Annotation of embedaddon/strongswan/src/libcharon/plugins/load_tester/load_tester_creds.c, revision 1.1.1.2
1.1 misho 1: /*
2: * Copyright (C) 2008 Martin Willi
3: * HSR Hochschule fuer Technik Rapperswil
4: *
5: * This program is free software; you can redistribute it and/or modify it
6: * under the terms of the GNU General Public License as published by the
7: * Free Software Foundation; either version 2 of the License, or (at your
8: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9: *
10: * This program is distributed in the hope that it will be useful, but
11: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13: * for more details.
14: */
15:
16: #include "load_tester_creds.h"
17:
18: #include <time.h>
19: #include <sys/stat.h>
20:
21: #include <daemon.h>
1.1.1.2 ! misho 22: #include <asn1/asn1.h>
1.1 misho 23: #include <credentials/keys/shared_key.h>
24: #include <credentials/certificates/x509.h>
25: #include <utils/identification.h>
26:
27: typedef struct private_load_tester_creds_t private_load_tester_creds_t;
28:
29: /**
30: * Private data of an load_tester_creds_t object
31: */
32: struct private_load_tester_creds_t {
33: /**
34: * Public part
35: */
36: load_tester_creds_t public;
37:
38: /**
39: * Private key to create signatures
40: */
41: private_key_t *private;
42:
43: /**
44: * CA certificate, to issue/verify peer certificates
45: */
46: certificate_t *ca;
47:
48: /**
49: * Trusted CA certificates, including issuer CA
50: */
51: linked_list_t *cas;
52:
53: /**
54: * Digest algorithm to issue certificates
55: */
56: hash_algorithm_t digest;
57:
58: /**
59: * serial number to issue certificates
60: */
61: uint32_t serial;
62:
63: /**
64: * Preshared key for IKE
65: */
66: shared_key_t *psk;
67:
68: /**
69: * Password for EAP
70: */
71: shared_key_t *pwd;
72:
73: /**
74: * List of certificate distribution points to include in generated certs
75: */
76: linked_list_t *cdps;
77: };
78:
79: /**
80: * 1024-bit RSA key:
81: -----BEGIN RSA PRIVATE KEY-----
82: MIICXQIBAAKBgQDQXr7poAPYZLxmTCqR51STGRuk9Hc5SWtTcs6b2RzpnP8EVRLx
83: JEVxOKE9Mw6n7mD1pNrupCpnpGRdLAV5VznTPhSQ6k7ppJJrxosRYg0pHTZqBUEC
84: 7nQFwAe10g8q0UnM1wa4lJzGxDH78d21cVweJgbkxAeyriS0jhNs7gO5nQIDAQAB
85: AoGACVACtkxJf7VY2jWTPXwaQoy/uIqYfX3zhwI9i6eTbDlxCE+JDi/xzpKaWjLa
86: 99RmjvP0OPArWQB239ck03x7gAm2obutosGbqbKzJZS5cyIayzyW9djZDHBdt9Ho
87: quKB39aspWit3xPzkrr+QeIkiggtmBKALTBxTwxAU+P6euECQQD4IPdrzKbCrO79
88: LKvoPrQQtTjL6ogag9rI9n2ZuoK3/XVybh2byOXT8tA5G5jSz9Ac8XeVOsnH9gT5
89: 3WXeaLOFAkEA1vrm/hVSEasp5eATgQ7ig9CF+GGKqhTwXp/uOSl/h3IRmStu5J0C
90: 9AkYyx0bn3j5R8iUEX/C00KSE1kQNh4NOQJAVOsLYlRG2idPH0xThQc4nuM2jes1
91: K0Xm8ZISSDNhm1BeCoyPC4rExTW7d1/vfG5svgsRrvvQpOOYrl7MB0Lz9QJBALhg
92: AWJiyLsskEd90Vx7dpvUaEHo7jMGuEx/X6GYzK5Oj3dNP9NEMfc4IhJ5SWqRJ0KA
93: bTVA3MexLXT4iqXPSkkCQQDSjLhBwvEnSuW4ElIMzBwLbu7573z2gzU82Mj6trrw
94: Osoox/vmcepT1Wjy4AvPZHgxp7vEXNSeS+M5L29QNTp8
95: -----END RSA PRIVATE KEY-----
96: */
97: static char private[] = {
98: 0x30,0x82,0x02,0x5d,0x02,0x01,0x00,0x02,0x81,0x81,0x00,0xd0,0x5e,0xbe,0xe9,0xa0,
99: 0x03,0xd8,0x64,0xbc,0x66,0x4c,0x2a,0x91,0xe7,0x54,0x93,0x19,0x1b,0xa4,0xf4,0x77,
100: 0x39,0x49,0x6b,0x53,0x72,0xce,0x9b,0xd9,0x1c,0xe9,0x9c,0xff,0x04,0x55,0x12,0xf1,
101: 0x24,0x45,0x71,0x38,0xa1,0x3d,0x33,0x0e,0xa7,0xee,0x60,0xf5,0xa4,0xda,0xee,0xa4,
102: 0x2a,0x67,0xa4,0x64,0x5d,0x2c,0x05,0x79,0x57,0x39,0xd3,0x3e,0x14,0x90,0xea,0x4e,
103: 0xe9,0xa4,0x92,0x6b,0xc6,0x8b,0x11,0x62,0x0d,0x29,0x1d,0x36,0x6a,0x05,0x41,0x02,
104: 0xee,0x74,0x05,0xc0,0x07,0xb5,0xd2,0x0f,0x2a,0xd1,0x49,0xcc,0xd7,0x06,0xb8,0x94,
105: 0x9c,0xc6,0xc4,0x31,0xfb,0xf1,0xdd,0xb5,0x71,0x5c,0x1e,0x26,0x06,0xe4,0xc4,0x07,
106: 0xb2,0xae,0x24,0xb4,0x8e,0x13,0x6c,0xee,0x03,0xb9,0x9d,0x02,0x03,0x01,0x00,0x01,
107: 0x02,0x81,0x80,0x09,0x50,0x02,0xb6,0x4c,0x49,0x7f,0xb5,0x58,0xda,0x35,0x93,0x3d,
108: 0x7c,0x1a,0x42,0x8c,0xbf,0xb8,0x8a,0x98,0x7d,0x7d,0xf3,0x87,0x02,0x3d,0x8b,0xa7,
109: 0x93,0x6c,0x39,0x71,0x08,0x4f,0x89,0x0e,0x2f,0xf1,0xce,0x92,0x9a,0x5a,0x32,0xda,
110: 0xf7,0xd4,0x66,0x8e,0xf3,0xf4,0x38,0xf0,0x2b,0x59,0x00,0x76,0xdf,0xd7,0x24,0xd3,
111: 0x7c,0x7b,0x80,0x09,0xb6,0xa1,0xbb,0xad,0xa2,0xc1,0x9b,0xa9,0xb2,0xb3,0x25,0x94,
112: 0xb9,0x73,0x22,0x1a,0xcb,0x3c,0x96,0xf5,0xd8,0xd9,0x0c,0x70,0x5d,0xb7,0xd1,0xe8,
113: 0xaa,0xe2,0x81,0xdf,0xd6,0xac,0xa5,0x68,0xad,0xdf,0x13,0xf3,0x92,0xba,0xfe,0x41,
114: 0xe2,0x24,0x8a,0x08,0x2d,0x98,0x12,0x80,0x2d,0x30,0x71,0x4f,0x0c,0x40,0x53,0xe3,
115: 0xfa,0x7a,0xe1,0x02,0x41,0x00,0xf8,0x20,0xf7,0x6b,0xcc,0xa6,0xc2,0xac,0xee,0xfd,
116: 0x2c,0xab,0xe8,0x3e,0xb4,0x10,0xb5,0x38,0xcb,0xea,0x88,0x1a,0x83,0xda,0xc8,0xf6,
117: 0x7d,0x99,0xba,0x82,0xb7,0xfd,0x75,0x72,0x6e,0x1d,0x9b,0xc8,0xe5,0xd3,0xf2,0xd0,
118: 0x39,0x1b,0x98,0xd2,0xcf,0xd0,0x1c,0xf1,0x77,0x95,0x3a,0xc9,0xc7,0xf6,0x04,0xf9,
119: 0xdd,0x65,0xde,0x68,0xb3,0x85,0x02,0x41,0x00,0xd6,0xfa,0xe6,0xfe,0x15,0x52,0x11,
120: 0xab,0x29,0xe5,0xe0,0x13,0x81,0x0e,0xe2,0x83,0xd0,0x85,0xf8,0x61,0x8a,0xaa,0x14,
121: 0xf0,0x5e,0x9f,0xee,0x39,0x29,0x7f,0x87,0x72,0x11,0x99,0x2b,0x6e,0xe4,0x9d,0x02,
122: 0xf4,0x09,0x18,0xcb,0x1d,0x1b,0x9f,0x78,0xf9,0x47,0xc8,0x94,0x11,0x7f,0xc2,0xd3,
123: 0x42,0x92,0x13,0x59,0x10,0x36,0x1e,0x0d,0x39,0x02,0x40,0x54,0xeb,0x0b,0x62,0x54,
124: 0x46,0xda,0x27,0x4f,0x1f,0x4c,0x53,0x85,0x07,0x38,0x9e,0xe3,0x36,0x8d,0xeb,0x35,
125: 0x2b,0x45,0xe6,0xf1,0x92,0x12,0x48,0x33,0x61,0x9b,0x50,0x5e,0x0a,0x8c,0x8f,0x0b,
126: 0x8a,0xc4,0xc5,0x35,0xbb,0x77,0x5f,0xef,0x7c,0x6e,0x6c,0xbe,0x0b,0x11,0xae,0xfb,
127: 0xd0,0xa4,0xe3,0x98,0xae,0x5e,0xcc,0x07,0x42,0xf3,0xf5,0x02,0x41,0x00,0xb8,0x60,
128: 0x01,0x62,0x62,0xc8,0xbb,0x2c,0x90,0x47,0x7d,0xd1,0x5c,0x7b,0x76,0x9b,0xd4,0x68,
129: 0x41,0xe8,0xee,0x33,0x06,0xb8,0x4c,0x7f,0x5f,0xa1,0x98,0xcc,0xae,0x4e,0x8f,0x77,
130: 0x4d,0x3f,0xd3,0x44,0x31,0xf7,0x38,0x22,0x12,0x79,0x49,0x6a,0x91,0x27,0x42,0x80,
131: 0x6d,0x35,0x40,0xdc,0xc7,0xb1,0x2d,0x74,0xf8,0x8a,0xa5,0xcf,0x4a,0x49,0x02,0x41,
132: 0x00,0xd2,0x8c,0xb8,0x41,0xc2,0xf1,0x27,0x4a,0xe5,0xb8,0x12,0x52,0x0c,0xcc,0x1c,
133: 0x0b,0x6e,0xee,0xf9,0xef,0x7c,0xf6,0x83,0x35,0x3c,0xd8,0xc8,0xfa,0xb6,0xba,0xf0,
134: 0x3a,0xca,0x28,0xc7,0xfb,0xe6,0x71,0xea,0x53,0xd5,0x68,0xf2,0xe0,0x0b,0xcf,0x64,
135: 0x78,0x31,0xa7,0xbb,0xc4,0x5c,0xd4,0x9e,0x4b,0xe3,0x39,0x2f,0x6f,0x50,0x35,0x3a,
136: 0x7c,
137: };
138:
139: /**
140: * And an associated self-signed CA certificate (note that the keyUsage
141: * extension has the digitalSignature bit set, which is not usually the case for
142: * CA certificates, so it can be used as end-entity certificate in load tests).
143: -----BEGIN CERTIFICATE-----
144: MIICJjCCAY+gAwIBAgIBADANBgkqhkiG9w0BAQsFADA3MQwwCgYDVQQDEwNzcnYx
145: EjAQBgNVBAsTCWxvYWQtdGVzdDETMBEGA1UEChMKc3Ryb25nU3dhbjAeFw0xOTAy
146: MDgwODUyMjVaFw0yOTAyMDgwODUyMjVaMDcxDDAKBgNVBAMTA3NydjESMBAGA1UE
147: CxMJbG9hZC10ZXN0MRMwEQYDVQQKEwpzdHJvbmdTd2FuMIGfMA0GCSqGSIb3DQEB
148: AQUAA4GNADCBiQKBgQDQXr7poAPYZLxmTCqR51STGRuk9Hc5SWtTcs6b2RzpnP8E
149: VRLxJEVxOKE9Mw6n7mD1pNrupCpnpGRdLAV5VznTPhSQ6k7ppJJrxosRYg0pHTZq
150: BUEC7nQFwAe10g8q0UnM1wa4lJzGxDH78d21cVweJgbkxAeyriS0jhNs7gO5nQID
151: AQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4E
152: FgQUytOG/alLWTyyO6ElA3cGwIzkofYwDQYJKoZIhvcNAQELBQADgYEAIdCzmJAw
153: Cj6VaDacc7yOhZK61nGzNJml5NEeLzZkGzYvsIggL/Kb2v42fKYC5OunkZ1Nw3YY
154: 207LR7wrhS7pndHfRMny86RwJ4d6LmiwtgbzTAbm3HL/iENDiyiJfCTknTvzMj9O
155: kGfz0rGDkJqIxx0inxp84PWWR5lX84A9pNQ=
156: -----END CERTIFICATE-----
157: */
158: static char default_cert[] = {
159: 0x30,0x82,0x02,0x26,0x30,0x82,0x01,0x8f,0xa0,0x03,0x02,0x01,0x02,0x02,0x01,0x00,
160: 0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x0b,0x05,0x00,0x30,
161: 0x37,0x31,0x0c,0x30,0x0a,0x06,0x03,0x55,0x04,0x03,0x13,0x03,0x73,0x72,0x76,0x31,
162: 0x12,0x30,0x10,0x06,0x03,0x55,0x04,0x0b,0x13,0x09,0x6c,0x6f,0x61,0x64,0x2d,0x74,
163: 0x65,0x73,0x74,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x0a,0x13,0x0a,0x73,0x74,
164: 0x72,0x6f,0x6e,0x67,0x53,0x77,0x61,0x6e,0x30,0x1e,0x17,0x0d,0x31,0x39,0x30,0x32,
165: 0x30,0x38,0x30,0x38,0x35,0x32,0x32,0x35,0x5a,0x17,0x0d,0x32,0x39,0x30,0x32,0x30,
166: 0x38,0x30,0x38,0x35,0x32,0x32,0x35,0x5a,0x30,0x37,0x31,0x0c,0x30,0x0a,0x06,0x03,
167: 0x55,0x04,0x03,0x13,0x03,0x73,0x72,0x76,0x31,0x12,0x30,0x10,0x06,0x03,0x55,0x04,
168: 0x0b,0x13,0x09,0x6c,0x6f,0x61,0x64,0x2d,0x74,0x65,0x73,0x74,0x31,0x13,0x30,0x11,
169: 0x06,0x03,0x55,0x04,0x0a,0x13,0x0a,0x73,0x74,0x72,0x6f,0x6e,0x67,0x53,0x77,0x61,
170: 0x6e,0x30,0x81,0x9f,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,
171: 0x01,0x05,0x00,0x03,0x81,0x8d,0x00,0x30,0x81,0x89,0x02,0x81,0x81,0x00,0xd0,0x5e,
172: 0xbe,0xe9,0xa0,0x03,0xd8,0x64,0xbc,0x66,0x4c,0x2a,0x91,0xe7,0x54,0x93,0x19,0x1b,
173: 0xa4,0xf4,0x77,0x39,0x49,0x6b,0x53,0x72,0xce,0x9b,0xd9,0x1c,0xe9,0x9c,0xff,0x04,
174: 0x55,0x12,0xf1,0x24,0x45,0x71,0x38,0xa1,0x3d,0x33,0x0e,0xa7,0xee,0x60,0xf5,0xa4,
175: 0xda,0xee,0xa4,0x2a,0x67,0xa4,0x64,0x5d,0x2c,0x05,0x79,0x57,0x39,0xd3,0x3e,0x14,
176: 0x90,0xea,0x4e,0xe9,0xa4,0x92,0x6b,0xc6,0x8b,0x11,0x62,0x0d,0x29,0x1d,0x36,0x6a,
177: 0x05,0x41,0x02,0xee,0x74,0x05,0xc0,0x07,0xb5,0xd2,0x0f,0x2a,0xd1,0x49,0xcc,0xd7,
178: 0x06,0xb8,0x94,0x9c,0xc6,0xc4,0x31,0xfb,0xf1,0xdd,0xb5,0x71,0x5c,0x1e,0x26,0x06,
179: 0xe4,0xc4,0x07,0xb2,0xae,0x24,0xb4,0x8e,0x13,0x6c,0xee,0x03,0xb9,0x9d,0x02,0x03,
180: 0x01,0x00,0x01,0xa3,0x42,0x30,0x40,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,
181: 0xff,0x04,0x05,0x30,0x03,0x01,0x01,0xff,0x30,0x0e,0x06,0x03,0x55,0x1d,0x0f,0x01,
182: 0x01,0xff,0x04,0x04,0x03,0x02,0x01,0x86,0x30,0x1d,0x06,0x03,0x55,0x1d,0x0e,0x04,
183: 0x16,0x04,0x14,0xca,0xd3,0x86,0xfd,0xa9,0x4b,0x59,0x3c,0xb2,0x3b,0xa1,0x25,0x03,
184: 0x77,0x06,0xc0,0x8c,0xe4,0xa1,0xf6,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,
185: 0x0d,0x01,0x01,0x0b,0x05,0x00,0x03,0x81,0x81,0x00,0x21,0xd0,0xb3,0x98,0x90,0x30,
186: 0x0a,0x3e,0x95,0x68,0x36,0x9c,0x73,0xbc,0x8e,0x85,0x92,0xba,0xd6,0x71,0xb3,0x34,
187: 0x99,0xa5,0xe4,0xd1,0x1e,0x2f,0x36,0x64,0x1b,0x36,0x2f,0xb0,0x88,0x20,0x2f,0xf2,
188: 0x9b,0xda,0xfe,0x36,0x7c,0xa6,0x02,0xe4,0xeb,0xa7,0x91,0x9d,0x4d,0xc3,0x76,0x18,
189: 0xdb,0x4e,0xcb,0x47,0xbc,0x2b,0x85,0x2e,0xe9,0x9d,0xd1,0xdf,0x44,0xc9,0xf2,0xf3,
190: 0xa4,0x70,0x27,0x87,0x7a,0x2e,0x68,0xb0,0xb6,0x06,0xf3,0x4c,0x06,0xe6,0xdc,0x72,
191: 0xff,0x88,0x43,0x43,0x8b,0x28,0x89,0x7c,0x24,0xe4,0x9d,0x3b,0xf3,0x32,0x3f,0x4e,
192: 0x90,0x67,0xf3,0xd2,0xb1,0x83,0x90,0x9a,0x88,0xc7,0x1d,0x22,0x9f,0x1a,0x7c,0xe0,
193: 0xf5,0x96,0x47,0x99,0x57,0xf3,0x80,0x3d,0xa4,0xd4,
194: };
195:
196: /**
197: * Default IKE preshared key
198: */
199: static char *default_psk = "default-psk";
200:
201: /**
202: * Default EAP password for EAP
203: */
204: static char *default_pwd = "default-pwd";
205:
206:
207: /**
208: * Load the private key, hard-coded or from a file
209: */
210: static private_key_t *load_issuer_key()
211: {
212: char *path;
213:
214: path = lib->settings->get_str(lib->settings,
215: "%s.plugins.load-tester.issuer_key", NULL, lib->ns);
216: if (!path)
217: {
218: return lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
219: BUILD_BLOB_ASN1_DER, chunk_create(private, sizeof(private)),
220: BUILD_END);
221: }
222: DBG1(DBG_CFG, "loading load-tester private key from '%s'", path);
223: return lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
224: BUILD_FROM_FILE, path, BUILD_END);
225: }
226:
227: /**
228: * Load the issuing certificate, hard-coded or from a file
229: */
230: static certificate_t *load_issuer_cert()
231: {
232: char *path;
233:
234: path = lib->settings->get_str(lib->settings,
235: "%s.plugins.load-tester.issuer_cert", NULL, lib->ns);
236: if (!path)
237: {
238: return lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
239: BUILD_BLOB_ASN1_DER,
240: chunk_create(default_cert, sizeof(default_cert)),
241: BUILD_X509_FLAG, X509_CA,
242: BUILD_END);
243: }
244: DBG1(DBG_CFG, "loading load-tester issuer cert from '%s'", path);
245: return lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
246: BUILD_FROM_FILE, path, BUILD_END);
247: }
248:
249: /**
250: * Load (intermediate) CA certificates, hard-coded or from a file
251: */
252: static void load_ca_certs(private_load_tester_creds_t *this)
253: {
254: enumerator_t *enumerator;
255: certificate_t *cert;
256: struct stat st;
257: char *path;
258:
259: path = lib->settings->get_str(lib->settings,
260: "%s.plugins.load-tester.ca_dir", NULL, lib->ns);
261: if (path)
262: {
263: enumerator = enumerator_create_directory(path);
264: if (enumerator)
265: {
266: while (enumerator->enumerate(enumerator, NULL, &path, &st))
267: {
268: if (S_ISREG(st.st_mode))
269: {
270: DBG1(DBG_CFG, "loading load-tester CA cert from '%s'", path);
271: cert = lib->creds->create(lib->creds,
272: CRED_CERTIFICATE, CERT_X509,
273: BUILD_FROM_FILE, path, BUILD_END);
274: if (cert)
275: {
276: this->cas->insert_last(this->cas, cert);
277: }
278: }
279: }
280: enumerator->destroy(enumerator);
281: }
282: }
283: }
284:
285: METHOD(credential_set_t, create_private_enumerator, enumerator_t*,
286: private_load_tester_creds_t *this, key_type_t type, identification_t *id)
287: {
288: if (this->private == NULL)
289: {
290: return NULL;
291: }
292: if (type != KEY_ANY && type != KEY_RSA)
293: {
294: return NULL;
295: }
296: if (id)
297: {
298: if (!this->private->has_fingerprint(this->private, id->get_encoding(id)))
299: {
300: return NULL;
301: }
302: }
303: return enumerator_create_single(this->private, NULL);
304: }
305:
306: METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
307: private_load_tester_creds_t *this, certificate_type_t cert, key_type_t key,
308: identification_t *id, bool trusted)
309: {
310: enumerator_t *enumerator;
311: certificate_t *peer_cert, *ca_cert;
312: public_key_t *peer_key, *ca_key;
313: identification_t *dn = NULL;
314: linked_list_t *sans;
1.1.1.2 ! misho 315: chunk_t serial;
1.1 misho 316: char buf[128];
317: time_t now;
318:
319: if (this->ca == NULL)
320: {
321: return NULL;
322: }
323: if (cert != CERT_ANY && cert != CERT_X509)
324: {
325: return NULL;
326: }
327: if (key != KEY_ANY && key != KEY_RSA)
328: {
329: return NULL;
330: }
331: if (!id)
332: {
333: return this->cas->create_enumerator(this->cas);
334: }
335: ca_key = this->ca->get_public_key(this->ca);
336: if (ca_key)
337: {
338: if (ca_key->has_fingerprint(ca_key, id->get_encoding(id)))
339: {
340: ca_key->destroy(ca_key);
341: return enumerator_create_single(this->ca, NULL);
342: }
343: ca_key->destroy(ca_key);
344: }
345: enumerator = this->cas->create_enumerator(this->cas);
346: while (enumerator->enumerate(enumerator, &ca_cert))
347: {
348: if (ca_cert->has_subject(ca_cert, id))
349: {
350: enumerator->destroy(enumerator);
351: return enumerator_create_single(ca_cert, NULL);
352: }
353: }
354: enumerator->destroy(enumerator);
355:
356: if (!trusted && this->private)
357: {
358: /* peer certificate, generate on demand */
359: now = time(NULL);
360: sans = linked_list_create();
361:
362: switch (id->get_type(id))
363: {
364: case ID_DER_ASN1_DN:
365: break;
366: case ID_FQDN:
367: case ID_RFC822_ADDR:
368: case ID_IPV4_ADDR:
369: case ID_IPV6_ADDR:
370: /* encode as subjectAltName, construct a sane DN */
371: sans->insert_last(sans, id);
372: snprintf(buf, sizeof(buf), "CN=%Y", id);
373: dn = identification_create_from_string(buf);
374: break;
375: default:
376: sans->destroy(sans);
377: return NULL;
378: }
1.1.1.2 ! misho 379: serial = asn1_integer_from_uint64(++this->serial);
1.1 misho 380: peer_key = this->private->get_public_key(this->private);
381: peer_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
382: BUILD_SIGNING_KEY, this->private,
383: BUILD_SIGNING_CERT, this->ca,
384: BUILD_DIGEST_ALG, this->digest,
385: BUILD_PUBLIC_KEY, peer_key,
386: BUILD_SUBJECT, dn ?: id,
387: BUILD_SUBJECT_ALTNAMES, sans,
388: BUILD_NOT_BEFORE_TIME, now - 60 * 60 * 24,
389: BUILD_NOT_AFTER_TIME, now + 60 * 60 * 24,
1.1.1.2 ! misho 390: BUILD_SERIAL, serial,
1.1 misho 391: BUILD_CRL_DISTRIBUTION_POINTS, this->cdps,
392: BUILD_END);
393: peer_key->destroy(peer_key);
394: sans->destroy(sans);
1.1.1.2 ! misho 395: chunk_free(&serial);
1.1 misho 396: DESTROY_IF(dn);
397: if (peer_cert)
398: {
399: return enumerator_create_single(peer_cert, (void*)peer_cert->destroy);
400: }
401: }
402: return NULL;
403: }
404:
405: CALLBACK(shared_filter, bool,
406: void *null, enumerator_t *orig, va_list args)
407: {
408: shared_key_t *key, **out;
409: id_match_t *me, *other;
410:
411: VA_ARGS_VGET(args, out, me, other);
412:
413: if (orig->enumerate(orig, &key))
414: {
415: *out = key;
416: if (me)
417: {
418: *me = ID_MATCH_ANY;
419: }
420: if (other)
421: {
422: *other = ID_MATCH_ANY;
423: }
424: return TRUE;
425: }
426: return FALSE;
427: }
428:
429: METHOD(credential_set_t, create_shared_enumerator, enumerator_t*,
430: private_load_tester_creds_t *this, shared_key_type_t type,
431: identification_t *me, identification_t *other)
432: {
433: shared_key_t *shared;
434:
435: switch (type)
436: {
437: case SHARED_IKE:
438: shared = this->psk;
439: break;
440: case SHARED_EAP:
441: shared = this->pwd;
442: break;
443: default:
444: return NULL;
445: }
446: return enumerator_create_filter(enumerator_create_single(shared, NULL),
447: shared_filter, NULL, NULL);
448: }
449:
450: METHOD(load_tester_creds_t, destroy, void,
451: private_load_tester_creds_t *this)
452: {
453: this->cas->destroy_offset(this->cas, offsetof(certificate_t, destroy));
454: DESTROY_IF(this->private);
455: DESTROY_IF(this->ca);
456: this->psk->destroy(this->psk);
457: this->pwd->destroy(this->pwd);
458: this->cdps->destroy_function(this->cdps, free);
459: free(this);
460: }
461:
462: load_tester_creds_t *load_tester_creds_create()
463: {
464: private_load_tester_creds_t *this;
465: char *pwd, *psk, *digest, *crl;
466:
467: psk = lib->settings->get_str(lib->settings,
468: "%s.plugins.load-tester.preshared_key", default_psk, lib->ns);
469: pwd = lib->settings->get_str(lib->settings,
470: "%s.plugins.load-tester.eap_password", default_pwd, lib->ns);
471: digest = lib->settings->get_str(lib->settings,
472: "%s.plugins.load-tester.digest", "sha1", lib->ns);
473: crl = lib->settings->get_str(lib->settings,
474: "%s.plugins.load-tester.crl", NULL, lib->ns);
475:
476: INIT(this,
477: .public = {
478: .credential_set = {
479: .create_shared_enumerator = _create_shared_enumerator,
480: .create_private_enumerator = _create_private_enumerator,
481: .create_cert_enumerator = _create_cert_enumerator,
482: .create_cdp_enumerator = (void*)return_null,
483: .cache_cert = (void*)nop,
484: },
485: .destroy = _destroy,
486: },
487: .private = load_issuer_key(),
488: .ca = load_issuer_cert(),
489: .cas = linked_list_create(),
490: .cdps = linked_list_create(),
491: .psk = shared_key_create(SHARED_IKE,
492: chunk_clone(chunk_create(psk, strlen(psk)))),
493: .pwd = shared_key_create(SHARED_EAP,
494: chunk_clone(chunk_create(pwd, strlen(pwd)))),
495: );
496:
497: if (this->ca)
498: {
499: this->cas->insert_last(this->cas, this->ca->get_ref(this->ca));
500: }
501:
502: if (!enum_from_name(hash_algorithm_short_names, digest, &this->digest))
503: {
504: DBG1(DBG_CFG, "invalid load-tester digest: '%s', using sha1", digest);
505: this->digest = HASH_SHA1;
506: }
507:
508: if (crl)
509: {
510: x509_cdp_t *cdp;
511:
512: INIT(cdp,
513: .uri = crl,
514: );
515: this->cdps->insert_last(this->cdps, cdp);
516: }
517:
518: load_ca_certs(this);
519:
520: return &this->public;
521: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to load_tester_creds.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / plugins / load_tester