projects / strongswan.git / blob
? search:


b0791ce1abd6308dc089e4d0fb64488d864afca6
[strongswan.git] / src / charon / plugins / stroke / stroke_list.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 *
15 * $Id$
16 */
17
18 #include "stroke_list.h"
19
20 #include <time.h>
21
22 #include <daemon.h>
23 #include <utils/linked_list.h>
24 #include <credentials/certificates/x509.h>
25 #include <credentials/certificates/ac.h>
26 #include <credentials/certificates/crl.h>
27 #include <config/peer_cfg.h>
28
29 /* warning intervals for list functions */
30 #define CERT_WARNING_INTERVAL 30 /* days */
31 #define CRL_WARNING_INTERVAL 7 /* days */
32 #define AC_WARNING_INTERVAL 1 /* day */
33
34 typedef struct private_stroke_list_t private_stroke_list_t;
35
36 /**
37 * private data of stroke_list
38 */
39 struct private_stroke_list_t {
40
41 /**
42 * public functions
43 */
44 stroke_list_t public;
45
46 /**
47 * timestamp of daemon start
48 */
49 time_t uptime;
50
51 /**
52 * strokes attribute provider
53 */
54 stroke_attribute_t *attribute;
55 };
56
57 /**
58 * get the authentication class of a config
59 */
60 auth_class_t get_auth_class(peer_cfg_t *config)
61 {
62 auth_class_t *class;
63 auth_info_t *auth_info;
64
65 auth_info = config->get_auth(config);
66 if (auth_info->get_item(auth_info, AUTHN_AUTH_CLASS, (void**)&class))
67 {
68 return *class;
69 }
70 /* fallback to pubkey authentication */
71 return AUTH_CLASS_PUBKEY;
72 }
73
74 /**
75 * log an IKE_SA to out
76 */
77 static void log_ike_sa(FILE *out, ike_sa_t *ike_sa, bool all)
78 {
79 ike_sa_id_t *id = ike_sa->get_id(ike_sa);
80 u_int32_t now;
81
82 now = time(NULL);
83
84 fprintf(out, "%12s[%d]: %N",
85 ike_sa->get_name(ike_sa), ike_sa->get_unique_id(ike_sa),
86 ike_sa_state_names, ike_sa->get_state(ike_sa));
87
88 if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED)
89 {
90 u_int32_t established;
91
92 established = now - ike_sa->get_statistic(ike_sa, STAT_ESTABLISHED);
93 fprintf(out, " %V", &established);
94 }
95
96 fprintf(out, ", %H[%D]...%H[%D]\n",
97 ike_sa->get_my_host(ike_sa), ike_sa->get_my_id(ike_sa),
98 ike_sa->get_other_host(ike_sa), ike_sa->get_other_id(ike_sa));
99
100 if (all)
101 {
102 proposal_t *ike_proposal;
103
104 ike_proposal = ike_sa->get_proposal(ike_sa);
105
106 fprintf(out, "%12s[%d]: IKE SPIs: %.16llx_i%s %.16llx_r%s",
107 ike_sa->get_name(ike_sa), ike_sa->get_unique_id(ike_sa),
108 id->get_initiator_spi(id), id->is_initiator(id) ? "*" : "",
109 id->get_responder_spi(id), id->is_initiator(id) ? "" : "*");
110
111
112 if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED)
113 {
114 u_int32_t rekey, reauth;
115
116 rekey = ike_sa->get_statistic(ike_sa, STAT_REKEY);
117 reauth = ike_sa->get_statistic(ike_sa, STAT_REAUTH);
118
119 if (rekey)
120 {
121 rekey -= now;
122 fprintf(out, ", rekeying in %V", &rekey);
123 }
124 if (reauth)
125 {
126 reauth -= now;
127 fprintf(out, ", %N reauthentication in %V", auth_class_names,
128 get_auth_class(ike_sa->get_peer_cfg(ike_sa)), &reauth);
129 }
130 if (!rekey && !reauth)
131 {
132 fprintf(out, ", rekeying disabled");
133 }
134 }
135 fprintf(out, "\n");
136
137 if (ike_proposal)
138 {
139 char buf[BUF_LEN];
140
141 snprintf(buf, BUF_LEN, "%P", ike_proposal);
142 fprintf(out, "%12s[%d]: IKE proposal: %s\n",
143 ike_sa->get_name(ike_sa), ike_sa->get_unique_id(ike_sa),
144 buf+4);
145 }
146 }
147 }
148
149 /**
150 * log an CHILD_SA to out
151 */
152 static void log_child_sa(FILE *out, child_sa_t *child_sa, bool all)
153 {
154 u_int32_t rekey, now = time(NULL);
155 u_int32_t use_in, use_out;
156 proposal_t *proposal;
157 child_cfg_t *config = child_sa->get_config(child_sa);
158
159 fprintf(out, "%12s{%d}: %N, %N%s",
160 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
161 child_sa_state_names, child_sa->get_state(child_sa),
162 ipsec_mode_names, child_sa->get_mode(child_sa),
163 config->use_proxy_mode(config) ? "_PROXY" : "");
164
165 if (child_sa->get_state(child_sa) == CHILD_INSTALLED)
166 {
167 fprintf(out, ", %N%s SPIs: %.8x_i %.8x_o",
168 protocol_id_names, child_sa->get_protocol(child_sa),
169 child_sa->has_encap(child_sa) ? " in UDP" : "",
170 ntohl(child_sa->get_spi(child_sa, TRUE)),
171 ntohl(child_sa->get_spi(child_sa, FALSE)));
172
173 if (child_sa->get_ipcomp(child_sa) != IPCOMP_NONE)
174 {
175 fprintf(out, ", IPCOMP CPIs: %.4x_i %.4x_o",
176 ntohs(child_sa->get_cpi(child_sa, TRUE)),
177 ntohs(child_sa->get_cpi(child_sa, FALSE)));
178 }
179
180 if (all)
181 {
182 fprintf(out, "\n%12s{%d}: ", child_sa->get_name(child_sa),
183 child_sa->get_reqid(child_sa));
184
185 proposal = child_sa->get_proposal(child_sa);
186 if (proposal)
187 {
188 u_int16_t encr_alg = ENCR_UNDEFINED, int_alg = AUTH_UNDEFINED;
189 u_int16_t encr_size = 0, int_size = 0;
190
191 proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
192 &encr_alg, &encr_size);
193 proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
194 &int_alg, &int_size);
195
196 if (encr_alg != ENCR_UNDEFINED)
197 {
198 fprintf(out, "%N", encryption_algorithm_names, encr_alg);
199 if (encr_size)
200 {
201 fprintf(out, "-%d", encr_size);
202 }
203 }
204 if (int_alg != AUTH_UNDEFINED)
205 {
206 fprintf(out, "/%N", integrity_algorithm_names, int_alg);
207 if (int_size)
208 {
209 fprintf(out, "-%d", int_size);
210 }
211 }
212 }
213 fprintf(out, ", rekeying ");
214
215 rekey = child_sa->get_lifetime(child_sa, FALSE);
216 if (rekey)
217 {
218 fprintf(out, "in %#V", &now, &rekey);
219 }
220 else
221 {
222 fprintf(out, "disabled");
223 }
224
225 fprintf(out, ", last use: ");
226 use_in = child_sa->get_usetime(child_sa, TRUE);
227 if (use_in)
228 {
229 fprintf(out, "%ds_i ", now - use_in);
230 }
231 else
232 {
233 fprintf(out, "no_i ");
234 }
235 use_out = child_sa->get_usetime(child_sa, FALSE);
236 if (use_out)
237 {
238 fprintf(out, "%ds_o ", now - use_out);
239 }
240 else
241 {
242 fprintf(out, "no_o ");
243 }
244 }
245 }
246
247 fprintf(out, "\n%12s{%d}: %#R=== %#R\n",
248 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
249 child_sa->get_traffic_selectors(child_sa, TRUE),
250 child_sa->get_traffic_selectors(child_sa, FALSE));
251 }
252
253 /**
254 * Implementation of stroke_list_t.status.
255 */
256 static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bool all)
257 {
258 enumerator_t *enumerator, *children;
259 ike_cfg_t *ike_cfg;
260 child_cfg_t *child_cfg;
261 ike_sa_t *ike_sa;
262 bool found = FALSE;
263 char *name = msg->status.name;
264
265 if (all)
266 {
267 peer_cfg_t *peer_cfg;
268 char *plugin, *name;
269 host_t *host;
270 u_int32_t dpd;
271 time_t uptime = time(NULL) - this->uptime;
272 bool first = TRUE;
273 u_int size, online, offline;
274
275 fprintf(out, "Performance:\n");
276 fprintf(out, " uptime: %V, since %#T\n", &uptime, &this->uptime, FALSE);
277 fprintf(out, " worker threads: %d idle of %d,",
278 charon->processor->get_idle_threads(charon->processor),
279 charon->processor->get_total_threads(charon->processor));
280 fprintf(out, " job queue load: %d,",
281 charon->processor->get_job_load(charon->processor));
282 fprintf(out, " scheduled events: %d\n",
283 charon->scheduler->get_job_load(charon->scheduler));
284 fprintf(out, " loaded plugins: ");
285 enumerator = lib->plugins->create_plugin_enumerator(lib->plugins);
286 while (enumerator->enumerate(enumerator, &plugin))
287 {
288 fprintf(out, "%s ", plugin);
289 }
290 enumerator->destroy(enumerator);
291 fprintf(out, "\n");
292
293 enumerator = this->attribute->create_pool_enumerator(this->attribute);
294 while (enumerator->enumerate(enumerator, &name, &size, &online, &offline))
295 {
296 if (first)
297 {
298 first = FALSE;
299 fprintf(out, "Virtual IP pools (size/online/offline):\n");
300 }
301 fprintf(out, " %s: %lu/%lu/%lu\n", name, size, online, offline);
302 }
303 enumerator->destroy(enumerator);
304
305 enumerator = charon->kernel_interface->create_address_enumerator(
306 charon->kernel_interface, FALSE, FALSE);
307 fprintf(out, "Listening IP addresses:\n");
308 while (enumerator->enumerate(enumerator, (void**)&host))
309 {
310 fprintf(out, " %H\n", host);
311 }
312 enumerator->destroy(enumerator);
313
314 fprintf(out, "Connections:\n");
315 enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends);
316 while (enumerator->enumerate(enumerator, (void**)&peer_cfg))
317 {
318 void *ptr;
319 certificate_t *cert;
320 auth_item_t item;
321 auth_info_t *auth;
322 enumerator_t *auth_enumerator;
323 identification_t *my_ca = NULL, *other_ca = NULL;
324 identification_t *eap_identity = NULL;
325 u_int32_t *eap_type = NULL;
326 bool ac_groups = FALSE;
327
328 if (peer_cfg->get_ike_version(peer_cfg) != 2 ||
329 (name && !streq(name, peer_cfg->get_name(peer_cfg))))
330 {
331 continue;
332 }
333
334 /* determine any required CAs, EAP type, EAP identity,
335 * and the presence of AC groups
336 */
337 auth = peer_cfg->get_auth(peer_cfg);
338 auth_enumerator = auth->create_item_enumerator(auth);
339 while (auth_enumerator->enumerate(auth_enumerator, &item, &ptr))
340 {
341 switch (item)
342 {
343 case AUTHN_EAP_TYPE:
344 eap_type = (u_int32_t *)ptr;
345 break;
346 case AUTHN_EAP_IDENTITY:
347 eap_identity = (identification_t *)ptr;
348 break;
349 case AUTHN_CA_CERT:
350 cert = (certificate_t *)ptr;
351 my_ca = cert->get_subject(cert);
352 break;
353 case AUTHN_CA_CERT_NAME:
354 my_ca = (identification_t *)ptr;
355 break;
356 case AUTHZ_CA_CERT:
357 cert = (certificate_t *)ptr;
358 other_ca = cert->get_subject(cert);
359 break;
360 case AUTHZ_CA_CERT_NAME:
361 other_ca = (identification_t *)ptr;
362 break;
363 case AUTHZ_AC_GROUP:
364 ac_groups = TRUE;
365 break;
366 default:
367 break;
368 }
369 }
370 auth_enumerator->destroy(auth_enumerator);
371
372 ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
373 fprintf(out, "%12s: %s[%D]...%s[%D]\n", peer_cfg->get_name(peer_cfg),
374 ike_cfg->get_my_addr(ike_cfg), peer_cfg->get_my_id(peer_cfg),
375 ike_cfg->get_other_addr(ike_cfg), peer_cfg->get_other_id(peer_cfg));
376 if (my_ca || other_ca)
377 {
378 fprintf(out, "%12s: CAs: ", peer_cfg->get_name(peer_cfg));
379 if (my_ca)
380 {
381 fprintf(out, "\"%D\"...", my_ca);
382 }
383 else
384 {
385 fprintf(out, "%%any...");
386 }
387 if (other_ca)
388 {
389 fprintf(out, "\"%D\"\n", other_ca);
390 }
391 else
392 {
393 fprintf(out, "%%any\n");
394 }
395 }
396
397 if (ac_groups)
398 {
399 bool first = TRUE;
400
401 fprintf(out, "%12s: groups: ", peer_cfg->get_name(peer_cfg));
402 auth_enumerator = auth->create_item_enumerator(auth);
403 while (auth_enumerator->enumerate(auth_enumerator, &item, &ptr))
404 {
405 if (item == AUTHZ_AC_GROUP)
406 {
407 identification_t *group = (identification_t *)ptr;
408
409 fprintf(out, "%s%D", first? "":", ", group);
410 first = FALSE;
411 }
412 }
413 auth_enumerator->destroy(auth_enumerator);
414 fprintf(out, "\n");
415 }
416
417 fprintf(out, "%12s: %N ", peer_cfg->get_name(peer_cfg),
418 auth_class_names, get_auth_class(peer_cfg));
419 if (eap_type)
420 {
421 fprintf(out, "and %N ", eap_type_names, *eap_type);
422 }
423 fprintf(out, "authentication");
424 if (eap_identity)
425 {
426 fprintf(out, ", EAP identity: '%D'", eap_identity);
427 }
428 dpd = peer_cfg->get_dpd(peer_cfg);
429 if (dpd)
430 {
431 fprintf(out, ", dpddelay=%us", dpd);
432 }
433 fprintf(out, "\n");
434
435 children = peer_cfg->create_child_cfg_enumerator(peer_cfg);
436 while (children->enumerate(children, &child_cfg))
437 {
438 linked_list_t *my_ts, *other_ts;
439
440 my_ts = child_cfg->get_traffic_selectors(child_cfg, TRUE, NULL, NULL);
441 other_ts = child_cfg->get_traffic_selectors(child_cfg, FALSE, NULL, NULL);
442 fprintf(out, "%12s: %#R=== %#R", child_cfg->get_name(child_cfg),
443 my_ts, other_ts);
444 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
445 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
446
447 if (dpd)
448 {
449 fprintf(out, ", dpdaction=%N", action_names,
450 child_cfg->get_dpd_action(child_cfg));
451 }
452 fprintf(out, "\n");
453 }
454 children->destroy(children);
455 }
456 enumerator->destroy(enumerator);
457 }
458
459 fprintf(out, "Security Associations:\n");
460 enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
461 while (enumerator->enumerate(enumerator, &ike_sa))
462 {
463 bool ike_printed = FALSE;
464 child_sa_t *child_sa;
465 iterator_t *children = ike_sa->create_child_sa_iterator(ike_sa);
466
467 if (name == NULL || streq(name, ike_sa->get_name(ike_sa)))
468 {
469 log_ike_sa(out, ike_sa, all);
470 found = TRUE;
471 ike_printed = TRUE;
472 }
473
474 while (children->iterate(children, (void**)&child_sa))
475 {
476 if (name == NULL || streq(name, child_sa->get_name(child_sa)))
477 {
478 if (!ike_printed)
479 {
480 log_ike_sa(out, ike_sa, all);
481 found = TRUE;
482 ike_printed = TRUE;
483 }
484 log_child_sa(out, child_sa, all);
485 }
486 }
487 children->destroy(children);
488 }
489 enumerator->destroy(enumerator);
490
491 if (!found)
492 {
493 if (name)
494 {
495 fprintf(out, " no match\n");
496 }
497 else
498 {
499 fprintf(out, " none\n");
500 }
501 }
502 }
503
504 /**
505 * create a unique certificate list without duplicates
506 * certicates having the same issuer are grouped together.
507 */
508 static linked_list_t* create_unique_cert_list(certificate_type_t type)
509 {
510 linked_list_t *list = linked_list_create();
511 enumerator_t *enumerator = charon->credentials->create_cert_enumerator(
512 charon->credentials, type, KEY_ANY,
513 NULL, FALSE);
514 certificate_t *cert;
515
516 while (enumerator->enumerate(enumerator, (void**)&cert))
517 {
518 iterator_t *iterator = list->create_iterator(list, TRUE);
519 identification_t *issuer = cert->get_issuer(cert);
520 bool previous_same, same = FALSE, last = TRUE;
521 certificate_t *list_cert;
522
523 while (iterator->iterate(iterator, (void**)&list_cert))
524 {
525 /* exit if we have a duplicate? */
526 if (list_cert->equals(list_cert, cert))
527 {
528 last = FALSE;
529 break;
530 }
531 /* group certificates with same issuer */
532 previous_same = same;
533 same = list_cert->has_issuer(list_cert, issuer);
534 if (previous_same && !same)
535 {
536 iterator->insert_before(iterator, (void *)cert->get_ref(cert));
537 last = FALSE;
538 break;
539 }
540 }
541 iterator->destroy(iterator);
542
543 if (last)
544 {
545 list->insert_last(list, (void *)cert->get_ref(cert));
546 }
547 }
548 enumerator->destroy(enumerator);
549 return list;
550 }
551
552 /**
553 * list all raw public keys
554 */
555 static void stroke_list_pubkeys(linked_list_t *list, bool utc, FILE *out)
556 {
557 bool first = TRUE;
558
559 enumerator_t *enumerator = list->create_enumerator(list);
560 certificate_t *cert;
561
562 while (enumerator->enumerate(enumerator, (void**)&cert))
563 {
564 public_key_t *public = cert->get_public_key(cert);
565
566 if (public)
567 {
568 private_key_t *private = NULL;
569 identification_t *id, *keyid;
570
571 if (first)
572 {
573 fprintf(out, "\n");
574 fprintf(out, "List of Raw Public Keys:\n");
575 first = FALSE;
576 }
577 fprintf(out, "\n");
578
579 /* list public key information */
580 id = public->get_id(public, ID_PUBKEY_SHA1);
581 keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
582
583 private = charon->credentials->get_private(
584 charon->credentials,
585 public->get_type(public), keyid, NULL);
586 fprintf(out, " pubkey: %N %d bits%s\n",
587 key_type_names, public->get_type(public),
588 public->get_keysize(public) * 8,
589 private ? ", has private key" : "");
590 fprintf(out, " keyid: %D\n", keyid);
591 fprintf(out, " subjkey: %D\n", id);
592 DESTROY_IF(private);
593 public->destroy(public);
594 }
595 }
596 enumerator->destroy(enumerator);
597 }
598
599 /**
600 * list all X.509 certificates matching the flags
601 */
602 static void stroke_list_certs(linked_list_t *list, char *label,
603 x509_flag_t flags, bool utc, FILE *out)
604 {
605 bool first = TRUE;
606 time_t now = time(NULL);
607 enumerator_t *enumerator = list->create_enumerator(list);
608 certificate_t *cert;
609
610 while (enumerator->enumerate(enumerator, (void**)&cert))
611 {
612 x509_t *x509 = (x509_t*)cert;
613 x509_flag_t x509_flags = x509->get_flags(x509);
614
615 /* list only if flag is set, or flags == 0 (ignoring self-signed) */
616 if ((x509_flags & flags) || (flags == (x509_flags & ~X509_SELF_SIGNED)))
617 {
618 enumerator_t *enumerator;
619 identification_t *altName;
620 bool first_altName = TRUE;
621 chunk_t serial = x509->get_serial(x509);
622 identification_t *authkey = x509->get_authKeyIdentifier(x509);
623 time_t notBefore, notAfter;
624 public_key_t *public = cert->get_public_key(cert);
625
626 if (first)
627 {
628 fprintf(out, "\n");
629 fprintf(out, "List of %s:\n", label);
630 first = FALSE;
631 }
632 fprintf(out, "\n");
633
634 /* list subjectAltNames */
635 enumerator = x509->create_subjectAltName_enumerator(x509);
636 while (enumerator->enumerate(enumerator, (void**)&altName))
637 {
638 if (first_altName)
639 {
640 fprintf(out, " altNames: ");
641 first_altName = FALSE;
642 }
643 else
644 {
645 fprintf(out, ", ");
646 }
647 fprintf(out, "%D", altName);
648 }
649 if (!first_altName)
650 {
651 fprintf(out, "\n");
652 }
653 enumerator->destroy(enumerator);
654
655 fprintf(out, " subject: \"%D\"\n", cert->get_subject(cert));
656 fprintf(out, " issuer: \"%D\"\n", cert->get_issuer(cert));
657 fprintf(out, " serial: %#B\n", &serial);
658
659 /* list validity */
660 cert->get_validity(cert, &now, &notBefore, &notAfter);
661 fprintf(out, " validity: not before %#T, ", &notBefore, utc);
662 if (now < notBefore)
663 {
664 fprintf(out, "not valid yet (valid in %#V)\n", &now, &notBefore);
665 }
666 else
667 {
668 fprintf(out, "ok\n");
669 }
670 fprintf(out, " not after %#T, ", &notAfter, utc);
671 if (now > notAfter)
672 {
673 fprintf(out, "expired (%#V ago)\n", &now, &notAfter);
674 }
675 else
676 {
677 fprintf(out, "ok");
678 if (now > notAfter - CERT_WARNING_INTERVAL * 60 * 60 * 24)
679 {
680 fprintf(out, " (expires in %#V)", &now, &notAfter);
681 }
682 fprintf(out, " \n");
683 }
684
685 /* list public key information */
686 if (public)
687 {
688 private_key_t *private = NULL;
689 identification_t *id, *keyid;
690
691 id = public->get_id(public, ID_PUBKEY_SHA1);
692 keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
693
694 private = charon->credentials->get_private(
695 charon->credentials,
696 public->get_type(public), keyid, NULL);
697 fprintf(out, " pubkey: %N %d bits%s\n",
698 key_type_names, public->get_type(public),
699 public->get_keysize(public) * 8,
700 private ? ", has private key" : "");
701 fprintf(out, " keyid: %D\n", keyid);
702 fprintf(out, " subjkey: %D\n", id);
703 DESTROY_IF(private);
704 public->destroy(public);
705 }
706
707 /* list optional authorityKeyIdentifier */
708 if (authkey)
709 {
710 fprintf(out, " authkey: %D\n", authkey);
711 }
712 }
713 }
714 enumerator->destroy(enumerator);
715 }
716
717 /**
718 * list all X.509 attribute certificates
719 */
720 static void stroke_list_acerts(linked_list_t *list, bool utc, FILE *out)
721 {
722 bool first = TRUE;
723 time_t thisUpdate, nextUpdate, now = time(NULL);
724 enumerator_t *enumerator = list->create_enumerator(list);
725 certificate_t *cert;
726
727 while (enumerator->enumerate(enumerator, (void**)&cert))
728 {
729 ac_t *ac = (ac_t*)cert;
730 chunk_t serial = ac->get_serial(ac);
731 chunk_t holderSerial = ac->get_holderSerial(ac);
732 identification_t *holderIssuer = ac->get_holderIssuer(ac);
733 identification_t *authkey = ac->get_authKeyIdentifier(ac);
734 identification_t *entityName = cert->get_subject(cert);
735
736 if (first)
737 {
738 fprintf(out, "\n");
739 fprintf(out, "List of X.509 Attribute Certificates:\n");
740 first = FALSE;
741 }
742 fprintf(out, "\n");
743
744 if (entityName)
745 {
746 fprintf(out, " holder: \"%D\"\n", entityName);
747 }
748 if (holderIssuer)
749 {
750 fprintf(out, " hissuer: \"%D\"\n", holderIssuer);
751 }
752 if (holderSerial.ptr)
753 {
754 fprintf(out, " hserial: %#B\n", &holderSerial);
755 }
756 fprintf(out, " issuer: \"%D\"\n", cert->get_issuer(cert));
757 fprintf(out, " serial: %#B\n", &serial);
758
759 /* list validity */
760 cert->get_validity(cert, &now, &thisUpdate, &nextUpdate);
761 fprintf(out, " updates: this %#T\n", &thisUpdate, utc);
762 fprintf(out, " next %#T, ", &nextUpdate, utc);
763 if (now > nextUpdate)
764 {
765 fprintf(out, "expired (%#V ago)\n", &now, &nextUpdate);
766 }
767 else
768 {
769 fprintf(out, "ok");
770 if (now > nextUpdate - AC_WARNING_INTERVAL * 60 * 60 * 24)
771 {
772 fprintf(out, " (expires in %#V)", &now, &nextUpdate);
773 }
774 fprintf(out, " \n");
775 }
776
777 /* list optional authorityKeyIdentifier */
778 if (authkey)
779 {
780 fprintf(out, " authkey: %D\n", authkey);
781 }
782 }
783 enumerator->destroy(enumerator);
784 }
785
786 /**
787 * list all X.509 CRLs
788 */
789 static void stroke_list_crls(linked_list_t *list, bool utc, FILE *out)
790 {
791 bool first = TRUE;
792 time_t thisUpdate, nextUpdate, now = time(NULL);
793 enumerator_t *enumerator = list->create_enumerator(list);
794 certificate_t *cert;
795
796 while (enumerator->enumerate(enumerator, (void**)&cert))
797 {
798 crl_t *crl = (crl_t*)cert;
799 chunk_t serial = crl->get_serial(crl);
800 identification_t *authkey = crl->get_authKeyIdentifier(crl);
801
802 if (first)
803 {
804 fprintf(out, "\n");
805 fprintf(out, "List of X.509 CRLs:\n");
806 first = FALSE;
807 }
808 fprintf(out, "\n");
809
810 fprintf(out, " issuer: \"%D\"\n", cert->get_issuer(cert));
811
812 /* list optional crlNumber */
813 if (serial.ptr)
814 {
815 fprintf(out, " serial: %#B\n", &serial);
816 }
817
818 /* count the number of revoked certificates */
819 {
820 int count = 0;
821 enumerator_t *enumerator = crl->create_enumerator(crl);
822
823 while (enumerator->enumerate(enumerator, NULL, NULL, NULL))
824 {
825 count++;
826 }
827 fprintf(out, " revoked: %d certificate%s\n", count,
828 (count == 1)? "" : "s");
829 enumerator->destroy(enumerator);
830 }
831
832 /* list validity */
833 cert->get_validity(cert, &now, &thisUpdate, &nextUpdate);
834 fprintf(out, " updates: this %#T\n", &thisUpdate, utc);
835 fprintf(out, " next %#T, ", &nextUpdate, utc);
836 if (now > nextUpdate)
837 {
838 fprintf(out, "expired (%#V ago)\n", &now, &nextUpdate);
839 }
840 else
841 {
842 fprintf(out, "ok");
843 if (now > nextUpdate - CRL_WARNING_INTERVAL * 60 * 60 * 24)
844 {
845 fprintf(out, " (expires in %#V)", &now, &nextUpdate);
846 }
847 fprintf(out, " \n");
848 }
849
850 /* list optional authorityKeyIdentifier */
851 if (authkey)
852 {
853 fprintf(out, " authkey: %D\n", authkey);
854 }
855 }
856 enumerator->destroy(enumerator);
857 }
858
859 /**
860 * list all OCSP responses
861 */
862 static void stroke_list_ocsp(linked_list_t* list, bool utc, FILE *out)
863 {
864 bool first = TRUE;
865 enumerator_t *enumerator = list->create_enumerator(list);
866 certificate_t *cert;
867
868 while (enumerator->enumerate(enumerator, (void**)&cert))
869 {
870 if (first)
871 {
872 fprintf(out, "\n");
873 fprintf(out, "List of OCSP responses:\n");
874 fprintf(out, "\n");
875 first = FALSE;
876 }
877
878 fprintf(out, " signer: \"%D\"\n", cert->get_issuer(cert));
879 }
880 enumerator->destroy(enumerator);
881 }
882
883 /**
884 * List of registered cryptographical algorithms
885 */
886 static void list_algs(FILE *out)
887 {
888 enumerator_t *enumerator;
889 encryption_algorithm_t encryption;
890 integrity_algorithm_t integrity;
891 hash_algorithm_t hash;
892 pseudo_random_function_t prf;
893 diffie_hellman_group_t group;
894
895 fprintf(out, "\n");
896 fprintf(out, "List of registered IKEv2 Algorithms:\n");
897 fprintf(out, "\n encryption: ");
898 enumerator = lib->crypto->create_crypter_enumerator(lib->crypto);
899 while (enumerator->enumerate(enumerator, &encryption))
900 {
901 fprintf(out, "%N ", encryption_algorithm_names, encryption);
902 }
903 enumerator->destroy(enumerator);
904 fprintf(out, "\n integrity: ");
905 enumerator = lib->crypto->create_signer_enumerator(lib->crypto);
906 while (enumerator->enumerate(enumerator, &integrity))
907 {
908 fprintf(out, "%N ", integrity_algorithm_names, integrity);
909 }
910 enumerator->destroy(enumerator);
911 fprintf(out, "\n hasher: ");
912 enumerator = lib->crypto->create_hasher_enumerator(lib->crypto);
913 while (enumerator->enumerate(enumerator, &hash))
914 {
915 fprintf(out, "%N ", hash_algorithm_names, hash);
916 }
917 enumerator->destroy(enumerator);
918 fprintf(out, "\n prf: ");
919 enumerator = lib->crypto->create_prf_enumerator(lib->crypto);
920 while (enumerator->enumerate(enumerator, &prf))
921 {
922 fprintf(out, "%N ", pseudo_random_function_names, prf);
923 }
924 enumerator->destroy(enumerator);
925 fprintf(out, "\n dh-group: ");
926 enumerator = lib->crypto->create_dh_enumerator(lib->crypto);
927 while (enumerator->enumerate(enumerator, &group))
928 {
929 fprintf(out, "%N ", diffie_hellman_group_names, group);
930 }
931 enumerator->destroy(enumerator);
932 fprintf(out, "\n");
933 }
934
935 /**
936 * Implementation of stroke_list_t.list.
937 */
938 static void list(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out)
939 {
940 linked_list_t *cert_list = NULL;
941
942 if (msg->list.flags & LIST_PUBKEYS)
943 {
944 linked_list_t *pubkey_list = create_unique_cert_list(CERT_TRUSTED_PUBKEY);
945
946 stroke_list_pubkeys(pubkey_list, msg->list.utc, out);
947 pubkey_list->destroy_offset(pubkey_list, offsetof(certificate_t, destroy));
948 }
949 if (msg->list.flags & (LIST_CERTS | LIST_CACERTS | LIST_OCSPCERTS | LIST_AACERTS))
950 {
951 cert_list = create_unique_cert_list(CERT_X509);
952 }
953 if (msg->list.flags & LIST_CERTS)
954 {
955 stroke_list_certs(cert_list, "X.509 End Entity Certificates",
956 0, msg->list.utc, out);
957 }
958 if (msg->list.flags & LIST_CACERTS)
959 {
960 stroke_list_certs(cert_list, "X.509 CA Certificates",
961 X509_CA, msg->list.utc, out);
962 }
963 if (msg->list.flags & LIST_OCSPCERTS)
964 {
965 stroke_list_certs(cert_list, "X.509 OCSP Signer Certificates",
966 X509_OCSP_SIGNER, msg->list.utc, out);
967 }
968 if (msg->list.flags & LIST_AACERTS)
969 {
970 stroke_list_certs(cert_list, "X.509 AA Certificates",
971 X509_AA, msg->list.utc, out);
972 }
973 if (msg->list.flags & LIST_ACERTS)
974 {
975 linked_list_t *ac_list = create_unique_cert_list(CERT_X509_AC);
976
977 stroke_list_acerts(ac_list, msg->list.utc, out);
978 ac_list->destroy_offset(ac_list, offsetof(certificate_t, destroy));
979 }
980 if (msg->list.flags & LIST_CRLS)
981 {
982 linked_list_t *crl_list = create_unique_cert_list(CERT_X509_CRL);
983
984 stroke_list_crls(crl_list, msg->list.utc, out);
985 crl_list->destroy_offset(crl_list, offsetof(certificate_t, destroy));
986 }
987 if (msg->list.flags & LIST_OCSP)
988 {
989 linked_list_t *ocsp_list = create_unique_cert_list(CERT_X509_OCSP_RESPONSE);
990
991 stroke_list_ocsp(ocsp_list, msg->list.utc, out);
992
993 ocsp_list->destroy_offset(ocsp_list, offsetof(certificate_t, destroy));
994 }
995 if (msg->list.flags & LIST_ALGS)
996 {
997 list_algs(out);
998 }
999 DESTROY_OFFSET_IF(cert_list, offsetof(certificate_t, destroy));
1000 }
1001
1002 /**
1003 * Implementation of stroke_list_t.destroy
1004 */
1005 static void destroy(private_stroke_list_t *this)
1006 {
1007 free(this);
1008 }
1009
1010 /*
1011 * see header file
1012 */
1013 stroke_list_t *stroke_list_create(stroke_attribute_t *attribute)
1014 {
1015 private_stroke_list_t *this = malloc_thing(private_stroke_list_t);
1016
1017 this->public.list = (void(*)(stroke_list_t*, stroke_msg_t *msg, FILE *out))list;
1018 this->public.status = (void(*)(stroke_list_t*, stroke_msg_t *msg, FILE *out,bool))status;
1019 this->public.destroy = (void(*)(stroke_list_t*))destroy;
1020
1021 this->uptime = time(NULL);
1022 this->attribute = attribute;
1023
1024 return &this->public;
1025 }
1026
strongSwan - IPsec VPN