Share vici_cert_info.c with vici_cred.c

src/libcharon/plugins/vici/vici_cert_info.c

@@ -31,6 +31,8 @@ static vici_cert_info_t vici_cert_infos[] = {
 	{ "x509crl", "X.509 CRL",                      CERT_X509_CRL,
 											 	   X509_NONE                },
 	{ "ocsp", "OCSP Response",                     CERT_X509_OCSP_RESPONSE,
+												   X509_NONE                },
+	{ "pubkey", "Raw Public Key",                  CERT_TRUSTED_PUBKEY,
 												   X509_NONE                }
 };
 

src/libcharon/plugins/vici/vici_cred.c

@@ -15,6 +15,7 @@
 
 #include "vici_cred.h"
 #include "vici_builder.h"
+#include "vici_cert_info.h"
 
 #include <credentials/sets/mem_cred.h>
 #include <credentials/certificates/ac.h>
@@ -66,9 +67,9 @@ static vici_message_t* create_reply(char *fmt, ...)
 CALLBACK(load_cert, vici_message_t*,
 	private_vici_cred_t *this, char *name, u_int id, vici_message_t *message)
 {
-	certificate_type_t type;
-	x509_flag_t required_flags = 0, additional_flags = 0;
+	vici_cert_info_t *cert_info;
 	certificate_t *cert;
+	x509_flag_t flag;
 	x509_t *x509;
 	chunk_t data;
 	bool trusted = TRUE;
@@ -79,61 +80,47 @@ CALLBACK(load_cert, vici_message_t*,
 	{
 		return create_reply("certificate type missing");
 	}
-	if (strcaseeq(str, "x509"))
+
+	cert_info = vici_cert_info_retrieve(str);
+	if (!cert_info)
 	{
-		type = CERT_X509;
-	}
-	else if (strcaseeq(str, "x509ca"))
-	{
-		type = CERT_X509;
-		required_flags = X509_CA;
-	}
-	else if (strcaseeq(str, "x509aa"))
-	{
-		type = CERT_X509;
-		additional_flags = X509_AA;
-	}
-	else if (strcaseeq(str, "x509crl"))
-	{
-		type = CERT_X509_CRL;
-	}
-	else if (strcaseeq(str, "x509ac"))
-	{
-		type = CERT_X509_AC;
-		trusted = FALSE;
-	}
-	else
-	{
-		return create_reply("invalid certificate type: %s", str);
+		return create_reply("invalid certificate type '%s'", str);
 	}
+
 	data = message->get_value(message, chunk_empty, "data");
 	if (!data.len)
 	{
 		return create_reply("certificate data missing");
 	}
-	cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
+
+	/* do not set CA flag externally */
+	flag = (cert_info->flag & X509_CA) ? X509_NONE : cert_info->flag;
+
+	cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, cert_info->type,
 							  BUILD_BLOB_PEM, data,
-							  BUILD_X509_FLAG, additional_flags,
+							  BUILD_X509_FLAG, flag,
 							  BUILD_END);
 	if (!cert)
 	{
 		return create_reply("parsing %N certificate failed",
-							certificate_type_names, type);
+							certificate_type_names, cert_info->type);
 	}
-	if (cert->get_type(cert) == CERT_X509)
-	{
-		x509 = (x509_t*)cert;
-
-		if ((required_flags & x509->get_flags(x509)) != required_flags)
-		{
-			cert->destroy(cert);
-			return create_reply("certificate misses required flag, rejected");
-		}
-	}
-
 	DBG1(DBG_CFG, "loaded certificate '%Y'", cert->get_subject(cert));
 
-	if (type == CERT_X509_CRL)
+	/* check if CA certificate has CA basic constraint set */
+	if (cert_info->flag & X509_CA)
+	{
+		char err_msg[] = "ca certificate lacks CA basic constraint, rejected";
+		x509 = (x509_t*)cert;
+
+		if (!(x509->get_flags(x509) & X509_CA))
+		{
+			cert->destroy(cert);
+			DBG1(DBG_CFG, "  %s", err_msg);
+			return create_reply(err_msg);
+		}
+	}
+	if (cert_info->type == CERT_X509_CRL)
 	{
 		this->creds->add_crl(this->creds, (crl_t*)cert);
 	}
@@ -169,6 +156,10 @@ CALLBACK(load_key, vici_message_t*,
 	{
 		type = KEY_ECDSA;
 	}
+	else if (strcaseeq(str, "bliss"))
+	{
+		type = KEY_BLISS;
+	}
 	else
 	{
 		return create_reply("invalid key type: %s", str);

src/libcharon/plugins/vici/vici_query.c

@@ -900,6 +900,10 @@ static void enum_others(private_vici_query_t *this, u_int id,
 				b->add_kv(b, "vici", "%N", vici_version_names, VICI_VERSION);
 				b->add_kv(b, "type", "%s", cert_type);
 			}
+			if (has_privkey(cert))
+			{
+				b->add_kv(b, "has_privkey", "yes");
+			}
 			b->add(b, VICI_KEY_VALUE, "data", encoding);
 			free(encoding.ptr);
 
@@ -1016,6 +1020,7 @@ CALLBACK(list_certs, vici_message_t*,
 	{
 		filter.subject = identification_create_from_string(str);
 	}
+	enum_certs(this, id, &filter, CERT_TRUSTED_PUBKEY, "pubkey");
 	enum_certs(this, id, &filter, CERT_X509, "x509");
 	enum_certs(this, id, &filter, CERT_X509_AC, "x509ac");
 	enum_certs(this, id, &filter, CERT_X509_CRL, "x509crl");