denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stroke: add exportconn{cert,chain} commands in addition to exportx509

Browse Source 
The new commands either export a single end entity certificate or the
full trust chain for a specific connection name.
This commit is contained in:
Martin Willi
2013-06-19 16:27:19 +02:00
parent a485320393
commit de2debf8e0
5 changed files with 80 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_socket.c
+65 -6
View File
@@ -431,6 +431,20 @@ static void stroke_purge(private_stroke_socket_t *this,
}
}
/**
* Print a certificate in PEM to out
*/
static void print_pem_cert(FILE *out, certificate_t *cert)
{
chunk_t encoded;
if (cert->get_encoding(cert, CERT_PEM, &encoded))
{
fprintf(out, "%.*s", (int)encoded.len, encoded.ptr);
free(encoded.ptr);
}
}
/**
* Export in-memory credentials
*/
@@ -444,22 +458,67 @@ static void stroke_export(private_stroke_socket_t *this,
enumerator_t *enumerator;
identification_t *id;
certificate_t *cert;
chunk_t encoded;
id = identification_create_from_string(msg->export.selector);
enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
CERT_X509, KEY_ANY, id, FALSE);
while (enumerator->enumerate(enumerator, &cert))
{
if (cert->get_encoding(cert, CERT_PEM, &encoded))
{
fprintf(out, "%.*s", (int)encoded.len, encoded.ptr);
free(encoded.ptr);
}
print_pem_cert(out, cert);
}
enumerator->destroy(enumerator);
id->destroy(id);
}
if (msg->export.flags & (EXPORT_CONN_CERT | EXPORT_CONN_CHAIN))
{
enumerator_t *sas, *auths, *certs;
ike_sa_t *ike_sa;
auth_cfg_t *auth;
certificate_t *cert;
auth_rule_t rule;
sas = charon->ike_sa_manager->create_enumerator(
charon->ike_sa_manager, TRUE);
while (sas->enumerate(sas, &ike_sa))
{
if (streq(msg->export.selector, ike_sa->get_name(ike_sa)))
{
auths = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
while (auths->enumerate(auths, &auth))
{
bool got_subject = FALSE;
certs = auth->create_enumerator(auth);
while (certs->enumerate(certs, &rule, &cert))
{
switch (rule)
{
case AUTH_RULE_CA_CERT:
case AUTH_RULE_IM_CERT:
if (msg->export.flags & EXPORT_CONN_CHAIN)
{
print_pem_cert(out, cert);
}
break;
case AUTH_RULE_SUBJECT_CERT:
if (!got_subject)
{
print_pem_cert(out, cert);
got_subject = TRUE;
}
break;
default:
break;
}
}
certs->destroy(certs);
}
auths->destroy(auths);
}
}
sas->destroy(sas);
}
}
/**