src/charon/plugins/stroke/stroke_cred.c

   1 /*
   2  * Copyright (C) 2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  *
  15  * $Id$
  16  */
  17
  18 #include "stroke_cred.h"
  19 #include "stroke_shared_key.h"
  20
  21 #include <sys/stat.h>
  22 #include <limits.h>
  23
  24 #include <credentials/certificates/x509.h>
  25 #include <credentials/certificates/crl.h>
  26 #include <credentials/certificates/ac.h>
  27 #include <utils/linked_list.h>
  28 #include <utils/mutex.h>
  29 #include <utils/lexparser.h>
  30 #include <asn1/pem.h>
  31 #include <daemon.h>
  32
  33 /* configuration directories and files */
  34 #define CONFIG_DIR IPSEC_CONFDIR
  35 #define IPSEC_D_DIR CONFIG_DIR "/ipsec.d"
  36 #define PRIVATE_KEY_DIR IPSEC_D_DIR "/private"
  37 #define CERTIFICATE_DIR IPSEC_D_DIR "/certs"
  38 #define CA_CERTIFICATE_DIR IPSEC_D_DIR "/cacerts"
  39 #define AA_CERTIFICATE_DIR IPSEC_D_DIR "/aacerts"
  40 #define ATTR_CERTIFICATE_DIR IPSEC_D_DIR "/acerts"
  41 #define OCSP_CERTIFICATE_DIR IPSEC_D_DIR "/ocspcerts"
  42 #define CRL_DIR IPSEC_D_DIR "/crls"
  43 #define SECRETS_FILE CONFIG_DIR "/ipsec.secrets"
  44
  45 typedef struct private_stroke_cred_t private_stroke_cred_t;
  46
  47 /**
  48  * private data of stroke_cred
  49  */
  50 struct private_stroke_cred_t {
  51
  52         /**
  53          * public functions
  54          */
  55         stroke_cred_t public;
  56
  57         /**
  58          * list of trusted peer/signer/CA certificates (certificate_t)
  59          */
  60         linked_list_t *certs;
  61
  62         /**
  63          * list of shared secrets (private_shared_key_t)
  64          */
  65         linked_list_t *shared;
  66
  67         /**
  68          * list of private keys (private_key_t)
  69          */
  70         linked_list_t *private;
  71
  72         /**
  73          * mutex to lock lists above
  74          */
  75         mutex_t *mutex;
  76
  77         /**
  78          * cache CRLs to disk?
  79          */
  80         bool cachecrl;
  81 };
  82
  83 /**
  84  * data to pass to various filters
  85  */
  86 typedef struct {
  87         private_stroke_cred_t *this;
  88         identification_t *id;
  89 } id_data_t;
  90
  91 /**
  92  * destroy id enumerator data and unlock list
  93  */
  94 static void id_data_destroy(id_data_t *data)
  95 {
  96         data->this->mutex->unlock(data->this->mutex);
  97         free(data);
  98 }
  99
 100 /**
 101  * filter function for private key enumerator
 102  */
 103 static bool private_filter(id_data_t *data,
 104                                                    private_key_t **in, private_key_t **out)
 105 {
 106         identification_t *candidate;
 107         id_type_t type;
 108
 109         if (data->id == NULL)
 110         {
 111                 *out = *in;
 112                 return TRUE;
 113         }
 114         type = data->id->get_type(data->id);
 115         if (type == ID_KEY_ID)
 116         {       /* handle ID_KEY_ID as a ID_PUBKEY_SHA1 */
 117                 type = ID_PUBKEY_SHA1;
 118         }
 119         candidate = (*in)->get_id(*in, type);
 120         if (candidate &&
 121                 chunk_equals(candidate->get_encoding(candidate),
 122                                          data->id->get_encoding(data->id)))
 123         {
 124                 *out = *in;
 125                 return TRUE;
 126         }
 127         return FALSE;
 128 }
 129
 130 /**
 131  * Implements credential_set_t.create_private_enumerator
 132  */
 133 static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
 134                                                         key_type_t type, identification_t *id)
 135 {
 136         id_data_t *data;
 137
 138         data = malloc_thing(id_data_t);
 139         data->this = this;
 140         data->id = id;
 141
 142         this->mutex->lock(this->mutex);
 143         return enumerator_create_filter(this->private->create_enumerator(this->private),
 144                                                                         (void*)private_filter, data,
 145                                                                         (void*)id_data_destroy);
 146 }
 147
 148 /**
 149  * filter function for certs enumerator
 150  */
 151 static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 152 {
 153         public_key_t *public;
 154         identification_t *candidate;
 155         certificate_t *cert = *in;
 156         certificate_type_t type = cert->get_type(cert);
 157
 158         if (type == CERT_X509_CRL || type == CERT_X509_AC)
 159         {
 160                 return FALSE;
 161         }
 162
 163         if (data->id == NULL || cert->has_subject(cert, data->id))
 164         {
 165                 *out = *in;
 166                 return TRUE;
 167         }
 168
 169         public = (cert)->get_public_key(cert);
 170         if (public)
 171         {
 172                 candidate = public->get_id(public, data->id->get_type(data->id));
 173                 if (candidate && data->id->equals(data->id, candidate))
 174                 {
 175                         public->destroy(public);
 176                         *out = *in;
 177                         return TRUE;
 178                 }
 179                 public->destroy(public);
 180         }
 181         return FALSE;
 182 }
 183
 184 /**
 185  * filter function for crl enumerator
 186  */
 187 static bool crl_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 188 {
 189         certificate_t *cert = *in;
 190
 191         if (cert->get_type(cert) != CERT_X509_CRL)
 192         {
 193                 return FALSE;
 194         }
 195
 196         if (data->id == NULL || cert->has_issuer(cert, data->id))
 197         {
 198                 *out = *in;
 199                 return TRUE;
 200         }
 201         return FALSE;
 202 }
 203
 204 /**
 205  * filter function for attribute certificate enumerator
 206  */
 207 static bool ac_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 208 {
 209         certificate_t *cert = *in;
 210
 211         if (cert->get_type(cert) != CERT_X509_AC)
 212         {
 213                 return FALSE;
 214         }
 215
 216         if (data->id == NULL || cert->has_subject(cert, data->id))
 217         {
 218                 *out = *in;
 219                 return TRUE;
 220         }
 221         return FALSE;
 222 }
 223
 224 /**
 225  * Implements credential_set_t.create_cert_enumerator
 226  */
 227 static enumerator_t* create_cert_enumerator(private_stroke_cred_t *this,
 228                                                         certificate_type_t cert, key_type_t key,
 229                                                         identification_t *id, bool trusted)
 230 {
 231         id_data_t *data;
 232
 233         if (cert == CERT_X509_CRL || cert == CERT_X509_AC)
 234         {
 235                 if (trusted)
 236                 {
 237                         return NULL;
 238                 }
 239                 data = malloc_thing(id_data_t);
 240                 data->this = this;
 241                 data->id = id;
 242
 243                 this->mutex->lock(this->mutex);
 244                 return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 245                                         (cert == CERT_X509_CRL)? (void*)crl_filter : (void*)ac_filter,
 246                                         data, (void*)id_data_destroy);
 247         }
 248         if (cert != CERT_X509 && cert != CERT_ANY)
 249         {       /* we only have X509 certificates. TODO: ACs? */
 250                 return NULL;
 251         }
 252         data = malloc_thing(id_data_t);
 253         data->this = this;
 254         data->id = id;
 255
 256         this->mutex->lock(this->mutex);
 257         return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 258                                                                         (void*)certs_filter, data,
 259                                                                         (void*)id_data_destroy);
 260 }
 261
 262 typedef struct {
 263         private_stroke_cred_t *this;
 264         identification_t *me;
 265         identification_t *other;
 266         shared_key_type_t type;
 267 } shared_data_t;
 268
 269 /**
 270  * free shared key enumerator data and unlock list
 271  */
 272 static void shared_data_destroy(shared_data_t *data)
 273 {
 274         data->this->mutex->unlock(data->this->mutex);
 275         free(data);
 276 }
 277
 278 /**
 279  * filter function for certs enumerator
 280  */
 281 static bool shared_filter(shared_data_t *data,
 282                                                   stroke_shared_key_t **in, shared_key_t **out,
 283                                                   void **unused1, id_match_t *me,
 284                                                   void **unused2, id_match_t *other)
 285 {
 286         id_match_t my_match, other_match;
 287         stroke_shared_key_t *stroke = *in;
 288         shared_key_t *shared = &stroke->shared;
 289
 290         if (data->type != SHARED_ANY && shared->get_type(shared) != data->type)
 291         {
 292                 return FALSE;
 293         }
 294
 295         my_match = stroke->has_owner(stroke, data->me);
 296         other_match = stroke->has_owner(stroke, data->other);
 297         if (!my_match && !other_match)
 298         {
 299                 return FALSE;
 300         }
 301         *out = shared;
 302         if (me)
 303         {
 304                 *me = my_match;
 305         }
 306         if (other)
 307         {
 308                 *other = other_match;
 309         }
 310         return TRUE;
 311 }
 312
 313 /**
 314  * Implements credential_set_t.create_shared_enumerator
 315  */
 316 static enumerator_t* create_shared_enumerator(private_stroke_cred_t *this,
 317                                                         shared_key_type_t type, identification_t *me,
 318                                                         identification_t *other)
 319 {
 320         shared_data_t *data = malloc_thing(shared_data_t);
 321
 322         data->this = this;
 323         data->me = me;
 324         data->other = other;
 325         data->type = type;
 326         this->mutex->lock(this->mutex);
 327         return enumerator_create_filter(this->shared->create_enumerator(this->shared),
 328                                                                         (void*)shared_filter, data,
 329                                                                         (void*)shared_data_destroy);
 330 }
 331
 332 /**
 333  * Add a certificate to chain
 334  */
 335 static certificate_t* add_cert(private_stroke_cred_t *this, certificate_t *cert)
 336 {
 337         certificate_t *current;
 338         enumerator_t *enumerator;
 339         bool new = TRUE;
 340
 341         this->mutex->lock(this->mutex);
 342         enumerator = this->certs->create_enumerator(this->certs);
 343         while (enumerator->enumerate(enumerator, (void**)&current))
 344         {
 345                 if (current->equals(current, cert))
 346                 {
 347                         /* cert already in queue */
 348                         cert->destroy(cert);
 349                         cert = current;
 350                         new = FALSE;
 351                         break;
 352                 }
 353         }
 354         enumerator->destroy(enumerator);
 355
 356         if (new)
 357         {
 358                 this->certs->insert_last(this->certs, cert);
 359         }
 360         this->mutex->unlock(this->mutex);
 361         return cert;
 362 }
 363
 364 /**
 365  * Implementation of stroke_cred_t.load_ca.
 366  */
 367 static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
 368 {
 369         certificate_t *cert;
 370         char path[PATH_MAX];
 371
 372         if (*filename == '/')
 373         {
 374                 snprintf(path, sizeof(path), "%s", filename);
 375         }
 376         else
 377         {
 378                 snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
 379         }
 380
 381         cert = lib->creds->create(lib->creds,
 382                                                           CRED_CERTIFICATE, CERT_X509,
 383                                                           BUILD_FROM_FILE, path,
 384                                                           BUILD_X509_FLAG, X509_CA,
 385                                                           BUILD_END);
 386         if (cert)
 387         {
 388                 return (certificate_t*)add_cert(this, cert);
 389         }
 390         return NULL;
 391 }
 392
 393 /**
 394  * Add X.509 CRL to chain
 395  */
 396 static bool add_crl(private_stroke_cred_t *this, crl_t* crl)
 397 {
 398         certificate_t *current, *cert = &crl->certificate;
 399         enumerator_t *enumerator;
 400         bool new = TRUE, found = FALSE;
 401
 402         this->mutex->lock(this->mutex);
 403         enumerator = this->certs->create_enumerator(this->certs);
 404         while (enumerator->enumerate(enumerator, (void**)&current))
 405         {
 406                 if (current->get_type(current) == CERT_X509_CRL)
 407                 {
 408                         crl_t *crl_c = (crl_t*)current;
 409                         identification_t *authkey = crl->get_authKeyIdentifier(crl);
 410                         identification_t *authkey_c = crl_c->get_authKeyIdentifier(crl_c);
 411
 412                         /* if compare authorityKeyIdentifiers if available */
 413                         if (authkey != NULL && authkey_c != NULL &&
 414                                 authkey->equals(authkey, authkey_c))
 415                         {
 416                                 found = TRUE;
 417                         }
 418                         else
 419                         {
 420                                 identification_t *issuer = cert->get_issuer(cert);
 421                                 identification_t *issuer_c = current->get_issuer(current);
 422
 423                                 /* otherwise compare issuer distinguished names */
 424                                 if (issuer->equals(issuer, issuer_c))
 425                                 {
 426                                         found = TRUE;
 427                                 }
 428                         }
 429                         if (found)
 430                         {
 431                                 new = cert->is_newer(cert, current);
 432                                 if (new)
 433                                 {
 434                                         this->certs->remove_at(this->certs, enumerator);
 435                                 }
 436                                 else
 437                                 {
 438                                         cert->destroy(cert);
 439                                 }
 440                                 break;
 441                         }
 442                 }
 443         }
 444         enumerator->destroy(enumerator);
 445
 446         if (new)
 447         {
 448                 this->certs->insert_last(this->certs, cert);
 449         }
 450         this->mutex->unlock(this->mutex);
 451         return new;
 452 }
 453
 454 /**
 455  * Add X.509 attribute certificate to chain
 456  */
 457 static bool add_ac(private_stroke_cred_t *this, ac_t* ac)
 458 {
 459         certificate_t *cert = &ac->certificate;
 460
 461         this->mutex->lock(this->mutex);
 462         this->certs->insert_last(this->certs, cert);
 463         this->mutex->unlock(this->mutex);
 464         return TRUE;
 465 }
 466
 467 /**
 468  * Implementation of stroke_cred_t.load_peer.
 469  */
 470 static certificate_t* load_peer(private_stroke_cred_t *this, char *filename)
 471 {
 472         certificate_t *cert;
 473         char path[PATH_MAX];
 474
 475         if (*filename == '/')
 476         {
 477                 snprintf(path, sizeof(path), "%s", filename);
 478         }
 479         else
 480         {
 481                 snprintf(path, sizeof(path), "%s/%s", CERTIFICATE_DIR, filename);
 482         }
 483
 484         cert = lib->creds->create(lib->creds,
 485                                                           CRED_CERTIFICATE, CERT_X509,
 486                                                           BUILD_FROM_FILE, path,
 487                                                           BUILD_X509_FLAG, 0,
 488                                                           BUILD_END);
 489         if (cert)
 490         {
 491                 cert = add_cert(this, cert);
 492                 return cert->get_ref(cert);
 493         }
 494         return NULL;
 495 }
 496
 497 /**
 498  * load trusted certificates from a directory
 499  */
 500 static void load_certdir(private_stroke_cred_t *this, char *path,
 501                                                  certificate_type_t type, x509_flag_t flag)
 502 {
 503         struct stat st;
 504         char *file;
 505
 506         enumerator_t *enumerator = enumerator_create_directory(path);
 507
 508         if (!enumerator)
 509         {
 510                 DBG1(DBG_CFG, "  reading directory failed");
 511                 return;
 512         }
 513
 514         while (enumerator->enumerate(enumerator, NULL, &file, &st))
 515         {
 516                 certificate_t *cert;
 517
 518                 if (!S_ISREG(st.st_mode))
 519                 {
 520                         /* skip special file */
 521                         continue;
 522                 }
 523                 switch (type)
 524                 {
 525                         case CERT_X509:
 526                                 cert = lib->creds->create(lib->creds,
 527                                                                                   CRED_CERTIFICATE, CERT_X509,
 528                                                                                   BUILD_FROM_FILE, file,
 529                                                                                   BUILD_X509_FLAG, flag,
 530                                                                                   BUILD_END);
 531                                 if (cert)
 532                                 {
 533                                         add_cert(this, cert);
 534                                 }
 535                                 break;
 536                         case CERT_X509_CRL:
 537                                 cert = lib->creds->create(lib->creds,
 538                                                                                   CRED_CERTIFICATE, CERT_X509_CRL,
 539                                                                                   BUILD_FROM_FILE, file,
 540                                                                                   BUILD_END);
 541                                 if (cert)
 542                                 {
 543                                         add_crl(this, (crl_t*)cert);
 544                                 }
 545                                 break;
 546                         case CERT_X509_AC:
 547                                 cert = lib->creds->create(lib->creds,
 548                                                                                   CRED_CERTIFICATE, CERT_X509_AC,
 549                                                                                   BUILD_FROM_FILE, file,
 550                                                                                   BUILD_END);
 551                                 if (cert)
 552                                 {
 553                                         add_ac(this, (ac_t*)cert);
 554                                 }
 555                                 break;
 556                         default:
 557                                 break;
 558                 }
 559         }
 560         enumerator->destroy(enumerator);
 561 }
 562
 563 /**
 564  * Implementation of credential_set_t.cache_cert.
 565  */
 566 static void cache_cert(private_stroke_cred_t *this, certificate_t *cert)
 567 {
 568         if (cert->get_type(cert) == CERT_X509_CRL && this->cachecrl)
 569         {
 570                 /* CRLs get written to /etc/ipsec.d/crls/authkeyId.crl */
 571                 crl_t *crl = (crl_t*)cert;
 572
 573                 cert->get_ref(cert);
 574                 if (add_crl(this, crl))
 575                 {
 576                         char buf[256];
 577                         chunk_t chunk, hex;
 578                         identification_t *id;
 579
 580                         id = crl->get_authKeyIdentifier(crl);
 581                         chunk = id->get_encoding(id);
 582                         hex = chunk_to_hex(chunk, NULL, FALSE);
 583                         snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex);
 584                         free(hex.ptr);
 585
 586                         chunk = cert->get_encoding(cert);
 587                         if (chunk_write(chunk, buf, 022, TRUE))
 588                         {
 589                                 DBG1(DBG_CFG, "  written crl to '%s'", buf);
 590                         }
 591                         else
 592                         {
 593                                 DBG1(DBG_CFG, "  writing crl to '%s' failed", buf);
 594                         }
 595                         free(chunk.ptr);
 596                 }
 597         }
 598 }
 599
 600 /**
 601  * Implementation of stroke_cred_t.cachecrl.
 602  */
 603 static void cachecrl(private_stroke_cred_t *this, bool enabled)
 604 {
 605         DBG1(DBG_CFG, "crl caching to %s %s",
 606                  CRL_DIR, enabled ? "enabled" : "disabled");
 607         this->cachecrl = enabled;
 608 }
 609
 610
 611 /**
 612  * Convert a string of characters into a binary secret
 613  * A string between single or double quotes is treated as ASCII characters
 614  * A string prepended by 0x is treated as HEX and prepended by 0s as Base64
 615  */
 616 static err_t extract_secret(chunk_t *secret, chunk_t *line)
 617 {
 618         chunk_t raw_secret;
 619         char delimiter = ' ';
 620         bool quotes = FALSE;
 621
 622         if (!eat_whitespace(line))
 623         {
 624                 return "missing secret";
 625         }
 626
 627         if (*line->ptr == '\'' || *line->ptr == '"')
 628         {
 629                 quotes = TRUE;
 630                 delimiter = *line->ptr;
 631                 line->ptr++;  line->len--;
 632         }
 633
 634         if (!extract_token(&raw_secret, delimiter, line))
 635         {
 636                 if (delimiter == ' ')
 637                 {
 638                         raw_secret = *line;
 639                 }
 640                 else
 641                 {
 642                         return "missing second delimiter";
 643                 }
 644         }
 645
 646         if (quotes)
 647         {
 648                 /* treat as an ASCII string */
 649                 *secret = chunk_clone(raw_secret);
 650                 return NULL;
 651         }
 652         /* treat 0x as hex, 0s as base64 */
 653         if (raw_secret.len > 2)
 654         {
 655                 if (strncasecmp("0x", raw_secret.ptr, 2) == 0)
 656                 {
 657                         *secret = chunk_from_hex(chunk_skip(raw_secret, 2), NULL);
 658                         return NULL;
 659                 }
 660                 if (strncasecmp("0s", raw_secret.ptr, 2) == 0)
 661                 {
 662                         *secret = chunk_from_base64(chunk_skip(raw_secret, 2), NULL);
 663                         return NULL;
 664                 }
 665         }
 666         *secret = chunk_clone(raw_secret);
 667         return NULL;
 668 }
 669
 670 /**
 671  * reload ipsec.secrets
 672  */
 673 static void load_secrets(private_stroke_cred_t *this)
 674 {
 675         size_t bytes;
 676         int line_nr = 0;
 677         chunk_t chunk, src, line;
 678         FILE *fd;
 679         private_key_t *private;
 680         shared_key_t *shared;
 681
 682         DBG1(DBG_CFG, "loading secrets from '%s'", SECRETS_FILE);
 683
 684         fd = fopen(SECRETS_FILE, "r");
 685         if (fd == NULL)
 686         {
 687                 DBG1(DBG_CFG, "opening secrets file '%s' failed");
 688                 return;
 689         }
 690
 691         /* TODO: do error checks */
 692         fseek(fd, 0, SEEK_END);
 693         chunk.len = ftell(fd);
 694         rewind(fd);
 695         chunk.ptr = malloc(chunk.len);
 696         bytes = fread(chunk.ptr, 1, chunk.len, fd);
 697         fclose(fd);
 698         src = chunk;
 699
 700         this->mutex->lock(this->mutex);
 701         while (this->shared->remove_last(this->shared,
 702                                                                                    (void**)&shared) == SUCCESS)
 703         {
 704                 shared->destroy(shared);
 705         }
 706         while (this->private->remove_last(this->private,
 707                                                                                     (void**)&private) == SUCCESS)
 708         {
 709                 private->destroy(private);
 710         }
 711
 712         while (fetchline(&src, &line))
 713         {
 714                 chunk_t ids, token;
 715                 shared_key_type_t type;
 716
 717                 line_nr++;
 718
 719                 if (!eat_whitespace(&line))
 720                 {
 721                         continue;
 722                 }
 723                 if (!extract_last_token(&ids, ':', &line))
 724                 {
 725                         DBG1(DBG_CFG, "line %d: missing ':' separator", line_nr);
 726                         goto error;
 727                 }
 728                 /* NULL terminate the ids string by replacing the : separator */
 729                 *(ids.ptr + ids.len) = '\0';
 730
 731                 if (!eat_whitespace(&line) || !extract_token(&token, ' ', &line))
 732                 {
 733                         DBG1(DBG_CFG, "line %d: missing token", line_nr);
 734                         goto error;
 735                 }
 736                 if (match("RSA", &token) || match("ECDSA", &token))
 737                 {
 738                         char path[PATH_MAX];
 739                         chunk_t filename;
 740                         chunk_t secret = chunk_empty;
 741                         private_key_t *key;
 742                         bool pgp = FALSE;
 743                         chunk_t chunk = chunk_empty;
 744                         key_type_t key_type = match("RSA", &token) ? KEY_RSA : KEY_ECDSA;
 745
 746                         err_t ugh = extract_value(&filename, &line);
 747
 748                         if (ugh != NULL)
 749                         {
 750                                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 751                                 goto error;
 752                         }
 753                         if (filename.len == 0)
 754                         {
 755                                 DBG1(DBG_CFG, "line %d: empty filename", line_nr);
 756                                 goto error;
 757                         }
 758                         if (*filename.ptr == '/')
 759                         {
 760                                 /* absolute path name */
 761                                 snprintf(path, sizeof(path), "%.*s", filename.len, filename.ptr);
 762                         }
 763                         else
 764                         {
 765                                 /* relative path name */
 766                                 snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
 767                                                  filename.len, filename.ptr);
 768                         }
 769
 770                         /* check for optional passphrase */
 771                         if (eat_whitespace(&line))
 772                         {
 773                                 ugh = extract_secret(&secret, &line);
 774                                 if (ugh != NULL)
 775                                 {
 776                                         DBG1(DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
 777                                         goto error;
 778                                 }
 779                         }
 780
 781                         if (pem_asn1_load_file(path, &secret, &chunk, &pgp))
 782                         {
 783                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
 784                                                                                  BUILD_BLOB_ASN1_DER, chunk, BUILD_END);
 785                                 if (key)
 786                                 {
 787                                         DBG1(DBG_CFG, "  loaded private key file '%s'", path);
 788                                         this->private->insert_last(this->private, key);
 789                                 }
 790                         }
 791                         chunk_clear(&secret);
 792                 }
 793                 else if ((match("PSK", &token) && (type = SHARED_IKE)) ||
 794                                  (match("EAP", &token) && (type = SHARED_EAP)) ||
 795                                  (match("XAUTH", &token) && (type = SHARED_EAP)) ||
 796                                  (match("PIN", &token) && (type = SHARED_PIN)))
 797                 {
 798                         stroke_shared_key_t *shared_key;
 799                         chunk_t secret = chunk_empty;
 800                         bool any = TRUE;
 801
 802                         err_t ugh = extract_secret(&secret, &line);
 803                         if (ugh != NULL)
 804                         {
 805                                 DBG1(DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
 806                                 goto error;
 807                         }
 808                         shared_key = stroke_shared_key_create(type, secret);
 809                         DBG1(DBG_CFG, "  loaded %N secret for %s", shared_key_type_names, type,
 810                                  ids.len > 0 ? (char*)ids.ptr : "%any");
 811                         DBG4(DBG_CFG, "  secret: %#B", &secret);
 812
 813                         this->shared->insert_last(this->shared, shared_key);
 814                         while (ids.len > 0)
 815                         {
 816                                 chunk_t id;
 817                                 identification_t *peer_id;
 818
 819                                 ugh = extract_value(&id, &ids);
 820                                 if (ugh != NULL)
 821                                 {
 822                                         DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 823                                         goto error;
 824                                 }
 825                                 if (id.len == 0)
 826                                 {
 827                                         continue;
 828                                 }
 829
 830                                 /* NULL terminate the ID string */
 831                                 *(id.ptr + id.len) = '\0';
 832
 833                                 peer_id = identification_create_from_string(id.ptr);
 834                                 if (peer_id == NULL)
 835                                 {
 836                                         DBG1(DBG_CFG, "line %d: malformed ID: %s", line_nr, id.ptr);
 837                                         goto error;
 838                                 }
 839                                 if (peer_id->get_type(peer_id) == ID_ANY)
 840                                 {
 841                                         peer_id->destroy(peer_id);
 842                                         continue;
 843                                 }
 844
 845                                 shared_key->add_owner(shared_key, peer_id);
 846                                 any = FALSE;
 847                         }
 848                         if (any)
 849                         {
 850                                 shared_key->add_owner(shared_key,
 851                                         identification_create_from_encoding(ID_ANY, chunk_empty));
 852                         }
 853                 }
 854                 else
 855                 {
 856                         DBG1(DBG_CFG, "line %d: token must be either "
 857                                  "RSA, EC, PSK, EAP, or PIN", line_nr);
 858                         goto error;
 859                 }
 860         }
 861 error:
 862         this->mutex->unlock(this->mutex);
 863         chunk_clear(&chunk);
 864 }
 865
 866 /**
 867  * load all certificates from ipsec.d
 868  */
 869 static void load_certs(private_stroke_cred_t *this)
 870 {
 871         DBG1(DBG_CFG, "loading ca certificates from '%s'",
 872                  CA_CERTIFICATE_DIR);
 873         load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
 874
 875         DBG1(DBG_CFG, "loading aa certificates from '%s'",
 876                  AA_CERTIFICATE_DIR);
 877         load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
 878
 879         DBG1(DBG_CFG, "loading ocsp signer certificates from '%s'",
 880                  OCSP_CERTIFICATE_DIR);
 881         load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509, X509_OCSP_SIGNER);
 882
 883         DBG1(DBG_CFG, "loading attribute certificates from '%s'",
 884                  ATTR_CERTIFICATE_DIR);
 885         load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
 886
 887         DBG1(DBG_CFG, "loading crls from '%s'",
 888                  CRL_DIR);
 889         load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
 890 }
 891
 892 /**
 893  * Implementation of stroke_cred_t.reread.
 894  */
 895 static void reread(private_stroke_cred_t *this, stroke_msg_t *msg)
 896 {
 897         if (msg->reread.flags & REREAD_SECRETS)
 898         {
 899                 DBG1(DBG_CFG, "rereading secrets");
 900                 load_secrets(this);
 901         }
 902         if (msg->reread.flags & REREAD_CACERTS)
 903         {
 904                 DBG1(DBG_CFG, "rereading ca certificates from '%s'",
 905                          CA_CERTIFICATE_DIR);
 906                 load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
 907         }
 908         if (msg->reread.flags & REREAD_OCSPCERTS)
 909         {
 910                 DBG1(DBG_CFG, "rereading ocsp signer certificates from '%s'",
 911                          OCSP_CERTIFICATE_DIR);
 912                 load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509,
 913                          X509_OCSP_SIGNER);
 914         }
 915         if (msg->reread.flags & REREAD_AACERTS)
 916         {
 917                 DBG1(DBG_CFG, "rereading aa certificates from '%s'",
 918                          AA_CERTIFICATE_DIR);
 919                 load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
 920         }
 921         if (msg->reread.flags & REREAD_ACERTS)
 922         {
 923                 DBG1(DBG_CFG, "rereading attribute certificates from '%s'",
 924                          ATTR_CERTIFICATE_DIR);
 925                 load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
 926         }
 927         if (msg->reread.flags & REREAD_CRLS)
 928         {
 929                 DBG1(DBG_CFG, "rereading crls from '%s'",
 930                          CRL_DIR);
 931                 load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
 932         }
 933 }
 934
 935 /**
 936  * Implementation of stroke_cred_t.destroy
 937  */
 938 static void destroy(private_stroke_cred_t *this)
 939 {
 940         this->certs->destroy_offset(this->certs, offsetof(certificate_t, destroy));
 941         this->shared->destroy_offset(this->shared, offsetof(shared_key_t, destroy));
 942         this->private->destroy_offset(this->private, offsetof(private_key_t, destroy));
 943         this->mutex->destroy(this->mutex);
 944         free(this);
 945 }
 946
 947 /*
 948  * see header file
 949  */
 950 stroke_cred_t *stroke_cred_create()
 951 {
 952         private_stroke_cred_t *this = malloc_thing(private_stroke_cred_t);
 953
 954         this->public.set.create_private_enumerator = (void*)create_private_enumerator;
 955         this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
 956         this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
 957         this->public.set.create_cdp_enumerator = (void*)return_null;
 958         this->public.set.cache_cert = (void*)cache_cert;
 959         this->public.reread = (void(*)(stroke_cred_t*, stroke_msg_t *msg))reread;
 960         this->public.load_ca = (certificate_t*(*)(stroke_cred_t*, char *filename))load_ca;
 961         this->public.load_peer = (certificate_t*(*)(stroke_cred_t*, char *filename))load_peer;
 962         this->public.cachecrl = (void(*)(stroke_cred_t*, bool enabled))cachecrl;
 963         this->public.destroy = (void(*)(stroke_cred_t*))destroy;
 964
 965         this->certs = linked_list_create();
 966         this->shared = linked_list_create();
 967         this->private = linked_list_create();
 968         this->mutex = mutex_create(MUTEX_RECURSIVE);
 969
 970         load_certs(this);
 971         load_secrets(this);
 972
 973         this->cachecrl = FALSE;
 974
 975         return &this->public;
 976 }
 977