diff --git a/src/charon/plugins/stroke/stroke.c b/src/charon/plugins/stroke/stroke.c index d29118f91..c2c0dc3aa 100755 --- a/src/charon/plugins/stroke/stroke.c +++ b/src/charon/plugins/stroke/stroke.c @@ -37,6 +37,7 @@ #include #include #include +#include #include #include #include @@ -695,51 +696,6 @@ static void pop_string(stroke_msg_t *msg, char **string) } } -/** - * Load an X.509 certificate - */ -static x509_t* load_cert(char *path, x509_flag_t flag) -{ - bool pgp = FALSE; - chunk_t chunk; - x509_t *x509; - certificate_t *cert; - time_t notBefore, notAfter, now; - - if (!pem_asn1_load_file(path, NULL, &chunk, &pgp)) - { - DBG1(DBG_CFG, " could not load certificate file '%s'", path); - return NULL; - } - x509 = (x509_t*)lib->creds->create(lib->creds, - CRED_CERTIFICATE, CERT_X509, - BUILD_BLOB_ASN1_DER, chunk, - BUILD_X509_FLAG, flag, - BUILD_END); - if (x509 == NULL) - { - DBG1(DBG_CFG, " could not parse loaded certificate file '%s'", path); - return NULL; - } - DBG1(DBG_CFG, " loaded certificate file '%s'", path); - - /* check validity */ - cert = &x509->interface; - now = time(NULL); - cert->get_validity(cert, &now, ¬Before, ¬After); - if (now > notAfter) - { - DBG1(DBG_CFG, " certificate expired at %T, discarded", ¬After); - cert->destroy(cert); - return NULL; - } - if (now < notBefore) - { - DBG1(DBG_CFG, " certificate not valid before %T", ¬Before); - } - return x509; -} - /** * Add X.509 certificate to chain */ @@ -886,7 +842,7 @@ static void load_peer_cert(private_stroke_t *this, snprintf(path, sizeof(path), "%s/%s", CERTIFICATE_DIR, filename); } - x509 = load_cert(path, 0); + x509 = x509_create_from_file(path, "end entity cert", 0); if (x509) { @@ -921,7 +877,7 @@ static certificate_t* load_ca_cert(private_stroke_t *this, char *filename) snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename); } - x509 = load_cert(path, X509_CA); + x509 = x509_create_from_file(path, "ca cert", X509_CA); if (x509) { @@ -936,8 +892,8 @@ static certificate_t* load_ca_cert(private_stroke_t *this, char *filename) /** * load trusted certificates from a directory */ -static void load_certdir(private_stroke_t *this, - char *path, certificate_type_t type, x509_flag_t flag) +static void load_certdir(private_stroke_t *this, char *path, char* label, + certificate_type_t type, x509_flag_t flag) { struct stat st; char *file; @@ -957,52 +913,53 @@ static void load_certdir(private_stroke_t *this, /* skip special file */ continue; } - if (type == CERT_X509) + switch (type) { - x509_t *x509 = load_cert(file, flag); - - if (x509) - { - add_x509_cert(this, x509); - } - } - else - { - certificate_t *cert; - bool pgp = FALSE; - chunk_t chunk; - - if (!pem_asn1_load_file(file, NULL, &chunk, &pgp)) - { - continue; - } - cert = lib->creds->create(lib->creds, - CRED_CERTIFICATE, type, - BUILD_BLOB_ASN1_DER, chunk, BUILD_END); - if (type == CERT_X509_CRL) - { - if (cert) + case CERT_X509: { - crl_t *crl = (crl_t*)cert; + x509_t *x509 = x509_create_from_file(file, label, flag); - DBG1(DBG_CFG, " loaded crl file '%s'", file); - - /* only trusted crls are added to the store */ - if (verify_crl(crl)) + if (x509) { - add_crl(this, crl); + add_x509_cert(this, x509); } - else + } + break; + case CERT_X509_CRL: + { + crl_t *crl = crl_create_from_file(file); + + if (crl) { - DBG1(DBG_CFG, " crl discarded"); + certificate_t *cert = &crl->certificate; + + /* only trusted crls are added to the store */ + if (verify_crl(crl)) + { + add_crl(this, crl); + } + else + { + DBG1(DBG_CFG, " crl discarded"); + cert->destroy(cert); + } + } + } + break; + case CERT_X509_AC: + { + ac_t *ac = ac_create_from_file(file); + + if (ac) + { + certificate_t *cert = &ac->certificate; + cert->destroy(cert); } } - else - { - DBG1(DBG_CFG, " could not load crl file '%s'", file); - } - } + break; + default: + break; } } enumerator->destroy(enumerator); @@ -2945,34 +2902,34 @@ static void stroke_reread(private_stroke_t *this, } if (msg->reread.flags & REREAD_CACERTS) { - DBG1(DBG_CFG, "rereading CA certificates from '%s'", + DBG1(DBG_CFG, "rereading ca certificates from '%s'", CA_CERTIFICATE_DIR); - load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA); + load_certdir(this, CA_CERTIFICATE_DIR, "ca cert", CERT_X509, X509_CA); } if (msg->reread.flags & REREAD_OCSPCERTS) { - DBG1(DBG_CFG, "rereading OCSP signer certificates from '%s'", + DBG1(DBG_CFG, "rereading ocsp signer certificates from '%s'", OCSP_CERTIFICATE_DIR); - load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509, + load_certdir(this, OCSP_CERTIFICATE_DIR, "ocsp cert", CERT_X509, X509_OCSP_SIGNER); } if (msg->reread.flags & REREAD_AACERTS) { - DBG1(DBG_CFG, "rereading AA certificates from '%s'", + DBG1(DBG_CFG, "rereading aa certificates from '%s'", AA_CERTIFICATE_DIR); - load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA); + load_certdir(this, AA_CERTIFICATE_DIR, "aa cert", CERT_X509, X509_AA); } if (msg->reread.flags & REREAD_ACERTS) { DBG1(DBG_CFG, "rereading attribute certificates from '%s'", ATTR_CERTIFICATE_DIR); - load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0); + load_certdir(this, ATTR_CERTIFICATE_DIR, "attr cert", CERT_X509_AC, 0); } if (msg->reread.flags & REREAD_CRLS) { - DBG1(DBG_CFG, "rereading CRLs from '%s'", + DBG1(DBG_CFG, "rereading crls from '%s'", CRL_DIR); - load_certdir(this, CRL_DIR, CERT_X509_CRL, 0); + load_certdir(this, CRL_DIR, "crl", CERT_X509_CRL, 0); } } @@ -3242,25 +3199,25 @@ static bool open_socket(private_stroke_t *this) */ static void load_certs(private_stroke_t *this) { - DBG1(DBG_CFG, "loading CA certificates from '%s'", + DBG1(DBG_CFG, "loading ca certificates from '%s'", CA_CERTIFICATE_DIR); - load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA); + load_certdir(this, CA_CERTIFICATE_DIR, "ca cert", CERT_X509, X509_CA); - DBG1(DBG_CFG, "loading AA certificates from '%s'", + DBG1(DBG_CFG, "loading aa certificates from '%s'", AA_CERTIFICATE_DIR); - load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA); + load_certdir(this, AA_CERTIFICATE_DIR, "aa cert", CERT_X509, X509_AA); - DBG1(DBG_CFG, "loading OCSP signer certificates from '%s'", + DBG1(DBG_CFG, "loading ocsp signer certificates from '%s'", OCSP_CERTIFICATE_DIR); - load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509, X509_OCSP_SIGNER); + load_certdir(this, OCSP_CERTIFICATE_DIR, "ocsp cert", CERT_X509, X509_OCSP_SIGNER); DBG1(DBG_CFG, "loading attribute certificates from '%s'", ATTR_CERTIFICATE_DIR); - load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0); + load_certdir(this, ATTR_CERTIFICATE_DIR, "attr cert", CERT_X509_AC, 0); - DBG1(DBG_CFG, "loading CRLs from '%s'", + DBG1(DBG_CFG, "loading crls from '%s'", CRL_DIR); - load_certdir(this, CRL_DIR, CERT_X509_CRL, 0); + load_certdir(this, CRL_DIR, "crl", CERT_X509_CRL, 0); } /* diff --git a/src/libstrongswan/Makefile.am b/src/libstrongswan/Makefile.am index 5f2169cc4..435f8bbba 100644 --- a/src/libstrongswan/Makefile.am +++ b/src/libstrongswan/Makefile.am @@ -34,7 +34,7 @@ credentials/keys/public_key.c credentials/keys/public_key.h \ credentials/keys/shared_key.c credentials/keys/shared_key.h \ credentials/certificates/certificate.c credentials/certificates/certificate.h \ credentials/certificates/x509.h credentials/certificates/x509.c \ -credentials/certificates/ac.h \ +credentials/certificates/ac.h credentials/certificates/ac.c \ credentials/certificates/crl.h credentials/certificates/crl.c \ credentials/certificates/ocsp_request.h credentials/certificates/ocsp_request.c \ credentials/certificates/ocsp_response.h credentials/certificates/ocsp_response.c \ diff --git a/src/libstrongswan/credentials/certificates/ac.h b/src/libstrongswan/credentials/certificates/ac.h index 20c88b829..64d2d8d0b 100644 --- a/src/libstrongswan/credentials/certificates/ac.h +++ b/src/libstrongswan/credentials/certificates/ac.h @@ -1,7 +1,7 @@ /* * Copyright (C) 2002 Ueli Galizzi, Ariane Seiler * Copyright (C) 2003 Martin Berner, Lukas Suter - * Copyright (C) 2007 Andreas Steffen + * Copyright (C) 2002-2008 Andreas Steffen * * Hochschule fuer Technik Rapperswil * @@ -15,7 +15,7 @@ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. * - * RCSID $Id: ac.h 3300 2007-10-12 21:53:18Z andreas $ + * $Id: ac.h 3300 2007-10-12 21:53:18Z andreas $ */ /** @@ -54,5 +54,10 @@ struct ac_t { bool (*equals_holder) (const ac_t *this, const ac_t *other); }; +/** + * Load and parse an X.509 attribute certificate file + */ +ac_t* ac_create_from_file(char *path); + #endif /* AC_H_ @}*/ diff --git a/src/libstrongswan/credentials/certificates/crl.c b/src/libstrongswan/credentials/certificates/crl.c index 48fb24a5d..2eda5306d 100644 --- a/src/libstrongswan/credentials/certificates/crl.c +++ b/src/libstrongswan/credentials/certificates/crl.c @@ -16,6 +16,9 @@ * $Id$ */ +#include +#include +#include #include "crl.h" ENUM(crl_reason_names, CRL_UNSPECIFIED, CRL_REMOVE_FROM_CRL, @@ -30,3 +33,28 @@ ENUM(crl_reason_names, CRL_UNSPECIFIED, CRL_REMOVE_FROM_CRL, "remove from crl", ); +/* + * Defined in header. + */ +crl_t* crl_create_from_file(char *path) +{ + crl_t *crl; + bool pgp = FALSE; + chunk_t chunk; + + if (!pem_asn1_load_file(path, NULL, &chunk, &pgp)) + { + DBG1(" could not load crl file '%s'", path); + return NULL; + } + crl = (crl_t*)lib->creds->create(lib->creds, + CRED_CERTIFICATE, CERT_X509_CRL, + BUILD_BLOB_ASN1_DER, chunk, BUILD_END); + if (crl == NULL) + { + DBG1(" could not parse loaded crl file '%s'", path); + return NULL; + } + DBG1(" loaded crl file '%s'", path); + return crl; +} diff --git a/src/libstrongswan/credentials/certificates/crl.h b/src/libstrongswan/credentials/certificates/crl.h index 78c9d86f9..3fe43916f 100644 --- a/src/libstrongswan/credentials/certificates/crl.h +++ b/src/libstrongswan/credentials/certificates/crl.h @@ -85,4 +85,9 @@ struct crl_t { }; +/** + * Load and parse an X.509 crl file + */ +crl_t* crl_create_from_file(char *path); + #endif /* CRL_H_ @}*/ diff --git a/src/libstrongswan/credentials/certificates/x509.c b/src/libstrongswan/credentials/certificates/x509.c index a5f4fc1d0..b354d489a 100644 --- a/src/libstrongswan/credentials/certificates/x509.c +++ b/src/libstrongswan/credentials/certificates/x509.c @@ -15,6 +15,10 @@ * $Id$ */ +#include +#include +#include + #include "x509.h" ENUM(x509_flag_names, X509_CA, X509_SELF_SIGNED, @@ -23,3 +27,50 @@ ENUM(x509_flag_names, X509_CA, X509_SELF_SIGNED, "X509_OCSP_SIGNER", "X509_SELF_SIGNED", ); + +/* + * Defined in header. + */ +x509_t* x509_create_from_file(char *path, char *label, x509_flag_t flag) +{ + bool pgp = FALSE; + chunk_t chunk; + x509_t *x509; + certificate_t *cert; + time_t notBefore, notAfter, now; + + if (!pem_asn1_load_file(path, NULL, &chunk, &pgp)) + { + DBG1(" could not load %s file '%s'", label, path); + return NULL; + } + x509 = (x509_t*)lib->creds->create(lib->creds, + CRED_CERTIFICATE, CERT_X509, + BUILD_BLOB_ASN1_DER, chunk, + BUILD_X509_FLAG, flag, + BUILD_END); + if (x509 == NULL) + { + DBG1(" could not parse loaded %s file '%s'",label, path); + return NULL; + } + DBG1(" loaded %s file '%s'", label, path); + + /* check validity */ + cert = &x509->interface; + now = time(NULL); + cert->get_validity(cert, &now, ¬Before, ¬After); + if (now > notAfter) + { + DBG1(" certificate expired at %T, discarded", ¬After); + cert->destroy(cert); + return NULL; + } + if (now < notBefore) + { + DBG1(" certificate not valid before %T", ¬Before); + } + return x509; +} + + diff --git a/src/libstrongswan/credentials/certificates/x509.h b/src/libstrongswan/credentials/certificates/x509.h index 3a90db53c..d368a8a56 100644 --- a/src/libstrongswan/credentials/certificates/x509.h +++ b/src/libstrongswan/credentials/certificates/x509.h @@ -104,4 +104,9 @@ struct x509_t { enumerator_t* (*create_ocsp_uri_enumerator)(x509_t *this); }; +/** + * Load and parse an X.509 certificate file + */ +x509_t* x509_create_from_file(char *path, char *label, x509_flag_t flag); + #endif /* X509_H_ @}*/