px5g_create_csr.patch

gehe zur Dokumentation dieser Datei

Provide additional "csr" action for px5g.

Signed-off-by: Lars Kruse <devel@sumpfralle.de>

--- a/openwrt/package/utils/px5g-standalone/src/px5g.c
+++ b/openwrt/package/utils/px5g-standalone/src/px5g.c
@@ -75,23 +75,23 @@ int rsakey(char **arg) {
   return 0;
 }
 
-int selfsigned(char **arg) {
+// prepare an x509 object for "selfsigned" or "csr"
+int prepare_x509(char **arg, rsa_context *rsa_ptr, x509_raw *cert_ptr, int *flag_ptr, char **certpath) {
   havege_state hs;
-  rsa_context rsa;
   x509_node node;
 
   char *subject = "";
   unsigned int ksize = 512;
   int exp = 65537;
   unsigned int days = 30;
-  char *keypath = NULL, *certpath = NULL;
-  int flag = X509_OUTPUT_PEM;
+  char *keypath = NULL;
   time_t from = time(NULL), to;
   char fstr[20], tstr[20];
+  *flag_ptr = X509_OUTPUT_PEM;
 
   while (*arg && **arg == '-') {
       if (!strcmp(*arg, "-der")) {
-          flag = X509_OUTPUT_DER;
+          *flag_ptr = X509_OUTPUT_DER;
       } else if (!strcmp(*arg, "-newkey") && arg[1]) {
           if (strncmp(arg[1], "rsa:", 4)) {
               fprintf(stderr, "error: invalid algorithm");
@@ -106,7 +106,7 @@ int selfsigned(char **arg) {
           keypath = arg[1];
           arg++;
       } else if (!strcmp(*arg, "-out") && arg[1]) {
-          certpath = arg[1];
+          *certpath = arg[1];
           arg++;
       } else if (!strcmp(*arg, "-subj") && arg[1]) {
           if (arg[1][0] != '/' || strchr(arg[1], ';')) {
@@ -140,16 +140,16 @@ int selfsigned(char **arg) {
   }
 
   havege_init(&hs);
-  rsa_init(&rsa, RSA_PKCS_V15, 0, havege_rand, &hs);
+  rsa_init(rsa_ptr, RSA_PKCS_V15, 0, havege_rand, &hs);
   x509write_init_node(&node);
   fprintf(stderr, "Generating RSA private key, %i bit long modulus\n", ksize);
-  if (rsa_gen_key(&rsa, ksize, exp)) {
+  if (rsa_gen_key(rsa_ptr, ksize, exp)) {
       fprintf(stderr, "error: key generation failed\n");
       return 1;
   }
 
   if (keypath) {
-      if (x509write_keyfile(&rsa, keypath, flag)) {
+      if (x509write_keyfile(rsa_ptr, keypath, *flag_ptr)) {
           fprintf(stderr, "error: I/O error\n");
           return 1;
       }
@@ -162,15 +162,29 @@ int selfsigned(char **arg) {
       to = INT_MAX;
   strftime(tstr, sizeof(tstr), "%F %H:%M:%S", gmtime(&to));
 
-  x509_raw cert;
-  x509write_init_raw(&cert);
-  x509write_add_pubkey(&cert, &rsa);
-  x509write_add_subject(&cert, (unsigned char*)subject);
-  x509write_add_validity(&cert, (unsigned char*)fstr, (unsigned char*)tstr);
-  fprintf(stderr, "Generating selfsigned certificate with subject '%s'"
+  x509write_init_raw(cert_ptr);
+  x509write_add_pubkey(cert_ptr, rsa_ptr);
+  x509write_add_subject(cert_ptr, (unsigned char*)subject);
+  x509write_add_validity(cert_ptr, (unsigned char*)fstr, (unsigned char*)tstr);
+  fprintf(stderr, "Generating x509 object with subject '%s'"
           " and validity %s-%s\n", subject, fstr, tstr);
+  return 0;
+}
+
+int selfsigned(char **arg) {
+  x509_raw cert;
+  rsa_context rsa;
+  int flag;
+  char *certpath = NULL;
+
+  if (prepare_x509(arg, &rsa, &cert, &flag, &certpath)) {
+      fprintf(stderr, "error: preparing x509 object failed\n");
+      return 1;
+  }
+
   if (x509write_create_selfsign(&cert, &rsa)) {
       fprintf(stderr, "error: certificate generation failed\n");
+      return 1;
   }
 
   if (x509write_crtfile(&cert, (unsigned char*)certpath, flag)) {
@@ -183,6 +197,32 @@ int selfsigned(char **arg) {
   return 0;
 }
 
+int csr(char **arg) {
+  x509_raw csr;
+  rsa_context rsa;
+  int flag;
+  char *csrpath = NULL;
+
+  if (prepare_x509(arg, &rsa, &csr, &flag, &csrpath)) {
+      fprintf(stderr, "error: preparing x509 object failed\n");
+      return 1;
+  }
+
+  if (x509write_create_csr(&csr, &rsa)) {
+      fprintf(stderr, "error: CSR generation failed\n");
+      return 1;
+  }
+
+  if (x509write_csrfile(&csr, (unsigned char*)csrpath, flag)) {
+      fprintf(stderr, "error: I/O error\n");
+      return 1;
+  }
+
+  x509write_free_raw(&csr);
+  rsa_free(&rsa);
+  return 0;
+}
+
 int main(int argc, char *argv[]) {
   if (!argv[1]) {
       //Usage
@@ -190,11 +230,13 @@ int main(int argc, char *argv[]) {
       return rsakey(argv+2);
   } else if (!strcmp(argv[1], "selfsigned")) {
       return selfsigned(argv+2);
+  } else if (!strcmp(argv[1], "csr")) {
+      return csr(argv+2);
   }
 
   fprintf(stderr,
       "PX5G X.509 Certificate Generator Utility v" PX5G_VERSION "\n" PX5G_COPY
       "\nbased on PolarSSL by Christophe Devine and Paul Bakker\n\n");
-  fprintf(stderr, "Usage: %s [rsakey|selfsigned]\n", *argv);
+  fprintf(stderr, "Usage: %s [rsakey|selfsigned|csr]\n", *argv);
   return 1;
 }