use credential builder to build crls

src/pluto/builder.c

@@ -31,6 +31,7 @@
 #include "id.h"
 #include "certs.h"
 #include "ac.h"
+#include "crl.h"
 
 /**
  * currently building cert_t
@@ -191,17 +192,88 @@ static builder_t *ac_builder(credential_type_t type, int subtype)
 	return this;
 }
 
+/**
+ * currently building x509crl_t
+ */
+static x509crl_t *crl;
+
+/**
+ * builder add function
+ */
+static void crl_add(builder_t *this, builder_part_t part, ...)
+{
+	chunk_t blob;
+	va_list args;
+
+	switch (part)
+	{
+		case BUILD_BLOB_ASN1_DER:
+		{
+			va_start(args, part);
+			blob = va_arg(args, chunk_t);
+			va_end(args);
+
+			crl = malloc_thing(x509crl_t);
+			*crl = empty_x509crl;
+
+			if (!parse_x509crl(blob, 0, crl))
+			{
+				plog("  error in X.509 crl");
+				free_crl(crl);
+				crl = NULL;
+			}
+			break;
+		}
+		default:
+			builder_cancel(this);
+			break;
+	}
+}
+
+/**
+ * builder build function
+ */
+static void *crl_build(builder_t *this)
+{
+	free(this);
+	return crl;
+}
+
+/**
+ * CRL builder in x509crl_t format.
+ */
+static builder_t *crl_builder(credential_type_t type, int subtype)
+{
+	builder_t *this;
+	
+	if (subtype != CRED_TYPE_CRL)
+	{
+		return NULL;
+	}
+	this = malloc_thing(builder_t);
+	this->add = crl_add;
+	this->build = crl_build;
+	
+	crl = NULL;
+	
+	return this;
+}
+
+
 void init_builder(void)
 {
 	lib->creds->add_builder(lib->creds, CRED_PLUTO_CERT, CRED_TYPE_CERTIFICATE,
 							(builder_constructor_t)cert_builder);
 	lib->creds->add_builder(lib->creds, CRED_PLUTO_CERT, CRED_TYPE_AC,
 							(builder_constructor_t)ac_builder);
+	lib->creds->add_builder(lib->creds, CRED_PLUTO_CERT, CRED_TYPE_CRL,
+							(builder_constructor_t)crl_builder);
 }
 
 void free_builder(void)
 {
 	lib->creds->remove_builder(lib->creds, (builder_constructor_t)cert_builder);
 	lib->creds->remove_builder(lib->creds, (builder_constructor_t)ac_builder);
+	lib->creds->remove_builder(lib->creds, (builder_constructor_t)crl_builder);
 }
 

src/pluto/crl.c

@@ -39,6 +39,7 @@
 #include "keys.h"
 #include "whack.h"
 #include "fetch.h"
+#include "builder.h"
 
 
 /* chained lists of X.509 crls */
@@ -202,14 +203,8 @@ void free_crls(void)
 /**
  * Insert X.509 CRL into chained list
  */
-bool insert_crl(chunk_t blob, chunk_t crl_uri, bool cache_crl)
+bool insert_crl(x509crl_t *crl, chunk_t crl_uri, bool cache_crl)
 {
-	x509crl_t *crl = malloc_thing(x509crl_t);
-
-	*crl = empty_x509crl;
-
-	if (parse_x509crl(blob, 0, crl))
-	{
 	x509cert_t *issuer_cert;
 	x509crl_t *oldcrl;
 	bool valid_sig;
@@ -316,13 +311,6 @@ bool insert_crl(chunk_t blob, chunk_t crl_uri, bool cache_crl)
 
 	/* is the fetched crl valid? */
 	return crl->nextUpdate - time(NULL) > 2*crl_check_interval;
-	}
-	else
-	{
-		plog("  error in X.509 crl");
-		free_crl(crl);
-		return FALSE;
-	}
 }
 
 /**
@@ -352,11 +340,12 @@ void load_crls(void)
 		{
 			while (n--)
 			{
-				bool pgp = FALSE;
-				chunk_t blob = chunk_empty;
 				char *filename = filelist[n]->d_name;
+				x509crl_t *crl;
 				
-				if (load_coded_file(filename, NULL, "crl", &blob, &pgp))
+				crl = lib->creds->create(lib->creds, CRED_PLUTO_CERT,
+							CRED_TYPE_CRL, BUILD_FROM_FILE, filename, BUILD_END);
+				if (crl)
 				{
 					chunk_t crl_uri;
 
@@ -367,7 +356,7 @@ void load_crls(void)
 					snprintf(crl_uri.ptr, crl_uri.len + 1, "file://%s/%s"
 						, CRL_PATH, filename);
 
-					insert_crl(blob, crl_uri, FALSE);
+					insert_crl(crl, crl_uri, FALSE);
 				}
 				free(filelist[n]);
 			}

src/pluto/crl.h

@@ -78,7 +78,7 @@ extern const x509crl_t  empty_x509crl;
 extern bool parse_x509crl(chunk_t blob, u_int level0, x509crl_t *crl);
 extern void load_crls(void);
 extern void check_crls(void);
-extern bool insert_crl(chunk_t blob, chunk_t crl_uri, bool cache_crl);
+extern bool insert_crl(x509crl_t *crl, chunk_t crl_uri, bool cache_crl);
 extern cert_status_t verify_by_crl(const x509cert_t *cert, time_t *until
 	, time_t *revocationDate, crl_reason_t *revocationReason);
 extern void list_crls(bool utc, bool strict);

src/pluto/fetch.c

@@ -41,6 +41,7 @@
 #include "ocsp.h"
 #include "crl.h"
 #include "fetch.h"
+#include "builder.h"
 
 fetch_req_t empty_fetch_req = {
 	NULL    , /* next */
@@ -262,40 +263,25 @@ static void free_fetch_request(fetch_req_t *req)
 /**
  * Fetch an ASN.1 blob coded in PEM or DER format from a URL
  */
-bool fetch_asn1_blob(char *url, chunk_t *blob)
+x509crl_t* fetch_crl(char *url)
 {
+	x509crl_t *crl;
+	chunk_t blob;
+
 	DBG1("  fetching crl from '%s' ...", url);
-	if (lib->fetcher->fetch(lib->fetcher, url, blob, FETCH_END) != SUCCESS)
+	if (lib->fetcher->fetch(lib->fetcher, url, &blob, FETCH_END) != SUCCESS)
 	{
 		DBG1("crl fetching failed");
 		return FALSE;
 	}
-
+	crl = lib->creds->create(lib->creds, CRED_PLUTO_CERT, CRED_TYPE_CRL,
-	if (is_asn1(*blob))
+							 BUILD_BLOB_PEM, blob, BUILD_END);
-	{
+	free(blob.ptr);
-		DBG2("  fetched blob coded in DER format");
+	if (!crl)
-	}
-	else
-	{
-		bool pgp = FALSE;
-
-		if (pem_to_bin(blob, chunk_empty, &pgp) != SUCCESS)
-		{
-			free(blob->ptr);
-			return FALSE;
-		}
-		if (is_asn1(*blob))
-		{
-			DBG2("  fetched blob coded in PEM format");
-		}
-		else
 	{
 		DBG1("crl fetched successfully but data coded in unknown format");
-			free(blob->ptr);
-			return FALSE;
 	}
-	}
+	return crl;
-	return TRUE;
 }
 
 /**
@@ -359,7 +345,6 @@ static void fetch_crls(bool cache_crls)
 	while (req != NULL)
 	{
 		bool valid_crl = FALSE;
-		chunk_t blob = chunk_empty;
 		generalName_t *gn = req->distributionPoints;
 		const char *ldaphost;
 		ca_info_t *ca;
@@ -372,12 +357,14 @@ static void fetch_crls(bool cache_crls)
 		while (gn != NULL)
 		{
 			char *uri = complete_uri(gn->name, ldaphost);
+			x509crl_t *crl;
 			
-			if (fetch_asn1_blob(uri, &blob))
+			crl = fetch_crl(uri);
+			if (crl)
 			{
 				chunk_t crl_uri = chunk_clone(gn->name);
 
-				if (insert_crl(blob, crl_uri, cache_crls))
+				if (insert_crl(crl, crl_uri, cache_crls))
 				{
 					DBG(DBG_CONTROL,
 						DBG_log("we have a valid crl")