denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactored certificate management for the vici and stroke interfaces

Browse Source
This commit is contained in:
Andreas Steffen
2015-12-12 00:19:24 +01:00
parent 4df09fe563
commit 02d431022c
12 changed files with 287 additions and 308 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/vici_query.c
+30 -70
View File
@@ -40,8 +40,6 @@
#include "vici_query.h"
#include "vici_builder.h"
#include "vici_version.h"
#include "vici_cert_info.h"
#include <inttypes.h>
#include <time.h>
@@ -53,6 +51,8 @@
#endif
#include <daemon.h>
#include <credentials/certificates/certificate.h>
#include <credentials/certificates/x509.h>
typedef struct private_vici_query_t private_vici_query_t;
@@ -809,7 +809,6 @@ static bool has_privkey(certificate_t *cert)
* Store cert filter data
*/
typedef struct {
vici_version_t version;
certificate_type_t type;
x509_flag_t flag;
identification_t *subject;
@@ -820,27 +819,25 @@ typedef struct {
*/
static void enum_x509(private_vici_query_t *this, u_int id,
linked_list_t *certs, cert_filter_t *filter,
x509_flag_t flag, char *cert_type)
x509_flag_t flag)
{
enumerator_t *enumerator;
certificate_t *cert;
vici_builder_t *b;
chunk_t encoding;
x509_flag_t mask;
x509_t *x509;
if (filter->type != CERT_ANY && filter->version != VICI_1_0 &&
if (filter->type != CERT_ANY && filter->flag != X509_ANY &&
filter->flag != flag)
{
return;
}
mask = X509_CA | X509_AA | X509_OCSP_SIGNER;
enumerator = certs->create_enumerator(certs);
while (enumerator->enumerate(enumerator, &cert))
{
x509 = (x509_t*)cert;
if ((x509->get_flags(x509) & mask) != flag)
if ((x509->get_flags(x509) & X509_ANY) != flag)
{
continue;
}
@@ -848,16 +845,8 @@ static void enum_x509(private_vici_query_t *this, u_int id,
if (cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
{
b = vici_builder_create();
if (filter->version == VICI_1_0)
{
b->add_kv(b, "type", "%N", certificate_type_names,
cert->get_type(cert));
}
else
{
b->add_kv(b, "vici", "%N", vici_version_names, VICI_VERSION);
b->add_kv(b, "type", "%s", cert_type);
}
b->add_kv(b, "type", "%N", certificate_type_names, CERT_X509);
b->add_kv(b, "flag", "%N", x509_flag_names, flag);
if (has_privkey(cert))
{
b->add_kv(b, "has_privkey", "yes");
@@ -876,8 +865,7 @@ static void enum_x509(private_vici_query_t *this, u_int id,
* Enumerate all non-X.509 certificate types
*/
static void enum_others(private_vici_query_t *this, u_int id,
linked_list_t *certs, cert_filter_t *filter,
char *cert_type)
linked_list_t *certs, cert_filter_t *filter)
{
enumerator_t *enumerator;
certificate_t *cert;
@@ -890,16 +878,8 @@ static void enum_others(private_vici_query_t *this, u_int id,
if (cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
{
b = vici_builder_create();
if (filter->version == VICI_1_0)
{
b->add_kv(b, "type", "%N", certificate_type_names,
cert->get_type(cert));
}
else
{
b->add_kv(b, "vici", "%N", vici_version_names, VICI_VERSION);
b->add_kv(b, "type", "%s", cert_type);
}
b->add_kv(b, "type", "%N", certificate_type_names,
cert->get_type(cert));
if (has_privkey(cert))
{
b->add_kv(b, "has_privkey", "yes");
@@ -918,8 +898,7 @@ static void enum_others(private_vici_query_t *this, u_int id,
* Enumerate all certificates of a given type
*/
static void enum_certs(private_vici_query_t *this, u_int id,
cert_filter_t *filter, certificate_type_t type,
char *cert_type)
cert_filter_t *filter, certificate_type_t type)
{
enumerator_t *e1, *e2;
certificate_t *cert, *current;
@@ -958,14 +937,14 @@ static void enum_certs(private_vici_query_t *this, u_int id,
if (type == CERT_X509)
{
enum_x509(this, id, certs, filter, X509_NONE, "x509");
enum_x509(this, id, certs, filter, X509_CA, "x509ca");
enum_x509(this, id, certs, filter, X509_AA, "x509ac");
enum_x509(this, id, certs, filter, X509_OCSP_SIGNER, "x509ocsp");
enum_x509(this, id, certs, filter, X509_NONE);
enum_x509(this, id, certs, filter, X509_CA);
enum_x509(this, id, certs, filter, X509_AA);
enum_x509(this, id, certs, filter, X509_OCSP_SIGNER);
}
else
{
enum_others(this, id, certs, filter, cert_type);
enum_others(this, id, certs, filter);
}
certs->destroy_offset(certs, offsetof(certificate_t, destroy));
}
@@ -974,43 +953,25 @@ CALLBACK(list_certs, vici_message_t*,
private_vici_query_t *this, char *name, u_int id, vici_message_t *request)
{
cert_filter_t filter = {
.version = VICI_1_0,
.type = CERT_ANY,
.flag = X509_NONE,
.flag = X509_ANY,
.subject = NULL
};
vici_builder_t *b;
char *str;
str = request->get_str(request, "1.0", "vici");
if (!enum_from_name(vici_version_names, str, &filter.version))
str = request->get_str(request, "ANY", "type");
if (!enum_from_name(certificate_type_names, str, &filter.type))
{
DBG1(DBG_CFG, "unsupported vici version '%s'", str);
DBG1(DBG_CFG, "invalid certificate type '%s'", str);
goto finalize;
}
str = request->get_str(request, "ANY", "type");
if (filter.version == VICI_1_0)
if (filter.type == CERT_X509)
{
if (!enum_from_name(certificate_type_names, str, &filter.type))
str = request->get_str(request, "ANY", "flag");
if (!enum_from_name(x509_flag_names, str, &filter.flag))
{
DBG1(DBG_CFG, "invalid certificate type '%s'", str);
goto finalize;
}
}
else /* VICI 2.0 */
{
vici_cert_info_t *cert_info;
cert_info = vici_cert_info_retrieve(str);
if (cert_info)
{
filter.type = cert_info->type;
filter.flag = cert_info->flag;
}
else
{
DBG1(DBG_CFG, "invalid certificate type '%s'", str);
DBG1(DBG_CFG, "invalid certificate flag '%s'", str);
goto finalize;
}
}
@@ -1020,11 +981,12 @@ CALLBACK(list_certs, vici_message_t*,
{
filter.subject = identification_create_from_string(str);
}
enum_certs(this, id, &filter, CERT_TRUSTED_PUBKEY, "pubkey");
enum_certs(this, id, &filter, CERT_X509, "x509");
enum_certs(this, id, &filter, CERT_X509_AC, "x509ac");
enum_certs(this, id, &filter, CERT_X509_CRL, "x509crl");
enum_certs(this, id, &filter, CERT_X509_OCSP_RESPONSE, "ocsp");
enum_certs(this, id, &filter, CERT_TRUSTED_PUBKEY);
enum_certs(this, id, &filter, CERT_X509);
enum_certs(this, id, &filter, CERT_X509_AC);
enum_certs(this, id, &filter, CERT_X509_CRL);
enum_certs(this, id, &filter, CERT_X509_OCSP_RESPONSE);
DESTROY_IF(filter.subject);
finalize:
@@ -1140,8 +1102,6 @@ CALLBACK(version, vici_message_t*,
vici_builder_t *b;
b = vici_builder_create();
b->add_kv(b, "vici", "%N", vici_version_names, VICI_VERSION);
b->add_kv(b, "daemon", "%s", lib->ns);
b->add_kv(b, "version", "%s", VERSION);