denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

certexpire: add an option to enforce exporting trustchains having a private key

Browse Source
This commit is contained in:
Martin Willi
2013-07-18 16:00:31 +02:00
parent 868abd0626
commit 8fc89db7b6
1 changed files with 83 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/certexpire/certexpire_export.c
+83 -15
View File
@@ -88,6 +88,11 @@ struct private_certexpire_export_t {
* String to use in empty fields, if using fixed_fields
*/
char *empty_string;
/**
* Force export of all trustchains we have a private key for
*/
bool force;
};
/**
@@ -184,21 +189,6 @@ static void export_csv(private_certexpire_export_t *this, char *path,
}
}
/**
* Export cached trustchain expiration dates to CSV files
*/
static void cron_export(private_certexpire_export_t *this)
{
if (this->local_path)
{
export_csv(this, this->local_path, this->local);
}
if (this->remote_path)
{
export_csv(this, this->remote_path, this->remote);
}
}
METHOD(certexpire_export_t, add, void,
private_certexpire_export_t *this, linked_list_t *trustchain, bool local)
{
@@ -320,6 +310,81 @@ METHOD(certexpire_export_t, add, void,
enumerator->destroy(enumerator);
}
/**
* Add trustchains we have a private key for to the list
*/
static void add_local_certs(private_certexpire_export_t *this)
{
enumerator_t *enumerator;
certificate_t *cert;
enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
CERT_X509, KEY_ANY, NULL, FALSE);
while (enumerator->enumerate(enumerator, &cert))
{
linked_list_t *trustchain;
private_key_t *private;
public_key_t *public;
identification_t *keyid;
chunk_t chunk;
x509_t *x509 = (x509_t*)cert;
trustchain = linked_list_create();
public = cert->get_public_key(cert);
if (public)
{
if (public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, &chunk))
{
keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
private = lib->credmgr->get_private(lib->credmgr,
public->get_type(public), keyid, NULL);
keyid->destroy(keyid);
if (private)
{
trustchain->insert_last(trustchain, cert->get_ref(cert));
while (!(x509->get_flags(x509) & X509_SELF_SIGNED))
{
cert = lib->credmgr->get_cert(lib->credmgr, CERT_X509,
KEY_ANY, cert->get_issuer(cert), FALSE);
if (!cert)
{
break;
}
x509 = (x509_t*)cert;
trustchain->insert_last(trustchain, cert);
}
private->destroy(private);
}
}
public->destroy(public);
}
add(this, trustchain, TRUE);
trustchain->destroy_offset(trustchain, offsetof(certificate_t, destroy));
}
enumerator->destroy(enumerator);
}
/**
* Export cached trustchain expiration dates to CSV files
*/
static void cron_export(private_certexpire_export_t *this)
{
if (this->local_path)
{
if (this->force)
{
add_local_certs(this);
}
export_csv(this, this->local_path, this->local);
}
if (this->remote_path)
{
export_csv(this, this->remote_path, this->remote);
}
}
METHOD(certexpire_export_t, destroy, void,
private_certexpire_export_t *this)
{
@@ -382,6 +447,9 @@ certexpire_export_t *certexpire_export_create()
.empty_string = lib->settings->get_str(lib->settings,
"%s.plugins.certexpire.csv.empty_string",
"", charon->name),
.force = lib->settings->get_bool(lib->settings,
"%s.plugins.certexpire.csv.force",
TRUE, charon->name),
);
cron = lib->settings->get_str(lib->settings,