src/charon/plugins/stroke/stroke_cred.c

   1 /*
   2  * Copyright (C) 2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  *
  15  * $Id$
  16  */
  17
  18 #include "stroke_cred.h"
  19 #include "stroke_shared_key.h"
  20
  21 #include <sys/stat.h>
  22
  23 #include <credentials/certificates/x509.h>
  24 #include <credentials/certificates/crl.h>
  25 #include <credentials/certificates/ac.h>
  26 #include <utils/linked_list.h>
  27 #include <utils/mutex.h>
  28 #include <utils/lexparser.h>
  29 #include <asn1/ttodata.h>
  30 #include <asn1/pem.h>
  31 #include <daemon.h>
  32
  33 /* configuration directories and files */
  34 #define CONFIG_DIR IPSEC_CONFDIR
  35 #define IPSEC_D_DIR CONFIG_DIR "/ipsec.d"
  36 #define PRIVATE_KEY_DIR IPSEC_D_DIR "/private"
  37 #define CERTIFICATE_DIR IPSEC_D_DIR "/certs"
  38 #define CA_CERTIFICATE_DIR IPSEC_D_DIR "/cacerts"
  39 #define AA_CERTIFICATE_DIR IPSEC_D_DIR "/aacerts"
  40 #define ATTR_CERTIFICATE_DIR IPSEC_D_DIR "/acerts"
  41 #define OCSP_CERTIFICATE_DIR IPSEC_D_DIR "/ocspcerts"
  42 #define CRL_DIR IPSEC_D_DIR "/crls"
  43 #define SECRETS_FILE CONFIG_DIR "/ipsec.secrets"
  44
  45 typedef struct private_stroke_cred_t private_stroke_cred_t;
  46
  47 /**
  48  * private data of stroke_cred
  49  */
  50 struct private_stroke_cred_t {
  51
  52         /**
  53          * public functions
  54          */
  55         stroke_cred_t public;
  56
  57         /**
  58          * list of trusted peer/signer/CA certificates (certificate_t)
  59          */
  60         linked_list_t *certs;
  61
  62         /**
  63          * list of shared secrets (private_shared_key_t)
  64          */
  65         linked_list_t *shared;
  66
  67         /**
  68          * list of private keys (private_key_t)
  69          */
  70         linked_list_t *private;
  71
  72         /**
  73          * mutex to lock lists above
  74          */
  75         mutex_t *mutex;
  76 };
  77
  78 /**
  79  * data to pass to various filters
  80  */
  81 typedef struct {
  82         private_stroke_cred_t *this;
  83         identification_t *id;
  84 } id_data_t;
  85
  86 /**
  87  * destroy id enumerator data and unlock list
  88  */
  89 static void id_data_destroy(id_data_t *data)
  90 {
  91         data->this->mutex->unlock(data->this->mutex);
  92         free(data);
  93 }
  94
  95 /**
  96  * filter function for private key enumerator
  97  */
  98 static bool private_filter(id_data_t *data,
  99                                                    private_key_t **in, private_key_t **out)
 100 {
 101         identification_t *candidate;
 102
 103         if (data->id == NULL)
 104         {
 105                 *out = *in;
 106                 return TRUE;
 107         }
 108         candidate = (*in)->get_id(*in, data->id->get_type(data->id));
 109         if (candidate && data->id->equals(data->id, candidate))
 110         {
 111                 *out = *in;
 112                 return TRUE;
 113         }
 114         return FALSE;
 115 }
 116
 117 /**
 118  * Implements credential_set_t.create_private_enumerator
 119  */
 120 static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
 121                                                         key_type_t type, identification_t *id)
 122 {
 123         id_data_t *data;
 124
 125         if (type != KEY_RSA && type != KEY_ANY)
 126         {       /* we only have RSA keys */
 127                 return NULL;
 128         }
 129         data = malloc_thing(id_data_t);
 130         data->this = this;
 131         data->id = id;
 132
 133         this->mutex->lock(this->mutex);
 134         return enumerator_create_filter(this->private->create_enumerator(this->private),
 135                                                                         (void*)private_filter, data,
 136                                                                         (void*)id_data_destroy);
 137 }
 138
 139 /**
 140  * filter function for certs enumerator
 141  */
 142 static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 143 {
 144         public_key_t *public;
 145         identification_t *candidate;
 146         certificate_t *cert = *in;
 147
 148         if (cert->get_type(cert) == CERT_X509_CRL)
 149         {
 150                 return FALSE;
 151         }
 152
 153         if (data->id == NULL || cert->has_subject(cert, data->id))
 154         {
 155                 *out = *in;
 156                 return TRUE;
 157         }
 158
 159         public = (cert)->get_public_key(cert);
 160         if (public)
 161         {
 162                 candidate = public->get_id(public, data->id->get_type(data->id));
 163                 if (candidate && data->id->equals(data->id, candidate))
 164                 {
 165                         public->destroy(public);
 166                         *out = *in;
 167                         return TRUE;
 168                 }
 169                 public->destroy(public);
 170         }
 171         return FALSE;
 172 }
 173
 174 /**
 175  * filter function for crl enumerator
 176  */
 177 static bool crl_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 178 {
 179         certificate_t *cert = *in;
 180
 181         if (cert->get_type(cert) != CERT_X509_CRL)
 182         {
 183                 return FALSE;
 184         }
 185
 186         if (data->id == NULL || cert->has_issuer(cert, data->id))
 187         {
 188                 *out = *in;
 189                 return TRUE;
 190         }
 191         return FALSE;
 192 }
 193
 194 /**
 195  * Implements credential_set_t.create_cert_enumerator
 196  */
 197 static enumerator_t* create_cert_enumerator(private_stroke_cred_t *this,
 198                                                         certificate_type_t cert, key_type_t key,
 199                                                         identification_t *id, bool trusted)
 200 {
 201         id_data_t *data;
 202
 203         if (cert == CERT_X509_CRL)
 204         {
 205                 if (trusted)
 206                 {
 207                         return NULL;
 208                 }
 209
 210                 data = malloc_thing(id_data_t);
 211                 data->this = this;
 212                 data->id = id;
 213
 214                 this->mutex->lock(this->mutex);
 215                 return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 216                                                                                 (void*)crl_filter, data,
 217                                                                                 (void*)id_data_destroy);
 218         }
 219         if (cert != CERT_X509 && cert != CERT_ANY)
 220         {       /* we only have X509 certificates. TODO: ACs? */
 221                 return NULL;
 222         }
 223         if (key != KEY_RSA && key != KEY_ANY)
 224         {       /* we only have RSA keys */
 225                 return NULL;
 226         }
 227         data = malloc_thing(id_data_t);
 228         data->this = this;
 229         data->id = id;
 230
 231         this->mutex->lock(this->mutex);
 232         return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 233                                                                         (void*)certs_filter, data,
 234                                                                         (void*)id_data_destroy);
 235 }
 236
 237 typedef struct {
 238         private_stroke_cred_t *this;
 239         identification_t *me;
 240         identification_t *other;
 241         shared_key_type_t type;
 242 } shared_data_t;
 243
 244 /**
 245  * free shared key enumerator data and unlock list
 246  */
 247 static void shared_data_destroy(shared_data_t *data)
 248 {
 249         data->this->mutex->unlock(data->this->mutex);
 250         free(data);
 251 }
 252
 253 /**
 254  * filter function for certs enumerator
 255  */
 256 static bool shared_filter(shared_data_t *data,
 257                                                   stroke_shared_key_t **in, shared_key_t **out,
 258                                                   void **unused1, id_match_t *me,
 259                                                   void **unused2, id_match_t *other)
 260 {
 261         id_match_t my_match, other_match;
 262         stroke_shared_key_t *stroke = *in;
 263         shared_key_t *shared = &stroke->shared;
 264
 265         if (data->type != SHARED_ANY && shared->get_type(shared) != data->type)
 266         {
 267                 return FALSE;
 268         }
 269
 270         my_match = stroke->has_owner(stroke, data->me);
 271         other_match = stroke->has_owner(stroke, data->other);
 272         if (!my_match && !other_match)
 273         {
 274                 return FALSE;
 275         }
 276         *out = shared;
 277         if (me)
 278         {
 279                 *me = my_match;
 280         }
 281         if (other)
 282         {
 283                 *other = other_match;
 284         }
 285         return TRUE;
 286 }
 287
 288 /**
 289  * Implements credential_set_t.create_shared_enumerator
 290  */
 291 static enumerator_t* create_shared_enumerator(private_stroke_cred_t *this,
 292                                                         shared_key_type_t type, identification_t *me,
 293                                                         identification_t *other)
 294 {
 295         shared_data_t *data = malloc_thing(shared_data_t);
 296
 297         data->this = this;
 298         data->me = me;
 299         data->other = other;
 300         data->type = type;
 301         this->mutex->lock(this->mutex);
 302         return enumerator_create_filter(this->shared->create_enumerator(this->shared),
 303                                                                         (void*)shared_filter, data,
 304                                                                         (void*)shared_data_destroy);
 305 }
 306
 307 /**
 308  * Add a certificate to chain
 309  */
 310 static certificate_t* add_cert(private_stroke_cred_t *this, certificate_t *cert)
 311 {
 312         certificate_t *current;
 313         enumerator_t *enumerator;
 314         bool new = TRUE;
 315
 316         this->mutex->lock(this->mutex);
 317         enumerator = this->certs->create_enumerator(this->certs);
 318         while (enumerator->enumerate(enumerator, (void**)&current))
 319         {
 320                 if (current->equals(current, cert))
 321                 {
 322                         /* cert already in queue */
 323                         cert->destroy(cert);
 324                         cert = current;
 325                         new = FALSE;
 326                         break;
 327                 }
 328         }
 329         enumerator->destroy(enumerator);
 330
 331         if (new)
 332         {
 333                 this->certs->insert_last(this->certs, cert);
 334         }
 335         this->mutex->unlock(this->mutex);
 336         return cert;
 337 }
 338
 339 /**
 340  * Implementation of stroke_cred_t.load_ca.
 341  */
 342 static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
 343 {
 344         certificate_t *cert;
 345         char path[PATH_MAX];
 346
 347         if (*filename == '/')
 348         {
 349                 snprintf(path, sizeof(path), "%s", filename);
 350         }
 351         else
 352         {
 353                 snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
 354         }
 355
 356         cert = lib->creds->create(lib->creds,
 357                                                           CRED_CERTIFICATE, CERT_X509,
 358                                                           BUILD_FROM_FILE, path,
 359                                                           BUILD_X509_FLAG, X509_CA,
 360                                                           BUILD_END);
 361         if (cert)
 362         {
 363                 return (certificate_t*)add_cert(this, cert);
 364         }
 365         return NULL;
 366 }
 367
 368 /**
 369  * Add X.509 CRL to chain
 370  */
 371 static bool add_crl(private_stroke_cred_t *this, crl_t* crl)
 372 {
 373         certificate_t *current, *cert = &crl->certificate;
 374         enumerator_t *enumerator;
 375         bool new = TRUE, found = FALSE;
 376
 377         this->mutex->lock(this->mutex);
 378         enumerator = this->certs->create_enumerator(this->certs);
 379         while (enumerator->enumerate(enumerator, (void**)&current))
 380         {
 381                 if (current->get_type(current) == CERT_X509_CRL)
 382                 {
 383                         crl_t *crl_c = (crl_t*)current;
 384                         identification_t *authkey = crl->get_authKeyIdentifier(crl);
 385                         identification_t *authkey_c = crl_c->get_authKeyIdentifier(crl_c);
 386
 387                         /* if compare authorityKeyIdentifiers if available */
 388                         if (authkey != NULL && authkey_c != NULL &&
 389                                 authkey->equals(authkey, authkey_c))
 390                         {
 391                                 found = TRUE;
 392                         }
 393                         else
 394                         {
 395                                 identification_t *issuer = cert->get_issuer(cert);
 396                                 identification_t *issuer_c = current->get_issuer(current);
 397
 398                                 /* otherwise compare issuer distinguished names */
 399                                 if (issuer->equals(issuer, issuer_c))
 400                                 {
 401                                         found = TRUE;
 402                                 }
 403                         }
 404                         if (found)
 405                         {
 406                                 new = cert->is_newer(cert, current);
 407                                 if (new)
 408                                 {
 409                                         this->certs->remove_at(this->certs, enumerator);
 410                                 }
 411                                 else
 412                                 {
 413                                         cert->destroy(cert);
 414                                 }
 415                                 break;
 416                         }
 417                 }
 418         }
 419         enumerator->destroy(enumerator);
 420
 421         if (new)
 422         {
 423                 this->certs->insert_last(this->certs, cert);
 424         }
 425         this->mutex->unlock(this->mutex);
 426         return new;
 427 }
 428
 429 /**
 430  * Implementation of stroke_cred_t.load_peer.
 431  */
 432 static certificate_t* load_peer(private_stroke_cred_t *this, char *filename)
 433 {
 434         certificate_t *cert;
 435         char path[PATH_MAX];
 436
 437         if (*filename == '/')
 438         {
 439                 snprintf(path, sizeof(path), "%s", filename);
 440         }
 441         else
 442         {
 443                 snprintf(path, sizeof(path), "%s/%s", CERTIFICATE_DIR, filename);
 444         }
 445
 446         cert = lib->creds->create(lib->creds,
 447                                                           CRED_CERTIFICATE, CERT_X509,
 448                                                           BUILD_FROM_FILE, path,
 449                                                           BUILD_X509_FLAG, 0,
 450                                                           BUILD_END);
 451         if (cert)
 452         {
 453                 cert = add_cert(this, cert);
 454                 return cert->get_ref(cert);
 455         }
 456         return NULL;
 457 }
 458
 459 /**
 460  * load trusted certificates from a directory
 461  */
 462 static void load_certdir(private_stroke_cred_t *this, char *path,
 463                                                  certificate_type_t type, x509_flag_t flag)
 464 {
 465         struct stat st;
 466         char *file;
 467
 468         enumerator_t *enumerator = enumerator_create_directory(path);
 469
 470         if (!enumerator)
 471         {
 472                 DBG1(DBG_CFG, "  reading directory failed");
 473                 return;
 474         }
 475
 476         while (enumerator->enumerate(enumerator, NULL, &file, &st))
 477         {
 478                 certificate_t *cert;
 479
 480                 if (!S_ISREG(st.st_mode))
 481                 {
 482                         /* skip special file */
 483                         continue;
 484                 }
 485                 switch (type)
 486                 {
 487                         case CERT_X509:
 488                                 cert = lib->creds->create(lib->creds,
 489                                                                                   CRED_CERTIFICATE, CERT_X509,
 490                                                                                   BUILD_FROM_FILE, file,
 491                                                                                   BUILD_X509_FLAG, flag,
 492                                                                                   BUILD_END);
 493                                 if (cert)
 494                                 {
 495                                         add_cert(this, cert);
 496                                 }
 497                                 break;
 498                         case CERT_X509_CRL:
 499                                 cert = lib->creds->create(lib->creds,
 500                                                                                   CRED_CERTIFICATE, CERT_X509_CRL,
 501                                                                                   BUILD_FROM_FILE, file,
 502                                                                                   BUILD_END);
 503                                 if (cert)
 504                                 {
 505                                         add_crl(this, (crl_t*)cert);
 506                                 }
 507                                 break;
 508                         case CERT_X509_AC:
 509                                 cert = lib->creds->create(lib->creds,
 510                                                                                   CRED_CERTIFICATE, CERT_X509_AC,
 511                                                                                   BUILD_FROM_FILE, file,
 512                                                                                   BUILD_END);
 513                                 if (cert)
 514                                 {
 515                                         cert->destroy(cert);
 516                                 }
 517                                 break;
 518                         default:
 519                                 break;
 520                 }
 521         }
 522         enumerator->destroy(enumerator);
 523 }
 524
 525 /**
 526  * Implementation of credential_set_t.cache_cert.
 527  */
 528 static void cache_cert(private_stroke_cred_t *this, certificate_t *cert)
 529 {
 530         if (cert->get_type(cert) == CERT_X509_CRL)
 531         {
 532                 /* CRLs get cached to /etc/ipsec.d/crls/authkeyId.der */
 533                 crl_t *crl = (crl_t*)cert;
 534
 535                 cert->get_ref(cert);
 536                 if (add_crl(this, crl))
 537                 {
 538                         char buf[256];
 539                         char *hex;
 540                         chunk_t chunk;
 541                         identification_t *id;
 542
 543                         id = crl->get_authKeyIdentifier(crl);
 544                         chunk = id->get_encoding(id);
 545                         hex = chunk_to_hex(chunk, FALSE);
 546                         snprintf(buf, sizeof(buf), "%s/%s.der", CRL_DIR, hex);
 547                         free(hex);
 548
 549                         chunk = cert->get_encoding(cert);
 550                         if (chunk_write(chunk, buf, 022, TRUE))
 551                         {
 552                                 DBG1(DBG_CFG, "cached crl to %s", buf);
 553                         }
 554                         else
 555                         {
 556                                 DBG1(DBG_CFG, "caching  crl to %s failed", buf);
 557                         }
 558                         free(chunk.ptr);
 559                 }
 560         }
 561 }
 562
 563 /**
 564  * Convert a string of characters into a binary secret
 565  * A string between single or double quotes is treated as ASCII characters
 566  * A string prepended by 0x is treated as HEX and prepended by 0s as Base64
 567  */
 568 static err_t extract_secret(chunk_t *secret, chunk_t *line)
 569 {
 570         chunk_t raw_secret;
 571         char delimiter = ' ';
 572         bool quotes = FALSE;
 573
 574         if (!eat_whitespace(line))
 575         {
 576                 return "missing secret";
 577         }
 578
 579         if (*line->ptr == '\'' || *line->ptr == '"')
 580         {
 581                 quotes = TRUE;
 582                 delimiter = *line->ptr;
 583                 line->ptr++;  line->len--;
 584         }
 585
 586         if (!extract_token(&raw_secret, delimiter, line))
 587         {
 588                 if (delimiter == ' ')
 589                 {
 590                         raw_secret = *line;
 591                 }
 592                 else
 593                 {
 594                         return "missing second delimiter";
 595                 }
 596         }
 597
 598         if (quotes)
 599         {
 600                 /* treat as an ASCII string */
 601                 *secret = chunk_clone(raw_secret);
 602         }
 603         else
 604         {
 605                 size_t len;
 606                 err_t ugh;
 607
 608                 /* secret converted to binary form doesn't use more space than the raw_secret */
 609                 *secret = chunk_alloc(raw_secret.len);
 610
 611                 /* convert from HEX or Base64 to binary */
 612                 ugh = ttodata(raw_secret.ptr, raw_secret.len, 0, secret->ptr, secret->len, &len);
 613
 614             if (ugh != NULL)
 615                 {
 616                         chunk_clear(secret);
 617                         return ugh;
 618                 }
 619                 secret->len = len;
 620         }
 621         return NULL;
 622 }
 623
 624 /**
 625  * reload ipsec.secrets
 626  */
 627 static void load_secrets(private_stroke_cred_t *this)
 628 {
 629         size_t bytes;
 630         int line_nr = 0;
 631         chunk_t chunk, src, line;
 632         FILE *fd;
 633         private_key_t *private;
 634         shared_key_t *shared;
 635
 636         DBG1(DBG_CFG, "loading secrets from '%s'", SECRETS_FILE);
 637
 638         fd = fopen(SECRETS_FILE, "r");
 639         if (fd == NULL)
 640         {
 641                 DBG1(DBG_CFG, "opening secrets file '%s' failed");
 642                 return;
 643         }
 644
 645         /* TODO: do error checks */
 646         fseek(fd, 0, SEEK_END);
 647         chunk.len = ftell(fd);
 648         rewind(fd);
 649         chunk.ptr = malloc(chunk.len);
 650         bytes = fread(chunk.ptr, 1, chunk.len, fd);
 651         fclose(fd);
 652         src = chunk;
 653
 654         this->mutex->lock(this->mutex);
 655         while (this->shared->remove_last(this->shared,
 656                                                                                    (void**)&shared) == SUCCESS)
 657         {
 658                 shared->destroy(shared);
 659         }
 660         while (this->private->remove_last(this->private,
 661                                                                                     (void**)&private) == SUCCESS)
 662         {
 663                 private->destroy(private);
 664         }
 665
 666         while (fetchline(&src, &line))
 667         {
 668                 chunk_t ids, token;
 669                 shared_key_type_t type;
 670
 671                 line_nr++;
 672
 673                 if (!eat_whitespace(&line))
 674                 {
 675                         continue;
 676                 }
 677                 if (!extract_last_token(&ids, ':', &line))
 678                 {
 679                         DBG1(DBG_CFG, "line %d: missing ':' separator", line_nr);
 680                         goto error;
 681                 }
 682                 /* NULL terminate the ids string by replacing the : separator */
 683                 *(ids.ptr + ids.len) = '\0';
 684
 685                 if (!eat_whitespace(&line) || !extract_token(&token, ' ', &line))
 686                 {
 687                         DBG1(DBG_CFG, "line %d: missing token", line_nr);
 688                         goto error;
 689                 }
 690                 if (match("RSA", &token))
 691                 {
 692                         char path[PATH_MAX];
 693                         chunk_t filename;
 694                         chunk_t secret = chunk_empty;
 695                         private_key_t *key;
 696                         bool pgp = FALSE;
 697                         chunk_t chunk = chunk_empty;
 698
 699                         err_t ugh = extract_value(&filename, &line);
 700
 701                         if (ugh != NULL)
 702                         {
 703                                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 704                                 goto error;
 705                         }
 706                         if (filename.len == 0)
 707                         {
 708                                 DBG1(DBG_CFG, "line %d: empty filename", line_nr);
 709                                 goto error;
 710                         }
 711                         if (*filename.ptr == '/')
 712                         {
 713                                 /* absolute path name */
 714                                 snprintf(path, sizeof(path), "%.*s", filename.len, filename.ptr);
 715                         }
 716                         else
 717                         {
 718                                 /* relative path name */
 719                                 snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
 720                                                  filename.len, filename.ptr);
 721                         }
 722
 723                         /* check for optional passphrase */
 724                         if (eat_whitespace(&line))
 725                         {
 726                                 ugh = extract_secret(&secret, &line);
 727                                 if (ugh != NULL)
 728                                 {
 729                                         DBG1(DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
 730                                         goto error;
 731                                 }
 732                         }
 733
 734                         if (pem_asn1_load_file(path, &secret, &chunk, &pgp))
 735                         {
 736                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
 737                                                                                  BUILD_BLOB_ASN1_DER, chunk, BUILD_END);
 738                                 if (key)
 739                                 {
 740                                         DBG1(DBG_CFG, "  loaded private key file '%s'", path);
 741                                         this->private->insert_last(this->private, key);
 742                                 }
 743                         }
 744                         chunk_clear(&secret);
 745                 }
 746                 else if ((match("PSK", &token) && (type = SHARED_IKE)) ||
 747                                  (match("EAP", &token) && (type = SHARED_EAP)) ||
 748                                  (match("XAUTH", &token) && (type = SHARED_EAP)) ||
 749                                  (match("PIN", &token) && (type = SHARED_PIN)))
 750                 {
 751                         stroke_shared_key_t *shared_key;
 752                         chunk_t secret = chunk_empty;
 753                         bool any = TRUE;
 754
 755                         err_t ugh = extract_secret(&secret, &line);
 756                         if (ugh != NULL)
 757                         {
 758                                 DBG1(DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
 759                                 goto error;
 760                         }
 761                         shared_key = stroke_shared_key_create(type, secret);
 762                         DBG1(DBG_CFG, "  loaded %N secret for %s", shared_key_type_names, type,
 763                                  ids.len > 0 ? (char*)ids.ptr : "%any");
 764                         DBG4(DBG_CFG, "  secret: %#B", &secret);
 765
 766                         this->shared->insert_last(this->shared, shared_key);
 767                         while (ids.len > 0)
 768                         {
 769                                 chunk_t id;
 770                                 identification_t *peer_id;
 771
 772                                 ugh = extract_value(&id, &ids);
 773                                 if (ugh != NULL)
 774                                 {
 775                                         DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 776                                         goto error;
 777                                 }
 778                                 if (id.len == 0)
 779                                 {
 780                                         continue;
 781                                 }
 782
 783                                 /* NULL terminate the ID string */
 784                                 *(id.ptr + id.len) = '\0';
 785
 786                                 peer_id = identification_create_from_string(id.ptr);
 787                                 if (peer_id == NULL)
 788                                 {
 789                                         DBG1(DBG_CFG, "line %d: malformed ID: %s", line_nr, id.ptr);
 790                                         goto error;
 791                                 }
 792                                 if (peer_id->get_type(peer_id) == ID_ANY)
 793                                 {
 794                                         peer_id->destroy(peer_id);
 795                                         continue;
 796                                 }
 797
 798                                 shared_key->add_owner(shared_key, peer_id);
 799                                 any = FALSE;
 800                         }
 801                         if (any)
 802                         {
 803                                 shared_key->add_owner(shared_key,
 804                                         identification_create_from_encoding(ID_ANY, chunk_empty));
 805                         }
 806                 }
 807                 else
 808                 {
 809                         DBG1(DBG_CFG, "line %d: token must be either "
 810                                  "RSA, PSK, EAP, or PIN", line_nr);
 811                         goto error;
 812                 }
 813         }
 814 error:
 815         this->mutex->unlock(this->mutex);
 816         chunk_clear(&chunk);
 817 }
 818
 819 /**
 820  * load all certificates from ipsec.d
 821  */
 822 static void load_certs(private_stroke_cred_t *this)
 823 {
 824         DBG1(DBG_CFG, "loading ca certificates from '%s'",
 825                  CA_CERTIFICATE_DIR);
 826         load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
 827
 828         DBG1(DBG_CFG, "loading aa certificates from '%s'",
 829                  AA_CERTIFICATE_DIR);
 830         load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
 831
 832         DBG1(DBG_CFG, "loading ocsp signer certificates from '%s'",
 833                  OCSP_CERTIFICATE_DIR);
 834         load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509, X509_OCSP_SIGNER);
 835
 836         DBG1(DBG_CFG, "loading attribute certificates from '%s'",
 837                  ATTR_CERTIFICATE_DIR);
 838         load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
 839
 840         DBG1(DBG_CFG, "loading crls from '%s'",
 841                  CRL_DIR);
 842         load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
 843 }
 844
 845 /**
 846  * Implementation of stroke_cred_t.reread.
 847  */
 848 static void reread(private_stroke_cred_t *this, stroke_msg_t *msg)
 849 {
 850         if (msg->reread.flags & REREAD_SECRETS)
 851         {
 852                 DBG1(DBG_CFG, "rereading secrets");
 853                 load_secrets(this);
 854         }
 855         if (msg->reread.flags & REREAD_CACERTS)
 856         {
 857                 DBG1(DBG_CFG, "rereading ca certificates from '%s'",
 858                          CA_CERTIFICATE_DIR);
 859                 load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
 860         }
 861         if (msg->reread.flags & REREAD_OCSPCERTS)
 862         {
 863                 DBG1(DBG_CFG, "rereading ocsp signer certificates from '%s'",
 864                          OCSP_CERTIFICATE_DIR);
 865                 load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509,
 866                          X509_OCSP_SIGNER);
 867         }
 868         if (msg->reread.flags & REREAD_AACERTS)
 869         {
 870                 DBG1(DBG_CFG, "rereading aa certificates from '%s'",
 871                          AA_CERTIFICATE_DIR);
 872                 load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
 873         }
 874         if (msg->reread.flags & REREAD_ACERTS)
 875         {
 876                 DBG1(DBG_CFG, "rereading attribute certificates from '%s'",
 877                          ATTR_CERTIFICATE_DIR);
 878                 load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
 879         }
 880         if (msg->reread.flags & REREAD_CRLS)
 881         {
 882                 DBG1(DBG_CFG, "rereading crls from '%s'",
 883                          CRL_DIR);
 884                 load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
 885         }
 886 }
 887
 888 /**
 889  * Implementation of stroke_cred_t.destroy
 890  */
 891 static void destroy(private_stroke_cred_t *this)
 892 {
 893         this->certs->destroy_offset(this->certs, offsetof(certificate_t, destroy));
 894         this->shared->destroy_offset(this->shared, offsetof(shared_key_t, destroy));
 895         this->private->destroy_offset(this->private, offsetof(private_key_t, destroy));
 896         this->mutex->destroy(this->mutex);
 897         free(this);
 898 }
 899
 900 /*
 901  * see header file
 902  */
 903 stroke_cred_t *stroke_cred_create()
 904 {
 905         private_stroke_cred_t *this = malloc_thing(private_stroke_cred_t);
 906
 907         this->public.set.create_private_enumerator = (void*)create_private_enumerator;
 908         this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
 909         this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
 910         this->public.set.create_cdp_enumerator = (void*)return_null;
 911         this->public.set.cache_cert = (void*)cache_cert;
 912         this->public.reread = (void(*)(stroke_cred_t*, stroke_msg_t *msg))reread;
 913         this->public.load_ca = (certificate_t*(*)(stroke_cred_t*, char *filename))load_ca;
 914         this->public.load_peer = (certificate_t*(*)(stroke_cred_t*, char *filename))load_peer;
 915         this->public.destroy = (void(*)(stroke_cred_t*))destroy;
 916
 917         this->certs = linked_list_create();
 918         this->shared = linked_list_create();
 919         this->private = linked_list_create();
 920         this->mutex = mutex_create(MUTEX_RECURSIVE);
 921
 922         load_certs(this);
 923         load_secrets(this);
 924
 925         return &this->public;
 926 }
 927