denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

%prompt support for smartcard PIN via "ipsec secrets"

Browse Source
This commit is contained in:
Martin Willi
2010-08-04 09:26:20 +02:00
parent a0bdd5d63e
commit 57522106c4
1 changed files with 95 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_cred.c
+95 -28
View File
@@ -679,7 +679,7 @@ typedef struct {
} passphrase_cb_data_t; } passphrase_cb_data_t;
/** /**
* Passphrase callback to read from whack fd * Passphrase callback to read from stroke fd
*/ */
chunk_t passphrase_cb(passphrase_cb_data_t *data, int try) chunk_t passphrase_cb(passphrase_cb_data_t *data, int try)
{ {
@@ -710,6 +710,31 @@ chunk_t passphrase_cb(passphrase_cb_data_t *data, int try)
return secret; return secret;
} }
/**
* Smartcard PIN callback to read from stroke fd
*/
chunk_t smartcard_cb(passphrase_cb_data_t *data, int try)
{
chunk_t secret = chunk_empty;;
if (try != 1)
{
fprintf(data->prompt, "invalid passphrase, aborting\n");
return chunk_empty;
}
fprintf(data->prompt, "Login to '%s' required\n", data->file);
fprintf(data->prompt, "Passphrase:\n");
if (fgets(data->buf, sizeof(data->buf), data->prompt))
{
secret = chunk_create(data->buf, strlen(data->buf));
if (secret.len)
{ /* trim appended \n */
secret.len--;
}
}
return secret;
}
/** /**
* reload ipsec.secrets * reload ipsec.secrets
*/ */
@@ -898,10 +923,10 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level,
{ {
if (prompt) if (prompt)
{ {
passphrase_cb_data_t data; passphrase_cb_data_t data = {
.prompt = prompt,
data.prompt = prompt; .file = path,
data.file = path; };
key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
key_type, BUILD_FROM_FILE, path, key_type, BUILD_FROM_FILE, path,
BUILD_PASSPHRASE_CALLBACK, BUILD_PASSPHRASE_CALLBACK,
@@ -930,7 +955,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level,
{ {
chunk_t sc = chunk_empty, secret = chunk_empty; chunk_t sc = chunk_empty, secret = chunk_empty;
char smartcard[64], keyid[64], module[64], *pos; char smartcard[64], keyid[64], module[64], *pos;
private_key_t *key; private_key_t *key = NULL;
u_int slot; u_int slot;
chunk_t chunk; chunk_t chunk;
enum { enum {
@@ -1000,29 +1025,71 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level,
} }
chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL); chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
switch (format)
if (secret.len == 7 && strneq(secret.ptr, "%prompt", 7))
{ {
case SC_FORMAT_SLOT_MODULE_KEYID: if (prompt)
key = lib->creds->create(lib->creds, {
CRED_PRIVATE_KEY, KEY_ANY, passphrase_cb_data_t data = {
BUILD_PKCS11_SLOT, slot, .prompt = prompt,
BUILD_PKCS11_MODULE, module, .file = smartcard,
BUILD_PKCS11_KEYID, chunk, };
BUILD_PASSPHRASE, secret, BUILD_END);
break; switch (format)
case SC_FORMAT_SLOT_KEYID: {
key = lib->creds->create(lib->creds, case SC_FORMAT_SLOT_MODULE_KEYID:
CRED_PRIVATE_KEY, KEY_ANY, key = lib->creds->create(lib->creds,
BUILD_PKCS11_SLOT, slot, CRED_PRIVATE_KEY, KEY_ANY,
BUILD_PKCS11_KEYID, chunk, BUILD_PKCS11_SLOT, slot,
BUILD_PASSPHRASE, secret, BUILD_END); BUILD_PKCS11_MODULE, module,
break; BUILD_PKCS11_KEYID, chunk,
case SC_FORMAT_KEYID: BUILD_PASSPHRASE_CALLBACK,
key = lib->creds->create(lib->creds, smartcard_cb, &data, BUILD_END);
CRED_PRIVATE_KEY, KEY_ANY, break;
BUILD_PKCS11_KEYID, chunk, case SC_FORMAT_SLOT_KEYID:
BUILD_PASSPHRASE, secret, BUILD_END); key = lib->creds->create(lib->creds,
break; CRED_PRIVATE_KEY, KEY_ANY,
BUILD_PKCS11_SLOT, slot,
BUILD_PKCS11_KEYID, chunk,
BUILD_PASSPHRASE_CALLBACK,
smartcard_cb, &data, BUILD_END);
break;
case SC_FORMAT_KEYID:
key = lib->creds->create(lib->creds,
CRED_PRIVATE_KEY, KEY_ANY,
BUILD_PKCS11_KEYID, chunk,
BUILD_PASSPHRASE_CALLBACK,
smartcard_cb, &data, BUILD_END);
break;
}
}
}
else
{
switch (format)
{
case SC_FORMAT_SLOT_MODULE_KEYID:
key = lib->creds->create(lib->creds,
CRED_PRIVATE_KEY, KEY_ANY,
BUILD_PKCS11_SLOT, slot,
BUILD_PKCS11_MODULE, module,
BUILD_PKCS11_KEYID, chunk,
BUILD_PASSPHRASE, secret, BUILD_END);
break;
case SC_FORMAT_SLOT_KEYID:
key = lib->creds->create(lib->creds,
CRED_PRIVATE_KEY, KEY_ANY,
BUILD_PKCS11_SLOT, slot,
BUILD_PKCS11_KEYID, chunk,
BUILD_PASSPHRASE, secret, BUILD_END);
break;
case SC_FORMAT_KEYID:
key = lib->creds->create(lib->creds,
CRED_PRIVATE_KEY, KEY_ANY,
BUILD_PKCS11_KEYID, chunk,
BUILD_PASSPHRASE, secret, BUILD_END);
break;
}
} }
free(chunk.ptr); free(chunk.ptr);
if (key) if (key)