199ebb4caSwyllys /* 299ebb4caSwyllys * CDDL HEADER START 399ebb4caSwyllys * 499ebb4caSwyllys * The contents of this file are subject to the terms of the 599ebb4caSwyllys * Common Development and Distribution License (the "License"). 699ebb4caSwyllys * You may not use this file except in compliance with the License. 799ebb4caSwyllys * 899ebb4caSwyllys * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 999ebb4caSwyllys * or http://www.opensolaris.org/os/licensing. 1099ebb4caSwyllys * See the License for the specific language governing permissions 1199ebb4caSwyllys * and limitations under the License. 1299ebb4caSwyllys * 1399ebb4caSwyllys * When distributing Covered Code, include this CDDL HEADER in each 1499ebb4caSwyllys * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 1599ebb4caSwyllys * If applicable, add the following below this CDDL HEADER, with the 1699ebb4caSwyllys * fields enclosed by brackets "[]" replaced with your own identifying 1799ebb4caSwyllys * information: Portions Copyright [yyyy] [name of copyright owner] 1899ebb4caSwyllys * 1999ebb4caSwyllys * CDDL HEADER END 2099ebb4caSwyllys * 2199ebb4caSwyllys * 2230a5e8faSwyllys * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 2399ebb4caSwyllys * Use is subject to license terms. 2499ebb4caSwyllys */ 2599ebb4caSwyllys 2699ebb4caSwyllys #pragma ident "%Z%%M% %I% %E% SMI" 2799ebb4caSwyllys 2899ebb4caSwyllys #include <stdio.h> 2999ebb4caSwyllys #include <string.h> 3099ebb4caSwyllys #include <ctype.h> 3199ebb4caSwyllys #include <malloc.h> 3299ebb4caSwyllys #include <libgen.h> 3399ebb4caSwyllys #include <errno.h> 3499ebb4caSwyllys #include <cryptoutil.h> 3599ebb4caSwyllys #include <security/cryptoki.h> 3699ebb4caSwyllys #include "common.h" 3799ebb4caSwyllys 3899ebb4caSwyllys #include <kmfapi.h> 3999ebb4caSwyllys 4099ebb4caSwyllys #define SET_VALUE(f, s) \ 4199ebb4caSwyllys kmfrv = f; \ 4299ebb4caSwyllys if (kmfrv != KMF_OK) { \ 4399ebb4caSwyllys cryptoerror(LOG_STDERR, \ 4499ebb4caSwyllys gettext("Failed to %s: 0x%02\n"), \ 4599ebb4caSwyllys s, kmfrv); \ 4699ebb4caSwyllys goto cleanup; \ 4799ebb4caSwyllys } 4899ebb4caSwyllys 4999ebb4caSwyllys static KMF_RETURN 5099ebb4caSwyllys gencsr_pkcs11(KMF_HANDLE_T kmfhandle, 5199ebb4caSwyllys char *token, char *subject, char *altname, 5299ebb4caSwyllys KMF_GENERALNAMECHOICES alttype, int altcrit, 5399ebb4caSwyllys char *certlabel, KMF_KEY_ALG keyAlg, 5499ebb4caSwyllys int keylen, 5599ebb4caSwyllys uint16_t kubits, int kucrit, 5699ebb4caSwyllys KMF_ENCODE_FORMAT fmt, char *csrfile, 5799ebb4caSwyllys KMF_CREDENTIAL *tokencred) 5899ebb4caSwyllys { 5999ebb4caSwyllys KMF_RETURN kmfrv = KMF_OK; 6099ebb4caSwyllys KMF_KEY_HANDLE pubk, prik; 6199ebb4caSwyllys KMF_X509_NAME csrSubject; 6299ebb4caSwyllys KMF_CSR_DATA csr; 6399ebb4caSwyllys KMF_ALGORITHM_INDEX sigAlg; 6499ebb4caSwyllys KMF_DATA signedCsr = {NULL, 0}; 6599ebb4caSwyllys 6630a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN; 6730a5e8faSwyllys int numattr = 0; 6830a5e8faSwyllys KMF_ATTRIBUTE attrlist[16]; 6930a5e8faSwyllys boolean_t storekey = TRUE; 7030a5e8faSwyllys 7199ebb4caSwyllys (void) memset(&csr, 0, sizeof (csr)); 7299ebb4caSwyllys (void) memset(&csrSubject, 0, sizeof (csrSubject)); 7399ebb4caSwyllys 7499ebb4caSwyllys if (keyAlg == KMF_DSA) 7599ebb4caSwyllys sigAlg = KMF_ALGID_SHA1WithDSA; 7699ebb4caSwyllys else 7799ebb4caSwyllys sigAlg = KMF_ALGID_MD5WithRSA; 7899ebb4caSwyllys 7999ebb4caSwyllys 8099ebb4caSwyllys /* If the subject name cannot be parsed, flag it now and exit */ 8130a5e8faSwyllys if ((kmfrv = kmf_dn_parser(subject, &csrSubject)) != KMF_OK) { 8299ebb4caSwyllys return (kmfrv); 8399ebb4caSwyllys } 8499ebb4caSwyllys 8599ebb4caSwyllys /* Select a PKCS11 token */ 8699ebb4caSwyllys kmfrv = select_token(kmfhandle, token, FALSE); 8799ebb4caSwyllys if (kmfrv != KMF_OK) { 8899ebb4caSwyllys return (kmfrv); 8999ebb4caSwyllys } 9099ebb4caSwyllys 9130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 9230a5e8faSwyllys &kstype, sizeof (kstype)); 9330a5e8faSwyllys numattr++; 9430a5e8faSwyllys 9530a5e8faSwyllys if (certlabel != NULL && strlen(certlabel)) { 9630a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLABEL_ATTR, 9730a5e8faSwyllys certlabel, strlen(certlabel)); 9830a5e8faSwyllys numattr++; 9930a5e8faSwyllys } 10030a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLENGTH_ATTR, 10130a5e8faSwyllys &keylen, sizeof (keylen)); 10230a5e8faSwyllys numattr++; 10330a5e8faSwyllys 10430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYALG_ATTR, 10530a5e8faSwyllys &keyAlg, sizeof (keyAlg)); 10630a5e8faSwyllys numattr++; 10730a5e8faSwyllys 10830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR, 10930a5e8faSwyllys tokencred, sizeof (KMF_CREDENTIAL)); 11030a5e8faSwyllys numattr++; 11130a5e8faSwyllys 11230a5e8faSwyllys if (token && strlen(token)) { 11330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR, 11430a5e8faSwyllys token, strlen(token)); 11530a5e8faSwyllys numattr++; 11630a5e8faSwyllys } 11730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR, 11830a5e8faSwyllys &pubk, sizeof (KMF_KEY_HANDLE)); 11930a5e8faSwyllys numattr++; 12030a5e8faSwyllys 12130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PRIVKEY_HANDLE_ATTR, 12230a5e8faSwyllys &prik, sizeof (KMF_KEY_HANDLE)); 12330a5e8faSwyllys numattr++; 12430a5e8faSwyllys 12530a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_STOREKEY_BOOL_ATTR, 12630a5e8faSwyllys &storekey, sizeof (storekey)); 12730a5e8faSwyllys numattr++; 12830a5e8faSwyllys 12930a5e8faSwyllys kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist); 13099ebb4caSwyllys if (kmfrv != KMF_OK) { 13199ebb4caSwyllys return (kmfrv); 13299ebb4caSwyllys } 13399ebb4caSwyllys 13430a5e8faSwyllys SET_VALUE(kmf_set_csr_pubkey(kmfhandle, &pubk, &csr), "keypair"); 13599ebb4caSwyllys 13630a5e8faSwyllys SET_VALUE(kmf_set_csr_version(&csr, 2), "version number"); 13799ebb4caSwyllys 13830a5e8faSwyllys SET_VALUE(kmf_set_csr_subject(&csr, &csrSubject), "subject name"); 13999ebb4caSwyllys 14030a5e8faSwyllys SET_VALUE(kmf_set_csr_sig_alg(&csr, sigAlg), 14130a5e8faSwyllys "SignatureAlgorithm"); 14299ebb4caSwyllys 14399ebb4caSwyllys if (altname != NULL) { 14430a5e8faSwyllys SET_VALUE(kmf_set_csr_subject_altname(&csr, altname, altcrit, 14530a5e8faSwyllys alttype), "SetCSRSubjectAltName"); 14699ebb4caSwyllys } 14799ebb4caSwyllys 14899ebb4caSwyllys if (kubits != 0) { 14930a5e8faSwyllys SET_VALUE(kmf_set_csr_ku(&csr, kucrit, kubits), 15030a5e8faSwyllys "SetCSRKeyUsage"); 15199ebb4caSwyllys } 15299ebb4caSwyllys 15330a5e8faSwyllys if ((kmfrv = kmf_sign_csr(kmfhandle, &csr, &prik, &signedCsr)) == 15430a5e8faSwyllys KMF_OK) { 15530a5e8faSwyllys kmfrv = kmf_create_csr_file(&signedCsr, fmt, csrfile); 15699ebb4caSwyllys } 15799ebb4caSwyllys 15899ebb4caSwyllys cleanup: 15930a5e8faSwyllys (void) kmf_free_data(&signedCsr); 16030a5e8faSwyllys (void) kmf_free_kmf_key(kmfhandle, &prik); 16199ebb4caSwyllys /* delete the key */ 16230a5e8faSwyllys numattr = 0; 16330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 16430a5e8faSwyllys &kstype, sizeof (kstype)); 16530a5e8faSwyllys numattr++; 16630a5e8faSwyllys 16730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR, 16830a5e8faSwyllys &pubk, sizeof (KMF_KEY_HANDLE)); 16930a5e8faSwyllys numattr++; 17030a5e8faSwyllys 17130a5e8faSwyllys (void) kmf_delete_key_from_keystore(kmfhandle, numattr, attrlist); 17230a5e8faSwyllys 17330a5e8faSwyllys (void) kmf_free_signed_csr(&csr); 17499ebb4caSwyllys 17599ebb4caSwyllys return (kmfrv); 17699ebb4caSwyllys } 17799ebb4caSwyllys 17899ebb4caSwyllys static KMF_RETURN 17999ebb4caSwyllys gencsr_file(KMF_HANDLE_T kmfhandle, 18099ebb4caSwyllys KMF_KEY_ALG keyAlg, 18199ebb4caSwyllys int keylen, KMF_ENCODE_FORMAT fmt, 18299ebb4caSwyllys char *subject, char *altname, KMF_GENERALNAMECHOICES alttype, 18399ebb4caSwyllys int altcrit, uint16_t kubits, int kucrit, 18499ebb4caSwyllys char *dir, char *outcsr, char *outkey) 18599ebb4caSwyllys { 18699ebb4caSwyllys KMF_RETURN kmfrv; 18799ebb4caSwyllys KMF_KEY_HANDLE pubk, prik; 18899ebb4caSwyllys KMF_X509_NAME csrSubject; 18999ebb4caSwyllys KMF_CSR_DATA csr; 19099ebb4caSwyllys KMF_ALGORITHM_INDEX sigAlg; 19199ebb4caSwyllys KMF_DATA signedCsr = {NULL, 0}; 19299ebb4caSwyllys char *fullcsrpath = NULL; 19399ebb4caSwyllys char *fullkeypath = NULL; 19499ebb4caSwyllys 19530a5e8faSwyllys int numattr = 0; 19630a5e8faSwyllys KMF_ATTRIBUTE attrlist[16]; 19730a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL; 19830a5e8faSwyllys boolean_t storekey = TRUE; 19930a5e8faSwyllys 20099ebb4caSwyllys (void) memset(&csr, 0, sizeof (csr)); 20199ebb4caSwyllys (void) memset(&csrSubject, 0, sizeof (csrSubject)); 20299ebb4caSwyllys 20399ebb4caSwyllys if (EMPTYSTRING(outcsr) || EMPTYSTRING(outkey)) { 20499ebb4caSwyllys cryptoerror(LOG_STDERR, 20530a5e8faSwyllys gettext("No output file was specified for " 20630a5e8faSwyllys "the csr or key\n")); 20799ebb4caSwyllys return (KMF_ERR_BAD_PARAMETER); 20899ebb4caSwyllys } 20999ebb4caSwyllys if (dir != NULL) { 21099ebb4caSwyllys fullcsrpath = get_fullpath(dir, outcsr); 21199ebb4caSwyllys if (fullcsrpath == NULL) { 21299ebb4caSwyllys cryptoerror(LOG_STDERR, 21330a5e8faSwyllys gettext("Cannot create file %s in " 21430a5e8faSwyllys "directory %s\n"), dir, outcsr); 21599ebb4caSwyllys return (PK_ERR_USAGE); 21699ebb4caSwyllys } 21799ebb4caSwyllys } else { 21899ebb4caSwyllys fullcsrpath = strdup(outcsr); 21999ebb4caSwyllys } 22099ebb4caSwyllys if (verify_file(fullcsrpath)) { 22199ebb4caSwyllys cryptoerror(LOG_STDERR, 22230a5e8faSwyllys gettext("Cannot write the indicated output " 22330a5e8faSwyllys "certificate file (%s).\n"), fullcsrpath); 22499ebb4caSwyllys free(fullcsrpath); 22599ebb4caSwyllys return (PK_ERR_USAGE); 22699ebb4caSwyllys } 22799ebb4caSwyllys if (dir != NULL) { 22899ebb4caSwyllys fullkeypath = get_fullpath(dir, outkey); 22999ebb4caSwyllys if (fullkeypath == NULL) { 23099ebb4caSwyllys cryptoerror(LOG_STDERR, 23130a5e8faSwyllys gettext("Cannot create file %s in " 23230a5e8faSwyllys "directory %s\n"), dir, outkey); 23399ebb4caSwyllys free(fullcsrpath); 23499ebb4caSwyllys return (PK_ERR_USAGE); 23599ebb4caSwyllys } 23699ebb4caSwyllys } else { 23799ebb4caSwyllys fullkeypath = strdup(outkey); 23899ebb4caSwyllys } 23999ebb4caSwyllys if (verify_file(fullcsrpath)) { 24099ebb4caSwyllys cryptoerror(LOG_STDERR, 24130a5e8faSwyllys gettext("Cannot write the indicated output " 24230a5e8faSwyllys "key file (%s).\n"), fullkeypath); 24399ebb4caSwyllys free(fullcsrpath); 24499ebb4caSwyllys return (PK_ERR_USAGE); 24599ebb4caSwyllys } 24699ebb4caSwyllys 24799ebb4caSwyllys if (keyAlg == KMF_DSA) 24899ebb4caSwyllys sigAlg = KMF_ALGID_SHA1WithDSA; 24999ebb4caSwyllys else 25099ebb4caSwyllys sigAlg = KMF_ALGID_MD5WithRSA; 25199ebb4caSwyllys 25299ebb4caSwyllys /* If the subject name cannot be parsed, flag it now and exit */ 25330a5e8faSwyllys if ((kmfrv = kmf_dn_parser(subject, &csrSubject)) != KMF_OK) { 25499ebb4caSwyllys return (kmfrv); 25599ebb4caSwyllys } 25699ebb4caSwyllys 25730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 25830a5e8faSwyllys &kstype, sizeof (kstype)); 25930a5e8faSwyllys numattr++; 26030a5e8faSwyllys 26130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_FILENAME_ATTR, 26230a5e8faSwyllys fullkeypath, strlen(fullkeypath)); 26330a5e8faSwyllys numattr++; 26430a5e8faSwyllys 26530a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLENGTH_ATTR, 26630a5e8faSwyllys &keylen, sizeof (keylen)); 26730a5e8faSwyllys numattr++; 26830a5e8faSwyllys 26930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYALG_ATTR, 27030a5e8faSwyllys &keyAlg, sizeof (keyAlg)); 27130a5e8faSwyllys numattr++; 27230a5e8faSwyllys 27330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_ENCODE_FORMAT_ATTR, 27430a5e8faSwyllys &fmt, sizeof (fmt)); 27530a5e8faSwyllys numattr++; 27699ebb4caSwyllys 27730a5e8faSwyllys (void) memset(&prik, 0, sizeof (prik)); 27830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PRIVKEY_HANDLE_ATTR, 27930a5e8faSwyllys &prik, sizeof (KMF_KEY_HANDLE)); 28030a5e8faSwyllys numattr++; 28199ebb4caSwyllys 28230a5e8faSwyllys (void) memset(&pubk, 0, sizeof (pubk)); 28330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR, 28430a5e8faSwyllys &pubk, sizeof (KMF_KEY_HANDLE)); 28530a5e8faSwyllys numattr++; 28630a5e8faSwyllys 28730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_STOREKEY_BOOL_ATTR, 28830a5e8faSwyllys &storekey, sizeof (storekey)); 28930a5e8faSwyllys numattr++; 29030a5e8faSwyllys 29130a5e8faSwyllys kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist); 29299ebb4caSwyllys if (kmfrv != KMF_OK) { 29399ebb4caSwyllys goto cleanup; 29499ebb4caSwyllys } 29530a5e8faSwyllys SET_VALUE(kmf_set_csr_pubkey(kmfhandle, &pubk, &csr), 29630a5e8faSwyllys "SetCSRPubKey"); 29799ebb4caSwyllys 29830a5e8faSwyllys SET_VALUE(kmf_set_csr_version(&csr, 2), "SetCSRVersion"); 29999ebb4caSwyllys 30030a5e8faSwyllys SET_VALUE(kmf_set_csr_subject(&csr, &csrSubject), 30130a5e8faSwyllys "kmf_set_csr_subject"); 30299ebb4caSwyllys 30330a5e8faSwyllys SET_VALUE(kmf_set_csr_sig_alg(&csr, sigAlg), "kmf_set_csr_sig_alg"); 30499ebb4caSwyllys 30599ebb4caSwyllys if (altname != NULL) { 30630a5e8faSwyllys SET_VALUE(kmf_set_csr_subject_altname(&csr, altname, altcrit, 30730a5e8faSwyllys alttype), "kmf_set_csr_subject_altname"); 30899ebb4caSwyllys } 30999ebb4caSwyllys if (kubits != NULL) { 31030a5e8faSwyllys SET_VALUE(kmf_set_csr_ku(&csr, kucrit, kubits), 31130a5e8faSwyllys "kmf_set_csr_ku"); 31299ebb4caSwyllys } 31330a5e8faSwyllys if ((kmfrv = kmf_sign_csr(kmfhandle, &csr, &prik, &signedCsr)) == 31430a5e8faSwyllys KMF_OK) { 31530a5e8faSwyllys kmfrv = kmf_create_csr_file(&signedCsr, fmt, fullcsrpath); 31699ebb4caSwyllys } 31799ebb4caSwyllys 31899ebb4caSwyllys cleanup: 31999ebb4caSwyllys if (fullkeypath) 32099ebb4caSwyllys free(fullkeypath); 32199ebb4caSwyllys if (fullcsrpath) 32299ebb4caSwyllys free(fullcsrpath); 32399ebb4caSwyllys 32430a5e8faSwyllys kmf_free_data(&signedCsr); 32530a5e8faSwyllys kmf_free_kmf_key(kmfhandle, &prik); 32630a5e8faSwyllys kmf_free_signed_csr(&csr); 32799ebb4caSwyllys 32899ebb4caSwyllys return (kmfrv); 32999ebb4caSwyllys } 33099ebb4caSwyllys 33199ebb4caSwyllys static KMF_RETURN 33299ebb4caSwyllys gencsr_nss(KMF_HANDLE_T kmfhandle, 33399ebb4caSwyllys char *token, char *subject, char *altname, 33499ebb4caSwyllys KMF_GENERALNAMECHOICES alttype, int altcrit, 33599ebb4caSwyllys char *nickname, char *dir, char *prefix, 33699ebb4caSwyllys KMF_KEY_ALG keyAlg, int keylen, 33799ebb4caSwyllys uint16_t kubits, int kucrit, 33899ebb4caSwyllys KMF_ENCODE_FORMAT fmt, char *csrfile, 33999ebb4caSwyllys KMF_CREDENTIAL *tokencred) 34099ebb4caSwyllys { 34199ebb4caSwyllys KMF_RETURN kmfrv; 34299ebb4caSwyllys KMF_KEY_HANDLE pubk, prik; 34399ebb4caSwyllys KMF_X509_NAME csrSubject; 34499ebb4caSwyllys KMF_CSR_DATA csr; 34599ebb4caSwyllys KMF_ALGORITHM_INDEX sigAlg; 34699ebb4caSwyllys KMF_DATA signedCsr = {NULL, 0}; 34730a5e8faSwyllys 34830a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS; 34930a5e8faSwyllys int numattr = 0; 35030a5e8faSwyllys KMF_ATTRIBUTE attrlist[16]; 35130a5e8faSwyllys boolean_t storekey = TRUE; 35299ebb4caSwyllys 35399ebb4caSwyllys if (token == NULL) 35499ebb4caSwyllys token = DEFAULT_NSS_TOKEN; 35599ebb4caSwyllys 35699ebb4caSwyllys if (keyAlg == KMF_DSA) 35799ebb4caSwyllys sigAlg = KMF_ALGID_SHA1WithDSA; 35899ebb4caSwyllys else 35999ebb4caSwyllys sigAlg = KMF_ALGID_MD5WithRSA; 36099ebb4caSwyllys 36199ebb4caSwyllys kmfrv = configure_nss(kmfhandle, dir, prefix); 36299ebb4caSwyllys if (kmfrv != KMF_OK) 36399ebb4caSwyllys return (kmfrv); 36499ebb4caSwyllys 36599ebb4caSwyllys (void) memset(&csr, 0, sizeof (csr)); 36699ebb4caSwyllys (void) memset(&csrSubject, 0, sizeof (csrSubject)); 36799ebb4caSwyllys 36899ebb4caSwyllys /* If the subject name cannot be parsed, flag it now and exit */ 36930a5e8faSwyllys if ((kmfrv = kmf_dn_parser(subject, &csrSubject)) != KMF_OK) { 37099ebb4caSwyllys return (kmfrv); 37199ebb4caSwyllys } 37299ebb4caSwyllys 37330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 37430a5e8faSwyllys &kstype, sizeof (kstype)); 37530a5e8faSwyllys numattr++; 37630a5e8faSwyllys 37730a5e8faSwyllys if (nickname != NULL && strlen(nickname)) { 37830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLABEL_ATTR, 37930a5e8faSwyllys nickname, strlen(nickname)); 38030a5e8faSwyllys numattr++; 38130a5e8faSwyllys } 38230a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLENGTH_ATTR, 38330a5e8faSwyllys &keylen, sizeof (keylen)); 38430a5e8faSwyllys numattr++; 38530a5e8faSwyllys 38630a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYALG_ATTR, 38730a5e8faSwyllys &keyAlg, sizeof (keyAlg)); 38830a5e8faSwyllys numattr++; 38930a5e8faSwyllys 39030a5e8faSwyllys if (tokencred != NULL && tokencred->credlen > 0) { 39130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR, 39230a5e8faSwyllys tokencred, sizeof (KMF_CREDENTIAL)); 39330a5e8faSwyllys numattr++; 39430a5e8faSwyllys } 39530a5e8faSwyllys 39630a5e8faSwyllys if (token && strlen(token)) { 39730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR, 39830a5e8faSwyllys token, strlen(token)); 39930a5e8faSwyllys numattr++; 40030a5e8faSwyllys } 40130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR, 40230a5e8faSwyllys &pubk, sizeof (KMF_KEY_HANDLE)); 40330a5e8faSwyllys numattr++; 40499ebb4caSwyllys 40530a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PRIVKEY_HANDLE_ATTR, 40630a5e8faSwyllys &prik, sizeof (KMF_KEY_HANDLE)); 40730a5e8faSwyllys numattr++; 40899ebb4caSwyllys 40930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_STOREKEY_BOOL_ATTR, 41030a5e8faSwyllys &storekey, sizeof (storekey)); 41130a5e8faSwyllys numattr++; 41230a5e8faSwyllys 41330a5e8faSwyllys kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist); 41499ebb4caSwyllys if (kmfrv != KMF_OK) { 41599ebb4caSwyllys goto cleanup; 41699ebb4caSwyllys } 41799ebb4caSwyllys 41830a5e8faSwyllys SET_VALUE(kmf_set_csr_pubkey(kmfhandle, &pubk, &csr), 41930a5e8faSwyllys "kmf_set_csr_pubkey"); 42030a5e8faSwyllys SET_VALUE(kmf_set_csr_version(&csr, 2), "kmf_set_csr_version"); 42130a5e8faSwyllys SET_VALUE(kmf_set_csr_subject(&csr, &csrSubject), 42230a5e8faSwyllys "kmf_set_csr_subject"); 42330a5e8faSwyllys SET_VALUE(kmf_set_csr_sig_alg(&csr, sigAlg), "kmf_set_csr_sig_alg"); 42499ebb4caSwyllys 42599ebb4caSwyllys if (altname != NULL) { 42630a5e8faSwyllys SET_VALUE(kmf_set_csr_subject_altname(&csr, altname, altcrit, 42730a5e8faSwyllys alttype), "kmf_set_csr_subject_altname"); 42899ebb4caSwyllys } 42999ebb4caSwyllys if (kubits != NULL) { 43030a5e8faSwyllys SET_VALUE(kmf_set_csr_ku(&csr, kucrit, kubits), 43130a5e8faSwyllys "kmf_set_csr_ku"); 43299ebb4caSwyllys } 43330a5e8faSwyllys if ((kmfrv = kmf_sign_csr(kmfhandle, &csr, &prik, &signedCsr)) == 43430a5e8faSwyllys KMF_OK) { 43530a5e8faSwyllys kmfrv = kmf_create_csr_file(&signedCsr, fmt, csrfile); 43699ebb4caSwyllys } 43799ebb4caSwyllys 43899ebb4caSwyllys cleanup: 43930a5e8faSwyllys (void) kmf_free_data(&signedCsr); 44030a5e8faSwyllys (void) kmf_free_kmf_key(kmfhandle, &prik); 44130a5e8faSwyllys 44299ebb4caSwyllys /* delete the key */ 44330a5e8faSwyllys numattr = 0; 44430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 44530a5e8faSwyllys &kstype, sizeof (kstype)); 44630a5e8faSwyllys numattr++; 44730a5e8faSwyllys 44830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR, 44930a5e8faSwyllys &pubk, sizeof (KMF_KEY_HANDLE)); 45030a5e8faSwyllys numattr++; 45130a5e8faSwyllys 45230a5e8faSwyllys if (tokencred != NULL && tokencred->credlen > 0) { 45330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR, 45430a5e8faSwyllys tokencred, sizeof (KMF_CREDENTIAL)); 45530a5e8faSwyllys numattr++; 45630a5e8faSwyllys } 45730a5e8faSwyllys 45830a5e8faSwyllys if (token && strlen(token)) { 45930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR, 46030a5e8faSwyllys token, strlen(token)); 46130a5e8faSwyllys numattr++; 46230a5e8faSwyllys } 46330a5e8faSwyllys 46430a5e8faSwyllys (void) kmf_delete_key_from_keystore(kmfhandle, numattr, attrlist); 46530a5e8faSwyllys 46630a5e8faSwyllys (void) kmf_free_signed_csr(&csr); 46799ebb4caSwyllys 46899ebb4caSwyllys return (kmfrv); 46999ebb4caSwyllys } 47099ebb4caSwyllys 47199ebb4caSwyllys int 47299ebb4caSwyllys pk_gencsr(int argc, char *argv[]) 47399ebb4caSwyllys { 47499ebb4caSwyllys KMF_RETURN rv; 47599ebb4caSwyllys int opt; 47699ebb4caSwyllys extern int optind_av; 47799ebb4caSwyllys extern char *optarg_av; 47899ebb4caSwyllys KMF_KEYSTORE_TYPE kstype = 0; 47999ebb4caSwyllys char *subject = NULL; 48099ebb4caSwyllys char *tokenname = NULL; 48199ebb4caSwyllys char *dir = NULL; 48299ebb4caSwyllys char *prefix = NULL; 48399ebb4caSwyllys int keylen = PK_DEFAULT_KEYLENGTH; 48499ebb4caSwyllys char *certlabel = NULL; 48599ebb4caSwyllys char *outcsr = NULL; 48699ebb4caSwyllys char *outkey = NULL; 48799ebb4caSwyllys char *format = NULL; 48899ebb4caSwyllys char *altname = NULL; 48999ebb4caSwyllys char *kustr = NULL; 49099ebb4caSwyllys uint16_t kubits = 0; 49199ebb4caSwyllys char *keytype = PK_DEFAULT_KEYTYPE; 49299ebb4caSwyllys KMF_HANDLE_T kmfhandle = NULL; 49399ebb4caSwyllys KMF_ENCODE_FORMAT fmt = KMF_FORMAT_ASN1; 49499ebb4caSwyllys KMF_KEY_ALG keyAlg = KMF_RSA; 49599ebb4caSwyllys KMF_ALGORITHM_INDEX sigAlg = KMF_ALGID_MD5WithRSA; 49699ebb4caSwyllys boolean_t interactive = B_FALSE; 49799ebb4caSwyllys char *subname = NULL; 49899ebb4caSwyllys KMF_CREDENTIAL tokencred = {NULL, 0}; 49999ebb4caSwyllys KMF_GENERALNAMECHOICES alttype = 0; 50099ebb4caSwyllys int altcrit = 0, kucrit = 0; 50199ebb4caSwyllys 50299ebb4caSwyllys while ((opt = getopt_av(argc, argv, 50330a5e8faSwyllys "ik:(keystore)s:(subject)n:(nickname)A:(altname)" 50430a5e8faSwyllys "u:(keyusage)T:(token)d:(dir)p:(prefix)t:(keytype)" 50530a5e8faSwyllys "y:(keylen)l:(label)c:(outcsr)" 50630a5e8faSwyllys "K:(outkey)F:(format)")) != EOF) { 50799ebb4caSwyllys 50899ebb4caSwyllys if (opt != 'i' && EMPTYSTRING(optarg_av)) 50999ebb4caSwyllys return (PK_ERR_USAGE); 51099ebb4caSwyllys 51199ebb4caSwyllys switch (opt) { 51299ebb4caSwyllys case 'A': 51399ebb4caSwyllys altname = optarg_av; 51499ebb4caSwyllys break; 51599ebb4caSwyllys case 'i': 51699ebb4caSwyllys if (interactive || subject) 51799ebb4caSwyllys return (PK_ERR_USAGE); 51899ebb4caSwyllys else 51999ebb4caSwyllys interactive = B_TRUE; 52099ebb4caSwyllys break; 52199ebb4caSwyllys case 'k': 52299ebb4caSwyllys kstype = KS2Int(optarg_av); 52399ebb4caSwyllys if (kstype == 0) 52499ebb4caSwyllys return (PK_ERR_USAGE); 52599ebb4caSwyllys break; 52699ebb4caSwyllys case 's': 52799ebb4caSwyllys if (interactive || subject) 52899ebb4caSwyllys return (PK_ERR_USAGE); 52999ebb4caSwyllys else 53099ebb4caSwyllys subject = optarg_av; 53199ebb4caSwyllys break; 53299ebb4caSwyllys case 'l': 53399ebb4caSwyllys case 'n': 53499ebb4caSwyllys if (certlabel) 53599ebb4caSwyllys return (PK_ERR_USAGE); 53699ebb4caSwyllys certlabel = optarg_av; 53799ebb4caSwyllys break; 53899ebb4caSwyllys case 'T': 53999ebb4caSwyllys if (tokenname) 54099ebb4caSwyllys return (PK_ERR_USAGE); 54199ebb4caSwyllys tokenname = optarg_av; 54299ebb4caSwyllys break; 54399ebb4caSwyllys case 'd': 54499ebb4caSwyllys dir = optarg_av; 54599ebb4caSwyllys break; 54699ebb4caSwyllys case 'p': 54799ebb4caSwyllys if (prefix) 54899ebb4caSwyllys return (PK_ERR_USAGE); 54999ebb4caSwyllys prefix = optarg_av; 55099ebb4caSwyllys break; 55199ebb4caSwyllys case 't': 55299ebb4caSwyllys keytype = optarg_av; 55399ebb4caSwyllys break; 55499ebb4caSwyllys case 'u': 55599ebb4caSwyllys kustr = optarg_av; 55699ebb4caSwyllys break; 55799ebb4caSwyllys case 'y': 55899ebb4caSwyllys if (sscanf(optarg_av, "%d", 55930a5e8faSwyllys &keylen) != 1) { 56099ebb4caSwyllys cryptoerror(LOG_STDERR, 56130a5e8faSwyllys gettext("Unrecognized " 56230a5e8faSwyllys "key length (%s)\n"), optarg_av); 56399ebb4caSwyllys return (PK_ERR_USAGE); 56499ebb4caSwyllys } 56599ebb4caSwyllys break; 56699ebb4caSwyllys case 'c': 56799ebb4caSwyllys if (outcsr) 56899ebb4caSwyllys return (PK_ERR_USAGE); 56999ebb4caSwyllys outcsr = optarg_av; 57099ebb4caSwyllys break; 57199ebb4caSwyllys case 'K': 57299ebb4caSwyllys if (outkey) 57399ebb4caSwyllys return (PK_ERR_USAGE); 57499ebb4caSwyllys outkey = optarg_av; 57599ebb4caSwyllys break; 57699ebb4caSwyllys case 'F': 57799ebb4caSwyllys if (format) 57899ebb4caSwyllys return (PK_ERR_USAGE); 57999ebb4caSwyllys format = optarg_av; 58099ebb4caSwyllys break; 58199ebb4caSwyllys default: 58299ebb4caSwyllys cryptoerror(LOG_STDERR, gettext( 58330a5e8faSwyllys "unrecognized gencsr option '%s'\n"), 58430a5e8faSwyllys argv[optind_av]); 58599ebb4caSwyllys return (PK_ERR_USAGE); 58699ebb4caSwyllys } 58799ebb4caSwyllys } 58899ebb4caSwyllys /* No additional args allowed. */ 58999ebb4caSwyllys argc -= optind_av; 59099ebb4caSwyllys argv += optind_av; 59199ebb4caSwyllys if (argc) { 59299ebb4caSwyllys return (PK_ERR_USAGE); 59399ebb4caSwyllys } 59499ebb4caSwyllys 59530a5e8faSwyllys if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) { 59699ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("Error initializing KMF\n")); 59799ebb4caSwyllys return (PK_ERR_USAGE); 59899ebb4caSwyllys } 59999ebb4caSwyllys 60099ebb4caSwyllys /* Assume keystore = PKCS#11 if not specified. */ 60199ebb4caSwyllys if (kstype == 0) 60299ebb4caSwyllys kstype = KMF_KEYSTORE_PK11TOKEN; 60399ebb4caSwyllys 604*2cbed729Swyllys if (EMPTYSTRING(outcsr) && interactive) { 605*2cbed729Swyllys (void) get_filename("CSR", &outcsr); 606*2cbed729Swyllys } 60799ebb4caSwyllys if (EMPTYSTRING(outcsr)) { 60899ebb4caSwyllys (void) printf(gettext("A filename must be specified to hold" 60930a5e8faSwyllys "the final certificate request data.\n")); 61099ebb4caSwyllys return (PK_ERR_USAGE); 61199ebb4caSwyllys } 612*2cbed729Swyllys /* 613*2cbed729Swyllys * verify that the outcsr file does not already exist 614*2cbed729Swyllys * and that it can be created. 615*2cbed729Swyllys */ 616*2cbed729Swyllys rv = verify_file(outcsr); 617*2cbed729Swyllys if (rv != KMF_OK) { 618*2cbed729Swyllys cryptoerror(LOG_STDERR, gettext("output file (%s) " 619*2cbed729Swyllys "cannot be created.\n"), outcsr); 62099ebb4caSwyllys return (PK_ERR_USAGE); 62199ebb4caSwyllys } 62299ebb4caSwyllys 623*2cbed729Swyllys if ((kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN)) { 624*2cbed729Swyllys if (EMPTYSTRING(certlabel) && interactive) 625*2cbed729Swyllys (void) get_certlabel(&certlabel); 626*2cbed729Swyllys 627*2cbed729Swyllys if (EMPTYSTRING(certlabel)) { 628*2cbed729Swyllys cryptoerror(LOG_STDERR, gettext("A label must be " 629*2cbed729Swyllys "specified to create a certificate request.\n")); 630*2cbed729Swyllys return (PK_ERR_USAGE); 631*2cbed729Swyllys } 632*2cbed729Swyllys } else if (kstype == KMF_KEYSTORE_OPENSSL) { 633*2cbed729Swyllys if (EMPTYSTRING(outkey) && interactive) 634*2cbed729Swyllys (void) get_filename("private key", &outkey); 635*2cbed729Swyllys 636*2cbed729Swyllys if (EMPTYSTRING(outkey)) { 637*2cbed729Swyllys cryptoerror(LOG_STDERR, gettext("A key filename " 638*2cbed729Swyllys "must be specified to create a certificate " 639*2cbed729Swyllys "request.\n")); 640*2cbed729Swyllys return (PK_ERR_USAGE); 641*2cbed729Swyllys } 642*2cbed729Swyllys } 643*2cbed729Swyllys 64499ebb4caSwyllys if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) { 64599ebb4caSwyllys cryptoerror(LOG_STDERR, 64630a5e8faSwyllys gettext("Error parsing format string (%s).\n"), format); 64799ebb4caSwyllys return (PK_ERR_USAGE); 64899ebb4caSwyllys } 64999ebb4caSwyllys if (format && fmt != KMF_FORMAT_ASN1 && fmt != KMF_FORMAT_PEM) { 65099ebb4caSwyllys cryptoerror(LOG_STDERR, 65130a5e8faSwyllys gettext("CSR must be DER or PEM format.\n")); 65299ebb4caSwyllys return (PK_ERR_USAGE); 65399ebb4caSwyllys } 65499ebb4caSwyllys 65599ebb4caSwyllys /* 65699ebb4caSwyllys * Check the subject name. 65799ebb4caSwyllys * If interactive is true, get it now interactively. 65899ebb4caSwyllys */ 65999ebb4caSwyllys if (interactive) { 66099ebb4caSwyllys if (get_subname(&subname) != KMF_OK) { 66199ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("Failed to get the " 66299ebb4caSwyllys "subject name interactively.\n")); 66399ebb4caSwyllys return (PK_ERR_USAGE); 66499ebb4caSwyllys } 66599ebb4caSwyllys } else { 66699ebb4caSwyllys if (EMPTYSTRING(subject)) { 66799ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("A subject name or " 66899ebb4caSwyllys "-i must be specified to create a certificate " 66999ebb4caSwyllys "request.\n")); 67099ebb4caSwyllys return (PK_ERR_USAGE); 67199ebb4caSwyllys } else { 67299ebb4caSwyllys subname = strdup(subject); 67399ebb4caSwyllys if (subname == NULL) { 67499ebb4caSwyllys cryptoerror(LOG_STDERR, 67599ebb4caSwyllys gettext("Out of memory.\n")); 67699ebb4caSwyllys return (PK_ERR_SYSTEM); 67799ebb4caSwyllys } 67899ebb4caSwyllys } 67999ebb4caSwyllys } 68099ebb4caSwyllys if (altname != NULL) { 68199ebb4caSwyllys rv = verify_altname(altname, &alttype, &altcrit); 68299ebb4caSwyllys if (rv != KMF_OK) { 68399ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("Subject AltName " 68430a5e8faSwyllys "must be specified as a name=value pair. " 68530a5e8faSwyllys "See the man page for details.")); 68699ebb4caSwyllys goto end; 68799ebb4caSwyllys } else { 68899ebb4caSwyllys /* advance the altname past the '=' sign */ 68999ebb4caSwyllys char *p = strchr(altname, '='); 69099ebb4caSwyllys if (p != NULL) 69199ebb4caSwyllys altname = p + 1; 69299ebb4caSwyllys } 69399ebb4caSwyllys } 69499ebb4caSwyllys 69599ebb4caSwyllys if (kustr != NULL) { 69699ebb4caSwyllys rv = verify_keyusage(kustr, &kubits, &kucrit); 69799ebb4caSwyllys if (rv != KMF_OK) { 69899ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("KeyUsage " 69930a5e8faSwyllys "must be specified as a comma-separated list. " 70030a5e8faSwyllys "See the man page for details.")); 70199ebb4caSwyllys goto end; 70299ebb4caSwyllys } 70399ebb4caSwyllys } 70499ebb4caSwyllys if ((rv = Str2KeyType(keytype, &keyAlg, &sigAlg)) != 0) { 70599ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("Unrecognized keytype (%s).\n"), 70630a5e8faSwyllys keytype); 70799ebb4caSwyllys goto end; 70899ebb4caSwyllys } 70999ebb4caSwyllys 71099ebb4caSwyllys if (kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN) { 71199ebb4caSwyllys if (tokenname == NULL || !strlen(tokenname)) { 71299ebb4caSwyllys if (kstype == KMF_KEYSTORE_NSS) { 71399ebb4caSwyllys tokenname = "internal"; 71499ebb4caSwyllys } else { 71599ebb4caSwyllys tokenname = PK_DEFAULT_PK11TOKEN; 71699ebb4caSwyllys } 71799ebb4caSwyllys } 71899ebb4caSwyllys 71999ebb4caSwyllys (void) get_token_password(kstype, tokenname, &tokencred); 72099ebb4caSwyllys } 72199ebb4caSwyllys 72299ebb4caSwyllys if (kstype == KMF_KEYSTORE_NSS) { 72399ebb4caSwyllys if (dir == NULL) 72499ebb4caSwyllys dir = PK_DEFAULT_DIRECTORY; 72599ebb4caSwyllys 72699ebb4caSwyllys rv = gencsr_nss(kmfhandle, 72730a5e8faSwyllys tokenname, subname, altname, alttype, altcrit, 72830a5e8faSwyllys certlabel, dir, prefix, 72930a5e8faSwyllys keyAlg, keylen, kubits, kucrit, 73030a5e8faSwyllys fmt, outcsr, &tokencred); 73199ebb4caSwyllys 73299ebb4caSwyllys } else if (kstype == KMF_KEYSTORE_PK11TOKEN) { 73399ebb4caSwyllys rv = gencsr_pkcs11(kmfhandle, 73430a5e8faSwyllys tokenname, subname, altname, alttype, altcrit, 73530a5e8faSwyllys certlabel, keyAlg, keylen, 73630a5e8faSwyllys kubits, kucrit, fmt, outcsr, &tokencred); 73799ebb4caSwyllys 73899ebb4caSwyllys } else if (kstype == KMF_KEYSTORE_OPENSSL) { 73999ebb4caSwyllys rv = gencsr_file(kmfhandle, 74030a5e8faSwyllys keyAlg, keylen, fmt, subname, altname, 74130a5e8faSwyllys alttype, altcrit, kubits, kucrit, 74230a5e8faSwyllys dir, outcsr, outkey); 74399ebb4caSwyllys } 74499ebb4caSwyllys 74599ebb4caSwyllys end: 74699ebb4caSwyllys if (rv != KMF_OK) 74799ebb4caSwyllys display_error(kmfhandle, rv, 74830a5e8faSwyllys gettext("Error creating CSR or keypair")); 74999ebb4caSwyllys 75099ebb4caSwyllys if (subname) 75199ebb4caSwyllys free(subname); 75299ebb4caSwyllys 75399ebb4caSwyllys if (tokencred.cred != NULL) 75499ebb4caSwyllys free(tokencred.cred); 75599ebb4caSwyllys 75630a5e8faSwyllys (void) kmf_finalize(kmfhandle); 75799ebb4caSwyllys if (rv != KMF_OK) 75899ebb4caSwyllys return (PK_ERR_USAGE); 75999ebb4caSwyllys 76099ebb4caSwyllys return (0); 76199ebb4caSwyllys } 762