![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to credential_manager.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / credentials|
Return to credential_manager.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / credentials |
1.1 misho 1: /*
2: * Copyright (C) 2015 Tobias Brunner
3: * Copyright (C) 2007 Martin Willi
4: * HSR Hochschule fuer Technik Rapperswil
5: *
6: * This program is free software; you can redistribute it and/or modify it
7: * under the terms of the GNU General Public License as published by the
8: * Free Software Foundation; either version 2 of the License, or (at your
9: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10: *
11: * This program is distributed in the hope that it will be useful, but
12: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14: * for more details.
15: */
16:
17: #include "credential_manager.h"
18:
19: #include <library.h>
20: #include <utils/debug.h>
21: #include <threading/thread_value.h>
22: #include <threading/mutex.h>
23: #include <threading/rwlock.h>
24: #include <collections/linked_list.h>
25: #include <credentials/sets/cert_cache.h>
26: #include <credentials/sets/auth_cfg_wrapper.h>
27: #include <credentials/certificates/x509.h>
28:
29: /**
30: * Maximum length of a certificate trust chain
31: */
32: #define MAX_TRUST_PATH_LEN 7
33:
34: typedef struct private_credential_manager_t private_credential_manager_t;
35:
36: /**
37: * private data of credential_manager
38: */
39: struct private_credential_manager_t {
40:
41: /**
42: * public functions
43: */
44: credential_manager_t public;
45:
46: /**
47: * list of credential sets
48: */
49: linked_list_t *sets;
50:
51: /**
52: * thread local set of credentials, linked_list_t with credential_set_t's
53: */
54: thread_value_t *local_sets;
55:
56: /**
57: * Exclusive local sets, linked_list_t with credential_set_t
58: */
59: thread_value_t *exclusive_local_sets;
60:
61: /**
62: * trust relationship and certificate cache
63: */
64: cert_cache_t *cache;
65:
66: /**
67: * certificates queued for persistent caching
68: */
69: linked_list_t *cache_queue;
70:
71: /**
72: * list of certificate validators, cert_validator_t
73: */
74: linked_list_t *validators;
75:
76: /**
77: * read-write lock to sets list
78: */
79: rwlock_t *lock;
80:
81: /**
82: * mutex for cache queue
83: */
84: mutex_t *queue_mutex;
85:
86: /**
87: * Registered hook to call on validation errors
88: */
89: credential_hook_t hook;
90:
91: /**
92: * Registered data to pass to hook
93: */
94: void *hook_data;
95: };
96:
97: /** data to pass to create_private_enumerator */
98: typedef struct {
99: private_credential_manager_t *this;
100: key_type_t type;
101: identification_t* keyid;
102: } private_data_t;
103:
104: /** data to pass to create_cert_enumerator */
105: typedef struct {
106: private_credential_manager_t *this;
107: certificate_type_t cert;
108: key_type_t key;
109: identification_t *id;
110: bool trusted;
111: } cert_data_t;
112:
113: /** data to pass to create_cdp_enumerator */
114: typedef struct {
115: private_credential_manager_t *this;
116: certificate_type_t type;
117: identification_t *id;
118: } cdp_data_t;
119:
120: /** data to pass to create_shared_enumerator */
121: typedef struct {
122: private_credential_manager_t *this;
123: shared_key_type_t type;
124: identification_t *me;
125: identification_t *other;
126: } shared_data_t;
127:
128: /** enumerator over local and global sets */
129: typedef struct {
130: /** implements enumerator_t */
131: enumerator_t public;
132: /** enumerator over global sets */
133: enumerator_t *global;
134: /** enumerator over local sets */
135: enumerator_t *local;
136: /** enumerator over exclusive local sets */
137: enumerator_t *exclusive;
138: } sets_enumerator_t;
139:
140: METHOD(credential_manager_t, set_hook, void,
141: private_credential_manager_t *this, credential_hook_t hook, void *data)
142: {
143: this->hook = hook;
144: this->hook_data = data;
145: }
146:
147: METHOD(credential_manager_t, call_hook, void,
148: private_credential_manager_t *this, credential_hook_type_t type,
149: certificate_t *cert)
150: {
151: if (this->hook)
152: {
153: this->hook(this->hook_data, type, cert);
154: }
155: }
156:
157: METHOD(enumerator_t, sets_enumerate, bool,
158: sets_enumerator_t *this, va_list args)
159: {
160: credential_set_t **set;
161:
162: VA_ARGS_VGET(args, set);
163:
164: if (this->exclusive)
165: {
166: if (this->exclusive->enumerate(this->exclusive, set))
167: { /* only enumerate last added */
168: this->exclusive->destroy(this->exclusive);
169: this->exclusive = NULL;
170: return TRUE;
171: }
172: }
173: if (this->local)
174: {
175: if (this->local->enumerate(this->local, set))
176: {
177: return TRUE;
178: }
179: /* end of local sets, look for global */
180: this->local->destroy(this->local);
181: this->local = NULL;
182: }
183: if (this->global)
184: {
185: return this->global->enumerate(this->global, set);
186: }
187: return FALSE;
188: }
189:
190: METHOD(enumerator_t, sets_destroy, void,
191: sets_enumerator_t *this)
192: {
193: DESTROY_IF(this->global);
194: DESTROY_IF(this->local);
195: DESTROY_IF(this->exclusive);
196: free(this);
197: }
198:
199: /**
200: * create an enumerator over both, global and local sets
201: */
202: static enumerator_t *create_sets_enumerator(private_credential_manager_t *this)
203: {
204: sets_enumerator_t *enumerator;
205: linked_list_t *list;
206:
207: INIT(enumerator,
208: .public = {
209: .enumerate = enumerator_enumerate_default,
210: .venumerate = _sets_enumerate,
211: .destroy = _sets_destroy,
212: },
213: );
214:
215: list = this->exclusive_local_sets->get(this->exclusive_local_sets);
216: if (list && list->get_count(list))
217: {
218: enumerator->exclusive = list->create_enumerator(list);
219: }
220: else
221: {
222: enumerator->global = this->sets->create_enumerator(this->sets);
223: list = this->local_sets->get(this->local_sets);
224: if (list)
225: {
226: enumerator->local = list->create_enumerator(list);
227: }
228: }
229: return &enumerator->public;
230: }
231:
232: /**
233: * cleanup function for cert data
234: */
235: static void destroy_cert_data(cert_data_t *data)
236: {
237: data->this->lock->unlock(data->this->lock);
238: free(data);
239: }
240:
241: /**
242: * enumerator constructor for certificates
243: */
244: static enumerator_t *create_cert(credential_set_t *set, cert_data_t *data)
245: {
246: return set->create_cert_enumerator(set, data->cert, data->key,
247: data->id, data->trusted);
248: }
249:
250: METHOD(credential_manager_t, create_cert_enumerator, enumerator_t*,
251: private_credential_manager_t *this, certificate_type_t certificate,
252: key_type_t key, identification_t *id, bool trusted)
253: {
254: cert_data_t *data = malloc_thing(cert_data_t);
255: data->this = this;
256: data->cert = certificate;
257: data->key = key;
258: data->id = id;
259: data->trusted = trusted;
260:
261: this->lock->read_lock(this->lock);
262: return enumerator_create_nested(create_sets_enumerator(this),
263: (void*)create_cert, data,
264: (void*)destroy_cert_data);
265: }
266:
267: METHOD(credential_manager_t, get_cert, certificate_t*,
268: private_credential_manager_t *this, certificate_type_t cert, key_type_t key,
269: identification_t *id, bool trusted)
270: {
271: certificate_t *current, *found = NULL;
272: enumerator_t *enumerator;
273:
274: enumerator = create_cert_enumerator(this, cert, key, id, trusted);
275: if (enumerator->enumerate(enumerator, ¤t))
276: {
277: /* TODO: best match? order by keyid, subject, subjectAltName */
278: found = current->get_ref(current);
279: }
280: enumerator->destroy(enumerator);
281: return found;
282: }
283:
284:
285: /**
286: * cleanup function for cdp data
287: */
288: static void destroy_cdp_data(cdp_data_t *data)
289: {
290: data->this->lock->unlock(data->this->lock);
291: free(data);
292: }
293:
294: /**
295: * enumerator constructor for CDPs
296: */
297: static enumerator_t *create_cdp(credential_set_t *set, cdp_data_t *data)
298: {
299: return set->create_cdp_enumerator(set, data->type, data->id);
300: }
301:
302: METHOD(credential_manager_t, create_cdp_enumerator, enumerator_t*,
303: private_credential_manager_t *this, certificate_type_t type,
304: identification_t *id)
305: {
306: cdp_data_t *data;
307:
308: INIT(data,
309: .this = this,
310: .type = type,
311: .id = id,
312: );
313: this->lock->read_lock(this->lock);
314: return enumerator_create_nested(create_sets_enumerator(this),
315: (void*)create_cdp, data,
316: (void*)destroy_cdp_data);
317: }
318:
319: /**
320: * cleanup function for private data
321: */
322: static void destroy_private_data(private_data_t *data)
323: {
324: data->this->lock->unlock(data->this->lock);
325: free(data);
326: }
327:
328: /**
329: * enumerator constructor for private keys
330: */
331: static enumerator_t *create_private(credential_set_t *set, private_data_t *data)
332: {
333: return set->create_private_enumerator(set, data->type, data->keyid);
334: }
335:
336: /**
337: * Create an enumerator over private keys
338: */
339: static enumerator_t *create_private_enumerator(
340: private_credential_manager_t *this, key_type_t key, identification_t *keyid)
341: {
342: private_data_t *data;
343:
344: INIT(data,
345: .this = this,
346: .type = key,
347: .keyid = keyid,
348: );
349: this->lock->read_lock(this->lock);
350: return enumerator_create_nested(create_sets_enumerator(this),
351: (void*)create_private, data,
352: (void*)destroy_private_data);
353: }
354:
355: /**
356: * Look up a private key by its key identifier
357: */
358: static private_key_t* get_private_by_keyid(private_credential_manager_t *this,
359: key_type_t key, identification_t *keyid)
360: {
361: private_key_t *found = NULL;
362: enumerator_t *enumerator;
363:
364: enumerator = create_private_enumerator(this, key, keyid);
365: if (enumerator->enumerate(enumerator, &found))
366: {
367: found->get_ref(found);
368: }
369: enumerator->destroy(enumerator);
370: return found;
371: }
372:
373: /**
374: * cleanup function for shared data
375: */
376: static void destroy_shared_data(shared_data_t *data)
377: {
378: data->this->lock->unlock(data->this->lock);
379: free(data);
380: }
381:
382: /**
383: * enumerator constructor for shared keys
384: */
385: static enumerator_t *create_shared(credential_set_t *set, shared_data_t *data)
386: {
387: return set->create_shared_enumerator(set, data->type, data->me, data->other);
388: }
389:
390: METHOD(credential_manager_t, create_shared_enumerator, enumerator_t*,
391: private_credential_manager_t *this, shared_key_type_t type,
392: identification_t *me, identification_t *other)
393: {
394: shared_data_t *data;
395:
396: INIT(data,
397: .this = this,
398: .type = type,
399: .me = me,
400: .other = other,
401: );
402: this->lock->read_lock(this->lock);
403: return enumerator_create_nested(create_sets_enumerator(this),
404: (void*)create_shared, data,
405: (void*)destroy_shared_data);
406: }
407:
408: METHOD(credential_manager_t, get_shared, shared_key_t*,
409: private_credential_manager_t *this, shared_key_type_t type,
410: identification_t *me, identification_t *other)
411: {
412: shared_key_t *current, *found = NULL;
413: id_match_t best_me = ID_MATCH_NONE, best_other = ID_MATCH_NONE;
414: id_match_t match_me, match_other;
415: enumerator_t *enumerator;
416:
417: enumerator = create_shared_enumerator(this, type, me, other);
418: while (enumerator->enumerate(enumerator, ¤t, &match_me, &match_other))
419: {
420: if (match_other > best_other ||
421: (match_other == best_other && match_me > best_me))
422: {
423: DESTROY_IF(found);
424: found = current->get_ref(current);
425: best_me = match_me;
426: best_other = match_other;
427: }
428: if (best_me == ID_MATCH_PERFECT && best_other == ID_MATCH_PERFECT)
429: {
430: break;
431: }
432: }
433: enumerator->destroy(enumerator);
434: return found;
435: }
436:
437: METHOD(credential_manager_t, add_local_set, void,
438: private_credential_manager_t *this, credential_set_t *set, bool exclusive)
439: {
440: linked_list_t *sets;
441: thread_value_t *tv;
442:
443: if (exclusive)
444: {
445: tv = this->exclusive_local_sets;
446: }
447: else
448: {
449: tv = this->local_sets;
450: }
451: sets = tv->get(tv);
452: if (!sets)
453: {
454: sets = linked_list_create();
455: tv->set(tv, sets);
456: }
457: if (exclusive)
458: {
459: sets->insert_first(sets, set);
460: }
461: else
462: {
463: sets->insert_last(sets, set);
464: }
465: }
466:
467: METHOD(credential_manager_t, remove_local_set, void,
468: private_credential_manager_t *this, credential_set_t *set)
469: {
470: linked_list_t *sets;
471: thread_value_t *tv;
472:
473: tv = this->local_sets;
474: sets = tv->get(tv);
475: if (sets && sets->remove(sets, set, NULL) && sets->get_count(sets) == 0)
476: {
477: tv->set(tv, NULL);
478: sets->destroy(sets);
479: }
480: tv = this->exclusive_local_sets;
481: sets = tv->get(tv);
482: if (sets && sets->remove(sets, set, NULL) && sets->get_count(sets) == 0)
483: {
484: tv->set(tv, NULL);
485: sets->destroy(sets);
486: }
487: }
488:
489: METHOD(credential_manager_t, issued_by, bool,
490: private_credential_manager_t *this, certificate_t *subject,
491: certificate_t *issuer, signature_params_t **scheme)
492: {
493: if (this->cache)
494: {
495: return this->cache->issued_by(this->cache, subject, issuer, scheme);
496: }
497: return subject->issued_by(subject, issuer, scheme);
498: }
499:
500: METHOD(credential_manager_t, cache_cert, void,
501: private_credential_manager_t *this, certificate_t *cert)
502: {
503: credential_set_t *set;
504: enumerator_t *enumerator;
505:
506: if (this->lock->try_write_lock(this->lock))
507: {
508: enumerator = this->sets->create_enumerator(this->sets);
509: while (enumerator->enumerate(enumerator, &set))
510: {
511: set->cache_cert(set, cert);
512: }
513: enumerator->destroy(enumerator);
514: this->lock->unlock(this->lock);
515: }
516: else
517: { /* we can't cache now as other threads are active, queue for later */
518: this->queue_mutex->lock(this->queue_mutex);
519: this->cache_queue->insert_last(this->cache_queue, cert->get_ref(cert));
520: this->queue_mutex->unlock(this->queue_mutex);
521: }
522: }
523:
524: /**
525: * Try to cache certificates queued for caching
526: */
527: static void cache_queue(private_credential_manager_t *this)
528: {
529: credential_set_t *set;
530: certificate_t *cert;
531: enumerator_t *enumerator;
532:
533: this->queue_mutex->lock(this->queue_mutex);
534: if (this->cache_queue->get_count(this->cache_queue) > 0 &&
535: this->lock->try_write_lock(this->lock))
536: {
537: while (this->cache_queue->remove_last(this->cache_queue,
538: (void**)&cert) == SUCCESS)
539: {
540: enumerator = this->sets->create_enumerator(this->sets);
541: while (enumerator->enumerate(enumerator, &set))
542: {
543: set->cache_cert(set, cert);
544: }
545: enumerator->destroy(enumerator);
546: cert->destroy(cert);
547: }
548: this->lock->unlock(this->lock);
549: }
550: this->queue_mutex->unlock(this->queue_mutex);
551: }
552:
553: /**
554: * Use validators to check the lifetime of certificates
555: */
556: static bool check_lifetime(private_credential_manager_t *this,
557: certificate_t *cert, char *label,
558: int pathlen, bool trusted, auth_cfg_t *auth)
559: {
560: time_t not_before, not_after;
561: cert_validator_t *validator;
562: enumerator_t *enumerator;
563: status_t status = NEED_MORE;
564:
565: enumerator = this->validators->create_enumerator(this->validators);
566: while (enumerator->enumerate(enumerator, &validator))
567: {
568: if (!validator->check_lifetime)
569: {
570: continue;
571: }
572: status = validator->check_lifetime(validator, cert,
573: pathlen, trusted, auth);
574: if (status != NEED_MORE)
575: {
576: break;
577: }
578: }
579: enumerator->destroy(enumerator);
580:
581: switch (status)
582: {
583: case NEED_MORE:
584: if (!cert->get_validity(cert, NULL, ¬_before, ¬_after))
585: {
586: DBG1(DBG_CFG, "%s certificate invalid (valid from %T to %T)",
587: label, ¬_before, FALSE, ¬_after, FALSE);
588: break;
589: }
590: return TRUE;
591: case SUCCESS:
592: return TRUE;
593: case FAILED:
594: default:
595: break;
596: }
597: call_hook(this, CRED_HOOK_EXPIRED, cert);
598: return FALSE;
599: }
600:
601: /**
602: * check a certificate for its lifetime
603: */
604: static bool check_certificate(private_credential_manager_t *this,
605: certificate_t *subject, certificate_t *issuer, bool online,
606: int pathlen, bool trusted, auth_cfg_t *auth)
607: {
608: cert_validator_t *validator;
609: enumerator_t *enumerator;
610:
611: if (!check_lifetime(this, subject, "subject", pathlen, FALSE, auth) ||
612: !check_lifetime(this, issuer, "issuer", pathlen + 1, trusted, auth))
613: {
614: return FALSE;
615: }
616:
617: enumerator = this->validators->create_enumerator(this->validators);
618: while (enumerator->enumerate(enumerator, &validator))
619: {
620: if (!validator->validate)
621: {
622: continue;
623: }
624: if (!validator->validate(validator, subject, issuer,
625: online, pathlen, trusted, auth))
626: {
627: enumerator->destroy(enumerator);
628: return FALSE;
629: }
630: }
631: enumerator->destroy(enumerator);
632: return TRUE;
633: }
634:
635: /**
636: * Get a trusted certificate from a credential set
637: */
638: static certificate_t *get_pretrusted_cert(private_credential_manager_t *this,
639: key_type_t type, identification_t *id)
640: {
641: certificate_t *subject;
642: public_key_t *public;
643:
644: subject = get_cert(this, CERT_ANY, type, id, TRUE);
645: if (!subject)
646: {
647: return NULL;
648: }
649: public = subject->get_public_key(subject);
650: if (!public)
651: {
652: subject->destroy(subject);
653: return NULL;
654: }
655: public->destroy(public);
656: return subject;
657: }
658:
659: /**
660: * Get the issuing certificate of a subject certificate
661: */
662: static certificate_t *get_issuer_cert(private_credential_manager_t *this,
663: certificate_t *subject, bool trusted,
664: signature_params_t **scheme)
665: {
666: enumerator_t *enumerator;
667: certificate_t *issuer = NULL, *candidate;
668:
669: enumerator = create_cert_enumerator(this, subject->get_type(subject), KEY_ANY,
670: subject->get_issuer(subject), trusted);
671: while (enumerator->enumerate(enumerator, &candidate))
672: {
673: if (issued_by(this, subject, candidate, scheme))
674: {
675: issuer = candidate->get_ref(candidate);
676: break;
677: }
678: }
679: enumerator->destroy(enumerator);
680: return issuer;
681: }
682:
683: /**
684: * Get the strength of certificate, add it to auth
685: */
686: static void get_key_strength(certificate_t *cert, auth_cfg_t *auth)
687: {
688: uintptr_t strength;
689: public_key_t *key;
690: key_type_t type;
691:
692: key = cert->get_public_key(cert);
693: if (key)
694: {
695: type = key->get_type(key);
696: strength = key->get_keysize(key);
697: DBG2(DBG_CFG, " certificate \"%Y\" key: %d bit %N",
698: cert->get_subject(cert), strength, key_type_names, type);
699: switch (type)
700: {
701: case KEY_RSA:
702: auth->add(auth, AUTH_RULE_RSA_STRENGTH, strength);
703: break;
704: case KEY_ECDSA:
705: auth->add(auth, AUTH_RULE_ECDSA_STRENGTH, strength);
706: break;
707: case KEY_BLISS:
708: auth->add(auth, AUTH_RULE_BLISS_STRENGTH, strength);
709: break;
710: default:
711: break;
712: }
713: key->destroy(key);
714: }
715: }
716:
717: /**
718: * try to verify the trust chain of subject, return TRUE if trusted
719: */
720: static bool verify_trust_chain(private_credential_manager_t *this,
721: certificate_t *subject, auth_cfg_t *result,
722: bool trusted, bool online)
723: {
724: certificate_t *current, *issuer;
725: auth_cfg_t *auth;
726: signature_params_t *scheme;
727: int pathlen;
728:
729: auth = auth_cfg_create();
730: get_key_strength(subject, auth);
731: current = subject->get_ref(subject);
732: auth->add(auth, AUTH_RULE_SUBJECT_CERT, current->get_ref(current));
733:
734: for (pathlen = 0; pathlen <= MAX_TRUST_PATH_LEN; pathlen++)
735: {
736: issuer = get_issuer_cert(this, current, TRUE, &scheme);
737: if (issuer)
738: {
739: /* accept only self-signed CAs as trust anchor */
740: if (issued_by(this, issuer, issuer, NULL))
741: {
742: auth->add(auth, AUTH_RULE_CA_CERT, issuer->get_ref(issuer));
743: DBG1(DBG_CFG, " using trusted ca certificate \"%Y\"",
744: issuer->get_subject(issuer));
745: trusted = TRUE;
746: }
747: else
748: {
749: auth->add(auth, AUTH_RULE_IM_CERT, issuer->get_ref(issuer));
750: DBG1(DBG_CFG, " using trusted intermediate ca certificate "
751: "\"%Y\"", issuer->get_subject(issuer));
752: }
753: auth->add(auth, AUTH_RULE_SIGNATURE_SCHEME, scheme);
754: }
755: else
756: {
757: issuer = get_issuer_cert(this, current, FALSE, &scheme);
758: if (issuer)
759: {
760: if (current->equals(current, issuer))
761: {
762: DBG1(DBG_CFG, " self-signed certificate \"%Y\" is not "
763: "trusted", current->get_subject(current));
764: issuer->destroy(issuer);
765: call_hook(this, CRED_HOOK_UNTRUSTED_ROOT, current);
766: break;
767: }
768: auth->add(auth, AUTH_RULE_IM_CERT, issuer->get_ref(issuer));
769: DBG1(DBG_CFG, " using untrusted intermediate certificate "
770: "\"%Y\"", issuer->get_subject(issuer));
771: auth->add(auth, AUTH_RULE_SIGNATURE_SCHEME, scheme);
772: }
773: else
774: {
775: DBG1(DBG_CFG, "no issuer certificate found for \"%Y\"",
776: current->get_subject(current));
777: DBG1(DBG_CFG, " issuer is \"%Y\"",
778: current->get_issuer(current));
779: call_hook(this, CRED_HOOK_NO_ISSUER, current);
780: break;
781: }
782: }
783: if (!check_certificate(this, current, issuer, online,
784: pathlen, trusted, auth))
785: {
786: trusted = FALSE;
787: issuer->destroy(issuer);
788: break;
789: }
790: if (issuer)
791: {
792: get_key_strength(issuer, auth);
793: }
794: current->destroy(current);
795: current = issuer;
796: if (trusted)
797: {
798: DBG1(DBG_CFG, " reached self-signed root ca with a "
799: "path length of %d", pathlen);
800: break;
801: }
802: }
803: current->destroy(current);
804: if (pathlen > MAX_TRUST_PATH_LEN)
805: {
806: DBG1(DBG_CFG, "maximum path length of %d exceeded", MAX_TRUST_PATH_LEN);
807: call_hook(this, CRED_HOOK_EXCEEDED_PATH_LEN, subject);
808: }
809: if (trusted)
810: {
811: result->merge(result, auth, FALSE);
812: }
813: auth->destroy(auth);
814: return trusted;
815: }
816:
817: CALLBACK(cert_equals, bool,
818: certificate_t *a, va_list args)
819: {
820: certificate_t *b;
821:
822: VA_ARGS_VGET(args, b);
823: return a->equals(a, b);
824: }
825:
826: /**
827: * enumerator for trusted certificates
828: */
829: typedef struct {
830: /** implements enumerator_t interface */
831: enumerator_t public;
832: /** enumerator over candidate peer certificates */
833: enumerator_t *candidates;
834: /** reference to the credential_manager */
835: private_credential_manager_t *this;
836: /** type of the requested key */
837: key_type_t type;
838: /** identity the requested key belongs to */
839: identification_t *id;
840: /** TRUE to do CRL/OCSP checking */
841: bool online;
842: /** pretrusted certificate we have served at first invocation */
843: certificate_t *pretrusted;
844: /** currently enumerating auth config */
845: auth_cfg_t *auth;
846: /** list of failed candidates */
847: linked_list_t *failed;
848: } trusted_enumerator_t;
849:
850: METHOD(enumerator_t, trusted_enumerate, bool,
851: trusted_enumerator_t *this, va_list args)
852: {
853: certificate_t *current, **cert;
854: auth_cfg_t **auth;
855:
856: VA_ARGS_VGET(args, cert, auth);
857:
858: DESTROY_IF(this->auth);
859: this->auth = auth_cfg_create();
860:
861: if (!this->candidates)
862: {
863: /* first invocation, build enumerator for next one */
864: this->candidates = create_cert_enumerator(this->this, CERT_ANY,
865: this->type, this->id, FALSE);
866: /* check if we have a trusted certificate for that peer */
867: this->pretrusted = get_pretrusted_cert(this->this, this->type, this->id);
868: if (this->pretrusted)
869: {
870: /* if we find a trusted self signed certificate, we just accept it.
871: * However, in order to fulfill authorization rules, we try to build
872: * the trust chain if it is not self signed */
873: if (issued_by(this->this, this->pretrusted, this->pretrusted, NULL) ||
874: verify_trust_chain(this->this, this->pretrusted, this->auth,
875: TRUE, this->online))
876: {
877: DBG1(DBG_CFG, " using trusted certificate \"%Y\"",
878: this->pretrusted->get_subject(this->pretrusted));
879: *cert = this->pretrusted;
880: if (!this->auth->get(this->auth, AUTH_RULE_SUBJECT_CERT))
881: { /* add cert to auth info, if not returned by trustchain */
882: this->auth->add(this->auth, AUTH_RULE_SUBJECT_CERT,
883: this->pretrusted->get_ref(this->pretrusted));
884: }
885: if (auth)
886: {
887: *auth = this->auth;
888: }
889: return TRUE;
890: }
891: }
892: }
893: /* try to verify the trust chain for each certificate found */
894: while (this->candidates->enumerate(this->candidates, ¤t))
895: {
896: if (this->pretrusted &&
897: this->pretrusted->equals(this->pretrusted, current))
898: { /* skip pretrusted certificate we already served */
899: continue;
900: }
901:
902: if (this->failed->find_first(this->failed, cert_equals, NULL, current))
903: { /* check each candidate only once */
904: continue;
905: }
906:
907: DBG1(DBG_CFG, " using certificate \"%Y\"",
908: current->get_subject(current));
909: if (verify_trust_chain(this->this, current, this->auth, FALSE,
910: this->online))
911: {
912: *cert = current;
913: if (auth)
914: {
915: *auth = this->auth;
916: }
917: return TRUE;
918: }
919: this->failed->insert_last(this->failed, current->get_ref(current));
920: }
921: return FALSE;
922: }
923:
924: METHOD(enumerator_t, trusted_destroy, void,
925: trusted_enumerator_t *this)
926: {
927: DESTROY_IF(this->pretrusted);
928: DESTROY_IF(this->auth);
929: DESTROY_IF(this->candidates);
930: this->failed->destroy_offset(this->failed, offsetof(certificate_t, destroy));
931: /* check for delayed certificate cache queue */
932: cache_queue(this->this);
933: free(this);
934: }
935:
936: METHOD(credential_manager_t, create_trusted_enumerator, enumerator_t*,
937: private_credential_manager_t *this, key_type_t type,
938: identification_t *id, bool online)
939: {
940: trusted_enumerator_t *enumerator;
941:
942: INIT(enumerator,
943: .public = {
944: .enumerate = enumerator_enumerate_default,
945: .venumerate = _trusted_enumerate,
946: .destroy = _trusted_destroy,
947: },
948: .this = this,
949: .type = type,
950: .id = id,
951: .online = online,
952: .failed = linked_list_create(),
953: );
954: return &enumerator->public;
955: }
956:
957: /**
958: * enumerator for public keys
959: */
960: typedef struct {
961: /** implements enumerator_t interface */
962: enumerator_t public;
963: /** enumerator over candidate peer certificates */
964: enumerator_t *inner;
965: /** reference to the credential_manager */
966: private_credential_manager_t *this;
967: /** currently enumerating key */
968: public_key_t *current;
969: /** credset wrapper around auth config */
970: auth_cfg_wrapper_t *wrapper;
971: } public_enumerator_t;
972:
973: METHOD(enumerator_t, public_enumerate, bool,
974: public_enumerator_t *this, va_list args)
975: {
976: certificate_t *cert;
977: public_key_t **key;
978: auth_cfg_t **auth;
979:
980: VA_ARGS_VGET(args, key, auth);
981:
982: while (this->inner->enumerate(this->inner, &cert, auth))
983: {
984: DESTROY_IF(this->current);
985: this->current = cert->get_public_key(cert);
986: if (this->current)
987: {
988: *key = this->current;
989: return TRUE;
990: }
991: }
992: return FALSE;
993: }
994:
995: METHOD(enumerator_t, public_destroy, void,
996: public_enumerator_t *this)
997: {
998: DESTROY_IF(this->current);
999: this->inner->destroy(this->inner);
1000: if (this->wrapper)
1001: {
1002: remove_local_set(this->this, &this->wrapper->set);
1003: this->wrapper->destroy(this->wrapper);
1004: }
1005: this->this->lock->unlock(this->this->lock);
1006: /* check for delayed certificate cache queue */
1007: cache_queue(this->this);
1008: free(this);
1009: }
1010:
1011: METHOD(credential_manager_t, create_public_enumerator, enumerator_t*,
1012: private_credential_manager_t *this, key_type_t type, identification_t *id,
1013: auth_cfg_t *auth, bool online)
1014: {
1015: public_enumerator_t *enumerator;
1016:
1017: INIT(enumerator,
1018: .public = {
1019: .enumerate = enumerator_enumerate_default,
1020: .venumerate = _public_enumerate,
1021: .destroy = _public_destroy,
1022: },
1023: .inner = create_trusted_enumerator(this, type, id, online),
1024: .this = this,
1025: );
1026: if (auth)
1027: {
1028: enumerator->wrapper = auth_cfg_wrapper_create(auth);
1029: add_local_set(this, &enumerator->wrapper->set, FALSE);
1030: }
1031: this->lock->read_lock(this->lock);
1032: return &enumerator->public;
1033: }
1034:
1035: /**
1036: * Check if a helper contains a certificate as trust anchor
1037: */
1038: static bool auth_contains_cacert(auth_cfg_t *auth, certificate_t *cert)
1039: {
1040: enumerator_t *enumerator;
1041: identification_t *value;
1042: auth_rule_t type;
1043: bool found = FALSE;
1044:
1045: enumerator = auth->create_enumerator(auth);
1046: while (enumerator->enumerate(enumerator, &type, &value))
1047: {
1048: if (type == AUTH_RULE_CA_CERT &&
1049: cert->equals(cert, (certificate_t*)value))
1050: {
1051: found = TRUE;
1052: break;
1053: }
1054: }
1055: enumerator->destroy(enumerator);
1056: return found;
1057: }
1058:
1059: /**
1060: * build a trustchain from subject up to a trust anchor in trusted
1061: */
1062: static auth_cfg_t *build_trustchain(private_credential_manager_t *this,
1063: certificate_t *subject, auth_cfg_t *auth)
1064: {
1065: certificate_t *issuer, *current;
1066: auth_cfg_t *trustchain;
1067: int pathlen = 0;
1068: bool has_anchor;
1069:
1070: trustchain = auth_cfg_create();
1071: has_anchor = auth->get(auth, AUTH_RULE_CA_CERT) != NULL;
1072: current = subject->get_ref(subject);
1073: while (TRUE)
1074: {
1075: if (auth_contains_cacert(auth, current))
1076: {
1077: trustchain->add(trustchain, AUTH_RULE_CA_CERT, current);
1078: return trustchain;
1079: }
1080: if (subject == current)
1081: {
1082: trustchain->add(trustchain, AUTH_RULE_SUBJECT_CERT, current);
1083: }
1084: else
1085: {
1086: if (!has_anchor && issued_by(this, current, current, NULL))
1087: { /* If no trust anchor specified, accept any CA */
1088: trustchain->add(trustchain, AUTH_RULE_CA_CERT, current);
1089: return trustchain;
1090: }
1091: trustchain->add(trustchain, AUTH_RULE_IM_CERT, current);
1092: }
1093: if (pathlen++ > MAX_TRUST_PATH_LEN)
1094: {
1095: break;
1096: }
1097: issuer = get_issuer_cert(this, current, FALSE, NULL);
1098: if (!issuer)
1099: {
1100: if (!has_anchor)
1101: { /* If no trust anchor specified, accept incomplete chains */
1102: return trustchain;
1103: }
1104: break;
1105: }
1106: if (has_anchor && issuer->equals(issuer, current))
1107: {
1108: issuer->destroy(issuer);
1109: break;
1110: }
1111: current = issuer;
1112: }
1113: trustchain->destroy(trustchain);
1114: return NULL;
1115: }
1116:
1117: /**
1118: * find a private key of a given certificate
1119: */
1120: static private_key_t *get_private_by_cert(private_credential_manager_t *this,
1121: certificate_t *cert, key_type_t type)
1122: {
1123: private_key_t *private = NULL;
1124: identification_t *keyid;
1125: chunk_t chunk;
1126: public_key_t *public;
1127:
1128: public = cert->get_public_key(cert);
1129: if (public)
1130: {
1131: if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &chunk))
1132: {
1133: keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
1134: private = get_private_by_keyid(this, type, keyid);
1135: keyid->destroy(keyid);
1136: }
1137: public->destroy(public);
1138: }
1139: return private;
1140: }
1141:
1142: /**
1143: * Move the actually used certificate to front, so it gets returned with get()
1144: */
1145: static void prefer_cert(auth_cfg_t *auth, certificate_t *cert)
1146: {
1147: enumerator_t *enumerator;
1148: auth_rule_t rule;
1149: certificate_t *current;
1150:
1151: enumerator = auth->create_enumerator(auth);
1152: while (enumerator->enumerate(enumerator, &rule, ¤t))
1153: {
1154: if (rule == AUTH_RULE_SUBJECT_CERT)
1155: {
1156: current->get_ref(current);
1157: auth->replace(auth, enumerator, AUTH_RULE_SUBJECT_CERT, cert);
1158: cert = current;
1159: }
1160: }
1161: enumerator->destroy(enumerator);
1162: auth->add(auth, AUTH_RULE_SUBJECT_CERT, cert);
1163: }
1164:
1165: METHOD(credential_manager_t, get_private, private_key_t*,
1166: private_credential_manager_t *this, key_type_t type, identification_t *id,
1167: auth_cfg_t *auth)
1168: {
1169: enumerator_t *enumerator;
1170: certificate_t *cert;
1171: private_key_t *private = NULL;
1172: auth_cfg_t *trustchain;
1173: auth_rule_t rule;
1174:
1175: /* check if this is a lookup by key ID, and do it if so */
1176: if (id && id->get_type(id) == ID_KEY_ID)
1177: {
1178: private = get_private_by_keyid(this, type, id);
1179: if (private)
1180: {
1181: return private;
1182: }
1183: }
1184:
1185: if (auth)
1186: {
1187: /* try to find a trustchain with one of the configured subject certs */
1188: enumerator = auth->create_enumerator(auth);
1189: while (enumerator->enumerate(enumerator, &rule, &cert))
1190: {
1191: if (rule == AUTH_RULE_SUBJECT_CERT)
1192: {
1193: private = get_private_by_cert(this, cert, type);
1194: if (private)
1195: {
1196: trustchain = build_trustchain(this, cert, auth);
1197: if (trustchain)
1198: {
1199: auth->merge(auth, trustchain, FALSE);
1200: prefer_cert(auth, cert->get_ref(cert));
1201: trustchain->destroy(trustchain);
1202: break;
1203: }
1204: private->destroy(private);
1205: private = NULL;
1206: }
1207: }
1208: }
1209: enumerator->destroy(enumerator);
1210: if (private)
1211: {
1212: return private;
1213: }
1214:
1215: /* if none yielded a trustchain, enforce the first configured cert */
1216: cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
1217: if (cert)
1218: {
1219: private = get_private_by_cert(this, cert, type);
1220: if (private)
1221: {
1222: trustchain = build_trustchain(this, cert, auth);
1223: if (trustchain)
1224: {
1225: auth->merge(auth, trustchain, FALSE);
1226: trustchain->destroy(trustchain);
1227: }
1228: return private;
1229: }
1230: }
1231:
1232: /* try to build a trust chain for each certificate found */
1233: enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE);
1234: while (enumerator->enumerate(enumerator, &cert))
1235: {
1236: private = get_private_by_cert(this, cert, type);
1237: if (private)
1238: {
1239: trustchain = build_trustchain(this, cert, auth);
1240: if (trustchain)
1241: {
1242: auth->merge(auth, trustchain, FALSE);
1243: trustchain->destroy(trustchain);
1244: break;
1245: }
1246: private->destroy(private);
1247: private = NULL;
1248: }
1249: }
1250: enumerator->destroy(enumerator);
1251: }
1252:
1253: /* if no valid trustchain was found, fall back to the first usable cert */
1254: if (!private)
1255: {
1256: enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE);
1257: while (enumerator->enumerate(enumerator, &cert))
1258: {
1259: private = get_private_by_cert(this, cert, type);
1260: if (private)
1261: {
1262: if (auth)
1263: {
1264: auth->add(auth, AUTH_RULE_SUBJECT_CERT, cert->get_ref(cert));
1265: }
1266: break;
1267: }
1268: }
1269: enumerator->destroy(enumerator);
1270: }
1271: return private;
1272: }
1273:
1274: METHOD(credential_manager_t, flush_cache, void,
1275: private_credential_manager_t *this, certificate_type_t type)
1276: {
1277: if (this->cache)
1278: {
1279: this->cache->flush(this->cache, type);
1280: }
1281: }
1282:
1283: METHOD(credential_manager_t, add_set, void,
1284: private_credential_manager_t *this, credential_set_t *set)
1285: {
1286: this->lock->write_lock(this->lock);
1287: this->sets->insert_last(this->sets, set);
1288: this->lock->unlock(this->lock);
1289: }
1290:
1291: METHOD(credential_manager_t, remove_set, void,
1292: private_credential_manager_t *this, credential_set_t *set)
1293: {
1294: this->lock->write_lock(this->lock);
1295: this->sets->remove(this->sets, set, NULL);
1296: this->lock->unlock(this->lock);
1297: }
1298:
1299: METHOD(credential_manager_t, add_validator, void,
1300: private_credential_manager_t *this, cert_validator_t *vdtr)
1301: {
1302: this->lock->write_lock(this->lock);
1303: this->validators->insert_last(this->validators, vdtr);
1304: this->lock->unlock(this->lock);
1305: }
1306:
1307: METHOD(credential_manager_t, remove_validator, void,
1308: private_credential_manager_t *this, cert_validator_t *vdtr)
1309: {
1310: this->lock->write_lock(this->lock);
1311: this->validators->remove(this->validators, vdtr, NULL);
1312: this->lock->unlock(this->lock);
1313: }
1314:
1315: METHOD(credential_manager_t, destroy, void,
1316: private_credential_manager_t *this)
1317: {
1318: cache_queue(this);
1319: this->cache_queue->destroy(this->cache_queue);
1320: if (this->cache)
1321: {
1322: this->sets->remove(this->sets, this->cache, NULL);
1323: this->cache->destroy(this->cache);
1324: }
1325: this->sets->destroy(this->sets);
1326: this->local_sets->destroy(this->local_sets);
1327: this->exclusive_local_sets->destroy(this->exclusive_local_sets);
1328: this->validators->destroy(this->validators);
1329: this->lock->destroy(this->lock);
1330: this->queue_mutex->destroy(this->queue_mutex);
1331: free(this);
1332: }
1333:
1334: /*
1335: * see header file
1336: */
1337: credential_manager_t *credential_manager_create()
1338: {
1339: private_credential_manager_t *this;
1340:
1341: INIT(this,
1342: .public = {
1343: .create_cert_enumerator = _create_cert_enumerator,
1344: .create_shared_enumerator = _create_shared_enumerator,
1345: .create_cdp_enumerator = _create_cdp_enumerator,
1346: .get_cert = _get_cert,
1347: .get_shared = _get_shared,
1348: .get_private = _get_private,
1349: .create_trusted_enumerator = _create_trusted_enumerator,
1350: .create_public_enumerator = _create_public_enumerator,
1351: .flush_cache = _flush_cache,
1352: .cache_cert = _cache_cert,
1353: .issued_by = _issued_by,
1354: .add_set = _add_set,
1355: .remove_set = _remove_set,
1356: .add_local_set = _add_local_set,
1357: .remove_local_set = _remove_local_set,
1358: .add_validator = _add_validator,
1359: .remove_validator = _remove_validator,
1360: .set_hook = _set_hook,
1361: .call_hook = _call_hook,
1362: .destroy = _destroy,
1363: },
1364: .sets = linked_list_create(),
1365: .validators = linked_list_create(),
1366: .cache_queue = linked_list_create(),
1367: .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
1368: .queue_mutex = mutex_create(MUTEX_TYPE_DEFAULT),
1369: );
1370:
1371: this->local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy);
1372: this->exclusive_local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy);
1373: if (lib->settings->get_bool(lib->settings, "%s.cert_cache", TRUE, lib->ns))
1374: {
1375: this->cache = cert_cache_create();
1376: this->sets->insert_first(this->sets, this->cache);
1377: }
1378:
1379: return &this->public;
1380: }