      printf("Algorithm = %s\n", buffer);
      res=cryptGetAttribute(cert, CRYPT_CTXINFO_KEYSIZE, &length);
      if(res) die("Could not get key size.");
      printf("Key size (bits) = %d\n", length*8);
    }

    if(type==CRYPT_CERTTYPE_CERTIFICATE || type==CRYPT_CERTTYPE_CERTREQUEST) {

      strcpy(buffer, get_dn(cert));
      printf("Subject = %s\n", buffer);
      
      res=cryptSetAttribute(cert, CRYPT_CERTINFO_CURRENT_EXTENSION, CRYPT_CERTINFO_SUBJECTALTNAME);
      if(!res) {
	strcpy(buffer, get_gn(cert));
	if(strcmp(buffer, ""))
	  printf("Subject alternate name = %s\n", buffer);
      }
    }
    if(type==CRYPT_CERTTYPE_CERTIFICATE) {
      res=cryptSetAttribute(cert, CRYPT_CERTINFO_ISSUERNAME, CRYPT_UNUSED);
      if(res) die("Could not switch to certificate issuer.");
      strcpy(buffer, get_dn(cert));
      printf("Issuer = %s\n", buffer);

      res=cryptSetAttribute(cert, CRYPT_CERTINFO_CURRENT_EXTENSION, CRYPT_CERTINFO_ISSUERALTNAME);
      if(!res) {
	strcpy(buffer, get_gn(cert));
	if(strcmp(buffer, ""))
	  printf("Issuer alternate name = %s\n", buffer);
      }
      /* THIS CODE DOES NOT WORK, it just gets the subject algorithm
      res=cryptGetAttributeString(cert, CRYPT_CTXINFO_NAME_ALGO, buffer, &length);
      if(res) die("Could not get algorithm name.");
      buffer[length]=0;
      printf("Signature algorithm = %s\n", buffer);
      */

      res=cryptGetAttributeString(cert, CRYPT_CERTINFO_VALIDFROM, buffer, &length);
      if(res) die("Could not get valid-from date in certificate.");
      printf("Start-date = ");
      print_time(*((int *)buffer));
      
      res=cryptGetAttributeString(cert, CRYPT_CERTINFO_VALIDTO, buffer, &length);
      if(res) die("Could not get valid-to date in certificate.");
      printf("End-date = ");
      print_time(*((int *)buffer));      
    }
    if(type==CRYPT_CERTTYPE_CRL) {
      res=cryptGetAttributeString(cert, CRYPT_CERTINFO_THISUPDATE, buffer, &length);
      if(res) die("Could not get CRL-this-update date in certificate.");
      printf("CRL-this-update = ");
      print_time(*((int *)buffer));
      
      res=cryptGetAttributeString(cert, CRYPT_CERTINFO_NEXTUPDATE, buffer, &length);
      if(res) die("Could not get CRL-next-update date in certificate.");
      printf("CRL-next-update = ");
      print_time(*((int *)buffer));
    }

    selfsigned=FALSE;
    if(type==CRYPT_CERTTYPE_CERTIFICATE || type==CRYPT_CERTTYPE_CERTREQUEST) {
      res=cryptGetAttribute(cert, CRYPT_CERTINFO_SELFSIGNED, &selfsigned);
      if(res) selfsigned=0;
      if(selfsigned) {
	printf("Self-signed = true\n");
	res=cryptCheckCert(cert, CRYPT_UNUSED);
	if(res)
	  printf("Valid-signature = false\n");
	else
	  printf("Valid-signature = true\n");
      }
      else
	printf("Self-signed = false\n");
    }
    ca=FALSE;
    if(type==CRYPT_CERTTYPE_CERTIFICATE) {
      res=cryptGetAttribute(cert, CRYPT_CERTINFO_CA, &ca);
      if(res) ca=FALSE;
      if(ca)
	printf("CA certificate = true\n");
      else
	printf("CA certificate = false\n");
      tmp = dump_usage(cert);
      if(strlen(tmp)>0)
	printf("Key usage = %s\n", tmp);
      tmp = dump_ext_usage(cert);
      if(strlen(tmp)>0)
	printf("Extended key usage = %s\n", tmp);
      if(ca) {
	/* Show CRLDP if present */
	res=cryptSetAttribute(cert, CRYPT_CERTINFO_CURRENT_FIELD, CRYPT_CERTINFO_CRLDIST_FULLNAME);
	if(!res) {
	  res=cryptGetAttributeString(cert, CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, buffer, &length);
	  if(!res) {
	    buffer[length]=0;
	    printf("CRL Distribution point = %s\n", buffer);
	  }
	}
      }
    }
    if(type==CRYPT_CERTTYPE_CRL) {
      printf("Serial Number\t\tRevocation Date\n");
      res=cryptSetAttribute(cert, CRYPT_CERTINFO_CURRENT_CERTIFICATE, 
			    CRYPT_CURSOR_FIRST);
      if(res) {
	printf("NONE\n");
      } else {
	while(TRUE) {
	  res=cryptGetAttributeString(cert, CRYPT_CERTINFO_SERIALNUMBER, buffer, &length);
	  if(res) die("Could not retrieve serial number of revoked certificate in CRL.");
	  printf("%s\t", sn_to_string((unsigned char *)buffer));
	  res=cryptGetAttributeString(cert, CRYPT_CERTINFO_REVOCATIONDATE, buffer, &length);
	  if(res) die("Could not retrive revocation date of revoked certificate in CRL.");
	  print_time(*((int *)buffer));
	  res=cryptSetAttribute(cert, CRYPT_CERTINFO_CURRENT_CERTIFICATE, 
				CRYPT_CURSOR_NEXT);
	  if(res) break;
	}
      }
    }
  }
}

/* Show the allowable fields for subjects and key-usages. */
void values(void)
{
  int i;
  printf("The following fields are legal for the subject:\n");
  /*  printf("\t  bc (business category)\n"); */
  printf("\t c (2 letter country code)\n");
  printf("\t cn (common name)\n");
  /* 
     printf("\t  d (description)\n");
     printf("\t  dc (domain component)\n");
     printf("\t  g (given name)\n");
     printf("\t  i (initials)\n");
     printf("\t  isdn (international isdn number)\n");
  */
  printf("\t l (locality)\n");
  printf("\t o (organization name)\n");
  printf("\t ou (organizational unit)\n");
  /*
    printf("\t  s (surname)\n");
    printf("\t  sn (serial number)\n");
  */
  printf("\t sp (state or province)\n");
  /*
    printf("\t  st (street address)\n");
    printf("\t  t (title)\n");
  */
  /*
    printf("Fields should be listed from most specific to least specific.\n\n");
  */
  printf("The following fields are valid in the subject alt-name:\n");
  for(i=0; i<NUM_SUBJ_ALT_ATTR; i++)
    printf("\t%s\n", subjalttable[i].txt);
  printf("The following fields are legal for key usage:\n");
  for(i=0; i<NUM_USAGE; i++)
    printf("\t%s\n", usagetable[i].txt);
  printf("The following fields are legal for extended key usage:\n");
  for(i=0; i<NUM_EXTUSAGE; i++)
    printf("\t%s\n", extusagetable[i].txt);
  printf("\n");
}

/* Given an action set in the global variable action,
   do the right thing.
*/
void do_action(void)
{
  if(show_values) {
    if(subject) {
      printf("subj = ");
      print_semicolon_list(subject);
      printf("\n");
    }
    if(subject_alt) {
      printf("subj-alt = ");
      print_semicolon_list(subject_alt);
      printf("\n");
    }
    if(usage) {
      printf("key-usage = ");
      print_semicolon_list(usage);
      printf("\n");
    }
    if(ext_usage) {
      printf("ext-key-usage = ");
      print_semicolon_list(ext_usage);
      printf("\n");
    }
    if(action==ACTION_CREATECA || action==ACTION_CREATECERT) {
      printf("start-date = ");
      print_time(validfrom);
      printf("end-date = ");
      print_time(validto);
    }
    if(action==ACTION_CREATECRL)
      printf("crl-next-update = %d\n", crl_next_update);
    if(crldp)
      printf("crldp = %s\n", crldp);
    if(inputfile)
      switch(action) {
      case ACTION_VIEW:
	printf("view = %s\n", inputfile);
	break;
      case ACTION_CREATECRL:
	printf("crl-contents = %s\n", inputfile);
	break;
      case ACTION_CREATECERT:
	printf("request = %s\n", inputfile);
	break;
      default:
	printf("input-file = %s\n", inputfile);
	break;
      }
    if(outputfile)
      switch(action) {
      case ACTION_CREATECA:
	printf("create-new-ca = %s\n", outputfile);
	break;
      case ACTION_CREATECERT:
	printf("create-cert = %s\n", outputfile);
	break;
      case ACTION_CREATECRL:
	printf("create-crl = %s\n", outputfile);
	break;
      case ACTION_CREATEREQUEST:
	printf("create-request = %s\n", outputfile);
	break;
      case ACTION_CREATEKEYS:
	printf("create-keys = %s\n", outputfile);
	break;
      default:
	printf("output-file = %s\n", outputfile);
	break;
      }
    if(keyfile)
      printf("priv-key = %s\n", keyfile);
    if(cert_dup_dir)
      printf("crldp = %s\n", cert_dup_dir);
    if(password)
      printf("password = %s\n", password);
    if(keysize>0)
      printf("key-size = %d\n", keysize);
  }
  switch(action) {
  case ACTION_NONE:
    die("No action specified.");
    break;
  case ACTION_CREATECA:
    create_new_ca();
    break;
  case ACTION_CREATEKEYS:
    create_keys();
    break;
  case ACTION_CREATEREQUEST:
    create_request();
    break;
  case ACTION_CREATECERT:
    create_cert();
    break;
  case ACTION_CREATECRL:
    create_crl();
    break;
  case ACTION_VIEW:
    view();
    break;
  case ACTION_VALUES:
    values();
    break;
  default:
    die("Unknown action.");
  }
}

/* Remove spaces from the front and end of a string. 
 */
char *squeeze_spaces(char *txt)
{
  char *p;
  char *res;
  res = strdup(txt);
  while(*res==' ') res++;
  p = res + strlen(res) - 1;
  while(*p == ' ' && p>=res) { *p = 0; p--; }
  return res;
}

/* Remove possible quotation marks surrounding a string.
 */
char *squeeze_quotes(char *txt)
{
  char *res;
  res = strdup(txt);
  if(res[0]=='"' && res[strlen(res)-1]=='"') {
    res[strlen(res)-1]=0;
    res++;
  }
  return res;    
}

/* Given a line of text, process it as a command line option. 
 */
void process_line(char *line)
{
  char *left, *right, *p;
  if(entirely_spaces(line)) return;
  if(comment(line)) return;
  line = squeeze_spaces(line);
  line = squeeze_quotes(line);
  line = squeeze_spaces(line);
  p=strchr(line, '=');
  if(p==NULL) {
    process_singleton(line);
  } else {
    *p = 0;
    left = line;
    right = p+1;
    left = squeeze_spaces(left);
    left = squeeze_quotes(left);
    left = squeeze_spaces(left);
    right = squeeze_spaces(right);
    right = squeeze_quotes(right);
    right = squeeze_spaces(right);
    process_pair(left, right);
  }
}

/* Given a configuration file, use it if it exists, give a warning
   and continue if it does not exist. */
void process_default_file(char *filename)
{
  FILE *fp;
  fp=fopen(filename, "rt");
  if(!fp) {
    /* printf("WARNING: Could not open default configuration file %s.\n", filename); */
    return;
  }
  fclose(fp);
  process_file(filename);
}


/* Given a file, consider each line to be an argument
   to the program. */
void process_file(char *filename)
{
  FILE *fp;
  char buffer[MAXBUF];
  fp=fopen(filename, "rt");
  if(!fp) {
    printf("ERROR: Could not open %s for reading.\n", filename);
    exit(EXIT_FAILURE);
  }
  while(!(feof(fp))) {
    memset(buffer, 0, MAXBUF);
    fgets(buffer, MAXBUF, fp);
    process_line(chomp(buffer));
  }
  fclose(fp);
}

/* Process the actual command line arguments passed
   to the program. */
void process_args(int argc, char *argv[])
{
  int i;
  for(i=1; i<argc; i++) {
    process_line(argv[i]);
  }
}



/* MAIN */


int main(int argc, char *argv[])
{
  /* Initialize cryptlib */
  cryptInit();
  /* Set default values for all global variables. */
  set_defaults();
  /* Process the original config file in preset location. */
  /* Later values may overwrite anything this does. */
  process_default_file(DEFAULT_CONFIG_FILE);
  /* Process the arguments passed by the user. */
  process_args(argc, argv);
  /* All global variables set, do the action. */
  do_action();
  /* Close cryptlib and we're done. */
  cryptEnd();
  return 0;
}