updated stroke plugin to fingerprinting API

src/charon/plugins/stroke/stroke_ca.c

@@ -142,7 +142,7 @@ static void cdp_data_destroy(cdp_data_t *data)
 static enumerator_t *create_inner_cdp(ca_section_t *section, cdp_data_t *data)
 {
 	public_key_t *public;
-	identification_t *keyid;
+	chunk_t keyid;
 	enumerator_t *enumerator = NULL;
 	linked_list_t *list;
 	
@@ -164,8 +164,8 @@ static enumerator_t *create_inner_cdp(ca_section_t *section, cdp_data_t *data)
 		}
 		else
 		{
-			keyid = public->get_id(public, data->id->get_type(data->id));
+			if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &keyid) &&
-			if (keyid && keyid->matches(keyid, data->id))
+				chunk_equals(keyid, data->id->get_encoding(data->id)))
 			{
 				enumerator = list->create_enumerator(list);
 			}
@@ -361,7 +361,7 @@ static void check_for_hash_and_url(private_stroke_ca_t *this, certificate_t* cer
 			chunk_t hash, encoded = cert->get_encoding(cert);
 			hasher->allocate_hash(hasher, encoded, &hash);
 			section->hashes->insert_last(section->hashes,
-					identification_create_from_encoding(ID_CERT_DER_SHA1, hash));
+					identification_create_from_encoding(ID_KEY_ID, hash));
 			chunk_free(&hash);
 			chunk_free(&encoded);
 			break;
@@ -388,6 +388,7 @@ static void list(private_stroke_ca_t *this, stroke_msg_t *msg, FILE *out)
 	{
 		certificate_t *cert = section->cert;
 		public_key_t *public = cert->get_public_key(cert);
+		chunk_t chunk;
 		
 		if (first)
 		{
@@ -401,10 +402,14 @@ static void list(private_stroke_ca_t *this, stroke_msg_t *msg, FILE *out)
 		/* list authkey and keyid */
 		if (public)
 		{
-			fprintf(out, "  authkey:      %Y\n",
+			if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &chunk))
-					public->get_id(public, ID_PUBKEY_SHA1));
+			{
-			fprintf(out, "  keyid:        %Y\n",
+				fprintf(out, "  authkey:      %#B\n", &chunk);
-					public->get_id(public, ID_PUBKEY_INFO_SHA1));
+			}
+			if (public->get_fingerprint(public, KEY_ID_PUBKEY_INFO_SHA1, &chunk))
+			{
+				fprintf(out, "  keyid:        %#B\n", &chunk);
+			}
 			public->destroy(public);
 		}
 		list_uris(section->crl, "  crluris:     ", out);

src/charon/plugins/stroke/stroke_cred.c

@@ -105,26 +105,24 @@ static void id_data_destroy(id_data_t *data)
 static bool private_filter(id_data_t *data,
 						   private_key_t **in, private_key_t **out)
 {
-	identification_t *candidate;
+	key_encoding_type_t type;
-	id_type_t type;
+	private_key_t *key;
+	chunk_t keyid;
 	
+	key = *in;
 	if (data->id == NULL)
 	{
-		*out = *in;
+		*out = key;
 		return TRUE;
 	}
-	type = data->id->get_type(data->id);
+	for (type = KEY_ID_PUBKEY_INFO_SHA1; type < KEY_ID_PUBKEY_SHA1; type++)
-	if (type == ID_KEY_ID)
-	{	/* handle ID_KEY_ID as a ID_PUBKEY_SHA1 */
-		type = ID_PUBKEY_SHA1;
-	}
-	candidate = (*in)->get_id(*in, type);
-	if (candidate &&
-		chunk_equals(candidate->get_encoding(candidate),
-					 data->id->get_encoding(data->id)))
 	{
-		*out = *in;
+		if (key->get_fingerprint(key, type, &keyid) &&
-		return TRUE;
+			chunk_equals(keyid, data->id->get_encoding(data->id)))
+		{
+			*out = key;
+			return TRUE;
+		}
 	}
 	return FALSE;
 }
@@ -152,31 +150,34 @@ static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
  */
 static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 {
+	key_encoding_type_t type;
 	public_key_t *public;
-	identification_t *candidate;
 	certificate_t *cert = *in;
-	certificate_type_t type = cert->get_type(cert);
+	chunk_t keyid;
 	
-	if (type == CERT_X509_CRL || type == CERT_X509_AC)
+	if (cert->get_type(cert) == CERT_X509_CRL ||
+		cert->get_type(cert) == CERT_X509_AC)
 	{
 		return FALSE;
 	}
-
 	if (data->id == NULL || cert->has_subject(cert, data->id))
 	{
 		*out = *in;
 		return TRUE;
 	}
 	
-	public = (cert)->get_public_key(cert);
+	public = cert->get_public_key(cert);
 	if (public)
 	{
-		candidate = public->get_id(public, data->id->get_type(data->id));
+		for (type = KEY_ID_PUBKEY_INFO_SHA1; type < KEY_ID_PUBKEY_SHA1; type++)
-		if (candidate && data->id->equals(data->id, candidate))
 		{
-			public->destroy(public);
+			if (public->get_fingerprint(public, type, &keyid) &&
-			*out = *in;
+				chunk_equals(keyid, data->id->get_encoding(data->id)))
-			return TRUE;
+			{
+				public->destroy(public);
+				*out = *in;
+				return TRUE;
+			}
 		}
 		public->destroy(public);
 	}
@@ -416,12 +417,11 @@ static bool add_crl(private_stroke_cred_t *this, crl_t* crl)
 		if (current->get_type(current) == CERT_X509_CRL)
 		{
 			crl_t *crl_c = (crl_t*)current;
-			identification_t *authkey = crl->get_authKeyIdentifier(crl);
+			chunk_t authkey = crl->get_authKeyIdentifier(crl);
-			identification_t *authkey_c = crl_c->get_authKeyIdentifier(crl_c);
+			chunk_t authkey_c = crl_c->get_authKeyIdentifier(crl_c);
 			
 			/* if compare authorityKeyIdentifiers if available */
-			if (authkey != NULL && authkey_c != NULL &&
+			if (authkey.ptr && authkey_c.ptr && chunk_equals(authkey, authkey_c))
-				authkey->equals(authkey, authkey_c))
 			{
 				found = TRUE;
 			}
@@ -643,10 +643,8 @@ static void cache_cert(private_stroke_cred_t *this, certificate_t *cert)
 		{
 			char buf[BUF_LEN];
 			chunk_t chunk, hex;
-			identification_t *id;
 			
-			id = crl->get_authKeyIdentifier(crl);
+			chunk = crl->get_authKeyIdentifier(crl);
-			chunk = id->get_encoding(id);
 			hex = chunk_to_hex(chunk, NULL, FALSE);
 			snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex);
 			free(hex.ptr);

src/charon/plugins/stroke/stroke_list.c

@@ -568,6 +568,37 @@ static linked_list_t* create_unique_cert_list(certificate_type_t type)
 	return list;
 }
 
+/**
+ * Print a single public key.
+ */
+static void list_public_key(public_key_t *public, FILE *out)
+{
+	private_key_t *private = NULL;
+	chunk_t keyid;
+	identification_t *id;
+	
+	if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &keyid))
+	{
+		id = identification_create_from_encoding(ID_KEY_ID, keyid);
+		private = charon->credentials->get_private(charon->credentials,
+									public->get_type(public), id, NULL);
+		id->destroy(id);
+	}
+	fprintf(out, "  pubkey:    %N %d bits%s\n",
+			key_type_names, public->get_type(public),
+			public->get_keysize(public) * 8,
+			private ? ", has private key" : "");
+	if (public->get_fingerprint(public, KEY_ID_PUBKEY_INFO_SHA1, &keyid))
+	{
+		fprintf(out, "  keyid:     %#B\n", &keyid);
+	}
+	if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &keyid))
+	{
+		fprintf(out, "  subjkey:   %#B\n", &keyid);
+	}
+	DESTROY_IF(private);
+}
+
 /**
  * list all raw public keys
  */
@@ -584,9 +615,6 @@ static void stroke_list_pubkeys(linked_list_t *list, bool utc, FILE *out)
 		
 		if (public)
 		{
-			private_key_t *private = NULL;
-			identification_t *id, *keyid;
-			
 			if (first)
 			{
 				fprintf(out, "\n");
@@ -595,20 +623,7 @@ static void stroke_list_pubkeys(linked_list_t *list, bool utc, FILE *out)
 			}
 			fprintf(out, "\n");
 			
-			/* list public key information */
+			list_public_key(public, out);
-			id    = public->get_id(public, ID_PUBKEY_SHA1);
-			keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
-
-			private = charon->credentials->get_private(
-								charon->credentials, 
-								public->get_type(public), keyid, NULL);
-			fprintf(out, "  pubkey:    %N %d bits%s\n",
-					key_type_names, public->get_type(public),
-					public->get_keysize(public) * 8,
-					private ? ", has private key" : "");
-			fprintf(out, "  keyid:     %Y\n", keyid);
-			fprintf(out, "  subjkey:   %Y\n", id);
-			DESTROY_IF(private);
 			public->destroy(public);
 		}
 	}
@@ -637,10 +652,9 @@ static void stroke_list_certs(linked_list_t *list, char *label,
 			enumerator_t *enumerator;
 			identification_t *altName;
 			bool first_altName = TRUE;
-			chunk_t serial = x509->get_serial(x509);
+			chunk_t serial, authkey;
-			identification_t *authkey = x509->get_authKeyIdentifier(x509);
 			time_t notBefore, notAfter;
-			public_key_t *public = cert->get_public_key(cert);
+			public_key_t *public;
 			
 			if (first)
 			{
@@ -673,6 +687,7 @@ static void stroke_list_certs(linked_list_t *list, char *label,
 			
 			fprintf(out, "  subject:  \"%Y\"\n", cert->get_subject(cert));
 			fprintf(out, "  issuer:   \"%Y\"\n", cert->get_issuer(cert));
+			serial = x509->get_serial(x509);
 			fprintf(out, "  serial:    %#B\n", &serial);
 			
 			/* list validity */
@@ -701,32 +716,18 @@ static void stroke_list_certs(linked_list_t *list, char *label,
 				fprintf(out, " \n");
 			}
 			
-			/* list public key information */
+			public = cert->get_public_key(cert);
 			if (public)
 			{
-				private_key_t *private = NULL;
+				list_public_key(public, out);
-				identification_t *id, *keyid;
-			
-				id    = public->get_id(public, ID_PUBKEY_SHA1);
-				keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
-
-				private = charon->credentials->get_private(
-									charon->credentials, 
-									public->get_type(public), keyid, NULL);
-				fprintf(out, "  pubkey:    %N %d bits%s\n",
-						key_type_names, public->get_type(public),
-						public->get_keysize(public) * 8,
-						private ? ", has private key" : "");
-				fprintf(out, "  keyid:     %Y\n", keyid);
-				fprintf(out, "  subjkey:   %Y\n", id);
-				DESTROY_IF(private);
 				public->destroy(public);
 			}
 			
 			/* list optional authorityKeyIdentifier */
-			if (authkey)
+			authkey = x509->get_authKeyIdentifier(x509);
+			if (authkey.ptr)
 			{
-				fprintf(out, "  authkey:   %Y\n", authkey);
+				fprintf(out, "  authkey:   %#B\n", &authkey);
 			}
 		}
 	}
@@ -746,11 +747,8 @@ static void stroke_list_acerts(linked_list_t *list, bool utc, FILE *out)
 	while (enumerator->enumerate(enumerator, (void**)&cert))
 	{
 		ac_t *ac = (ac_t*)cert;
-		chunk_t serial  = ac->get_serial(ac);
+		identification_t *id;
-		chunk_t holderSerial = ac->get_holderSerial(ac);
+		chunk_t chunk;
-		identification_t *holderIssuer = ac->get_holderIssuer(ac);
-		identification_t *authkey = ac->get_authKeyIdentifier(ac);
-		identification_t *entityName = cert->get_subject(cert);
 		
 		if (first)
 		{
@@ -760,20 +758,24 @@ static void stroke_list_acerts(linked_list_t *list, bool utc, FILE *out)
 		}
 		fprintf(out, "\n");
 		
-		if (entityName)
+		id = cert->get_subject(cert);
+		if (id)
 		{
-			fprintf(out, "  holder:   \"%Y\"\n", entityName);
+			fprintf(out, "  holder:   \"%Y\"\n", id);
 		}
-		if (holderIssuer)
+		id = ac->get_holderIssuer(ac);
+		if (id)
 		{
-			fprintf(out, "  hissuer:  \"%Y\"\n", holderIssuer);
+			fprintf(out, "  hissuer:  \"%Y\"\n", id);
 		}
-		if (holderSerial.ptr)
+		chunk = ac->get_holderSerial(ac);
+		if (chunk.ptr)
 		{
-			fprintf(out, "  hserial:   %#B\n", &holderSerial);
+			fprintf(out, "  hserial:   %#B\n", &chunk);
 		}
 		fprintf(out, "  issuer:   \"%Y\"\n", cert->get_issuer(cert));
-		fprintf(out, "  serial:    %#B\n", &serial);
+		chunk  = ac->get_serial(ac);
+		fprintf(out, "  serial:    %#B\n", &chunk);
 
 		/* list validity */
 		cert->get_validity(cert, &now, &thisUpdate, &nextUpdate);
@@ -794,9 +796,10 @@ static void stroke_list_acerts(linked_list_t *list, bool utc, FILE *out)
 		}
 		
 		/* list optional authorityKeyIdentifier */
-		if (authkey)
+		chunk = ac->get_authKeyIdentifier(ac);
+		if (chunk.ptr)
 		{
-			fprintf(out, "  authkey:   %Y\n", authkey);
+			fprintf(out, "  authkey:   %#B\n", &chunk);
 		}
 	}
 	enumerator->destroy(enumerator);
@@ -815,8 +818,7 @@ static void stroke_list_crls(linked_list_t *list, bool utc, FILE *out)
 	while (enumerator->enumerate(enumerator, (void**)&cert))
 	{
 		crl_t *crl = (crl_t*)cert;
-		chunk_t serial  = crl->get_serial(crl);
+		chunk_t chunk;
-		identification_t *authkey = crl->get_authKeyIdentifier(crl);
 		
 		if (first)
 		{
@@ -829,9 +831,10 @@ static void stroke_list_crls(linked_list_t *list, bool utc, FILE *out)
 		fprintf(out, "  issuer:   \"%Y\"\n", cert->get_issuer(cert));
 		
 		/* list optional crlNumber */
-		if (serial.ptr)
+		chunk = crl->get_serial(crl);
+		if (chunk.ptr)
 		{
-			fprintf(out, "  serial:    %#B\n", &serial);
+			fprintf(out, "  serial:    %#B\n", &chunk);
 		}
 		
 		/* count the number of revoked certificates */
@@ -867,9 +870,10 @@ static void stroke_list_crls(linked_list_t *list, bool utc, FILE *out)
 		}
 		
 		/* list optional authorityKeyIdentifier */
-		if (authkey)
+		chunk = crl->get_authKeyIdentifier(crl);
+		if (chunk.ptr)
 		{
-			fprintf(out, "  authkey:   %Y\n", authkey);
+			fprintf(out, "  authkey:   %#B\n", chunk);
 		}
 	}
 	enumerator->destroy(enumerator);