Implement the "pki new-csr" command

refs #7247

lib/base/tlsutility.cpp

@@ -246,17 +246,23 @@ shared_ptr<X509> GetX509Certificate(const String& pemfile)
 	return shared_ptr<X509>(cert, X509_free);
 }
 
-int MakeX509CSR(const char *cn, const char *keyfile, const char *csrfile)
+int MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile, const String& certfile)
 {
 	InitializeOpenSSL();
 
 	RSA *rsa = RSA_generate_key(4096, RSA_F4, NULL, NULL);
 
+	Log(LogInformation, "base", "Writing private key to '" + keyfile + "'.");
+
 	BIO *bio = BIO_new(BIO_s_file());
-	BIO_write_filename(bio, const_cast<char *>(keyfile));
+	BIO_write_filename(bio, const_cast<char *>(keyfile.CStr()));
 	PEM_write_bio_RSAPrivateKey(bio, rsa, NULL, NULL, 0, NULL, NULL);
 	BIO_free(bio);
 
+#ifndef _WIN32
+	chmod(keyfile.CStr(), 0600);
+#endif /* _WIN32 */
+
 	X509_REQ *req = X509_REQ_new();
 
 	if (!req)
@@ -266,16 +272,40 @@ int MakeX509CSR(const char *cn, const char *keyfile, const char *csrfile)
 	EVP_PKEY_assign_RSA(key, rsa);
 	X509_REQ_set_version(req, 0);
 	X509_REQ_set_pubkey(req, key);
+
+	if (!certfile.IsEmpty()) {
+		X509 *cert = X509_new();
+		ASN1_INTEGER_set(X509_get_serialNumber(cert), 1);
+		X509_gmtime_adj(X509_get_notBefore(cert), 0);
+		X509_gmtime_adj(X509_get_notAfter(cert), 365 * 24 * 60 * 60 * 30);
+		X509_set_pubkey(cert, key);
+
+		X509_NAME *name = X509_get_subject_name(cert);
+		X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)cn.CStr(), -1, -1, 0);
+		X509_set_issuer_name(cert, name);
+		X509_sign(cert, key, EVP_sha1());
+
+		Log(LogInformation, "base", "Writing X509 certificate to '" + certfile + "'.");
+
+		bio = BIO_new(BIO_s_file());
+		BIO_write_filename(bio, const_cast<char *>(certfile.CStr()));
+		PEM_write_bio_X509(bio, cert);
+		BIO_free(bio);
+
+		X509_free(cert);
+	}
 
 	X509_NAME *name = X509_REQ_get_subject_name(req);
-	X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)cn, -1, -1, 0);
+	X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)cn.CStr(), -1, -1, 0);
 
 	X509_REQ_sign(req, key, EVP_sha1());
 
 	EVP_PKEY_free(key);
 
+	Log(LogInformation, "base", "Writing certificate signing request to '" + certfile + "'.");
+
 	bio = BIO_new(BIO_s_file());
-	BIO_write_filename(bio, const_cast<char *>(csrfile));
+	BIO_write_filename(bio, const_cast<char *>(csrfile.CStr()));
 	PEM_write_bio_X509_REQ(bio, req);
 	BIO_free(bio);
 

lib/base/tlsutility.hpp

@@ -37,7 +37,7 @@ shared_ptr<SSL_CTX> I2_BASE_API MakeSSLContext(const String& pubkey, const Strin
 void I2_BASE_API AddCRLToSSLContext(const shared_ptr<SSL_CTX>& context, const String& crlPath);
 String I2_BASE_API GetCertificateCN(const shared_ptr<X509>& certificate);
 shared_ptr<X509> I2_BASE_API GetX509Certificate(const String& pemfile);
-extern "C" int I2_BASE_API MakeX509CSR(const char *cn, const char *keyfile, const char *csrfile);
+int I2_BASE_API MakeX509CSR(const String& cn, const String& keyfile, const String& csrfile, const String& certfile = String());
 String I2_BASE_API SHA256(const String& s);
 
 class I2_BASE_API openssl_error : virtual public std::exception, virtual public boost::exception { };

lib/cli/CMakeLists.txt

@@ -16,7 +16,7 @@
 # Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
 
 set(cli_SOURCES
-  cainitcommand.cpp daemoncommand.cpp
+  pkiinitcacommand.cpp pkinewcsrcommand.cpp daemoncommand.cpp
 )
 
 if(ICINGA2_UNITY_BUILD)

lib/cli/cainitcommand.cpp → lib/cli/pkiinitcacommand.cpp

@@ -17,25 +17,25 @@
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
  ******************************************************************************/
 
-#include "cli/cainitcommand.hpp"
+#include "cli/pkiinitcacommand.hpp"
 #include "base/logger_fwd.hpp"
 #include "base/clicommand.hpp"
 
 using namespace icinga;
 
-REGISTER_CLICOMMAND("ca/init", CAInitCommand);
+REGISTER_CLICOMMAND("pki/init-ca", PKIInitCACommand);
 
-String CAInitCommand::GetDescription(void) const
+String PKIInitCACommand::GetDescription(void) const
 {
 	return "Sets up a new Certificate Authority.";
 }
 
-String CAInitCommand::GetShortDescription(void) const
+String PKIInitCACommand::GetShortDescription(void) const
 {
 	return "sets up a new CA";
 }
 
-void CAInitCommand::InitParameters(boost::program_options::options_description& visibleDesc,
+void PKIInitCACommand::InitParameters(boost::program_options::options_description& visibleDesc,
     boost::program_options::options_description& hiddenDesc) const
 {
 	/* Command doesn't support any parameters. */
@@ -46,7 +46,7 @@ void CAInitCommand::InitParameters(boost::program_options::options_description&
  *
  * @returns An exit status.
  */
-int CAInitCommand::Run(const boost::program_options::variables_map& vm) const
+int PKIInitCACommand::Run(const boost::program_options::variables_map& vm) const
 {
 	Log(LogNotice, "cli", "Test!");
 	Log(LogInformation, "cli", "Hello World!");

lib/cli/cainitcommand.hpp → lib/cli/pkiinitcacommand.hpp

@@ -17,8 +17,8 @@
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
  ******************************************************************************/
 
-#ifndef CAINITCOMMAND_H
-#define CAINITCOMMAND_H
+#ifndef PKIINITCACOMMAND_H
+#define PKIINITCACOMMAND_H
 
 #include "base/qstring.hpp"
 #include "base/clicommand.hpp"
@@ -27,14 +27,14 @@ namespace icinga
 {
 
 /**
- * The "ca init" command.
+ * The "pki init-ca" command.
  *
  * @ingroup cli
  */
-class CAInitCommand : public CLICommand
+class PKIInitCACommand : public CLICommand
 {
 public:
-	DECLARE_PTR_TYPEDEFS(CAInitCommand);
+	DECLARE_PTR_TYPEDEFS(PKIInitCACommand);
 
 	virtual String GetDescription(void) const;
 	virtual String GetShortDescription(void) const;
@@ -46,4 +46,4 @@ class CAInitCommand : public CLICommand
 
 }
 
-#endif /* CAINITCOMMAND_H */
+#endif /* PKIINITCACOMMAND_H */

lib/cli/pkinewcsrcommand.cpp

@@ -0,0 +1,80 @@
+/******************************************************************************
+ * Icinga 2                                                                   *
+ * Copyright (C) 2012-2014 Icinga Development Team (http://www.icinga.org)    *
+ *                                                                            *
+ * This program is free software; you can redistribute it and/or              *
+ * modify it under the terms of the GNU General Public License                *
+ * as published by the Free Software Foundation; either version 2             *
+ * of the License, or (at your option) any later version.                     *
+ *                                                                            *
+ * This program is distributed in the hope that it will be useful,            *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of             *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              *
+ * GNU General Public License for more details.                               *
+ *                                                                            *
+ * You should have received a copy of the GNU General Public License          *
+ * along with this program; if not, write to the Free Software Foundation     *
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
+ ******************************************************************************/
+
+#include "cli/pkinewcsrcommand.hpp"
+#include "base/logger_fwd.hpp"
+#include "base/clicommand.hpp"
+#include "base/tlsutility.hpp"
+
+using namespace icinga;
+namespace po = boost::program_options;
+
+REGISTER_CLICOMMAND("pki/new-csr", PKINewCSRCommand);
+
+String PKINewCSRCommand::GetDescription(void) const
+{
+	return "Creates a new Certificate Signing Request and optionally a self-signed X509 certificate.";
+}
+
+String PKINewCSRCommand::GetShortDescription(void) const
+{
+	return "creates a new CSR";
+}
+
+void PKINewCSRCommand::InitParameters(boost::program_options::options_description& visibleDesc,
+    boost::program_options::options_description& hiddenDesc) const
+{
+	visibleDesc.add_options()
+		("cn", po::value<std::string>(), "Common Name")
+		("keyfile", po::value<std::string>(), "Key file path")
+		("csrfile", po::value<std::string>(), "CSR file path")
+		("certfile", po::value<std::string>(), "Certificate file path (optional)");
+}
+
+/**
+ * The entry point for the "ca init" CLI command.
+ *
+ * @returns An exit status.
+ */
+int PKINewCSRCommand::Run(const boost::program_options::variables_map& vm) const
+{
+	if (!vm.count("cn")) {
+		Log(LogCritical, "cli", "Common name (--cn) must be specified.");
+		return 1;
+	}
+
+	if (!vm.count("keyfile")) {
+		Log(LogCritical, "cli", "Key file path (--keyfile) must be specified.");
+		return 1;
+	}
+
+	if (!vm.count("csrfile")) {
+		Log(LogCritical, "cli", "CSR file path (--csrfile) must be specified.");
+		return 1;
+	}
+
+	String certfile;
+
+	if (vm.count("certfile"))
+		certfile = vm["certfile"].as<std::string>();
+
+	MakeX509CSR(vm["cn"].as<std::string>(), vm["keyfile"].as<std::string>(), vm["csrfile"].as<std::string>(), certfile);
+
+	return 0;
+}

lib/cli/pkinewcsrcommand.hpp

@@ -0,0 +1,49 @@
+/******************************************************************************
+ * Icinga 2                                                                   *
+ * Copyright (C) 2012-2014 Icinga Development Team (http://www.icinga.org)    *
+ *                                                                            *
+ * This program is free software; you can redistribute it and/or              *
+ * modify it under the terms of the GNU General Public License                *
+ * as published by the Free Software Foundation; either version 2             *
+ * of the License, or (at your option) any later version.                     *
+ *                                                                            *
+ * This program is distributed in the hope that it will be useful,            *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of             *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the              *
+ * GNU General Public License for more details.                               *
+ *                                                                            *
+ * You should have received a copy of the GNU General Public License          *
+ * along with this program; if not, write to the Free Software Foundation     *
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
+ ******************************************************************************/
+
+#ifndef PKINEWCSRCOMMAND_H
+#define PKINEWCSRCOMMAND_H
+
+#include "base/qstring.hpp"
+#include "base/clicommand.hpp"
+
+namespace icinga
+{
+
+/**
+ * The "pki new-csr" command.
+ *
+ * @ingroup cli
+ */
+class PKINewCSRCommand : public CLICommand
+{
+public:
+	DECLARE_PTR_TYPEDEFS(PKINewCSRCommand);
+
+	virtual String GetDescription(void) const;
+	virtual String GetShortDescription(void) const;
+	virtual void InitParameters(boost::program_options::options_description& visibleDesc,
+	    boost::program_options::options_description& hiddenDesc) const;
+	virtual int Run(const boost::program_options::variables_map& vm) const;
+
+};
+
+}
+
+#endif /* PKINEWCSRCOMMAND_H */