denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactored certificate management for the vici and stroke interfaces

Browse Source
This commit is contained in:
Andreas Steffen
2015-12-12 00:19:24 +01:00
parent 4df09fe563
commit 02d431022c
12 changed files with 287 additions and 308 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_list.c
+29 -128
View File
@@ -31,7 +31,6 @@
#include <collections/linked_list.h>
#include <plugins/plugin.h>
#include <credentials/certificates/x509.h>
#include <credentials/certificates/pgp_certificate.h>
#include <credentials/certificates/certificate_printer.h>
#include <config/peer_cfg.h>
@@ -63,6 +62,11 @@ struct private_stroke_list_t {
stroke_attribute_t *attribute;
};
/**
* Static certificate printer object
*/
static certificate_printer_t *cert_printer = NULL;
/**
* Log tasks of a specific queue to out
*/
@@ -760,133 +764,50 @@ static bool has_privkey(certificate_t *cert)
return (private != NULL);
}
/**
* list OpenPGP certificates
*/
static void stroke_list_pgp_certs(linked_list_t *list, char *label,
bool utc, FILE *out)
{
bool first = TRUE;
time_t now = time(NULL);
enumerator_t *enumerator = list->create_enumerator(list);
certificate_t *cert;
chunk_t keyid;
while (enumerator->enumerate(enumerator, (void**)&cert))
{
time_t created, until;
public_key_t *public;
pgp_certificate_t *pgp_cert = (pgp_certificate_t*)cert;
chunk_t fingerprint = pgp_cert->get_fingerprint(pgp_cert);
if (first)
{
fprintf(out, "\n");
fprintf(out, "List of %ss:\n", label);
first = FALSE;
}
fprintf(out, "\n");
fprintf(out, " userid: '%Y'\n", cert->get_subject(cert));
fprintf(out, " digest: %#B\n", &fingerprint);
/* list validity */
cert->get_validity(cert, &now, &created, &until);
fprintf(out, " created: %T\n", &created, utc);
fprintf(out, " until: %T%s\n", &until, utc,
(until == TIME_32_BIT_SIGNED_MAX) ? " (expires never)":"");
public = cert->get_public_key(cert);
if (public)
{
fprintf(out, " pubkey: %N %d bits%s\n",
key_type_names, public->get_type(public),
public->get_keysize(public),
has_privkey(cert) ? ", has private key" : "");
if (public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, &keyid))
{
fprintf(out, " keyid: %#B\n", &keyid);
}
if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &keyid))
{
fprintf(out, " subjkey: %#B\n", &keyid);
}
public->destroy(public);
}
}
enumerator->destroy(enumerator);
}
/**
* list all X.509 certificates matching the flags
*/
static void stroke_list_x509_certs(linked_list_t *list, char *label,
x509_flag_t flags, bool utc, FILE *out)
static void stroke_list_x509_certs(linked_list_t *list, x509_flag_t flag)
{
bool first = TRUE;
enumerator_t *enumerator;
certificate_t *cert;
certificate_printer_t *printer;
x509_flag_t flag_mask;
printer = certificate_printer_create(out, TRUE, utc),
/* mask all auxiliary flags */
flag_mask = ~(X509_SERVER_AUTH | X509_CLIENT_AUTH | X509_IKE_INTERMEDIATE |
X509_SELF_SIGNED | X509_IP_ADDR_BLOCKS);
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, (void**)&cert))
{
x509_t *x509 = (x509_t*)cert;
x509_flag_t x509_flags = x509->get_flags(x509) & flag_mask;
x509_flag_t flags = x509->get_flags(x509) & X509_ANY;
/* list only if flag is set or flag == 0 */
if ((x509_flags & flags) || (x509_flags == flags))
if ((flags & flag) || flags == flag)
{
if (first)
{
fprintf(out, "\n");
fprintf(out, "List of %ss:\n", label);
first = FALSE;
}
fprintf(out, "\n");
printer->print(printer, cert, has_privkey(cert));
cert_printer->print_caption(cert_printer, CERT_X509, flag);
cert_printer->print(cert_printer, cert, has_privkey(cert));
}
}
enumerator->destroy(enumerator);
printer->destroy(printer);
}
/**
* list all other certificates types
*/
static void stroke_list_other_certs(linked_list_t *list, char *label,
bool utc, FILE *out)
static void stroke_list_other_certs(certificate_type_t type)
{
bool first = TRUE;
enumerator_t *enumerator;
certificate_t *cert;
certificate_printer_t *printer;
linked_list_t *list;
printer = certificate_printer_create(out, TRUE, utc),
list = create_unique_cert_list(type);
enumerator = list->create_enumerator(list);
while (enumerator->enumerate(enumerator, &cert))
{
if (first)
{
fprintf(out, "\n");
fprintf(out, "List of %ss:\n", label);
first = FALSE;
}
fprintf(out, "\n");
printer->print(printer, cert, has_privkey(cert));
cert_printer->print_caption(cert_printer, cert->get_type(cert), X509_NONE);
cert_printer->print(cert_printer, cert, has_privkey(cert));
}
enumerator->destroy(enumerator);
printer->destroy(printer);
list->destroy_offset(list, offsetof(certificate_t, destroy));
}
/**
@@ -1058,21 +979,15 @@ METHOD(stroke_list_t, list, void,
{
linked_list_t *cert_list = NULL;
cert_printer = certificate_printer_create(out, TRUE, msg->list.utc);
if (msg->list.flags & LIST_PUBKEYS)
{
linked_list_t *pubkey_list = create_unique_cert_list(CERT_TRUSTED_PUBKEY);
stroke_list_other_certs(pubkey_list, "Raw Public Key",
msg->list.utc, out);
pubkey_list->destroy_offset(pubkey_list, offsetof(certificate_t, destroy));
stroke_list_other_certs(CERT_TRUSTED_PUBKEY);
}
if (msg->list.flags & LIST_CERTS)
{
linked_list_t *pgp_list = create_unique_cert_list(CERT_GPG);
stroke_list_pgp_certs(pgp_list, "PGP End Entity Certificate",
msg->list.utc, out);
pgp_list->destroy_offset(pgp_list, offsetof(certificate_t, destroy));
stroke_list_other_certs(CERT_GPG);
}
if (msg->list.flags & (LIST_CERTS | LIST_CACERTS | LIST_OCSPCERTS | LIST_AACERTS))
{
@@ -1080,49 +995,33 @@ METHOD(stroke_list_t, list, void,
}
if (msg->list.flags & LIST_CERTS)
{
stroke_list_x509_certs(cert_list, "X.509 End Entity Certificate",
X509_NONE, msg->list.utc, out);
stroke_list_x509_certs(cert_list, X509_NONE);
}
if (msg->list.flags & LIST_CACERTS)
{
stroke_list_x509_certs(cert_list, "X.509 CA Certificate",
X509_CA, msg->list.utc, out);
stroke_list_x509_certs(cert_list, X509_CA);
}
if (msg->list.flags & LIST_OCSPCERTS)
{
stroke_list_x509_certs(cert_list, "X.509 OCSP Signer Certificate",
X509_OCSP_SIGNER, msg->list.utc, out);
stroke_list_x509_certs(cert_list, X509_OCSP_SIGNER);
}
if (msg->list.flags & LIST_AACERTS)
{
stroke_list_x509_certs(cert_list, "X.509 AA Certificate",
X509_AA, msg->list.utc, out);
stroke_list_x509_certs(cert_list, X509_AA);
}
DESTROY_OFFSET_IF(cert_list, offsetof(certificate_t, destroy));
if (msg->list.flags & LIST_ACERTS)
{
linked_list_t *ac_list = create_unique_cert_list(CERT_X509_AC);
stroke_list_other_certs(ac_list, "X.509 Attribute Certificate",
msg->list.utc, out);
ac_list->destroy_offset(ac_list, offsetof(certificate_t, destroy));
stroke_list_other_certs(CERT_X509_AC);
}
if (msg->list.flags & LIST_CRLS)
{
linked_list_t *crl_list = create_unique_cert_list(CERT_X509_CRL);
stroke_list_other_certs(crl_list, "X.509 CRL",
msg->list.utc, out);
crl_list->destroy_offset(crl_list, offsetof(certificate_t, destroy));
stroke_list_other_certs(CERT_X509_CRL);
}
if (msg->list.flags & LIST_OCSP)
{
linked_list_t *ocsp_list = create_unique_cert_list(CERT_X509_OCSP_RESPONSE);
stroke_list_other_certs(ocsp_list, "OCSP Response",
msg->list.utc, out);
ocsp_list->destroy_offset(ocsp_list, offsetof(certificate_t, destroy));
stroke_list_other_certs(CERT_X509_OCSP_RESPONSE);
}
if (msg->list.flags & LIST_ALGS)
{
@@ -1132,6 +1031,8 @@ METHOD(stroke_list_t, list, void,
{
list_plugins(out);
}
cert_printer->destroy(cert_printer);
cert_printer = NULL;
}
/**
src/libcharon/plugins/vici/Makefile.am
+2 -2
View File
@@ -18,7 +18,7 @@ libstrongswan_vici_la_SOURCES = \
vici_message.h vici_message.c \
vici_builder.h vici_builder.c \
vici_dispatcher.h vici_dispatcher.c \
vici_cert_info.c vici_cert_info.h \
vici_cert_info.h vici_cert_info.c \
vici_query.h vici_query.c \
vici_control.h vici_control.c \
vici_config.h vici_config.c \
@@ -39,7 +39,7 @@ ipseclib_LTLIBRARIES = libvici.la
libvici_la_SOURCES = \
vici_message.c vici_message.h \
vici_builder.c vici_builder.h \
vici_cert_info.c vici_cert_info.h \
vici_cert_info.h vici_cert_info.c \
libvici.c libvici.h
libvici_la_LIBADD = $(top_builddir)/src/libstrongswan/libstrongswan.la
src/libcharon/plugins/vici/README.md
+7 -3
View File
@@ -369,7 +369,9 @@ call includes all certificates known by the daemon, not only those loaded
over vici.
{
type = <certificate type to filter for, or ANY>
type = <certificate type to filter for, X509|X509_AC|X509_CRL|
OCSP_RESPONSE|PUBKEY or ANY>
flag = <X.509 certificate flag to filter for, NONE|CA|AA|OCSP or ANY>
subject = <set to list only certificates having subject>
} => {
# completes after streaming list-cert events
@@ -427,7 +429,8 @@ Unload a previously loaded connection definition by name.
Load a certificate into the daemon.
{
type = <certificate type, X509|X509CA|X509AA|X509CRL|X509AC>
type = <certificate type, X509|X509_AC|X509_CRL>
flag = <X.509 certificate flag, NONE|CA|AA|OCSP>
data = <PEM or DER encoded certificate data>
} => {
success = <yes or no>
@@ -753,7 +756,8 @@ The _list-cert_ event is issued to stream loaded certificates during an active
_list-certs_ command.
{
type = <certificate type>
type = <certificate type, X509|X509_AC|X509_CRL|OCSP_RESPONSE|PUBKEY>
flag = <X.509 certificate flag, NONE|CA|AA|OCSP>
has_privkey = <set if a private key for the certificate is available>
data = <ASN1 encoded certificate data>
}
src/libcharon/plugins/vici/perl/Vici-Session/README.pod
+2 -2
View File
@@ -164,13 +164,13 @@ print $version->raw(), "\n";
loads a certificate into the daemon.
my %vars = ( type => 'X509CA', data => $ca_cert );
my %vars = ( type => 'X509', flag => 'CA', data => $ca_cert );
my ($res, $errmsg) = $session->load_cert(Vici::Message->new(\%vars));
=cut
print "----- load-cert -----\n";
my %vars = ( type => 'X509CA', data => $ca_cert );
my %vars = ( type => 'X509', flag => 'CA', data => $ca_cert );
my ($res, $errmsg) = $session->load_cert(Vici::Message->new(\%vars));
print $res ? "ok\n" : "failed: $errmsg\n";
src/libcharon/plugins/vici/vici_cred.c
+23 -11
View File
@@ -2,6 +2,9 @@
* Copyright (C) 2014 Martin Willi
* Copyright (C) 2014 revosec AG
*
* Copyright (C) 2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
@@ -67,9 +70,9 @@ static vici_message_t* create_reply(char *fmt, ...)
CALLBACK(load_cert, vici_message_t*,
private_vici_cred_t *this, char *name, u_int id, vici_message_t *message)
{
vici_cert_info_t *cert_info;
certificate_t *cert;
x509_flag_t flag;
certificate_type_t type;
x509_flag_t ext_flag, flag = X509_NONE;
x509_t *x509;
chunk_t data;
bool trusted = TRUE;
@@ -80,9 +83,18 @@ CALLBACK(load_cert, vici_message_t*,
{
return create_reply("certificate type missing");
}
cert_info = vici_cert_info_retrieve(str);
if (!cert_info)
if (enum_from_name(certificate_type_names, str, &type))
{
if (type == CERT_X509)
{
str = message->get_str(message, "NONE", "flag");
if (!enum_from_name(x509_flag_names, str, &flag))
{
return create_reply("invalid certificate flag '%s'", str);
}
}
}
else if (!vici_cert_info_from_str(str, &type, &flag))
{
return create_reply("invalid certificate type '%s'", str);
}
@@ -94,21 +106,21 @@ CALLBACK(load_cert, vici_message_t*,
}
/* do not set CA flag externally */
flag = (cert_info->flag & X509_CA) ? X509_NONE : cert_info->flag;
ext_flag = (flag & X509_CA) ? X509_NONE : flag;
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, cert_info->type,
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
BUILD_BLOB_PEM, data,
BUILD_X509_FLAG, flag,
BUILD_X509_FLAG, ext_flag,
BUILD_END);
if (!cert)
{
return create_reply("parsing %N certificate failed",
certificate_type_names, cert_info->type);
certificate_type_names, type);
}
DBG1(DBG_CFG, "loaded certificate '%Y'", cert->get_subject(cert));
/* check if CA certificate has CA basic constraint set */
if (cert_info->flag & X509_CA)
if (flag & X509_CA)
{
char err_msg[] = "ca certificate lacks CA basic constraint, rejected";
x509 = (x509_t*)cert;
@@ -120,7 +132,7 @@ CALLBACK(load_cert, vici_message_t*,
return create_reply(err_msg);
}
}
if (cert_info->type == CERT_X509_CRL)
if (type == CERT_X509_CRL)
{
this->creds->add_crl(this->creds, (crl_t*)cert);
}
src/libcharon/plugins/vici/vici_query.c
+30 -70
View File
@@ -40,8 +40,6 @@
#include "vici_query.h"
#include "vici_builder.h"
#include "vici_version.h"
#include "vici_cert_info.h"
#include <inttypes.h>
#include <time.h>
@@ -53,6 +51,8 @@
#endif
#include <daemon.h>
#include <credentials/certificates/certificate.h>
#include <credentials/certificates/x509.h>
typedef struct private_vici_query_t private_vici_query_t;
@@ -809,7 +809,6 @@ static bool has_privkey(certificate_t *cert)
* Store cert filter data
*/
typedef struct {
vici_version_t version;
certificate_type_t type;
x509_flag_t flag;
identification_t *subject;
@@ -820,27 +819,25 @@ typedef struct {
*/
static void enum_x509(private_vici_query_t *this, u_int id,
linked_list_t *certs, cert_filter_t *filter,
x509_flag_t flag, char *cert_type)
x509_flag_t flag)
{
enumerator_t *enumerator;
certificate_t *cert;
vici_builder_t *b;
chunk_t encoding;
x509_flag_t mask;
x509_t *x509;
if (filter->type != CERT_ANY && filter->version != VICI_1_0 &&
if (filter->type != CERT_ANY && filter->flag != X509_ANY &&
filter->flag != flag)
{
return;
}
mask = X509_CA | X509_AA | X509_OCSP_SIGNER;
enumerator = certs->create_enumerator(certs);
while (enumerator->enumerate(enumerator, &cert))
{
x509 = (x509_t*)cert;
if ((x509->get_flags(x509) & mask) != flag)
if ((x509->get_flags(x509) & X509_ANY) != flag)
{
continue;
}
@@ -848,16 +845,8 @@ static void enum_x509(private_vici_query_t *this, u_int id,
if (cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
{
b = vici_builder_create();
if (filter->version == VICI_1_0)
{
b->add_kv(b, "type", "%N", certificate_type_names,
cert->get_type(cert));
}
else
{
b->add_kv(b, "vici", "%N", vici_version_names, VICI_VERSION);
b->add_kv(b, "type", "%s", cert_type);
}
b->add_kv(b, "type", "%N", certificate_type_names, CERT_X509);
b->add_kv(b, "flag", "%N", x509_flag_names, flag);
if (has_privkey(cert))
{
b->add_kv(b, "has_privkey", "yes");
@@ -876,8 +865,7 @@ static void enum_x509(private_vici_query_t *this, u_int id,
* Enumerate all non-X.509 certificate types
*/
static void enum_others(private_vici_query_t *this, u_int id,
linked_list_t *certs, cert_filter_t *filter,
char *cert_type)
linked_list_t *certs, cert_filter_t *filter)
{
enumerator_t *enumerator;
certificate_t *cert;
@@ -890,16 +878,8 @@ static void enum_others(private_vici_query_t *this, u_int id,
if (cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
{
b = vici_builder_create();
if (filter->version == VICI_1_0)
{
b->add_kv(b, "type", "%N", certificate_type_names,
cert->get_type(cert));
}
else
{
b->add_kv(b, "vici", "%N", vici_version_names, VICI_VERSION);
b->add_kv(b, "type", "%s", cert_type);
}
b->add_kv(b, "type", "%N", certificate_type_names,
cert->get_type(cert));
if (has_privkey(cert))
{
b->add_kv(b, "has_privkey", "yes");
@@ -918,8 +898,7 @@ static void enum_others(private_vici_query_t *this, u_int id,
* Enumerate all certificates of a given type
*/
static void enum_certs(private_vici_query_t *this, u_int id,
cert_filter_t *filter, certificate_type_t type,
char *cert_type)
cert_filter_t *filter, certificate_type_t type)
{
enumerator_t *e1, *e2;
certificate_t *cert, *current;
@@ -958,14 +937,14 @@ static void enum_certs(private_vici_query_t *this, u_int id,
if (type == CERT_X509)
{
enum_x509(this, id, certs, filter, X509_NONE, "x509");
enum_x509(this, id, certs, filter, X509_CA, "x509ca");
enum_x509(this, id, certs, filter, X509_AA, "x509ac");
enum_x509(this, id, certs, filter, X509_OCSP_SIGNER, "x509ocsp");
enum_x509(this, id, certs, filter, X509_NONE);
enum_x509(this, id, certs, filter, X509_CA);
enum_x509(this, id, certs, filter, X509_AA);
enum_x509(this, id, certs, filter, X509_OCSP_SIGNER);
}
else
{
enum_others(this, id, certs, filter, cert_type);
enum_others(this, id, certs, filter);
}
certs->destroy_offset(certs, offsetof(certificate_t, destroy));
}
@@ -974,43 +953,25 @@ CALLBACK(list_certs, vici_message_t*,
private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
{
cert_filter_t filter = {
.version = VICI_1_0,
.type = CERT_ANY,
.flag = X509_NONE,
.flag = X509_ANY,
.subject = NULL
};
vici_builder_t *b;
char *str;
str = request->get_str(request, "1.0", "vici");
if (!enum_from_name(vici_version_names, str, &filter.version))
str = request->get_str(request, "ANY", "type");
if (!enum_from_name(certificate_type_names, str, &filter.type))
{
DBG1(DBG_CFG, "unsupported vici version '%s'", str);
DBG1(DBG_CFG, "invalid certificate type '%s'", str);
goto finalize;
}
str = request->get_str(request, "ANY", "type");
if (filter.version == VICI_1_0)
if (filter.type == CERT_X509)
{
if (!enum_from_name(certificate_type_names, str, &filter.type))
str = request->get_str(request, "ANY", "flag");
if (!enum_from_name(x509_flag_names, str, &filter.flag))
{
DBG1(DBG_CFG, "invalid certificate type '%s'", str);
goto finalize;
}
}
else /* VICI 2.0 */
{
vici_cert_info_t *cert_info;
cert_info = vici_cert_info_retrieve(str);
if (cert_info)
{
filter.type = cert_info->type;
filter.flag = cert_info->flag;
}
else
{
DBG1(DBG_CFG, "invalid certificate type '%s'", str);
DBG1(DBG_CFG, "invalid certificate flag '%s'", str);
goto finalize;
}
}
@@ -1020,11 +981,12 @@ CALLBACK(list_certs, vici_message_t*,
{
filter.subject = identification_create_from_string(str);
}
enum_certs(this, id, &filter, CERT_TRUSTED_PUBKEY, "pubkey");
enum_certs(this, id, &filter, CERT_X509, "x509");
enum_certs(this, id, &filter, CERT_X509_AC, "x509ac");
enum_certs(this, id, &filter, CERT_X509_CRL, "x509crl");
enum_certs(this, id, &filter, CERT_X509_OCSP_RESPONSE, "ocsp");
enum_certs(this, id, &filter, CERT_TRUSTED_PUBKEY);
enum_certs(this, id, &filter, CERT_X509);
enum_certs(this, id, &filter, CERT_X509_AC);
enum_certs(this, id, &filter, CERT_X509_CRL);
enum_certs(this, id, &filter, CERT_X509_OCSP_RESPONSE);
DESTROY_IF(filter.subject);
finalize:
@@ -1140,8 +1102,6 @@ CALLBACK(version, vici_message_t*,
vici_builder_t *b;
b = vici_builder_create();
b->add_kv(b, "vici", "%N", vici_version_names, VICI_VERSION);
b->add_kv(b, "daemon", "%s", lib->ns);
b->add_kv(b, "version", "%s", VERSION);