src/charon/plugins/stroke/stroke_cred.c

   1 /*
   2  * Copyright (C) 2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  *
  15  * $Id$
  16  */
  17
  18 #include "stroke_cred.h"
  19 #include "stroke_shared_key.h"
  20
  21 #include <sys/stat.h>
  22
  23 #include <credentials/certificates/x509.h>
  24 #include <credentials/certificates/crl.h>
  25 #include <credentials/certificates/ac.h>
  26 #include <utils/linked_list.h>
  27 #include <utils/mutex.h>
  28 #include <utils/lexparser.h>
  29 #include <asn1/ttodata.h>
  30 #include <asn1/pem.h>
  31 #include <daemon.h>
  32
  33 /* configuration directories and files */
  34 #define CONFIG_DIR IPSEC_CONFDIR
  35 #define IPSEC_D_DIR CONFIG_DIR "/ipsec.d"
  36 #define PRIVATE_KEY_DIR IPSEC_D_DIR "/private"
  37 #define CERTIFICATE_DIR IPSEC_D_DIR "/certs"
  38 #define CA_CERTIFICATE_DIR IPSEC_D_DIR "/cacerts"
  39 #define AA_CERTIFICATE_DIR IPSEC_D_DIR "/aacerts"
  40 #define ATTR_CERTIFICATE_DIR IPSEC_D_DIR "/acerts"
  41 #define OCSP_CERTIFICATE_DIR IPSEC_D_DIR "/ocspcerts"
  42 #define CRL_DIR IPSEC_D_DIR "/crls"
  43 #define SECRETS_FILE CONFIG_DIR "/ipsec.secrets"
  44
  45 typedef struct private_stroke_cred_t private_stroke_cred_t;
  46
  47 /**
  48  * private data of stroke_cred
  49  */
  50 struct private_stroke_cred_t {
  51
  52         /**
  53          * public functions
  54          */
  55         stroke_cred_t public;
  56
  57         /**
  58          * list of trusted peer/signer/CA certificates (certificate_t)
  59          */
  60         linked_list_t *certs;
  61
  62         /**
  63          * list of shared secrets (private_shared_key_t)
  64          */
  65         linked_list_t *shared;
  66
  67         /**
  68          * list of private keys (private_key_t)
  69          */
  70         linked_list_t *private;
  71
  72         /**
  73          * mutex to lock lists above
  74          */
  75         mutex_t *mutex;
  76 };
  77
  78 /**
  79  * data to pass to various filters
  80  */
  81 typedef struct {
  82         private_stroke_cred_t *this;
  83         identification_t *id;
  84 } id_data_t;
  85
  86 /**
  87  * destroy id enumerator data and unlock list
  88  */
  89 static void id_data_destroy(id_data_t *data)
  90 {
  91         data->this->mutex->unlock(data->this->mutex);
  92         free(data);
  93 }
  94
  95 /**
  96  * filter function for private key enumerator
  97  */
  98 static bool private_filter(id_data_t *data,
  99                                                    private_key_t **in, private_key_t **out)
 100 {
 101         identification_t *candidate;
 102
 103         if (data->id == NULL)
 104         {
 105                 *out = *in;
 106                 return TRUE;
 107         }
 108         candidate = (*in)->get_id(*in, data->id->get_type(data->id));
 109         if (candidate && data->id->equals(data->id, candidate))
 110         {
 111                 *out = *in;
 112                 return TRUE;
 113         }
 114         return FALSE;
 115 }
 116
 117 /**
 118  * Implements credential_set_t.create_private_enumerator
 119  */
 120 static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
 121                                                         key_type_t type, identification_t *id)
 122 {
 123         id_data_t *data;
 124
 125         if (type != KEY_RSA && type != KEY_ANY)
 126         {       /* we only have RSA keys */
 127                 return NULL;
 128         }
 129         data = malloc_thing(id_data_t);
 130         data->this = this;
 131         data->id = id;
 132
 133         this->mutex->lock(this->mutex);
 134         return enumerator_create_filter(this->private->create_enumerator(this->private),
 135                                                                         (void*)private_filter, data,
 136                                                                         (void*)id_data_destroy);
 137 }
 138
 139 /**
 140  * filter function for certs enumerator
 141  */
 142 static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 143 {
 144         public_key_t *public;
 145         identification_t *candidate;
 146         certificate_t *cert = *in;
 147
 148         if (cert->get_type(cert) == CERT_X509_CRL)
 149         {
 150                 return FALSE;
 151         }
 152
 153         if (data->id == NULL || cert->has_subject(cert, data->id))
 154         {
 155                 *out = *in;
 156                 return TRUE;
 157         }
 158
 159         public = (cert)->get_public_key(cert);
 160         if (public)
 161         {
 162                 candidate = public->get_id(public, data->id->get_type(data->id));
 163                 if (candidate && data->id->equals(data->id, candidate))
 164                 {
 165                         public->destroy(public);
 166                         *out = *in;
 167                         return TRUE;
 168                 }
 169                 public->destroy(public);
 170         }
 171         return FALSE;
 172 }
 173
 174 /**
 175  * filter function for crl enumerator
 176  */
 177 static bool crl_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 178 {
 179         certificate_t *cert = *in;
 180
 181         if (cert->get_type(cert) != CERT_X509_CRL)
 182         {
 183                 return FALSE;
 184         }
 185
 186         if (data->id == NULL || cert->has_issuer(cert, data->id))
 187         {
 188                 *out = *in;
 189                 return TRUE;
 190         }
 191         return FALSE;
 192 }
 193
 194 /**
 195  * Implements credential_set_t.create_cert_enumerator
 196  */
 197 static enumerator_t* create_cert_enumerator(private_stroke_cred_t *this,
 198                                                         certificate_type_t cert, key_type_t key,
 199                                                         identification_t *id, bool trusted)
 200 {
 201         id_data_t *data;
 202
 203         if (cert == CERT_X509_CRL)
 204         {
 205                 if (trusted)
 206                 {
 207                         return FALSE;
 208                 }
 209
 210                 data = malloc_thing(id_data_t);
 211                 data->this = this;
 212                 data->id = id;
 213
 214                 this->mutex->lock(this->mutex);
 215                 return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 216                                                                                 (void*)crl_filter, data,
 217                                                                                 (void*)id_data_destroy);
 218         }
 219         if (cert != CERT_X509 && cert != CERT_ANY)
 220         {       /* we only have X509 certificates. TODO: ACs? */
 221                 return NULL;
 222         }
 223         if (key != KEY_RSA && key != KEY_ANY)
 224         {       /* we only have RSA keys */
 225                 return NULL;
 226         }
 227         data = malloc_thing(id_data_t);
 228         data->this = this;
 229         data->id = id;
 230
 231         this->mutex->lock(this->mutex);
 232         return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 233                                                                         (void*)certs_filter, data,
 234                                                                         (void*)id_data_destroy);
 235 }
 236
 237 typedef struct {
 238         private_stroke_cred_t *this;
 239         identification_t *me;
 240         identification_t *other;
 241         shared_key_type_t type;
 242 } shared_data_t;
 243
 244 /**
 245  * free shared key enumerator data and unlock list
 246  */
 247 static void shared_data_destroy(shared_data_t *data)
 248 {
 249         data->this->mutex->unlock(data->this->mutex);
 250         free(data);
 251 }
 252
 253 /**
 254  * filter function for certs enumerator
 255  */
 256 static bool shared_filter(shared_data_t *data,
 257                                                   stroke_shared_key_t **in, shared_key_t **out,
 258                                                   void **unused1, id_match_t *me,
 259                                                   void **unused2, id_match_t *other)
 260 {
 261         id_match_t my_match, other_match;
 262         stroke_shared_key_t *stroke = *in;
 263         shared_key_t *shared = &stroke->shared;
 264
 265         if (data->type != SHARED_ANY && shared->get_type(shared) != data->type)
 266         {
 267                 return FALSE;
 268         }
 269
 270         my_match = stroke->has_owner(stroke, data->me);
 271         other_match = stroke->has_owner(stroke, data->other);
 272         if (!my_match && !other_match)
 273         {
 274                 return FALSE;
 275         }
 276         *out = shared;
 277         if (me)
 278         {
 279                 *me = my_match;
 280         }
 281         if (other)
 282         {
 283                 *other = other_match;
 284         }
 285         return TRUE;
 286 }
 287
 288 /**
 289  * Implements credential_set_t.create_shared_enumerator
 290  */
 291 static enumerator_t* create_shared_enumerator(private_stroke_cred_t *this,
 292                                                         shared_key_type_t type, identification_t *me,
 293                                                         identification_t *other)
 294 {
 295         shared_data_t *data = malloc_thing(shared_data_t);
 296
 297         data->this = this;
 298         data->me = me;
 299         data->other = other;
 300         data->type = type;
 301         this->mutex->lock(this->mutex);
 302         return enumerator_create_filter(this->shared->create_enumerator(this->shared),
 303                                                                         (void*)shared_filter, data,
 304                                                                         (void*)shared_data_destroy);
 305 }
 306
 307 /**
 308  * Add a certificate to chain
 309  */
 310 static certificate_t* add_cert(private_stroke_cred_t *this, certificate_t *cert)
 311 {
 312         certificate_t *current;
 313         enumerator_t *enumerator;
 314         bool new = TRUE;
 315
 316         this->mutex->lock(this->mutex);
 317         enumerator = this->certs->create_enumerator(this->certs);
 318         while (enumerator->enumerate(enumerator, (void**)&current))
 319         {
 320                 if (current->equals(current, cert))
 321                 {
 322                         /* cert already in queue */
 323                         cert->destroy(cert);
 324                         cert = current;
 325                         new = FALSE;
 326                         break;
 327                 }
 328         }
 329         enumerator->destroy(enumerator);
 330
 331         if (new)
 332         {
 333                 this->certs->insert_last(this->certs, cert);
 334         }
 335         this->mutex->unlock(this->mutex);
 336         return cert;
 337 }
 338
 339 /**
 340  * Implementation of stroke_cred_t.load_ca.
 341  */
 342 static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
 343 {
 344         certificate_t *cert;
 345         char path[PATH_MAX];
 346
 347         if (*filename == '/')
 348         {
 349                 snprintf(path, sizeof(path), "%s", filename);
 350         }
 351         else
 352         {
 353                 snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
 354         }
 355
 356         cert = lib->creds->create(lib->creds,
 357                                                           CRED_CERTIFICATE, CERT_X509,
 358                                                           BUILD_FROM_FILE, path,
 359                                                           BUILD_X509_FLAG, X509_CA,
 360                                                           BUILD_END);
 361         if (cert)
 362         {
 363                 return (certificate_t*)add_cert(this, cert);
 364         }
 365         return NULL;
 366 }
 367
 368 /**
 369  * Add X.509 CRL to chain
 370  */
 371 static void add_crl(private_stroke_cred_t *this, crl_t* crl)
 372 {
 373         certificate_t *current, *cert = &crl->certificate;
 374         enumerator_t *enumerator;
 375         bool new = TRUE, found = FALSE;
 376
 377         this->mutex->lock(this->mutex);
 378         enumerator = this->certs->create_enumerator(this->certs);
 379         while (enumerator->enumerate(enumerator, (void**)&current))
 380         {
 381                 if (current->get_type(current) == CERT_X509_CRL)
 382                 {
 383                         crl_t *crl_c = (crl_t*)current;
 384                         identification_t *authkey = crl->get_authKeyIdentifier(crl);
 385                         identification_t *authkey_c = crl_c->get_authKeyIdentifier(crl_c);
 386
 387                         /* if compare authorityKeyIdentifiers if available */
 388                         if (authkey != NULL && authkey_c != NULL &&
 389                                 authkey->equals(authkey, authkey_c))
 390                         {
 391                                 found = TRUE;
 392                         }
 393                         else
 394                         {
 395                                 identification_t *issuer = cert->get_issuer(cert);
 396                                 identification_t *issuer_c = current->get_issuer(current);
 397
 398                                 /* otherwise compare issuer distinguished names */
 399                                 if (issuer->equals(issuer, issuer_c))
 400                                 {
 401                                         found = TRUE;
 402                                 }
 403                         }
 404                         if (found)
 405                         {
 406                                 new = cert->is_newer(cert, current);
 407                                 if (new)
 408                                 {
 409                                         this->certs->remove_at(this->certs, enumerator);
 410                                 }
 411                                 else
 412                                 {
 413                                         cert->destroy(cert);
 414                                 }
 415                                 break;
 416                         }
 417                 }
 418         }
 419         enumerator->destroy(enumerator);
 420
 421         if (new)
 422         {
 423                 this->certs->insert_last(this->certs, cert);
 424         }
 425         this->mutex->unlock(this->mutex);
 426 }
 427
 428 /**
 429  * Implementation of stroke_cred_t.load_peer.
 430  */
 431 static certificate_t* load_peer(private_stroke_cred_t *this, char *filename)
 432 {
 433         certificate_t *cert;
 434         char path[PATH_MAX];
 435
 436         if (*filename == '/')
 437         {
 438                 snprintf(path, sizeof(path), "%s", filename);
 439         }
 440         else
 441         {
 442                 snprintf(path, sizeof(path), "%s/%s", CERTIFICATE_DIR, filename);
 443         }
 444
 445         cert = lib->creds->create(lib->creds,
 446                                                           CRED_CERTIFICATE, CERT_X509,
 447                                                           BUILD_FROM_FILE, path,
 448                                                           BUILD_X509_FLAG, 0,
 449                                                           BUILD_END);
 450         if (cert)
 451         {
 452                 cert = add_cert(this, cert);
 453                 return cert->get_ref(cert);
 454         }
 455         return NULL;
 456 }
 457
 458 /**
 459  * load trusted certificates from a directory
 460  */
 461 static void load_certdir(private_stroke_cred_t *this, char *path,
 462                                                  certificate_type_t type, x509_flag_t flag)
 463 {
 464         struct stat st;
 465         char *file;
 466
 467         enumerator_t *enumerator = enumerator_create_directory(path);
 468
 469         if (!enumerator)
 470         {
 471                 DBG1(DBG_CFG, "  reading directory failed");
 472                 return;
 473         }
 474
 475         while (enumerator->enumerate(enumerator, NULL, &file, &st))
 476         {
 477                 certificate_t *cert;
 478
 479                 if (!S_ISREG(st.st_mode))
 480                 {
 481                         /* skip special file */
 482                         continue;
 483                 }
 484                 switch (type)
 485                 {
 486                         case CERT_X509:
 487                                 cert = lib->creds->create(lib->creds,
 488                                                                                   CRED_CERTIFICATE, CERT_X509,
 489                                                                                   BUILD_FROM_FILE, file,
 490                                                                                   BUILD_X509_FLAG, flag,
 491                                                                                   BUILD_END);
 492                                 if (cert)
 493                                 {
 494                                         add_cert(this, cert);
 495                                 }
 496                                 break;
 497                         case CERT_X509_CRL:
 498                                 cert = lib->creds->create(lib->creds,
 499                                                                                   CRED_CERTIFICATE, CERT_X509_CRL,
 500                                                                                   BUILD_FROM_FILE, file,
 501                                                                                   BUILD_END);
 502                                 if (cert)
 503                                 {
 504                                         add_crl(this, (crl_t*)cert);
 505                                 }
 506                                 break;
 507                         case CERT_X509_AC:
 508                                 cert = lib->creds->create(lib->creds,
 509                                                                                   CRED_CERTIFICATE, CERT_X509_AC,
 510                                                                                   BUILD_FROM_FILE, file,
 511                                                                                   BUILD_END);
 512                                 if (cert)
 513                                 {
 514                                         cert->destroy(cert);
 515                                 }
 516                                 break;
 517                         default:
 518                                 break;
 519                 }
 520         }
 521         enumerator->destroy(enumerator);
 522 }
 523
 524 /**
 525  * Convert a string of characters into a binary secret
 526  * A string between single or double quotes is treated as ASCII characters
 527  * A string prepended by 0x is treated as HEX and prepended by 0s as Base64
 528  */
 529 static err_t extract_secret(chunk_t *secret, chunk_t *line)
 530 {
 531         chunk_t raw_secret;
 532         char delimiter = ' ';
 533         bool quotes = FALSE;
 534
 535         if (!eat_whitespace(line))
 536         {
 537                 return "missing secret";
 538         }
 539
 540         if (*line->ptr == '\'' || *line->ptr == '"')
 541         {
 542                 quotes = TRUE;
 543                 delimiter = *line->ptr;
 544                 line->ptr++;  line->len--;
 545         }
 546
 547         if (!extract_token(&raw_secret, delimiter, line))
 548         {
 549                 if (delimiter == ' ')
 550                 {
 551                         raw_secret = *line;
 552                 }
 553                 else
 554                 {
 555                         return "missing second delimiter";
 556                 }
 557         }
 558
 559         if (quotes)
 560         {
 561                 /* treat as an ASCII string */
 562                 *secret = chunk_clone(raw_secret);
 563         }
 564         else
 565         {
 566                 size_t len;
 567                 err_t ugh;
 568
 569                 /* secret converted to binary form doesn't use more space than the raw_secret */
 570                 *secret = chunk_alloc(raw_secret.len);
 571
 572                 /* convert from HEX or Base64 to binary */
 573                 ugh = ttodata(raw_secret.ptr, raw_secret.len, 0, secret->ptr, secret->len, &len);
 574
 575             if (ugh != NULL)
 576                 {
 577                         chunk_free_randomized(secret);
 578                         return ugh;
 579                 }
 580                 secret->len = len;
 581         }
 582         return NULL;
 583 }
 584
 585 /**
 586  * reload ipsec.secrets
 587  */
 588 static void load_secrets(private_stroke_cred_t *this)
 589 {
 590         size_t bytes;
 591         int line_nr = 0;
 592         chunk_t chunk, src, line;
 593         FILE *fd;
 594         private_key_t *private;
 595         shared_key_t *shared;
 596
 597         DBG1(DBG_CFG, "loading secrets from '%s'", SECRETS_FILE);
 598
 599         fd = fopen(SECRETS_FILE, "r");
 600         if (fd == NULL)
 601         {
 602                 DBG1(DBG_CFG, "opening secrets file '%s' failed");
 603                 return;
 604         }
 605
 606         /* TODO: do error checks */
 607         fseek(fd, 0, SEEK_END);
 608         chunk.len = ftell(fd);
 609         rewind(fd);
 610         chunk.ptr = malloc(chunk.len);
 611         bytes = fread(chunk.ptr, 1, chunk.len, fd);
 612         fclose(fd);
 613         src = chunk;
 614
 615         this->mutex->lock(this->mutex);
 616         while (this->shared->remove_last(this->shared,
 617                                                                                    (void**)&shared) == SUCCESS)
 618         {
 619                 shared->destroy(shared);
 620         }
 621         while (this->private->remove_last(this->private,
 622                                                                                     (void**)&private) == SUCCESS)
 623         {
 624                 private->destroy(private);
 625         }
 626
 627         while (fetchline(&src, &line))
 628         {
 629                 chunk_t ids, token;
 630                 shared_key_type_t type;
 631
 632                 line_nr++;
 633
 634                 if (!eat_whitespace(&line))
 635                 {
 636                         continue;
 637                 }
 638                 if (!extract_token(&ids, ':', &line))
 639                 {
 640                         DBG1(DBG_CFG, "line %d: missing ':' separator", line_nr);
 641                         goto error;
 642                 }
 643                 /* NULL terminate the ids string by replacing the : separator */
 644                 *(ids.ptr + ids.len) = '\0';
 645
 646                 if (!eat_whitespace(&line) || !extract_token(&token, ' ', &line))
 647                 {
 648                         DBG1(DBG_CFG, "line %d: missing token", line_nr);
 649                         goto error;
 650                 }
 651                 if (match("RSA", &token))
 652                 {
 653                         char path[PATH_MAX];
 654                         chunk_t filename;
 655                         chunk_t secret = chunk_empty;
 656                         private_key_t *key;
 657                         bool pgp = FALSE;
 658                         chunk_t chunk = chunk_empty;
 659
 660                         err_t ugh = extract_value(&filename, &line);
 661
 662                         if (ugh != NULL)
 663                         {
 664                                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 665                                 goto error;
 666                         }
 667                         if (filename.len == 0)
 668                         {
 669                                 DBG1(DBG_CFG, "line %d: empty filename", line_nr);
 670                                 goto error;
 671                         }
 672                         if (*filename.ptr == '/')
 673                         {
 674                                 /* absolute path name */
 675                                 snprintf(path, sizeof(path), "%.*s", filename.len, filename.ptr);
 676                         }
 677                         else
 678                         {
 679                                 /* relative path name */
 680                                 snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
 681                                                  filename.len, filename.ptr);
 682                         }
 683
 684                         /* check for optional passphrase */
 685                         if (eat_whitespace(&line))
 686                         {
 687                                 ugh = extract_secret(&secret, &line);
 688                                 if (ugh != NULL)
 689                                 {
 690                                         DBG1(DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
 691                                         goto error;
 692                                 }
 693                         }
 694
 695                         if (pem_asn1_load_file(path, &secret, &chunk, &pgp))
 696                         {
 697                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
 698                                                                                  BUILD_BLOB_ASN1_DER, chunk, BUILD_END);
 699                                 if (key)
 700                                 {
 701                                         DBG1(DBG_CFG, "  loaded private key file '%s'", path);
 702                                         this->private->insert_last(this->private, key);
 703                                 }
 704                         }
 705                         chunk_free_randomized(&secret);
 706                 }
 707                 else if ((match("PSK", &token) && (type = SHARED_IKE)) ||
 708                                  (match("EAP", &token) && (type = SHARED_EAP)) ||
 709                                  (match("XAUTH", &token) && (type = SHARED_EAP)) ||
 710                                  (match("PIN", &token) && (type = SHARED_PIN)))
 711                 {
 712                         stroke_shared_key_t *shared_key;
 713                         chunk_t secret = chunk_empty;
 714                         bool any = TRUE;
 715
 716                         err_t ugh = extract_secret(&secret, &line);
 717                         if (ugh != NULL)
 718                         {
 719                                 DBG1(DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
 720                                 goto error;
 721                         }
 722                         shared_key = stroke_shared_key_create(type, secret);
 723                         DBG1(DBG_CFG, "  loaded %N secret for %s", shared_key_type_names, type,
 724                                  ids.len > 0 ? (char*)ids.ptr : "%any");
 725                         DBG4(DBG_CFG, "  secret:", secret);
 726
 727                         this->shared->insert_last(this->shared, shared_key);
 728                         while (ids.len > 0)
 729                         {
 730                                 chunk_t id;
 731                                 identification_t *peer_id;
 732
 733                                 ugh = extract_value(&id, &ids);
 734                                 if (ugh != NULL)
 735                                 {
 736                                         DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 737                                         goto error;
 738                                 }
 739                                 if (id.len == 0)
 740                                 {
 741                                         continue;
 742                                 }
 743
 744                                 /* NULL terminate the ID string */
 745                                 *(id.ptr + id.len) = '\0';
 746
 747                                 peer_id = identification_create_from_string(id.ptr);
 748                                 if (peer_id == NULL)
 749                                 {
 750                                         DBG1(DBG_CFG, "line %d: malformed ID: %s", line_nr, id.ptr);
 751                                         goto error;
 752                                 }
 753                                 if (peer_id->get_type(peer_id) == ID_ANY)
 754                                 {
 755                                         peer_id->destroy(peer_id);
 756                                         continue;
 757                                 }
 758
 759                                 shared_key->add_owner(shared_key, peer_id);
 760                                 any = FALSE;
 761                         }
 762                         if (any)
 763                         {
 764                                 shared_key->add_owner(shared_key,
 765                                         identification_create_from_encoding(ID_ANY, chunk_empty));
 766                         }
 767                 }
 768                 else
 769                 {
 770                         DBG1(DBG_CFG, "line %d: token must be either "
 771                                  "RSA, PSK, EAP, or PIN", line_nr);
 772                         goto error;
 773                 }
 774         }
 775 error:
 776         this->mutex->unlock(this->mutex);
 777         chunk_free_randomized(&chunk);
 778 }
 779
 780 /**
 781  * load all certificates from ipsec.d
 782  */
 783 static void load_certs(private_stroke_cred_t *this)
 784 {
 785         DBG1(DBG_CFG, "loading ca certificates from '%s'",
 786                  CA_CERTIFICATE_DIR);
 787         load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
 788
 789         DBG1(DBG_CFG, "loading aa certificates from '%s'",
 790                  AA_CERTIFICATE_DIR);
 791         load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
 792
 793         DBG1(DBG_CFG, "loading ocsp signer certificates from '%s'",
 794                  OCSP_CERTIFICATE_DIR);
 795         load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509, X509_OCSP_SIGNER);
 796
 797         DBG1(DBG_CFG, "loading attribute certificates from '%s'",
 798                  ATTR_CERTIFICATE_DIR);
 799         load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
 800
 801         DBG1(DBG_CFG, "loading crls from '%s'",
 802                  CRL_DIR);
 803         load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
 804 }
 805
 806 /**
 807  * Implementation of stroke_cred_t.reread.
 808  */
 809 static void reread(private_stroke_cred_t *this, stroke_msg_t *msg)
 810 {
 811         if (msg->reread.flags & REREAD_SECRETS)
 812         {
 813                 DBG1(DBG_CFG, "rereading secrets");
 814                 load_secrets(this);
 815         }
 816         if (msg->reread.flags & REREAD_CACERTS)
 817         {
 818                 DBG1(DBG_CFG, "rereading ca certificates from '%s'",
 819                          CA_CERTIFICATE_DIR);
 820                 load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
 821         }
 822         if (msg->reread.flags & REREAD_OCSPCERTS)
 823         {
 824                 DBG1(DBG_CFG, "rereading ocsp signer certificates from '%s'",
 825                          OCSP_CERTIFICATE_DIR);
 826                 load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509,
 827                          X509_OCSP_SIGNER);
 828         }
 829         if (msg->reread.flags & REREAD_AACERTS)
 830         {
 831                 DBG1(DBG_CFG, "rereading aa certificates from '%s'",
 832                          AA_CERTIFICATE_DIR);
 833                 load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
 834         }
 835         if (msg->reread.flags & REREAD_ACERTS)
 836         {
 837                 DBG1(DBG_CFG, "rereading attribute certificates from '%s'",
 838                          ATTR_CERTIFICATE_DIR);
 839                 load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
 840         }
 841         if (msg->reread.flags & REREAD_CRLS)
 842         {
 843                 DBG1(DBG_CFG, "rereading crls from '%s'",
 844                          CRL_DIR);
 845                 load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
 846         }
 847 }
 848
 849 /**
 850  * Implementation of stroke_cred_t.destroy
 851  */
 852 static void destroy(private_stroke_cred_t *this)
 853 {
 854         this->certs->destroy_offset(this->certs, offsetof(certificate_t, destroy));
 855         this->shared->destroy_offset(this->shared, offsetof(shared_key_t, destroy));
 856         this->private->destroy_offset(this->private, offsetof(private_key_t, destroy));
 857         this->mutex->destroy(this->mutex);
 858         free(this);
 859 }
 860
 861 /*
 862  * see header file
 863  */
 864 stroke_cred_t *stroke_cred_create()
 865 {
 866         private_stroke_cred_t *this = malloc_thing(private_stroke_cred_t);
 867
 868         this->public.set.create_private_enumerator = (void*)create_private_enumerator;
 869         this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
 870         this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
 871         this->public.set.create_cdp_enumerator = (void*)return_null;
 872         this->public.reread = (void(*)(stroke_cred_t*, stroke_msg_t *msg))reread;
 873         this->public.load_ca = (certificate_t*(*)(stroke_cred_t*, char *filename))load_ca;
 874         this->public.load_peer = (certificate_t*(*)(stroke_cred_t*, char *filename))load_peer;
 875         this->public.destroy = (void(*)(stroke_cred_t*))destroy;
 876
 877         this->certs = linked_list_create();
 878         this->shared = linked_list_create();
 879         this->private = linked_list_create();
 880         this->mutex = mutex_create(MUTEX_RECURSIVE);
 881
 882         load_certs(this);
 883         load_secrets(this);
 884
 885         return &this->public;
 886 }
 887