support cachecrls=yes

src/charon/config/credentials/local_credential_store.c

@@ -665,7 +665,7 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
 			/* if ocsp service is not available then fall back to crl */
 			if ((status == CERT_UNDEFINED) || (status == CERT_UNKNOWN && this->strict))
 			{
-				status = issuer->verify_by_crl(issuer, certinfo);
+				status = issuer->verify_by_crl(issuer, certinfo, CRL_DIR);
 			}
 			
 			nextUpdate = certinfo->get_nextUpdate(certinfo);
@@ -1038,7 +1038,7 @@ static void load_ocsp_certificates(private_local_credential_store_t *this)
 /**
  * Add the latest crl to the issuing ca
  */
-static void add_crl(private_local_credential_store_t *this, crl_t *crl)
+static void add_crl(private_local_credential_store_t *this, crl_t *crl, const char *path)
 {
 	iterator_t *iterator = this->ca_infos->create_iterator(this->ca_infos, TRUE);
 	ca_info_t *ca_info;
@@ -1048,8 +1048,16 @@ static void add_crl(private_local_credential_store_t *this, crl_t *crl)
 	{
 		if (ca_info->is_crl_issuer(ca_info, crl))
 		{
-			found = TRUE;
+			char buffer[BUF_LEN];
+			chunk_t uri = { buffer, 7 + strlen(path) };
+
 			ca_info->add_crl(ca_info, crl);
+			if (uri.len < BUF_LEN)
+			{
+				snprintf(buffer, BUF_LEN, "file://%s", path);
+				ca_info->add_crluri(ca_info, uri);
+			}
+			found = TRUE;
 			break;
 		}
 	}
@@ -1097,8 +1105,8 @@ static void load_crls(private_local_credential_store_t *this)
 			crl = crl_create_from_file(file);
 			if (crl)
 			{
-				DBG1(DBG_CFG, "crl is %s", crl->is_valid(crl)? "valid":"stale");
-				add_crl(this, crl);
+				DBG1(DBG_CFG, "  crl is %s", crl->is_valid(crl)? "valid":"stale");
+				add_crl(this, crl, file);
 			}
 		}
 	}

src/charon/daemon.c

@@ -380,6 +380,7 @@ static void usage(const char *msg)
 					"         [--help]\n"
 					"         [--version]\n"
 					"         [--strictcrlpolicy]\n"
+					"         [--cachecrls]\n"
 					"         [--crlcheckinterval <interval>]\n"
 					"         [--eapdir <dir>]\n"
 					"         [--use-syslog]\n"
@@ -399,6 +400,7 @@ int main(int argc, char *argv[])
 {
 	u_int crl_check_interval = 0;
 	bool strict_crl_policy = FALSE;
+	bool cache_crls = FALSE;
 	bool use_syslog = FALSE;
 	char *eapdir = IPSEC_EAPDIR;
 
@@ -424,6 +426,7 @@ int main(int argc, char *argv[])
 			{ "version", no_argument, NULL, 'v' },
 			{ "use-syslog", no_argument, NULL, 'l' },
 			{ "strictcrlpolicy", no_argument, NULL, 'r' },
+			{ "cachecrls", no_argument, NULL, 'C' },
 			{ "crlcheckinterval", required_argument, NULL, 'x' },
 			{ "eapdir", required_argument, NULL, 'e' },
 			/* TODO: handle "debug-all" */
@@ -457,6 +460,9 @@ int main(int argc, char *argv[])
 			case 'r':
 				strict_crl_policy = TRUE;
 				continue;
+			case 'C':
+				cache_crls = TRUE;
+				continue;
 			case 'x':
 				crl_check_interval = atoi(optarg);
 				continue;
@@ -483,8 +489,8 @@ int main(int argc, char *argv[])
 	/* load pluggable EAP modules */
 	eap_method_load(eapdir);
 	
-	/* set crl_check_interval */
-	ca_info_set_crlcheckinterval(crl_check_interval);
+	/* set cache_crls and crl_check_interval options */
+	ca_info_set_options(cache_crls, crl_check_interval);
 
 	/* check/setup PID file */
 	if (stat(PID_FILE, &stb) == 0)