src/charon/plugins/stroke/stroke_cred.c

   1 /*
   2  * Copyright (C) 2008 Tobias Brunner
   3  * Copyright (C) 2008 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <sys/stat.h>
  18 #include <limits.h>
  19 #include <glob.h>
  20 #include <libgen.h>
  21
  22 #include "stroke_cred.h"
  23 #include "stroke_shared_key.h"
  24
  25 #include <credentials/certificates/x509.h>
  26 #include <credentials/certificates/crl.h>
  27 #include <credentials/certificates/ac.h>
  28 #include <utils/linked_list.h>
  29 #include <utils/lexparser.h>
  30 #include <threading/rwlock.h>
  31 #include <daemon.h>
  32
  33 /* configuration directories and files */
  34 #define CONFIG_DIR IPSEC_CONFDIR
  35 #define IPSEC_D_DIR CONFIG_DIR "/ipsec.d"
  36 #define PRIVATE_KEY_DIR IPSEC_D_DIR "/private"
  37 #define CERTIFICATE_DIR IPSEC_D_DIR "/certs"
  38 #define CA_CERTIFICATE_DIR IPSEC_D_DIR "/cacerts"
  39 #define AA_CERTIFICATE_DIR IPSEC_D_DIR "/aacerts"
  40 #define ATTR_CERTIFICATE_DIR IPSEC_D_DIR "/acerts"
  41 #define OCSP_CERTIFICATE_DIR IPSEC_D_DIR "/ocspcerts"
  42 #define CRL_DIR IPSEC_D_DIR "/crls"
  43 #define SECRETS_FILE CONFIG_DIR "/ipsec.secrets"
  44
  45 #define MAX_SECRETS_RECURSION 10
  46
  47 typedef struct private_stroke_cred_t private_stroke_cred_t;
  48
  49 /**
  50  * private data of stroke_cred
  51  */
  52 struct private_stroke_cred_t {
  53
  54         /**
  55          * public functions
  56          */
  57         stroke_cred_t public;
  58
  59         /**
  60          * list of trusted peer/signer/CA certificates (certificate_t)
  61          */
  62         linked_list_t *certs;
  63
  64         /**
  65          * list of shared secrets (private_shared_key_t)
  66          */
  67         linked_list_t *shared;
  68
  69         /**
  70          * list of private keys (private_key_t)
  71          */
  72         linked_list_t *private;
  73
  74         /**
  75          * read-write lock to lists
  76          */
  77         rwlock_t *lock;
  78
  79         /**
  80          * cache CRLs to disk?
  81          */
  82         bool cachecrl;
  83 };
  84
  85 /**
  86  * data to pass to various filters
  87  */
  88 typedef struct {
  89         private_stroke_cred_t *this;
  90         identification_t *id;
  91         certificate_type_t type;
  92 } id_data_t;
  93
  94 /**
  95  * destroy id enumerator data and unlock list
  96  */
  97 static void id_data_destroy(id_data_t *data)
  98 {
  99         data->this->lock->unlock(data->this->lock);
 100         free(data);
 101 }
 102
 103 /**
 104  * filter function for private key enumerator
 105  */
 106 static bool private_filter(id_data_t *data,
 107                                                    private_key_t **in, private_key_t **out)
 108 {
 109         private_key_t *key;
 110
 111         key = *in;
 112         if (data->id == NULL)
 113         {
 114                 *out = key;
 115                 return TRUE;
 116         }
 117         if (key->has_fingerprint(key, data->id->get_encoding(data->id)))
 118         {
 119                 *out = key;
 120                 return TRUE;
 121         }
 122         return FALSE;
 123 }
 124
 125 /**
 126  * Implements credential_set_t.create_private_enumerator
 127  */
 128 static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
 129                                                         key_type_t type, identification_t *id)
 130 {
 131         id_data_t *data;
 132
 133         data = malloc_thing(id_data_t);
 134         data->this = this;
 135         data->id = id;
 136
 137         this->lock->read_lock(this->lock);
 138         return enumerator_create_filter(this->private->create_enumerator(this->private),
 139                                                                         (void*)private_filter, data,
 140                                                                         (void*)id_data_destroy);
 141 }
 142
 143 /**
 144  * filter function for certs enumerator
 145  */
 146 static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 147 {
 148         public_key_t *public;
 149         certificate_t *cert = *in;
 150
 151         if (data->type != CERT_ANY && data->type != cert->get_type(cert))
 152         {
 153                 return FALSE;
 154         }
 155         if (data->id == NULL || cert->has_subject(cert, data->id))
 156         {
 157                 *out = *in;
 158                 return TRUE;
 159         }
 160
 161         public = cert->get_public_key(cert);
 162         if (public)
 163         {
 164                 if (public->has_fingerprint(public, data->id->get_encoding(data->id)))
 165                 {
 166                         public->destroy(public);
 167                         *out = *in;
 168                         return TRUE;
 169                 }
 170                 public->destroy(public);
 171         }
 172         return FALSE;
 173 }
 174
 175 /**
 176  * Implements credential_set_t.create_cert_enumerator
 177  */
 178 static enumerator_t* create_cert_enumerator(private_stroke_cred_t *this,
 179                                                         certificate_type_t cert, key_type_t key,
 180                                                         identification_t *id, bool trusted)
 181 {
 182         id_data_t *data;
 183
 184         if (trusted && (cert == CERT_X509_CRL || cert == CERT_X509_AC))
 185         {
 186                 return NULL;
 187         }
 188         data = malloc_thing(id_data_t);
 189         data->this = this;
 190         data->id = id;
 191         data->type = cert;
 192
 193         this->lock->read_lock(this->lock);
 194         return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 195                                                                         (void*)certs_filter, data,
 196                                                                         (void*)id_data_destroy);
 197 }
 198
 199 typedef struct {
 200         private_stroke_cred_t *this;
 201         identification_t *me;
 202         identification_t *other;
 203         shared_key_type_t type;
 204 } shared_data_t;
 205
 206 /**
 207  * free shared key enumerator data and unlock list
 208  */
 209 static void shared_data_destroy(shared_data_t *data)
 210 {
 211         data->this->lock->unlock(data->this->lock);
 212         free(data);
 213 }
 214
 215 /**
 216  * filter function for certs enumerator
 217  */
 218 static bool shared_filter(shared_data_t *data,
 219                                                   stroke_shared_key_t **in, shared_key_t **out,
 220                                                   void **unused1, id_match_t *me,
 221                                                   void **unused2, id_match_t *other)
 222 {
 223         id_match_t my_match = ID_MATCH_NONE, other_match = ID_MATCH_NONE;
 224         stroke_shared_key_t *stroke = *in;
 225         shared_key_t *shared = &stroke->shared;
 226
 227         if (data->type != SHARED_ANY && shared->get_type(shared) != data->type)
 228         {
 229                 return FALSE;
 230         }
 231
 232         if (data->me)
 233         {
 234                 my_match = stroke->has_owner(stroke, data->me);
 235         }
 236         if (data->other)
 237         {
 238                 other_match = stroke->has_owner(stroke, data->other);
 239         }
 240         if ((data->me || data->other) && (!my_match && !other_match))
 241         {
 242                 return FALSE;
 243         }
 244         *out = shared;
 245         if (me)
 246         {
 247                 *me = my_match;
 248         }
 249         if (other)
 250         {
 251                 *other = other_match;
 252         }
 253         return TRUE;
 254 }
 255
 256 /**
 257  * Implements credential_set_t.create_shared_enumerator
 258  */
 259 static enumerator_t* create_shared_enumerator(private_stroke_cred_t *this,
 260                                                         shared_key_type_t type, identification_t *me,
 261                                                         identification_t *other)
 262 {
 263         shared_data_t *data = malloc_thing(shared_data_t);
 264
 265         data->this = this;
 266         data->me = me;
 267         data->other = other;
 268         data->type = type;
 269         this->lock->read_lock(this->lock);
 270         return enumerator_create_filter(this->shared->create_enumerator(this->shared),
 271                                                                         (void*)shared_filter, data,
 272                                                                         (void*)shared_data_destroy);
 273 }
 274
 275 /**
 276  * Add a certificate to chain
 277  */
 278 static certificate_t* add_cert(private_stroke_cred_t *this, certificate_t *cert)
 279 {
 280         certificate_t *current;
 281         enumerator_t *enumerator;
 282         bool new = TRUE;
 283
 284         this->lock->read_lock(this->lock);
 285         enumerator = this->certs->create_enumerator(this->certs);
 286         while (enumerator->enumerate(enumerator, (void**)&current))
 287         {
 288                 if (current->equals(current, cert))
 289                 {
 290                         /* cert already in queue */
 291                         cert->destroy(cert);
 292                         cert = current;
 293                         new = FALSE;
 294                         break;
 295                 }
 296         }
 297         enumerator->destroy(enumerator);
 298
 299         if (new)
 300         {
 301                 this->certs->insert_last(this->certs, cert);
 302         }
 303         this->lock->unlock(this->lock);
 304         return cert;
 305 }
 306
 307 /**
 308  * Implementation of stroke_cred_t.load_ca.
 309  */
 310 static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
 311 {
 312         certificate_t *cert;
 313         char path[PATH_MAX];
 314
 315         if (*filename == '/')
 316         {
 317                 snprintf(path, sizeof(path), "%s", filename);
 318         }
 319         else
 320         {
 321                 snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
 322         }
 323
 324         cert = lib->creds->create(lib->creds,
 325                                                           CRED_CERTIFICATE, CERT_X509,
 326                                                           BUILD_FROM_FILE, path,
 327                                                           BUILD_END);
 328         if (cert)
 329         {
 330                 x509_t *x509 = (x509_t*)cert;
 331
 332                 if (!(x509->get_flags(x509) & X509_CA))
 333                 {
 334                         DBG1(DBG_CFG, "  ca certificate \"%Y\" misses ca basic constraint, "
 335                                  "discarded", cert->get_subject(cert));
 336                         cert->destroy(cert);
 337                         return NULL;
 338                 }
 339                 return (certificate_t*)add_cert(this, cert);
 340         }
 341         return NULL;
 342 }
 343
 344 /**
 345  * Add X.509 CRL to chain
 346  */
 347 static bool add_crl(private_stroke_cred_t *this, crl_t* crl)
 348 {
 349         certificate_t *current, *cert = &crl->certificate;
 350         enumerator_t *enumerator;
 351         bool new = TRUE, found = FALSE;
 352
 353         this->lock->write_lock(this->lock);
 354         enumerator = this->certs->create_enumerator(this->certs);
 355         while (enumerator->enumerate(enumerator, (void**)&current))
 356         {
 357                 if (current->get_type(current) == CERT_X509_CRL)
 358                 {
 359                         crl_t *crl_c = (crl_t*)current;
 360                         chunk_t authkey = crl->get_authKeyIdentifier(crl);
 361                         chunk_t authkey_c = crl_c->get_authKeyIdentifier(crl_c);
 362
 363                         /* if compare authorityKeyIdentifiers if available */
 364                         if (authkey.ptr && authkey_c.ptr && chunk_equals(authkey, authkey_c))
 365                         {
 366                                 found = TRUE;
 367                         }
 368                         else
 369                         {
 370                                 identification_t *issuer = cert->get_issuer(cert);
 371                                 identification_t *issuer_c = current->get_issuer(current);
 372
 373                                 /* otherwise compare issuer distinguished names */
 374                                 if (issuer->equals(issuer, issuer_c))
 375                                 {
 376                                         found = TRUE;
 377                                 }
 378                         }
 379                         if (found)
 380                         {
 381                                 new = cert->is_newer(cert, current);
 382                                 if (new)
 383                                 {
 384                                         this->certs->remove_at(this->certs, enumerator);
 385                                 }
 386                                 else
 387                                 {
 388                                         cert->destroy(cert);
 389                                 }
 390                                 break;
 391                         }
 392                 }
 393         }
 394         enumerator->destroy(enumerator);
 395
 396         if (new)
 397         {
 398                 this->certs->insert_last(this->certs, cert);
 399         }
 400         this->lock->unlock(this->lock);
 401         return new;
 402 }
 403
 404 /**
 405  * Add X.509 attribute certificate to chain
 406  */
 407 static bool add_ac(private_stroke_cred_t *this, ac_t* ac)
 408 {
 409         certificate_t *cert = &ac->certificate;
 410
 411         this->lock->write_lock(this->lock);
 412         this->certs->insert_last(this->certs, cert);
 413         this->lock->unlock(this->lock);
 414         return TRUE;
 415 }
 416
 417 /**
 418  * Implementation of stroke_cred_t.load_peer.
 419  */
 420 static certificate_t* load_peer(private_stroke_cred_t *this, char *filename)
 421 {
 422         certificate_t *cert;
 423         char path[PATH_MAX];
 424
 425         if (*filename == '/')
 426         {
 427                 snprintf(path, sizeof(path), "%s", filename);
 428         }
 429         else
 430         {
 431                 snprintf(path, sizeof(path), "%s/%s", CERTIFICATE_DIR, filename);
 432         }
 433
 434         cert = lib->creds->create(lib->creds,
 435                                                           CRED_CERTIFICATE, CERT_ANY,
 436                                                           BUILD_FROM_FILE, path,
 437                                                           BUILD_END);
 438         if (cert)
 439         {
 440                 cert = add_cert(this, cert);
 441                 DBG1(DBG_CFG, "  loaded certificate \"%Y\" from '%s'",
 442                                           cert->get_subject(cert), filename);
 443                 return cert->get_ref(cert);
 444         }
 445         DBG1(DBG_CFG, "  loading certificate from '%s' failed", filename);
 446         return NULL;
 447 }
 448
 449 /**
 450  * load trusted certificates from a directory
 451  */
 452 static void load_certdir(private_stroke_cred_t *this, char *path,
 453                                                  certificate_type_t type, x509_flag_t flag)
 454 {
 455         struct stat st;
 456         char *file;
 457
 458         enumerator_t *enumerator = enumerator_create_directory(path);
 459
 460         if (!enumerator)
 461         {
 462                 DBG1(DBG_CFG, "  reading directory failed");
 463                 return;
 464         }
 465
 466         while (enumerator->enumerate(enumerator, NULL, &file, &st))
 467         {
 468                 certificate_t *cert;
 469
 470                 if (!S_ISREG(st.st_mode))
 471                 {
 472                         /* skip special file */
 473                         continue;
 474                 }
 475                 switch (type)
 476                 {
 477                         case CERT_X509:
 478                                 if (flag & X509_CA)
 479                                 {       /* for CA certificates, we strictly require
 480                                          * the CA basic constraint to be set */
 481                                         cert = lib->creds->create(lib->creds,
 482                                                                                 CRED_CERTIFICATE, CERT_X509,
 483                                                                                 BUILD_FROM_FILE, file, BUILD_END);
 484                                         if (cert)
 485                                         {
 486                                                 x509_t *x509 = (x509_t*)cert;
 487
 488                                                 if (!(x509->get_flags(x509) & X509_CA))
 489                                                 {
 490                                                         DBG1(DBG_CFG, "  ca certificate \"%Y\" lacks "
 491                                                                  "ca basic constraint, discarded",
 492                                                                  cert->get_subject(cert));
 493                                                         cert->destroy(cert);
 494                                                         cert = NULL;
 495                                                 }
 496                                                 else
 497                                                 {
 498                                                         DBG1(DBG_CFG, "  loaded ca certificate \"%Y\" from '%s'",
 499                                                                                   cert->get_subject(cert), file);
 500                                                 }
 501                                         }
 502                                         else
 503                                         {
 504                                                 DBG1(DBG_CFG, "  loading ca certificate from '%s' "
 505                                                                           "failed", file);
 506                                         }
 507                                 }
 508                                 else
 509                                 {       /* for all other flags, we add them to the certificate. */
 510                                         cert = lib->creds->create(lib->creds,
 511                                                                                 CRED_CERTIFICATE, CERT_X509,
 512                                                                                 BUILD_FROM_FILE, file,
 513                                                                                 BUILD_X509_FLAG, flag, BUILD_END);
 514                                         if (cert)
 515                                         {
 516                                                 DBG1(DBG_CFG, "  loaded certificate \"%Y\" from '%s'",
 517                                                                           cert->get_subject(cert), file);
 518                                         }
 519                                         else
 520                                         {
 521                                                 DBG1(DBG_CFG, "  loading certificate from '%s' "
 522                                                                           "failed", file);
 523                                         }
 524                                 }
 525                                 if (cert)
 526                                 {
 527                                         add_cert(this, cert);
 528                                 }
 529                                 break;
 530                         case CERT_X509_CRL:
 531                                 cert = lib->creds->create(lib->creds,
 532                                                                                   CRED_CERTIFICATE, CERT_X509_CRL,
 533                                                                                   BUILD_FROM_FILE, file,
 534                                                                                   BUILD_END);
 535                                 if (cert)
 536                                 {
 537                                         add_crl(this, (crl_t*)cert);
 538                                         DBG1(DBG_CFG, "  loaded crl from '%s'",  file);
 539                                 }
 540                                 else
 541                                 {
 542                                         DBG1(DBG_CFG, "  loading crl from '%s' failed", file);
 543                                 }
 544                                 break;
 545                         case CERT_X509_AC:
 546                                 cert = lib->creds->create(lib->creds,
 547                                                                                   CRED_CERTIFICATE, CERT_X509_AC,
 548                                                                                   BUILD_FROM_FILE, file,
 549                                                                                   BUILD_END);
 550                                 if (cert)
 551                                 {
 552                                         add_ac(this, (ac_t*)cert);
 553                                         DBG1(DBG_CFG, "  loaded attribute certificate from '%s'",
 554                                                                   file);
 555                                 }
 556                                 else
 557                                 {
 558                                         DBG1(DBG_CFG, "  loading attribute certificate from '%s' "
 559                                                                   "failed", file);
 560                                 }
 561                                 break;
 562                         default:
 563                                 break;
 564                 }
 565         }
 566         enumerator->destroy(enumerator);
 567 }
 568
 569 /**
 570  * Implementation of credential_set_t.cache_cert.
 571  */
 572 static void cache_cert(private_stroke_cred_t *this, certificate_t *cert)
 573 {
 574         if (cert->get_type(cert) == CERT_X509_CRL && this->cachecrl)
 575         {
 576                 /* CRLs get written to /etc/ipsec.d/crls/<authkeyId>.crl */
 577                 crl_t *crl = (crl_t*)cert;
 578
 579                 cert->get_ref(cert);
 580                 if (add_crl(this, crl))
 581                 {
 582                         char buf[BUF_LEN];
 583                         chunk_t chunk, hex;
 584
 585                         chunk = crl->get_authKeyIdentifier(crl);
 586                         hex = chunk_to_hex(chunk, NULL, FALSE);
 587                         snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex);
 588                         free(hex.ptr);
 589
 590                         chunk = cert->get_encoding(cert);
 591                         chunk_write(chunk, buf, "crl", 022, TRUE);
 592                         free(chunk.ptr);
 593                 }
 594         }
 595 }
 596
 597 /**
 598  * Implementation of stroke_cred_t.cachecrl.
 599  */
 600 static void cachecrl(private_stroke_cred_t *this, bool enabled)
 601 {
 602         DBG1(DBG_CFG, "crl caching to %s %s",
 603                  CRL_DIR, enabled ? "enabled" : "disabled");
 604         this->cachecrl = enabled;
 605 }
 606
 607
 608 /**
 609  * Convert a string of characters into a binary secret
 610  * A string between single or double quotes is treated as ASCII characters
 611  * A string prepended by 0x is treated as HEX and prepended by 0s as Base64
 612  */
 613 static err_t extract_secret(chunk_t *secret, chunk_t *line)
 614 {
 615         chunk_t raw_secret;
 616         char delimiter = ' ';
 617         bool quotes = FALSE;
 618
 619         if (!eat_whitespace(line))
 620         {
 621                 return "missing secret";
 622         }
 623
 624         if (*line->ptr == '\'' || *line->ptr == '"')
 625         {
 626                 quotes = TRUE;
 627                 delimiter = *line->ptr;
 628                 line->ptr++;  line->len--;
 629         }
 630
 631         if (!extract_token(&raw_secret, delimiter, line))
 632         {
 633                 if (delimiter == ' ')
 634                 {
 635                         raw_secret = *line;
 636                 }
 637                 else
 638                 {
 639                         return "missing second delimiter";
 640                 }
 641         }
 642
 643         if (quotes)
 644         {
 645                 /* treat as an ASCII string */
 646                 *secret = chunk_clone(raw_secret);
 647                 return NULL;
 648         }
 649         /* treat 0x as hex, 0s as base64 */
 650         if (raw_secret.len > 2)
 651         {
 652                 if (strncasecmp("0x", raw_secret.ptr, 2) == 0)
 653                 {
 654                         *secret = chunk_from_hex(chunk_skip(raw_secret, 2), NULL);
 655                         return NULL;
 656                 }
 657                 if (strncasecmp("0s", raw_secret.ptr, 2) == 0)
 658                 {
 659                         *secret = chunk_from_base64(chunk_skip(raw_secret, 2), NULL);
 660                         return NULL;
 661                 }
 662         }
 663         *secret = chunk_clone(raw_secret);
 664         return NULL;
 665 }
 666
 667 /**
 668  * Data to pass to passphrase_cb
 669  */
 670 typedef struct {
 671         /** socket we use for prompting */
 672         FILE *prompt;
 673         /** private key file */
 674         char *file;
 675         /** buffer for passphrase */
 676         char buf[256];
 677 } passphrase_cb_data_t;
 678
 679 /**
 680  * Passphrase callback to read from whack fd
 681  */
 682 chunk_t passphrase_cb(passphrase_cb_data_t *data, int try)
 683 {
 684         chunk_t secret = chunk_empty;;
 685
 686         if (try > 5)
 687         {
 688                 fprintf(data->prompt, "invalid passphrase, too many trials\n");
 689                 return chunk_empty;
 690         }
 691         if (try == 1)
 692         {
 693                 fprintf(data->prompt, "Private key '%s' is encrypted\n", data->file);
 694         }
 695         else
 696         {
 697                 fprintf(data->prompt, "invalid passphrase\n");
 698         }
 699         fprintf(data->prompt, "Passphrase:\n");
 700         if (fgets(data->buf, sizeof(data->buf), data->prompt))
 701         {
 702                 secret = chunk_create(data->buf, strlen(data->buf));
 703                 if (secret.len)
 704                 {       /* trim appended \n */
 705                         secret.len--;
 706                 }
 707         }
 708         return secret;
 709 }
 710
 711 /**
 712  * reload ipsec.secrets
 713  */
 714 static void load_secrets(private_stroke_cred_t *this, char *file, int level,
 715                                                  FILE *prompt)
 716 {
 717         size_t bytes;
 718         int line_nr = 0;
 719         chunk_t chunk, src, line;
 720         FILE *fd;
 721         private_key_t *private;
 722         shared_key_t *shared;
 723
 724         DBG1(DBG_CFG, "loading secrets from '%s'", file);
 725
 726         fd = fopen(file, "r");
 727         if (fd == NULL)
 728         {
 729                 DBG1(DBG_CFG, "opening secrets file '%s' failed", file);
 730                 return;
 731         }
 732
 733         /* TODO: do error checks */
 734         fseek(fd, 0, SEEK_END);
 735         chunk.len = ftell(fd);
 736         rewind(fd);
 737         chunk.ptr = malloc(chunk.len);
 738         bytes = fread(chunk.ptr, 1, chunk.len, fd);
 739         fclose(fd);
 740         src = chunk;
 741
 742         if (level == 0)
 743         {
 744                 this->lock->write_lock(this->lock);
 745
 746                 /* flush secrets on non-recursive invocation */
 747                 while (this->shared->remove_last(this->shared,
 748                                                                                  (void**)&shared) == SUCCESS)
 749                 {
 750                         shared->destroy(shared);
 751                 }
 752                 while (this->private->remove_last(this->private,
 753                                                                                   (void**)&private) == SUCCESS)
 754                 {
 755                         private->destroy(private);
 756                 }
 757         }
 758
 759         while (fetchline(&src, &line))
 760         {
 761                 chunk_t ids, token;
 762                 shared_key_type_t type;
 763
 764                 line_nr++;
 765
 766                 if (!eat_whitespace(&line))
 767                 {
 768                         continue;
 769                 }
 770                 if (line.len > strlen("include ") &&
 771                         strneq(line.ptr, "include ", strlen("include ")))
 772                 {
 773                         glob_t buf;
 774                         char **expanded, *dir, pattern[PATH_MAX];
 775                         u_char *pos;
 776
 777                         if (level > MAX_SECRETS_RECURSION)
 778                         {
 779                                 DBG1(DBG_CFG, "maximum level of %d includes reached, ignored",
 780                                          MAX_SECRETS_RECURSION);
 781                                 continue;
 782                         }
 783                         /* terminate filename by space */
 784                         line = chunk_skip(line, strlen("include "));
 785                         pos = memchr(line.ptr, ' ', line.len);
 786                         if (pos)
 787                         {
 788                                 line.len = pos - line.ptr;
 789                         }
 790                         if (line.len && line.ptr[0] == '/')
 791                         {
 792                                 if (line.len + 1 > sizeof(pattern))
 793                                 {
 794                                         DBG1(DBG_CFG, "include pattern too long, ignored");
 795                                         continue;
 796                                 }
 797                                 snprintf(pattern, sizeof(pattern), "%.*s", line.len, line.ptr);
 798                         }
 799                         else
 800                         {       /* use directory of current file if relative */
 801                                 dir = strdup(file);
 802                                 dir = dirname(dir);
 803
 804                                 if (line.len + 1 + strlen(dir) + 1 > sizeof(pattern))
 805                                 {
 806                                         DBG1(DBG_CFG, "include pattern too long, ignored");
 807                                         free(dir);
 808                                         continue;
 809                                 }
 810                                 snprintf(pattern, sizeof(pattern), "%s/%.*s",
 811                                                  dir, line.len, line.ptr);
 812                                 free(dir);
 813                         }
 814                         if (glob(pattern, GLOB_ERR, NULL, &buf) != 0)
 815                         {
 816                                 DBG1(DBG_CFG, "expanding file expression '%s' failed", pattern);
 817                                 globfree(&buf);
 818                         }
 819                         else
 820                         {
 821                                 for (expanded = buf.gl_pathv; *expanded != NULL; expanded++)
 822                                 {
 823                                         load_secrets(this, *expanded, level + 1, prompt);
 824                                 }
 825                         }
 826                         globfree(&buf);
 827                         continue;
 828                 }
 829
 830                 if (line.len > 2 && strneq(": ", line.ptr, 2))
 831                 {
 832                         /* no ids, skip the ':' */
 833                         ids = chunk_empty;
 834                         line.ptr++;
 835                         line.len--;
 836                 }
 837                 else if (extract_token_str(&ids, " : ", &line))
 838                 {
 839                         /* NULL terminate the extracted id string */
 840                         *(ids.ptr + ids.len) = '\0';
 841                 }
 842                 else
 843                 {
 844                         DBG1(DBG_CFG, "line %d: missing ' : ' separator", line_nr);
 845                         goto error;
 846                 }
 847
 848                 if (!eat_whitespace(&line) || !extract_token(&token, ' ', &line))
 849                 {
 850                         DBG1(DBG_CFG, "line %d: missing token", line_nr);
 851                         goto error;
 852                 }
 853                 if (match("RSA", &token) || match("ECDSA", &token))
 854                 {
 855                         char path[PATH_MAX];
 856                         chunk_t filename;
 857                         chunk_t secret = chunk_empty;
 858                         private_key_t *key = NULL;
 859                         key_type_t key_type = match("RSA", &token) ? KEY_RSA : KEY_ECDSA;
 860
 861                         err_t ugh = extract_value(&filename, &line);
 862
 863                         if (ugh != NULL)
 864                         {
 865                                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 866                                 goto error;
 867                         }
 868                         if (filename.len == 0)
 869                         {
 870                                 DBG1(DBG_CFG, "line %d: empty filename", line_nr);
 871                                 goto error;
 872                         }
 873                         if (*filename.ptr == '/')
 874                         {
 875                                 /* absolute path name */
 876                                 snprintf(path, sizeof(path), "%.*s", filename.len, filename.ptr);
 877                         }
 878                         else
 879                         {
 880                                 /* relative path name */
 881                                 snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
 882                                                  filename.len, filename.ptr);
 883                         }
 884
 885                         /* check for optional passphrase */
 886                         if (eat_whitespace(&line))
 887                         {
 888                                 ugh = extract_secret(&secret, &line);
 889                                 if (ugh != NULL)
 890                                 {
 891                                         DBG1(DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
 892                                         goto error;
 893                                 }
 894                         }
 895                         if (secret.len == 7 && strneq(secret.ptr, "%prompt", 7))
 896                         {
 897                                 if (prompt)
 898                                 {
 899                                         passphrase_cb_data_t data;
 900
 901                                         data.prompt = prompt;
 902                                         data.file = path;
 903                                         key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 904                                                                                          key_type, BUILD_FROM_FILE, path,
 905                                                                                          BUILD_PASSPHRASE_CALLBACK,
 906                                                                                          passphrase_cb, &data, BUILD_END);
 907                                 }
 908                         }
 909                         else
 910                         {
 911                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
 912                                                                                  BUILD_FROM_FILE, path,
 913                                                                                  BUILD_PASSPHRASE, secret, BUILD_END);
 914                         }
 915                         if (key)
 916                         {
 917                                 DBG1(DBG_CFG, "  loaded %N private key from '%s'",
 918                                          key_type_names, key->get_type(key), path);
 919                                 this->private->insert_last(this->private, key);
 920                         }
 921                         else
 922                         {
 923                                 DBG1(DBG_CFG, "  loading private key from '%s' failed", path);
 924                         }
 925                         chunk_clear(&secret);
 926                 }
 927                 else if (match("PIN", &token))
 928                 {
 929                         chunk_t sc = chunk_empty, secret = chunk_empty;
 930                         char smartcard[32], keyid[22], pin[32];
 931                         private_key_t *key;
 932                         u_int slot;
 933
 934                         err_t ugh = extract_value(&sc, &line);
 935
 936                         if (ugh != NULL)
 937                         {
 938                                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 939                                 goto error;
 940                         }
 941                         if (sc.len == 0)
 942                         {
 943                                 DBG1(DBG_CFG, "line %d: expected %%smartcard specifier", line_nr);
 944                                 goto error;
 945                         }
 946                         snprintf(smartcard, sizeof(smartcard), "%.*s", sc.len, sc.ptr);
 947                         smartcard[sizeof(smartcard) - 1] = '\0';
 948
 949                         /* parse slot and key id. only two formats are supported.
 950                          * first try %smartcard<slot>:<keyid> */
 951                         if (sscanf(smartcard, "%%smartcard%u:%s", &slot, keyid) == 2)
 952                         {
 953                                 snprintf(smartcard, sizeof(smartcard), "%u:%s", slot, keyid);
 954                         }
 955                         /* then try %smartcard:<keyid> */
 956                         else if (sscanf(smartcard, "%%smartcard:%s", keyid) == 1)
 957                         {
 958                                 snprintf(smartcard, sizeof(smartcard), "%s", keyid);
 959                         }
 960                         else
 961                         {
 962                                 DBG1(DBG_CFG, "line %d: the given %%smartcard specifier is not"
 963                                                 " supported or invalid", line_nr);
 964                                 goto error;
 965                         }
 966
 967                         if (!eat_whitespace(&line))
 968                         {
 969                                 DBG1(DBG_CFG, "line %d: expected PIN", line_nr);
 970                                 goto error;
 971                         }
 972                         ugh = extract_secret(&secret, &line);
 973                         if (ugh != NULL)
 974                         {
 975                                 DBG1(DBG_CFG, "line %d: malformed PIN: %s", line_nr, ugh);
 976                                 goto error;
 977                         }
 978                         snprintf(pin, sizeof(pin), "%.*s", secret.len, secret.ptr);
 979                         pin[sizeof(pin) - 1] = '\0';
 980
 981                         /* we assume an RSA key */
 982                         key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
 983                                                                          BUILD_SMARTCARD_KEYID, smartcard,
 984                                                                          BUILD_SMARTCARD_PIN, pin, BUILD_END);
 985
 986                         if (key)
 987                         {
 988                                 DBG1(DBG_CFG, "  loaded private key from %.*s", sc.len, sc.ptr);
 989                                 this->private->insert_last(this->private, key);
 990                         }
 991                         memset(pin, 0, sizeof(pin));
 992                         chunk_clear(&secret);
 993                 }
 994                 else if ((match("PSK", &token) && (type = SHARED_IKE)) ||
 995                                  (match("EAP", &token) && (type = SHARED_EAP)) ||
 996                                  (match("NTLM", &token) && (type = SHARED_NT_HASH)) ||
 997                                  (match("XAUTH", &token) && (type = SHARED_EAP)))
 998                 {
 999                         stroke_shared_key_t *shared_key;
1000                         chunk_t secret = chunk_empty;
1001                         bool any = TRUE;
1002
1003                         err_t ugh = extract_secret(&secret, &line);
1004                         if (ugh != NULL)
1005                         {
1006                                 DBG1(DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
1007                                 goto error;
1008                         }
1009                         shared_key = stroke_shared_key_create(type, secret);
1010                         DBG1(DBG_CFG, "  loaded %N secret for %s", shared_key_type_names, type,
1011                                  ids.len > 0 ? (char*)ids.ptr : "%any");
1012                         DBG4(DBG_CFG, "  secret: %#B", &secret);
1013
1014                         this->shared->insert_last(this->shared, shared_key);
1015                         while (ids.len > 0)
1016                         {
1017                                 chunk_t id;
1018                                 identification_t *peer_id;
1019
1020                                 ugh = extract_value(&id, &ids);
1021                                 if (ugh != NULL)
1022                                 {
1023                                         DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
1024                                         goto error;
1025                                 }
1026                                 if (id.len == 0)
1027                                 {
1028                                         continue;
1029                                 }
1030
1031                                 /* NULL terminate the ID string */
1032                                 *(id.ptr + id.len) = '\0';
1033                                 peer_id = identification_create_from_string(id.ptr);
1034                                 if (peer_id->get_type(peer_id) == ID_ANY)
1035                                 {
1036                                         peer_id->destroy(peer_id);
1037                                         continue;
1038                                 }
1039
1040                                 shared_key->add_owner(shared_key, peer_id);
1041                                 any = FALSE;
1042                         }
1043                         if (any)
1044                         {
1045                                 shared_key->add_owner(shared_key,
1046                                         identification_create_from_encoding(ID_ANY, chunk_empty));
1047                         }
1048                 }
1049                 else
1050                 {
1051                         DBG1(DBG_CFG, "line %d: token must be either "
1052                                  "RSA, ECDSA, PSK, EAP, XAUTH or PIN", line_nr);
1053                         goto error;
1054                 }
1055         }
1056 error:
1057         if (level == 0)
1058         {
1059                 this->lock->unlock(this->lock);
1060         }
1061         chunk_clear(&chunk);
1062 }
1063
1064 /**
1065  * load all certificates from ipsec.d
1066  */
1067 static void load_certs(private_stroke_cred_t *this)
1068 {
1069         DBG1(DBG_CFG, "loading ca certificates from '%s'",
1070                  CA_CERTIFICATE_DIR);
1071         load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
1072
1073         DBG1(DBG_CFG, "loading aa certificates from '%s'",
1074                  AA_CERTIFICATE_DIR);
1075         load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
1076
1077         DBG1(DBG_CFG, "loading ocsp signer certificates from '%s'",
1078                  OCSP_CERTIFICATE_DIR);
1079         load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509, X509_OCSP_SIGNER);
1080
1081         DBG1(DBG_CFG, "loading attribute certificates from '%s'",
1082                  ATTR_CERTIFICATE_DIR);
1083         load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
1084
1085         DBG1(DBG_CFG, "loading crls from '%s'",
1086                  CRL_DIR);
1087         load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
1088 }
1089
1090 /**
1091  * Implementation of stroke_cred_t.reread.
1092  */
1093 static void reread(private_stroke_cred_t *this, stroke_msg_t *msg, FILE *prompt)
1094 {
1095         if (msg->reread.flags & REREAD_SECRETS)
1096         {
1097                 DBG1(DBG_CFG, "rereading secrets");
1098                 load_secrets(this, SECRETS_FILE, 0, prompt);
1099         }
1100         if (msg->reread.flags & REREAD_CACERTS)
1101         {
1102                 DBG1(DBG_CFG, "rereading ca certificates from '%s'",
1103                          CA_CERTIFICATE_DIR);
1104                 load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
1105         }
1106         if (msg->reread.flags & REREAD_OCSPCERTS)
1107         {
1108                 DBG1(DBG_CFG, "rereading ocsp signer certificates from '%s'",
1109                          OCSP_CERTIFICATE_DIR);
1110                 load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509,
1111                          X509_OCSP_SIGNER);
1112         }
1113         if (msg->reread.flags & REREAD_AACERTS)
1114         {
1115                 DBG1(DBG_CFG, "rereading aa certificates from '%s'",
1116                          AA_CERTIFICATE_DIR);
1117                 load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
1118         }
1119         if (msg->reread.flags & REREAD_ACERTS)
1120         {
1121                 DBG1(DBG_CFG, "rereading attribute certificates from '%s'",
1122                          ATTR_CERTIFICATE_DIR);
1123                 load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
1124         }
1125         if (msg->reread.flags & REREAD_CRLS)
1126         {
1127                 DBG1(DBG_CFG, "rereading crls from '%s'",
1128                          CRL_DIR);
1129                 load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
1130         }
1131 }
1132
1133 /**
1134  * Implementation of stroke_cred_t.destroy
1135  */
1136 static void destroy(private_stroke_cred_t *this)
1137 {
1138         this->certs->destroy_offset(this->certs, offsetof(certificate_t, destroy));
1139         this->shared->destroy_offset(this->shared, offsetof(shared_key_t, destroy));
1140         this->private->destroy_offset(this->private, offsetof(private_key_t, destroy));
1141         this->lock->destroy(this->lock);
1142         free(this);
1143 }
1144
1145 /*
1146  * see header file
1147  */
1148 stroke_cred_t *stroke_cred_create()
1149 {
1150         private_stroke_cred_t *this = malloc_thing(private_stroke_cred_t);
1151
1152         this->public.set.create_private_enumerator = (void*)create_private_enumerator;
1153         this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
1154         this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
1155         this->public.set.create_cdp_enumerator = (void*)return_null;
1156         this->public.set.cache_cert = (void*)cache_cert;
1157         this->public.reread = (void(*)(stroke_cred_t*, stroke_msg_t *msg, FILE*))reread;
1158         this->public.load_ca = (certificate_t*(*)(stroke_cred_t*, char *filename))load_ca;
1159         this->public.load_peer = (certificate_t*(*)(stroke_cred_t*, char *filename))load_peer;
1160         this->public.cachecrl = (void(*)(stroke_cred_t*, bool enabled))cachecrl;
1161         this->public.destroy = (void(*)(stroke_cred_t*))destroy;
1162
1163         this->certs = linked_list_create();
1164         this->shared = linked_list_create();
1165         this->private = linked_list_create();
1166         this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
1167
1168         load_certs(this);
1169         load_secrets(this, SECRETS_FILE, 0, NULL);
1170
1171         this->cachecrl = FALSE;
1172
1173         return &this->public;
1174 }
1175