c28b0554807abdddc017a3ed4a99ea6d98c4b9bc
[strongswan.git] / src / charon / plugins / nm / nm_creds.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "nm_creds.h"
17
18 #include <sys/types.h>
19 #include <sys/stat.h>
20 #include <unistd.h>
21
22 #include <daemon.h>
23 #include <utils/mutex.h>
24 #include <credentials/certificates/x509.h>
25
26 typedef struct private_nm_creds_t private_nm_creds_t;
27
28 /**
29 * private data of nm_creds
30 */
31 struct private_nm_creds_t {
32
33 /**
34 * public functions
35 */
36 nm_creds_t public;
37
38 /**
39 * List of trusted certificates, certificate_t*
40 */
41 linked_list_t *certs;
42
43 /**
44 * User name
45 */
46 identification_t *user;
47
48 /**
49 * User password
50 */
51 char *pass;
52
53 /**
54 * users certificate
55 */
56 certificate_t *usercert;
57
58 /**
59 * users private key
60 */
61 private_key_t *key;
62
63 /**
64 * read/write lock
65 */
66 rwlock_t *lock;
67 };
68
69 /**
70 * Enumerator for user certificate
71 */
72 static enumerator_t *create_usercert_enumerator(private_nm_creds_t *this,
73 certificate_type_t cert, key_type_t key)
74 {
75 public_key_t *public;
76
77 if (cert != CERT_ANY && cert != this->usercert->get_type(this->usercert))
78 {
79 return NULL;
80 }
81 if (key != KEY_ANY)
82 {
83 public = this->usercert->get_public_key(this->usercert);
84 if (!public)
85 {
86 return NULL;
87 }
88 if (public->get_type(public) != key)
89 {
90 public->destroy(public);
91 return NULL;
92 }
93 public->destroy(public);
94 }
95 this->lock->read_lock(this->lock);
96 return enumerator_create_cleaner(
97 enumerator_create_single(this->usercert, NULL),
98 (void*)this->lock->unlock, this->lock);
99 }
100
101 /**
102 * CA certificate enumerator data
103 */
104 typedef struct {
105 /** ref to credential credential store */
106 private_nm_creds_t *this;
107 /** type of key we are looking for */
108 key_type_t key;
109 /** CA certificate ID */
110 identification_t *id;
111 } cert_data_t;
112
113 /**
114 * Destroy CA certificate enumerator data
115 */
116 static void cert_data_destroy(cert_data_t *data)
117 {
118 data->this->lock->unlock(data->this->lock);
119 free(data);
120 }
121
122 /**
123 * Filter function for certificates enumerator
124 */
125 static bool cert_filter(cert_data_t *data, certificate_t **in,
126 certificate_t **out)
127 {
128 certificate_t *cert = *in;
129 public_key_t *public;
130 chunk_t keyid;
131
132 public = cert->get_public_key(cert);
133 if (!public)
134 {
135 return FALSE;
136 }
137 if (data->key != KEY_ANY && public->get_type(public) != data->key)
138 {
139 public->destroy(public);
140 return FALSE;
141 }
142 if (data->id && data->id->get_type(data->id) == ID_KEY_ID &&
143 public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &keyid) &&
144 chunk_equals(keyid, data->id->get_encoding(data->id)))
145 {
146 public->destroy(public);
147 *out = cert;
148 return TRUE;
149 }
150 public->destroy(public);
151 if (data->id && !cert->has_subject(cert, data->id))
152 {
153 return FALSE;
154 }
155 *out = cert;
156 return TRUE;
157 }
158
159 /**
160 * Create enumerator for trusted certificates
161 */
162 static enumerator_t *create_trusted_cert_enumerator(private_nm_creds_t *this,
163 key_type_t key, identification_t *id)
164 {
165 cert_data_t *data = malloc_thing(cert_data_t);
166
167 data->this = this;
168 data->id = id;
169 data->key = key;
170
171 this->lock->read_lock(this->lock);
172 return enumerator_create_filter(
173 this->certs->create_enumerator(this->certs),
174 (void*)cert_filter, data, (void*)cert_data_destroy);
175 }
176
177 /**
178 * Implements credential_set_t.create_cert_enumerator
179 */
180 static enumerator_t* create_cert_enumerator(private_nm_creds_t *this,
181 certificate_type_t cert, key_type_t key,
182 identification_t *id, bool trusted)
183 {
184 if (id && this->usercert &&
185 id->equals(id, this->usercert->get_subject(this->usercert)))
186 {
187 return create_usercert_enumerator(this, cert, key);
188 }
189 if (cert == CERT_X509 || cert == CERT_ANY)
190 {
191 return create_trusted_cert_enumerator(this, key, id);
192 }
193 return NULL;
194 }
195
196 /**
197 * Implements credential_set_t.create_cert_enumerator
198 */
199 static enumerator_t* create_private_enumerator(private_nm_creds_t *this,
200 key_type_t type, identification_t *id)
201 {
202 if (this->key == NULL)
203 {
204 return NULL;
205 }
206 if (type != KEY_ANY && type != this->key->get_type(this->key))
207 {
208 return NULL;
209 }
210 if (id && id->get_type(id) != ID_ANY)
211 {
212 chunk_t keyid;
213
214 if (id->get_type(id) != ID_KEY_ID ||
215 !this->key->get_fingerprint(this->key, KEY_ID_PUBKEY_SHA1, &keyid) ||
216 !chunk_equals(keyid, id->get_encoding(id)))
217 {
218 return NULL;
219 }
220 }
221 this->lock->read_lock(this->lock);
222 return enumerator_create_cleaner(enumerator_create_single(this->key, NULL),
223 (void*)this->lock->unlock, this->lock);
224 }
225
226 /**
227 * shared key enumerator implementation
228 */
229 typedef struct {
230 enumerator_t public;
231 private_nm_creds_t *this;
232 shared_key_t *key;
233 bool done;
234 } shared_enumerator_t;
235
236 /**
237 * enumerate function for shared enumerator
238 */
239 static bool shared_enumerate(shared_enumerator_t *this, shared_key_t **key,
240 id_match_t *me, id_match_t *other)
241 {
242 if (this->done)
243 {
244 return FALSE;
245 }
246 *key = this->key;
247 *me = ID_MATCH_PERFECT;
248 *other = ID_MATCH_ANY;
249 this->done = TRUE;
250 return TRUE;
251 }
252
253 /**
254 * Destroy function for shared enumerator
255 */
256 static void shared_destroy(shared_enumerator_t *this)
257 {
258 this->key->destroy(this->key);
259 this->this->lock->unlock(this->this->lock);
260 free(this);
261 }
262 /**
263 * Implements credential_set_t.create_cert_enumerator
264 */
265 static enumerator_t* create_shared_enumerator(private_nm_creds_t *this,
266 shared_key_type_t type, identification_t *me,
267 identification_t *other)
268 {
269 shared_enumerator_t *enumerator;
270
271 if (!this->pass || !this->user)
272 {
273 return NULL;
274 }
275 if (type != SHARED_EAP && type != SHARED_IKE)
276 {
277 return NULL;
278 }
279 if (me && !me->equals(me, this->user))
280 {
281 return NULL;
282 }
283
284 enumerator = malloc_thing(shared_enumerator_t);
285 enumerator->public.enumerate = (void*)shared_enumerate;
286 enumerator->public.destroy = (void*)shared_destroy;
287 enumerator->this = this;
288 enumerator->done = FALSE;
289 this->lock->read_lock(this->lock);
290 enumerator->key = shared_key_create(type,
291 chunk_clone(chunk_create(this->pass,
292 strlen(this->pass))));
293 return &enumerator->public;
294 }
295
296 /**
297 * Implementation of nm_creds_t.add_certificate
298 */
299 static void add_certificate(private_nm_creds_t *this, certificate_t *cert)
300 {
301 this->lock->write_lock(this->lock);
302 this->certs->insert_last(this->certs, cert);
303 this->lock->unlock(this->lock);
304 }
305
306 /**
307 * Load a certificate file
308 */
309 static void load_ca_file(private_nm_creds_t *this, char *file)
310 {
311 certificate_t *cert;
312
313 /* We add the CA constraint, as many CAs miss it */
314 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
315 BUILD_FROM_FILE, file, BUILD_END);
316 if (!cert)
317 {
318 DBG1(DBG_CFG, "loading CA certificate '%s' failed", file);
319 }
320 else
321 {
322 DBG2(DBG_CFG, "loaded CA certificate '%Y'", cert->get_subject(cert));
323 x509_t *x509 = (x509_t*)cert;
324 if (!(x509->get_flags(x509) & X509_SELF_SIGNED))
325 {
326 DBG1(DBG_CFG, "%Y is not self signed", cert->get_subject(cert));
327 }
328 this->certs->insert_last(this->certs, cert);
329 }
330 }
331
332 /**
333 * Implementation of nm_creds_t.load_ca_dir
334 */
335 static void load_ca_dir(private_nm_creds_t *this, char *dir)
336 {
337 enumerator_t *enumerator;
338 char *rel, *abs;
339 struct stat st;
340
341 enumerator = enumerator_create_directory(dir);
342 if (enumerator)
343 {
344 while (enumerator->enumerate(enumerator, &rel, &abs, &st))
345 {
346 /* skip '.', '..' and hidden files */
347 if (rel[0] != '.')
348 {
349 if (S_ISDIR(st.st_mode))
350 {
351 load_ca_dir(this, abs);
352 }
353 else if (S_ISREG(st.st_mode))
354 {
355 load_ca_file(this, abs);
356 }
357 }
358 }
359 enumerator->destroy(enumerator);
360 }
361 }
362
363 /**
364 * Implementation of nm_creds_t.set_password
365 */
366 static void set_username_password(private_nm_creds_t *this, identification_t *id,
367 char *password)
368 {
369 this->lock->write_lock(this->lock);
370 DESTROY_IF(this->user);
371 this->user = id->clone(id);
372 free(this->pass);
373 this->pass = password ? strdup(password) : NULL;
374 this->lock->unlock(this->lock);
375 }
376
377 /**
378 * Implementation of nm_creds_t.set_cert_and_key
379 */
380 static void set_cert_and_key(private_nm_creds_t *this, certificate_t *cert,
381 private_key_t *key)
382 {
383 this->lock->write_lock(this->lock);
384 DESTROY_IF(this->key);
385 DESTROY_IF(this->usercert);
386 this->key = key;
387 this->usercert = cert;
388 this->lock->unlock(this->lock);
389 }
390
391 /**
392 * Implementation of nm_creds_t.clear
393 */
394 static void clear(private_nm_creds_t *this)
395 {
396 certificate_t *cert;
397
398 while (this->certs->remove_last(this->certs, (void**)&cert) == SUCCESS)
399 {
400 cert->destroy(cert);
401 }
402 DESTROY_IF(this->user);
403 free(this->pass);
404 DESTROY_IF(this->usercert);
405 DESTROY_IF(this->key);
406 this->key = NULL;
407 this->usercert = NULL;
408 this->pass = NULL;
409 this->user = NULL;
410 }
411
412 /**
413 * Implementation of nm_creds_t.destroy
414 */
415 static void destroy(private_nm_creds_t *this)
416 {
417 clear(this);
418 this->certs->destroy(this->certs);
419 this->lock->destroy(this->lock);
420 free(this);
421 }
422
423 /*
424 * see header file
425 */
426 nm_creds_t *nm_creds_create()
427 {
428 private_nm_creds_t *this = malloc_thing(private_nm_creds_t);
429
430 this->public.set.create_private_enumerator = (void*)create_private_enumerator;
431 this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
432 this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
433 this->public.set.create_cdp_enumerator = (void*)return_null;
434 this->public.set.cache_cert = (void*)nop;
435 this->public.add_certificate = (void(*)(nm_creds_t*, certificate_t *cert))add_certificate;
436 this->public.load_ca_dir = (void(*)(nm_creds_t*, char *dir))load_ca_dir;
437 this->public.set_username_password = (void(*)(nm_creds_t*, identification_t *id, char *password))set_username_password;
438 this->public.set_cert_and_key = (void(*)(nm_creds_t*, certificate_t *cert, private_key_t *key))set_cert_and_key;
439 this->public.clear = (void(*)(nm_creds_t*))clear;
440 this->public.destroy = (void(*)(nm_creds_t*))destroy;
441
442 this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
443
444 this->certs = linked_list_create();
445 this->user = NULL;
446 this->pass = NULL;
447 this->usercert = NULL;
448 this->key = NULL;
449
450 return &this->public;
451 }
452