certgen.h

/*NB_REVISION*/
 
/*NB_COPYRIGHT*/
 
#ifndef _CERT_GEN_H
#define _CERT_GEN_H
#include <predef.h>
#include <nettypes.h>
#include <nbstring.h>
 
#if defined(NB_SSL_SUPPORTED) || defined(NB_SSH_SUPPORTED)
 
#include <crypto/ssl.h>
#include <crypto/wolfssl/wolfcrypt/ecc.h>
#include <random.h>
 
#define MAX_CERT_SNAME_LEN 64
 
// Check for ECC and RSA. If both exist, prefer ECC since it is faster.
#if defined(HAVE_ECC) && defined(ENABLE_ECCKEY_CREATE)
#define SSL_KEY_ECC
#elif defined(ENABLE_RSAKEY_CREATE)
#define SSL_KEY_RSA
#endif
 
 
enum SslKeyType_t
{
    SSL_KEY_NONE,
    SSL_KEY_ECC_SECP192R1 = ECC_SECP192R1,      
    SSL_KEY_ECC_SECP224R1 = ECC_SECP224R1,      
    SSL_KEY_ECC_SECP256R1 = ECC_SECP256R1,      
    SSL_KEY_ECC_SECP384R1 = ECC_SECP384R1,      
    SSL_KEY_ECC_SECP521R1 = ECC_SECP521R1,      
    SSL_KEY_RSA_1024,                           
    SSL_KEY_RSA_2048,                           
    SSL_KEY_RSA_4096,                           
};
#if defined(SSL_KEY_ECC)
constexpr SslKeyType_t DEFAULT_KEY_TYPE(SSL_KEY_ECC_SECP256R1);
#else
constexpr SslKeyType_t DEFAULT_KEY_TYPE(SSL_KEY_RSA_2048);
#endif
 
enum AltNameType_t : char
{
    ALT_NAME_TYPE_NONE = 0,           
    ALT_NAME_TYPE_DNS = (char)0x82,   
    ALT_NAME_TYPE_IP = (char)0x87     
};
 
 
enum CertGenReturnCode : int
{
    CERT_GEN_RETURN_SUCCESS = 1,               
    CERT_GEN_RETURN_NOT_REQUIRED = 2,          
    CERT_GEN_RETURN_INVALID_RANDOM = -1,       
    CERT_GEN_RETURN_MALLOC_ERROR = -2,         
    CERT_GEN_RETURN_ECC_INIT_ERROR = -3,       
    CERT_GEN_RETURN_ECC_CREATE_ERROR = -4,     
    CERT_GEN_RETURN_RSA_INIT_ERROR = -5,       
    CERT_GEN_RETURN_RSA_CREATE_ERROR = -6,     
    CERT_GEN_RETURN_CERT_INIT_ERROR = -7,      
    CERT_GEN_RETURN_CERT_CREATE_ERROR = -8,    
    CERT_GEN_RETURN_CERT_SIGNING_ERROR = -9,   
    CERT_GEN_RETURN_CERT_SAVING_ERROR = -10,   
    CERT_GEN_RETURN_KEY_CONVERT_ERROR = -11,   
    CERT_GEN_RETURN_KEY_SAVING_ERROR = -12,    
    CERT_GEN_RETURN_SET_ISSUER_ERROR = -13,    
};
 
 
struct CertGenData
{
 
    // Values passed in by EnableOnboardCertificateCreation() and set by the user
    const char * m_country;
    const char * m_state;
    const char * m_locality;
    const char * m_org;
    const char * m_unit;
    const char * m_email;
    const char *m_commonName;                 
    int m_yrsValid;                    
    NBString m_altNamesString;   
    /* m_altNamesString format of included alt name
      A single string, with possibly multiple altnames separated by a comma.
      You can either incude a tag telling the system what kind of AltName it is...
       So say you wanted :
    IP:192.168.1.36 and
    DNS:demo.netburner.com
    The following strings would both work:
    "IP:192.168.1.36,DNS:demo.netburner.com"
    "192.168.1.36,demo.netburner.com"
 
    or dual interface IP's...
 
    "192.168.1.36,10.1.1.35"
 
    or both V4 and V6....
    "IP:fe80::203:f4ff:fe0a:447f,192.168.1.36" 
    */
 
 
 
    // Values set when a cert is generated to monitor its expiration
    time_t m_certExpTime;    
 
    CertGenData() : 
        m_country(nullptr),  
        m_state(nullptr),     
        m_locality(nullptr),  
        m_org(nullptr),       
        m_unit(nullptr),      
        m_email(nullptr),     
        m_commonName(nullptr), 
        m_yrsValid(1), 
        m_certExpTime(0){}
};
 
 
#include <config_obj.h>
 
extern const char * DEFAULT_CERT_COUNTRY;
extern const char * DEFAULT_CERT_STATE;
extern const char * DEFAULT_CERT_LOCALITY;
extern const char * DEFAULT_CERT_ORG;
extern const char * DEFAULT_CERT_UNIT;
extern const char * DEFAULT_CERT_EMAIL;
extern const char * DEFAULT_CERT_COM_NAME;
extern const char * DEFAULT_CERT_ALT_NAMES;
 
class CertData : public config_obj
{
   public:
    config_string m_country;
    config_string m_state;
    config_string m_locality;
    config_string m_org;
    config_string m_unit;
    config_string m_email;
    config_string m_comname;
    config_string m_altNames;
    ConfigEndMarker;   // No new data members below this line
    CertGenData *  GetDataForCertGen();
    CertData(const char * Country=DEFAULT_CERT_COUNTRY,
             const char * State=DEFAULT_CERT_STATE,
             const char * Locality=DEFAULT_CERT_LOCALITY,
             const char * Org=DEFAULT_CERT_ORG,
             const char * Unit=DEFAULT_CERT_UNIT,    
             const char * Email=DEFAULT_CERT_EMAIL,
             const char * Name=DEFAULT_CERT_COM_NAME,
             const char * AltNames=DEFAULT_CERT_ALT_NAMES
             ) : config_obj(sys,"CertData" ,"Object to hold the data for certificate generation"),
     m_country(Country,"Country"),
     m_state  (State,"State"),                                  
     m_locality(Locality,"Locality"),         
     m_org(Org,"Org"),                 
     m_unit(Unit,"Unit"),                      
     m_email(Email,"Email"),
     m_comname(Name,"Comname"),               
     m_altNames(AltNames,"AltNames") 
    {
    };
};
 
 
extern "C" CertGenReturnCode SSL_CreateNewSelfSignedCert(CertGenData & pGenData);
 
extern CertGenReturnCode (*SSL_CreateNewCert)(CertGenData & cGenData);
 
void EnableOnboardCertificateCreation( CertGenReturnCode (*createCertFunc)(CertGenData & cGenData) = SSL_CreateNewSelfSignedCert);
 
 
void FillInAltNamesASN1(Cert & TheCert,NBString & altNameString);
 
CertGenReturnCode CheckAndCreateHalCertAndKey();
 
extern CertGenData * GetDataForCertGen();
 
#endif /* NB_SSL_SUPPORTED */
#endif /* #ifdef _CERT_GEN_H */