denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added crl support

Browse Source
This commit is contained in:
Andreas Steffen
2006-06-16 05:55:30 +00:00
parent d92cca4a72
commit 21e7a724d0
3 changed files with 188 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/config/credentials/credential_store.h
+19 -2
View File
@@ -92,14 +92,22 @@ struct credential_store_t {
bool (*has_rsa_private_key) (credential_store_t *this, rsa_public_key_t *pubkey);
/**
* @brief If a certificate does not already exists in the credential store then add it.
* @brief If an end certificate does not already exists in the credential store then add it.
*
* @param this calling object
* @param cert certificate to be added
* @return pointer to the added or already existing certificate
*/
x509_t* (*add_certificate) (credential_store_t *this, x509_t *cert);
x509_t* (*add_end_certificate) (credential_store_t *this, x509_t *cert);
/**
* @brief If a ca certificate does not already exists in the credential store then add it.
*
* @param this calling object
* @param cert ca certificate to be added
* @return pointer to the added or already existing certificate
*/
x509_t* (*add_ca_certificate) (credential_store_t *this, x509_t *cert);
/**
* @brief Lists all certificates kept in the local credential store.
*
@@ -118,6 +126,15 @@ struct credential_store_t {
*/
void (*log_ca_certificates) (credential_store_t *this, logger_t *logger, bool utc);
/**
* @brief Lists all CRLs kept in the local credential store.
*
* @param this calling object
* @param logger logger to be used
* @param utc log dates either in UTC or local time
*/
void (*log_crls) (credential_store_t *this, logger_t *logger, bool utc);
/**
* @brief Destroys a credential_store_t object.
*
src/charon/config/credentials/local_credential_store.c
+152 -7
View File
@@ -30,6 +30,7 @@
#include <utils/linked_list.h>
#include <utils/logger_manager.h>
#include <crypto/x509.h>
#include <crypto/crl.h>
#define PATH_BUF 256
@@ -59,6 +60,17 @@ struct private_local_credential_store_t {
* list of X.509 CA certificates with public keys
*/
linked_list_t *ca_certs;
/**
* list of X.509 CRLs
*/
linked_list_t *crls;
/**
* enforce strict crl policy
*/
bool strict;
/**
* Assigned logger
*/
@@ -148,13 +160,13 @@ static bool has_rsa_private_key(private_local_credential_store_t *this, rsa_publ
}
/**
* Implements credential_store_t.add_certificate
* Add a unique certificate to a linked list
*/
static x509_t* add_certificate(private_local_credential_store_t *this, x509_t *cert)
static x509_t* add_certificate(linked_list_t *certs, x509_t *cert)
{
bool found = FALSE;
iterator_t *iterator = this->certs->create_iterator(this->certs, TRUE);
iterator_t *iterator = certs->create_iterator(certs, TRUE);
while (iterator->has_next(iterator))
{
@@ -173,11 +185,27 @@ static x509_t* add_certificate(private_local_credential_store_t *this, x509_t *c
if (!found)
{
this->certs->insert_last(this->certs, (void*)cert);
certs->insert_last(certs, (void*)cert);
}
return cert;
}
/**
* Implements credential_store_t.add_end_certificate
*/
static x509_t* add_end_certificate(private_local_credential_store_t *this, x509_t *cert)
{
return add_certificate(this->certs, cert);
}
/**
* Implements credential_store_t.add_ca_certificate
*/
static x509_t* add_ca_certificate(private_local_credential_store_t *this, x509_t *cert)
{
return add_certificate(this->ca_certs, cert);
}
/**
* Implements credential_store_t.log_certificates
*/
@@ -227,6 +255,31 @@ static void log_ca_certificates(private_local_credential_store_t *this, logger_t
}
iterator->destroy(iterator);
}
/**
* Implements credential_store_t.log_crls
*/
static void log_crls(private_local_credential_store_t *this, logger_t *logger, bool utc)
{
iterator_t *iterator = this->crls->create_iterator(this->crls, TRUE);
if (iterator->get_count(iterator))
{
logger->log(logger, CONTROL, "");
logger->log(logger, CONTROL, "List of X.509 CRLs:");
logger->log(logger, CONTROL, "");
}
while (iterator->has_next(iterator))
{
crl_t *crl;
iterator->current(iterator, (void**)&crl);
crl->log_crl(crl, logger, utc, this->strict);
}
iterator->destroy(iterator);
}
/**
* Implements local_credential_store_t.load_ca_certificates
*/
@@ -270,7 +323,7 @@ static void load_ca_certificates(private_local_credential_store_t *this, const c
}
if (cert->is_ca(cert))
{
this->ca_certs->insert_last(this->ca_certs, (void*)cert);
cert = add_certificate(this->ca_certs, cert);
}
else
{
@@ -284,6 +337,85 @@ static void load_ca_certificates(private_local_credential_store_t *this, const c
closedir(dir);
}
/**
* Add the latest crl to a linked list
*/
static crl_t* add_crl(linked_list_t *crls, crl_t *crl)
{
bool found = FALSE;
iterator_t *iterator = crls->create_iterator(crls, TRUE);
while (iterator->has_next(iterator))
{
crl_t *current_crl;
iterator->current(iterator, (void**)&current_crl);
if (crl->equals_issuer(crl, current_crl))
{
found = TRUE;
crl->destroy(crl);
crl = current_crl;
break;
}
}
iterator->destroy(iterator);
if (!found)
{
crls->insert_last(crls, (void*)crl);
}
return crl;
}
/**
* Implements local_credential_store_t.load_crls
*/
static void load_crls(private_local_credential_store_t *this, const char *path)
{
struct dirent* entry;
struct stat stb;
DIR* dir;
crl_t *crl;
this->logger->log(this->logger, CONTROL, "loading crls from '%s/'", path);
dir = opendir(path);
if (dir == NULL)
{
this->logger->log(this->logger, ERROR, "error opening crl directory %s'", path);
return;
}
while ((entry = readdir(dir)) != NULL)
{
char file[PATH_BUF];
snprintf(file, sizeof(file), "%s/%s", path, entry->d_name);
if (stat(file, &stb) == -1)
{
continue;
}
/* try to parse all regular files */
if (stb.st_mode & S_IFREG)
{
crl = crl_create_from_file(file);
if (crl)
{
err_t ugh = crl->is_valid(crl, NULL, this->strict);
if (ugh != NULL)
{
this->logger->log(this->logger, ERROR, "warning: crl %s", ugh);
}
crl = add_crl(this->crls, crl);
}
}
}
closedir(dir);
}
/**
* Implements local_credential_store_t.load_private_keys
*/
@@ -394,6 +526,7 @@ error:
static void destroy(private_local_credential_store_t *this)
{
x509_t *cert;
crl_t *crl;
rsa_private_key_t *key;
/* destroy cert list */
@@ -410,6 +543,13 @@ static void destroy(private_local_credential_store_t *this)
}
this->ca_certs->destroy(this->ca_certs);
/* destroy crl list */
while (this->crls->remove_last(this->crls, (void**)&crl) == SUCCESS)
{
crl->destroy(crl);
}
this->crls->destroy(this->crls);
/* destroy private key list */
while (this->private_keys->remove_last(this->private_keys, (void**)&key) == SUCCESS)
{
@@ -423,7 +563,7 @@ static void destroy(private_local_credential_store_t *this)
/**
* Described in header.
*/
local_credential_store_t * local_credential_store_create(void)
local_credential_store_t * local_credential_store_create(bool strict)
{
private_local_credential_store_t *this = malloc_thing(private_local_credential_store_t);
@@ -431,10 +571,13 @@ local_credential_store_t * local_credential_store_create(void)
this->public.credential_store.get_rsa_private_key = (rsa_private_key_t*(*)(credential_store_t*,rsa_public_key_t*))get_rsa_private_key;
this->public.credential_store.has_rsa_private_key = (bool(*)(credential_store_t*,rsa_public_key_t*))has_rsa_private_key;
this->public.credential_store.get_rsa_public_key = (rsa_public_key_t*(*)(credential_store_t*,identification_t*))get_rsa_public_key;
this->public.credential_store.add_certificate = (x509_t*(*)(credential_store_t*,x509_t*))add_certificate;
this->public.credential_store.add_end_certificate = (x509_t*(*)(credential_store_t*,x509_t*))add_end_certificate;
this->public.credential_store.add_ca_certificate = (x509_t*(*)(credential_store_t*,x509_t*))add_ca_certificate;
this->public.credential_store.log_certificates = (void(*)(credential_store_t*,logger_t*,bool))log_certificates;
this->public.credential_store.log_ca_certificates = (void(*)(credential_store_t*,logger_t*,bool))log_ca_certificates;
this->public.credential_store.log_crls = (void(*)(credential_store_t*,logger_t*,bool))log_crls;
this->public.load_ca_certificates = (void(*)(local_credential_store_t*,const char*))load_ca_certificates;
this->public.load_crls = (void(*)(local_credential_store_t*,const char*))load_crls;
this->public.load_private_keys = (void(*)(local_credential_store_t*,const char*, const char*))load_private_keys;
this->public.credential_store.destroy = (void(*)(credential_store_t*))destroy;
@@ -442,6 +585,8 @@ local_credential_store_t * local_credential_store_create(void)
this->private_keys = linked_list_create();
this->certs = linked_list_create();
this->ca_certs = linked_list_create();
this->crls = linked_list_create();
this->strict = strict;
this->logger = logger_manager->get_logger(logger_manager, CONFIG);
return (&this->public);
src/charon/config/credentials/local_credential_store.h
+17 -6
View File
@@ -38,7 +38,7 @@ typedef struct local_credential_store_t local_credential_store_t;
* Shared secret are not handled yet, so get_shared_secret always returns NOT_FOUND.
*
* @b Constructors:
* - local_credential_store_create()
* - local_credential_store_create(bool strict)
*
* @ingroup config
*/
@@ -50,7 +50,7 @@ struct local_credential_store_t {
credential_store_t credential_store;
/**
* @brief Loads trusted certificates from a folder.
* @brief Loads trusted CA certificates from a default directory.
*
* Certificates in both DER and PEM format are accepted
*
@@ -59,6 +59,16 @@ struct local_credential_store_t {
*/
void (*load_ca_certificates) (local_credential_store_t *this, const char *path);
/**
* @brief Loads CRLs from a default directory.
*
* Certificates in both DER and PEM format are accepted
*
* @param this calling object
* @param path directory to load crls from
*/
void (*load_crls) (local_credential_store_t *this, const char *path);
/**
* @brief Loads RSA private keys defined in ipsec.secrets
*
@@ -68,18 +78,19 @@ struct local_credential_store_t {
*
* @param this calling object
* @param secretsfile file where secrets are stored
* @param defaultpath default directory for private keys
* @param path default directory for private keys
*/
void (*load_private_keys) (local_credential_store_t *this, const char *secretsfile, const char *defaultpath);
void (*load_private_keys) (local_credential_store_t *this, const char *secretsfile, const char *path);
};
/**
* @brief Creates a local_credential_store_t instance.
*
* @return credential store instance.
* @param strict enforce a strict crl policy
* @return credential store instance.
*
* @ingroup config
*/
local_credential_store_t *local_credential_store_create(void);
local_credential_store_t *local_credential_store_create(bool strict);
#endif /* LOCAL_CREDENTIAL_H_ */