Credential backends use has_fingerprint() methods to select keys/certificates
[strongswan.git] / src / charon / plugins / nm / nm_creds.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "nm_creds.h"
17
18 #include <sys/types.h>
19 #include <sys/stat.h>
20 #include <unistd.h>
21
22 #include <daemon.h>
23 #include <utils/mutex.h>
24 #include <credentials/certificates/x509.h>
25
26 typedef struct private_nm_creds_t private_nm_creds_t;
27
28 /**
29 * private data of nm_creds
30 */
31 struct private_nm_creds_t {
32
33 /**
34 * public functions
35 */
36 nm_creds_t public;
37
38 /**
39 * List of trusted certificates, certificate_t*
40 */
41 linked_list_t *certs;
42
43 /**
44 * User name
45 */
46 identification_t *user;
47
48 /**
49 * User password
50 */
51 char *pass;
52
53 /**
54 * users certificate
55 */
56 certificate_t *usercert;
57
58 /**
59 * users private key
60 */
61 private_key_t *key;
62
63 /**
64 * read/write lock
65 */
66 rwlock_t *lock;
67 };
68
69 /**
70 * Enumerator for user certificate
71 */
72 static enumerator_t *create_usercert_enumerator(private_nm_creds_t *this,
73 certificate_type_t cert, key_type_t key)
74 {
75 public_key_t *public;
76
77 if (cert != CERT_ANY && cert != this->usercert->get_type(this->usercert))
78 {
79 return NULL;
80 }
81 if (key != KEY_ANY)
82 {
83 public = this->usercert->get_public_key(this->usercert);
84 if (!public)
85 {
86 return NULL;
87 }
88 if (public->get_type(public) != key)
89 {
90 public->destroy(public);
91 return NULL;
92 }
93 public->destroy(public);
94 }
95 this->lock->read_lock(this->lock);
96 return enumerator_create_cleaner(
97 enumerator_create_single(this->usercert, NULL),
98 (void*)this->lock->unlock, this->lock);
99 }
100
101 /**
102 * CA certificate enumerator data
103 */
104 typedef struct {
105 /** ref to credential credential store */
106 private_nm_creds_t *this;
107 /** type of key we are looking for */
108 key_type_t key;
109 /** CA certificate ID */
110 identification_t *id;
111 } cert_data_t;
112
113 /**
114 * Destroy CA certificate enumerator data
115 */
116 static void cert_data_destroy(cert_data_t *data)
117 {
118 data->this->lock->unlock(data->this->lock);
119 free(data);
120 }
121
122 /**
123 * Filter function for certificates enumerator
124 */
125 static bool cert_filter(cert_data_t *data, certificate_t **in,
126 certificate_t **out)
127 {
128 certificate_t *cert = *in;
129 public_key_t *public;
130
131 public = cert->get_public_key(cert);
132 if (!public)
133 {
134 return FALSE;
135 }
136 if (data->key != KEY_ANY && public->get_type(public) != data->key)
137 {
138 public->destroy(public);
139 return FALSE;
140 }
141 if (data->id && data->id->get_type(data->id) == ID_KEY_ID &&
142 public->has_fingerprint(public, data->id->get_encoding(data->id)))
143 {
144 public->destroy(public);
145 *out = cert;
146 return TRUE;
147 }
148 public->destroy(public);
149 if (data->id && !cert->has_subject(cert, data->id))
150 {
151 return FALSE;
152 }
153 *out = cert;
154 return TRUE;
155 }
156
157 /**
158 * Create enumerator for trusted certificates
159 */
160 static enumerator_t *create_trusted_cert_enumerator(private_nm_creds_t *this,
161 key_type_t key, identification_t *id)
162 {
163 cert_data_t *data = malloc_thing(cert_data_t);
164
165 data->this = this;
166 data->id = id;
167 data->key = key;
168
169 this->lock->read_lock(this->lock);
170 return enumerator_create_filter(
171 this->certs->create_enumerator(this->certs),
172 (void*)cert_filter, data, (void*)cert_data_destroy);
173 }
174
175 /**
176 * Implements credential_set_t.create_cert_enumerator
177 */
178 static enumerator_t* create_cert_enumerator(private_nm_creds_t *this,
179 certificate_type_t cert, key_type_t key,
180 identification_t *id, bool trusted)
181 {
182 if (id && this->usercert &&
183 id->equals(id, this->usercert->get_subject(this->usercert)))
184 {
185 return create_usercert_enumerator(this, cert, key);
186 }
187 if (cert == CERT_X509 || cert == CERT_ANY)
188 {
189 return create_trusted_cert_enumerator(this, key, id);
190 }
191 return NULL;
192 }
193
194 /**
195 * Implements credential_set_t.create_cert_enumerator
196 */
197 static enumerator_t* create_private_enumerator(private_nm_creds_t *this,
198 key_type_t type, identification_t *id)
199 {
200 if (this->key == NULL)
201 {
202 return NULL;
203 }
204 if (type != KEY_ANY && type != this->key->get_type(this->key))
205 {
206 return NULL;
207 }
208 if (id && id->get_type(id) != ID_ANY)
209 {
210 if (id->get_type(id) != ID_KEY_ID ||
211 !this->key->has_fingerprint(this->key, id->get_encoding(id)))
212 {
213 return NULL;
214 }
215 }
216 this->lock->read_lock(this->lock);
217 return enumerator_create_cleaner(enumerator_create_single(this->key, NULL),
218 (void*)this->lock->unlock, this->lock);
219 }
220
221 /**
222 * shared key enumerator implementation
223 */
224 typedef struct {
225 enumerator_t public;
226 private_nm_creds_t *this;
227 shared_key_t *key;
228 bool done;
229 } shared_enumerator_t;
230
231 /**
232 * enumerate function for shared enumerator
233 */
234 static bool shared_enumerate(shared_enumerator_t *this, shared_key_t **key,
235 id_match_t *me, id_match_t *other)
236 {
237 if (this->done)
238 {
239 return FALSE;
240 }
241 *key = this->key;
242 *me = ID_MATCH_PERFECT;
243 *other = ID_MATCH_ANY;
244 this->done = TRUE;
245 return TRUE;
246 }
247
248 /**
249 * Destroy function for shared enumerator
250 */
251 static void shared_destroy(shared_enumerator_t *this)
252 {
253 this->key->destroy(this->key);
254 this->this->lock->unlock(this->this->lock);
255 free(this);
256 }
257 /**
258 * Implements credential_set_t.create_cert_enumerator
259 */
260 static enumerator_t* create_shared_enumerator(private_nm_creds_t *this,
261 shared_key_type_t type, identification_t *me,
262 identification_t *other)
263 {
264 shared_enumerator_t *enumerator;
265
266 if (!this->pass || !this->user)
267 {
268 return NULL;
269 }
270 if (type != SHARED_EAP && type != SHARED_IKE)
271 {
272 return NULL;
273 }
274 if (me && !me->equals(me, this->user))
275 {
276 return NULL;
277 }
278
279 enumerator = malloc_thing(shared_enumerator_t);
280 enumerator->public.enumerate = (void*)shared_enumerate;
281 enumerator->public.destroy = (void*)shared_destroy;
282 enumerator->this = this;
283 enumerator->done = FALSE;
284 this->lock->read_lock(this->lock);
285 enumerator->key = shared_key_create(type,
286 chunk_clone(chunk_create(this->pass,
287 strlen(this->pass))));
288 return &enumerator->public;
289 }
290
291 /**
292 * Implementation of nm_creds_t.add_certificate
293 */
294 static void add_certificate(private_nm_creds_t *this, certificate_t *cert)
295 {
296 this->lock->write_lock(this->lock);
297 this->certs->insert_last(this->certs, cert);
298 this->lock->unlock(this->lock);
299 }
300
301 /**
302 * Load a certificate file
303 */
304 static void load_ca_file(private_nm_creds_t *this, char *file)
305 {
306 certificate_t *cert;
307
308 /* We add the CA constraint, as many CAs miss it */
309 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
310 BUILD_FROM_FILE, file, BUILD_END);
311 if (!cert)
312 {
313 DBG1(DBG_CFG, "loading CA certificate '%s' failed", file);
314 }
315 else
316 {
317 DBG2(DBG_CFG, "loaded CA certificate '%Y'", cert->get_subject(cert));
318 x509_t *x509 = (x509_t*)cert;
319 if (!(x509->get_flags(x509) & X509_SELF_SIGNED))
320 {
321 DBG1(DBG_CFG, "%Y is not self signed", cert->get_subject(cert));
322 }
323 this->certs->insert_last(this->certs, cert);
324 }
325 }
326
327 /**
328 * Implementation of nm_creds_t.load_ca_dir
329 */
330 static void load_ca_dir(private_nm_creds_t *this, char *dir)
331 {
332 enumerator_t *enumerator;
333 char *rel, *abs;
334 struct stat st;
335
336 enumerator = enumerator_create_directory(dir);
337 if (enumerator)
338 {
339 while (enumerator->enumerate(enumerator, &rel, &abs, &st))
340 {
341 /* skip '.', '..' and hidden files */
342 if (rel[0] != '.')
343 {
344 if (S_ISDIR(st.st_mode))
345 {
346 load_ca_dir(this, abs);
347 }
348 else if (S_ISREG(st.st_mode))
349 {
350 load_ca_file(this, abs);
351 }
352 }
353 }
354 enumerator->destroy(enumerator);
355 }
356 }
357
358 /**
359 * Implementation of nm_creds_t.set_password
360 */
361 static void set_username_password(private_nm_creds_t *this, identification_t *id,
362 char *password)
363 {
364 this->lock->write_lock(this->lock);
365 DESTROY_IF(this->user);
366 this->user = id->clone(id);
367 free(this->pass);
368 this->pass = password ? strdup(password) : NULL;
369 this->lock->unlock(this->lock);
370 }
371
372 /**
373 * Implementation of nm_creds_t.set_cert_and_key
374 */
375 static void set_cert_and_key(private_nm_creds_t *this, certificate_t *cert,
376 private_key_t *key)
377 {
378 this->lock->write_lock(this->lock);
379 DESTROY_IF(this->key);
380 DESTROY_IF(this->usercert);
381 this->key = key;
382 this->usercert = cert;
383 this->lock->unlock(this->lock);
384 }
385
386 /**
387 * Implementation of nm_creds_t.clear
388 */
389 static void clear(private_nm_creds_t *this)
390 {
391 certificate_t *cert;
392
393 while (this->certs->remove_last(this->certs, (void**)&cert) == SUCCESS)
394 {
395 cert->destroy(cert);
396 }
397 DESTROY_IF(this->user);
398 free(this->pass);
399 DESTROY_IF(this->usercert);
400 DESTROY_IF(this->key);
401 this->key = NULL;
402 this->usercert = NULL;
403 this->pass = NULL;
404 this->user = NULL;
405 }
406
407 /**
408 * Implementation of nm_creds_t.destroy
409 */
410 static void destroy(private_nm_creds_t *this)
411 {
412 clear(this);
413 this->certs->destroy(this->certs);
414 this->lock->destroy(this->lock);
415 free(this);
416 }
417
418 /*
419 * see header file
420 */
421 nm_creds_t *nm_creds_create()
422 {
423 private_nm_creds_t *this = malloc_thing(private_nm_creds_t);
424
425 this->public.set.create_private_enumerator = (void*)create_private_enumerator;
426 this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
427 this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
428 this->public.set.create_cdp_enumerator = (void*)return_null;
429 this->public.set.cache_cert = (void*)nop;
430 this->public.add_certificate = (void(*)(nm_creds_t*, certificate_t *cert))add_certificate;
431 this->public.load_ca_dir = (void(*)(nm_creds_t*, char *dir))load_ca_dir;
432 this->public.set_username_password = (void(*)(nm_creds_t*, identification_t *id, char *password))set_username_password;
433 this->public.set_cert_and_key = (void(*)(nm_creds_t*, certificate_t *cert, private_key_t *key))set_cert_and_key;
434 this->public.clear = (void(*)(nm_creds_t*))clear;
435 this->public.destroy = (void(*)(nm_creds_t*))destroy;
436
437 this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
438
439 this->certs = linked_list_create();
440 this->user = NULL;
441 this->pass = NULL;
442 this->usercert = NULL;
443 this->key = NULL;
444
445 return &this->public;
446 }
447