src/libcharon/plugins/stroke/stroke_cred.c

   1 /*
   2  * Copyright (C) 2008 Tobias Brunner
   3  * Copyright (C) 2008 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <sys/types.h>
  18 #include <sys/stat.h>
  19 #include <limits.h>
  20 #include <glob.h>
  21 #include <libgen.h>
  22 #include <sys/mman.h>
  23 #include <fcntl.h>
  24 #include <errno.h>
  25 #include <unistd.h>
  26
  27 #include "stroke_cred.h"
  28 #include "stroke_shared_key.h"
  29
  30 #include <credentials/certificates/x509.h>
  31 #include <credentials/certificates/crl.h>
  32 #include <credentials/certificates/ac.h>
  33 #include <credentials/sets/mem_cred.h>
  34 #include <credentials/sets/callback_cred.h>
  35 #include <utils/linked_list.h>
  36 #include <utils/lexparser.h>
  37 #include <threading/rwlock.h>
  38 #include <daemon.h>
  39
  40 /* configuration directories and files */
  41 #define CONFIG_DIR IPSEC_CONFDIR
  42 #define IPSEC_D_DIR CONFIG_DIR "/ipsec.d"
  43 #define PRIVATE_KEY_DIR IPSEC_D_DIR "/private"
  44 #define CERTIFICATE_DIR IPSEC_D_DIR "/certs"
  45 #define CA_CERTIFICATE_DIR IPSEC_D_DIR "/cacerts"
  46 #define AA_CERTIFICATE_DIR IPSEC_D_DIR "/aacerts"
  47 #define ATTR_CERTIFICATE_DIR IPSEC_D_DIR "/acerts"
  48 #define OCSP_CERTIFICATE_DIR IPSEC_D_DIR "/ocspcerts"
  49 #define CRL_DIR IPSEC_D_DIR "/crls"
  50 #define SECRETS_FILE CONFIG_DIR "/ipsec.secrets"
  51
  52 #define MAX_SECRETS_RECURSION 10
  53
  54 typedef struct private_stroke_cred_t private_stroke_cred_t;
  55
  56 /**
  57  * private data of stroke_cred
  58  */
  59 struct private_stroke_cred_t {
  60
  61         /**
  62          * public functions
  63          */
  64         stroke_cred_t public;
  65
  66         /**
  67          * list of trusted peer/signer/CA certificates (certificate_t)
  68          */
  69         linked_list_t *certs;
  70
  71         /**
  72          * list of shared secrets (private_shared_key_t)
  73          */
  74         linked_list_t *shared;
  75
  76         /**
  77          * list of private keys (private_key_t)
  78          */
  79         linked_list_t *private;
  80
  81         /**
  82          * read-write lock to lists
  83          */
  84         rwlock_t *lock;
  85
  86         /**
  87          * cache CRLs to disk?
  88          */
  89         bool cachecrl;
  90 };
  91
  92 /**
  93  * data to pass to various filters
  94  */
  95 typedef struct {
  96         private_stroke_cred_t *this;
  97         identification_t *id;
  98         certificate_type_t cert;
  99         key_type_t key;
 100 } id_data_t;
 101
 102 /**
 103  * destroy id enumerator data and unlock list
 104  */
 105 static void id_data_destroy(id_data_t *data)
 106 {
 107         data->this->lock->unlock(data->this->lock);
 108         free(data);
 109 }
 110
 111 /**
 112  * filter function for private key enumerator
 113  */
 114 static bool private_filter(id_data_t *data,
 115                                                    private_key_t **in, private_key_t **out)
 116 {
 117         private_key_t *key;
 118
 119         key = *in;
 120         if (data->key == KEY_ANY || data->key == key->get_type(key))
 121         {
 122                 if (data->id == NULL)
 123                 {
 124                         *out = key;
 125                         return TRUE;
 126                 }
 127                 if (key->has_fingerprint(key, data->id->get_encoding(data->id)))
 128                 {
 129                         *out = key;
 130                         return TRUE;
 131                 }
 132         }
 133         return FALSE;
 134 }
 135
 136 /**
 137  * Implements credential_set_t.create_private_enumerator
 138  */
 139 static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
 140                                                         key_type_t type, identification_t *id)
 141 {
 142         id_data_t *data;
 143
 144         data = malloc_thing(id_data_t);
 145         data->this = this;
 146         data->id = id;
 147         data->key = type;
 148
 149         this->lock->read_lock(this->lock);
 150         return enumerator_create_filter(this->private->create_enumerator(this->private),
 151                                                                         (void*)private_filter, data,
 152                                                                         (void*)id_data_destroy);
 153 }
 154
 155 /**
 156  * filter function for certs enumerator
 157  */
 158 static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 159 {
 160         public_key_t *public;
 161         certificate_t *cert = *in;
 162
 163         if (data->cert != CERT_ANY && data->cert != cert->get_type(cert))
 164         {
 165                 return FALSE;
 166         }
 167         if (data->id == NULL || cert->has_subject(cert, data->id))
 168         {
 169                 *out = *in;
 170                 return TRUE;
 171         }
 172
 173         public = cert->get_public_key(cert);
 174         if (public)
 175         {
 176                 if (data->key == KEY_ANY || data->key != public->get_type(public))
 177                 {
 178                         if (public->has_fingerprint(public, data->id->get_encoding(data->id)))
 179                         {
 180                                 public->destroy(public);
 181                                 *out = *in;
 182                                 return TRUE;
 183                         }
 184                 }
 185                 public->destroy(public);
 186         }
 187         return FALSE;
 188 }
 189
 190 /**
 191  * Implements credential_set_t.create_cert_enumerator
 192  */
 193 static enumerator_t* create_cert_enumerator(private_stroke_cred_t *this,
 194                                                         certificate_type_t cert, key_type_t key,
 195                                                         identification_t *id, bool trusted)
 196 {
 197         id_data_t *data;
 198
 199         if (trusted && (cert == CERT_X509_CRL || cert == CERT_X509_AC))
 200         {
 201                 return NULL;
 202         }
 203         data = malloc_thing(id_data_t);
 204         data->this = this;
 205         data->id = id;
 206         data->cert = cert;
 207         data->key = key;
 208
 209         this->lock->read_lock(this->lock);
 210         return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 211                                                                         (void*)certs_filter, data,
 212                                                                         (void*)id_data_destroy);
 213 }
 214
 215 typedef struct {
 216         private_stroke_cred_t *this;
 217         identification_t *me;
 218         identification_t *other;
 219         shared_key_type_t type;
 220 } shared_data_t;
 221
 222 /**
 223  * free shared key enumerator data and unlock list
 224  */
 225 static void shared_data_destroy(shared_data_t *data)
 226 {
 227         data->this->lock->unlock(data->this->lock);
 228         free(data);
 229 }
 230
 231 /**
 232  * filter function for certs enumerator
 233  */
 234 static bool shared_filter(shared_data_t *data,
 235                                                   stroke_shared_key_t **in, shared_key_t **out,
 236                                                   void **unused1, id_match_t *me,
 237                                                   void **unused2, id_match_t *other)
 238 {
 239         id_match_t my_match = ID_MATCH_NONE, other_match = ID_MATCH_NONE;
 240         stroke_shared_key_t *stroke = *in;
 241         shared_key_t *shared = &stroke->shared;
 242
 243         if (data->type != SHARED_ANY && shared->get_type(shared) != data->type)
 244         {
 245                 return FALSE;
 246         }
 247
 248         if (data->me)
 249         {
 250                 my_match = stroke->has_owner(stroke, data->me);
 251         }
 252         if (data->other)
 253         {
 254                 other_match = stroke->has_owner(stroke, data->other);
 255         }
 256         if ((data->me || data->other) && (!my_match && !other_match))
 257         {
 258                 return FALSE;
 259         }
 260         *out = shared;
 261         if (me)
 262         {
 263                 *me = my_match;
 264         }
 265         if (other)
 266         {
 267                 *other = other_match;
 268         }
 269         return TRUE;
 270 }
 271
 272 /**
 273  * Implements credential_set_t.create_shared_enumerator
 274  */
 275 static enumerator_t* create_shared_enumerator(private_stroke_cred_t *this,
 276                                                         shared_key_type_t type, identification_t *me,
 277                                                         identification_t *other)
 278 {
 279         shared_data_t *data = malloc_thing(shared_data_t);
 280
 281         data->this = this;
 282         data->me = me;
 283         data->other = other;
 284         data->type = type;
 285         this->lock->read_lock(this->lock);
 286         return enumerator_create_filter(this->shared->create_enumerator(this->shared),
 287                                                                         (void*)shared_filter, data,
 288                                                                         (void*)shared_data_destroy);
 289 }
 290
 291 /**
 292  * Add a certificate to chain
 293  */
 294 static certificate_t* add_cert(private_stroke_cred_t *this, certificate_t *cert)
 295 {
 296         certificate_t *current;
 297         enumerator_t *enumerator;
 298         bool new = TRUE;
 299
 300         this->lock->read_lock(this->lock);
 301         enumerator = this->certs->create_enumerator(this->certs);
 302         while (enumerator->enumerate(enumerator, (void**)&current))
 303         {
 304                 if (current->equals(current, cert))
 305                 {
 306                         /* cert already in queue */
 307                         cert->destroy(cert);
 308                         cert = current;
 309                         new = FALSE;
 310                         break;
 311                 }
 312         }
 313         enumerator->destroy(enumerator);
 314
 315         if (new)
 316         {
 317                 this->certs->insert_last(this->certs, cert);
 318         }
 319         this->lock->unlock(this->lock);
 320         return cert;
 321 }
 322
 323 /**
 324  * Implementation of stroke_cred_t.load_ca.
 325  */
 326 static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
 327 {
 328         certificate_t *cert;
 329         char path[PATH_MAX];
 330
 331         if (*filename == '/')
 332         {
 333                 snprintf(path, sizeof(path), "%s", filename);
 334         }
 335         else
 336         {
 337                 snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
 338         }
 339
 340         cert = lib->creds->create(lib->creds,
 341                                                           CRED_CERTIFICATE, CERT_X509,
 342                                                           BUILD_FROM_FILE, path,
 343                                                           BUILD_END);
 344         if (cert)
 345         {
 346                 x509_t *x509 = (x509_t*)cert;
 347
 348                 if (!(x509->get_flags(x509) & X509_CA))
 349                 {
 350                         DBG1(DBG_CFG, "  ca certificate \"%Y\" misses ca basic constraint, "
 351                                  "discarded", cert->get_subject(cert));
 352                         cert->destroy(cert);
 353                         return NULL;
 354                 }
 355                 return (certificate_t*)add_cert(this, cert);
 356         }
 357         return NULL;
 358 }
 359
 360 /**
 361  * Add X.509 CRL to chain
 362  */
 363 static bool add_crl(private_stroke_cred_t *this, crl_t* crl)
 364 {
 365         certificate_t *current, *cert = &crl->certificate;
 366         enumerator_t *enumerator;
 367         bool new = TRUE, found = FALSE;
 368
 369         this->lock->write_lock(this->lock);
 370         enumerator = this->certs->create_enumerator(this->certs);
 371         while (enumerator->enumerate(enumerator, (void**)&current))
 372         {
 373                 if (current->get_type(current) == CERT_X509_CRL)
 374                 {
 375                         crl_t *crl_c = (crl_t*)current;
 376                         chunk_t authkey = crl->get_authKeyIdentifier(crl);
 377                         chunk_t authkey_c = crl_c->get_authKeyIdentifier(crl_c);
 378
 379                         /* if compare authorityKeyIdentifiers if available */
 380                         if (authkey.ptr && authkey_c.ptr && chunk_equals(authkey, authkey_c))
 381                         {
 382                                 found = TRUE;
 383                         }
 384                         else
 385                         {
 386                                 identification_t *issuer = cert->get_issuer(cert);
 387                                 identification_t *issuer_c = current->get_issuer(current);
 388
 389                                 /* otherwise compare issuer distinguished names */
 390                                 if (issuer->equals(issuer, issuer_c))
 391                                 {
 392                                         found = TRUE;
 393                                 }
 394                         }
 395                         if (found)
 396                         {
 397                                 new = crl_is_newer(crl, crl_c);
 398                                 if (new)
 399                                 {
 400                                         this->certs->remove_at(this->certs, enumerator);
 401                                 }
 402                                 else
 403                                 {
 404                                         cert->destroy(cert);
 405                                 }
 406                                 break;
 407                         }
 408                 }
 409         }
 410         enumerator->destroy(enumerator);
 411
 412         if (new)
 413         {
 414                 this->certs->insert_last(this->certs, cert);
 415         }
 416         this->lock->unlock(this->lock);
 417         return new;
 418 }
 419
 420 /**
 421  * Add X.509 attribute certificate to chain
 422  */
 423 static bool add_ac(private_stroke_cred_t *this, ac_t* ac)
 424 {
 425         certificate_t *cert = &ac->certificate;
 426
 427         this->lock->write_lock(this->lock);
 428         this->certs->insert_last(this->certs, cert);
 429         this->lock->unlock(this->lock);
 430         return TRUE;
 431 }
 432
 433 /**
 434  * Implementation of stroke_cred_t.load_peer.
 435  */
 436 static certificate_t* load_peer(private_stroke_cred_t *this, char *filename)
 437 {
 438         certificate_t *cert;
 439         char path[PATH_MAX];
 440
 441         if (*filename == '/')
 442         {
 443                 snprintf(path, sizeof(path), "%s", filename);
 444         }
 445         else
 446         {
 447                 snprintf(path, sizeof(path), "%s/%s", CERTIFICATE_DIR, filename);
 448         }
 449
 450         cert = lib->creds->create(lib->creds,
 451                                                           CRED_CERTIFICATE, CERT_ANY,
 452                                                           BUILD_FROM_FILE, path,
 453                                                           BUILD_END);
 454         if (cert)
 455         {
 456                 cert = add_cert(this, cert);
 457                 DBG1(DBG_CFG, "  loaded certificate \"%Y\" from '%s'",
 458                                           cert->get_subject(cert), filename);
 459                 return cert->get_ref(cert);
 460         }
 461         DBG1(DBG_CFG, "  loading certificate from '%s' failed", filename);
 462         return NULL;
 463 }
 464
 465 /**
 466  * load trusted certificates from a directory
 467  */
 468 static void load_certdir(private_stroke_cred_t *this, char *path,
 469                                                  certificate_type_t type, x509_flag_t flag)
 470 {
 471         struct stat st;
 472         char *file;
 473
 474         enumerator_t *enumerator = enumerator_create_directory(path);
 475
 476         if (!enumerator)
 477         {
 478                 DBG1(DBG_CFG, "  reading directory failed");
 479                 return;
 480         }
 481
 482         while (enumerator->enumerate(enumerator, NULL, &file, &st))
 483         {
 484                 certificate_t *cert;
 485
 486                 if (!S_ISREG(st.st_mode))
 487                 {
 488                         /* skip special file */
 489                         continue;
 490                 }
 491                 switch (type)
 492                 {
 493                         case CERT_X509:
 494                                 if (flag & X509_CA)
 495                                 {       /* for CA certificates, we strictly require
 496                                          * the CA basic constraint to be set */
 497                                         cert = lib->creds->create(lib->creds,
 498                                                                                 CRED_CERTIFICATE, CERT_X509,
 499                                                                                 BUILD_FROM_FILE, file, BUILD_END);
 500                                         if (cert)
 501                                         {
 502                                                 x509_t *x509 = (x509_t*)cert;
 503
 504                                                 if (!(x509->get_flags(x509) & X509_CA))
 505                                                 {
 506                                                         DBG1(DBG_CFG, "  ca certificate \"%Y\" lacks "
 507                                                                  "ca basic constraint, discarded",
 508                                                                  cert->get_subject(cert));
 509                                                         cert->destroy(cert);
 510                                                         cert = NULL;
 511                                                 }
 512                                                 else
 513                                                 {
 514                                                         DBG1(DBG_CFG, "  loaded ca certificate \"%Y\" from '%s'",
 515                                                                                   cert->get_subject(cert), file);
 516                                                 }
 517                                         }
 518                                         else
 519                                         {
 520                                                 DBG1(DBG_CFG, "  loading ca certificate from '%s' "
 521                                                                           "failed", file);
 522                                         }
 523                                 }
 524                                 else
 525                                 {       /* for all other flags, we add them to the certificate. */
 526                                         cert = lib->creds->create(lib->creds,
 527                                                                                 CRED_CERTIFICATE, CERT_X509,
 528                                                                                 BUILD_FROM_FILE, file,
 529                                                                                 BUILD_X509_FLAG, flag, BUILD_END);
 530                                         if (cert)
 531                                         {
 532                                                 DBG1(DBG_CFG, "  loaded certificate \"%Y\" from '%s'",
 533                                                                           cert->get_subject(cert), file);
 534                                         }
 535                                         else
 536                                         {
 537                                                 DBG1(DBG_CFG, "  loading certificate from '%s' "
 538                                                                           "failed", file);
 539                                         }
 540                                 }
 541                                 if (cert)
 542                                 {
 543                                         add_cert(this, cert);
 544                                 }
 545                                 break;
 546                         case CERT_X509_CRL:
 547                                 cert = lib->creds->create(lib->creds,
 548                                                                                   CRED_CERTIFICATE, CERT_X509_CRL,
 549                                                                                   BUILD_FROM_FILE, file,
 550                                                                                   BUILD_END);
 551                                 if (cert)
 552                                 {
 553                                         add_crl(this, (crl_t*)cert);
 554                                         DBG1(DBG_CFG, "  loaded crl from '%s'",  file);
 555                                 }
 556                                 else
 557                                 {
 558                                         DBG1(DBG_CFG, "  loading crl from '%s' failed", file);
 559                                 }
 560                                 break;
 561                         case CERT_X509_AC:
 562                                 cert = lib->creds->create(lib->creds,
 563                                                                                   CRED_CERTIFICATE, CERT_X509_AC,
 564                                                                                   BUILD_FROM_FILE, file,
 565                                                                                   BUILD_END);
 566                                 if (cert)
 567                                 {
 568                                         add_ac(this, (ac_t*)cert);
 569                                         DBG1(DBG_CFG, "  loaded attribute certificate from '%s'",
 570                                                                   file);
 571                                 }
 572                                 else
 573                                 {
 574                                         DBG1(DBG_CFG, "  loading attribute certificate from '%s' "
 575                                                                   "failed", file);
 576                                 }
 577                                 break;
 578                         default:
 579                                 break;
 580                 }
 581         }
 582         enumerator->destroy(enumerator);
 583 }
 584
 585 /**
 586  * Implementation of credential_set_t.cache_cert.
 587  */
 588 static void cache_cert(private_stroke_cred_t *this, certificate_t *cert)
 589 {
 590         if (cert->get_type(cert) == CERT_X509_CRL && this->cachecrl)
 591         {
 592                 /* CRLs get written to /etc/ipsec.d/crls/<authkeyId>.crl */
 593                 crl_t *crl = (crl_t*)cert;
 594
 595                 cert->get_ref(cert);
 596                 if (add_crl(this, crl))
 597                 {
 598                         char buf[BUF_LEN];
 599                         chunk_t chunk, hex;
 600
 601                         chunk = crl->get_authKeyIdentifier(crl);
 602                         hex = chunk_to_hex(chunk, NULL, FALSE);
 603                         snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex);
 604                         free(hex.ptr);
 605
 606                         if (cert->get_encoding(cert, CERT_ASN1_DER, &chunk))
 607                         {
 608                                 chunk_write(chunk, buf, "crl", 022, TRUE);
 609                                 free(chunk.ptr);
 610                         }
 611                 }
 612         }
 613 }
 614
 615 /**
 616  * Implementation of stroke_cred_t.cachecrl.
 617  */
 618 static void cachecrl(private_stroke_cred_t *this, bool enabled)
 619 {
 620         DBG1(DBG_CFG, "crl caching to %s %s",
 621                  CRL_DIR, enabled ? "enabled" : "disabled");
 622         this->cachecrl = enabled;
 623 }
 624
 625
 626 /**
 627  * Convert a string of characters into a binary secret
 628  * A string between single or double quotes is treated as ASCII characters
 629  * A string prepended by 0x is treated as HEX and prepended by 0s as Base64
 630  */
 631 static err_t extract_secret(chunk_t *secret, chunk_t *line)
 632 {
 633         chunk_t raw_secret;
 634         char delimiter = ' ';
 635         bool quotes = FALSE;
 636
 637         if (!eat_whitespace(line))
 638         {
 639                 return "missing secret";
 640         }
 641
 642         if (*line->ptr == '\'' || *line->ptr == '"')
 643         {
 644                 quotes = TRUE;
 645                 delimiter = *line->ptr;
 646                 line->ptr++;  line->len--;
 647         }
 648
 649         if (!extract_token(&raw_secret, delimiter, line))
 650         {
 651                 if (delimiter == ' ')
 652                 {
 653                         raw_secret = *line;
 654                 }
 655                 else
 656                 {
 657                         return "missing second delimiter";
 658                 }
 659         }
 660
 661         if (quotes)
 662         {
 663                 /* treat as an ASCII string */
 664                 *secret = chunk_clone(raw_secret);
 665                 return NULL;
 666         }
 667         /* treat 0x as hex, 0s as base64 */
 668         if (raw_secret.len > 2)
 669         {
 670                 if (strncasecmp("0x", raw_secret.ptr, 2) == 0)
 671                 {
 672                         *secret = chunk_from_hex(chunk_skip(raw_secret, 2), NULL);
 673                         return NULL;
 674                 }
 675                 if (strncasecmp("0s", raw_secret.ptr, 2) == 0)
 676                 {
 677                         *secret = chunk_from_base64(chunk_skip(raw_secret, 2), NULL);
 678                         return NULL;
 679                 }
 680         }
 681         *secret = chunk_clone(raw_secret);
 682         return NULL;
 683 }
 684
 685 /**
 686  * Data for passphrase callback
 687  */
 688 typedef struct {
 689         /** socket we use for prompting */
 690         FILE *prompt;
 691         /** private key file */
 692         char *path;
 693         /** number of tries */
 694         int try;
 695 } passphrase_cb_data_t;
 696
 697 /**
 698  * Callback function to receive Passphrases
 699  */
 700 static shared_key_t* passphrase_cb(passphrase_cb_data_t *data,
 701                                                                 shared_key_type_t type,
 702                                                                 identification_t *me, identification_t *other,
 703                                                                 id_match_t *match_me, id_match_t *match_other)
 704 {
 705         chunk_t secret;
 706         char buf[256];
 707
 708         if (type != SHARED_ANY && type != SHARED_PRIVATE_KEY_PASS)
 709         {
 710                 return NULL;
 711         }
 712
 713         if (data->try > 1)
 714         {
 715                 if (data->try > 5)
 716                 {
 717                         fprintf(data->prompt, "PIN invalid, giving up.\n");
 718                         return NULL;
 719                 }
 720                 fprintf(data->prompt, "PIN invalid!\n");
 721         }
 722         data->try++;
 723         fprintf(data->prompt, "Private key '%s' is encrypted.\n", data->path);
 724         fprintf(data->prompt, "Passphrase:\n");
 725         if (fgets(buf, sizeof(buf), data->prompt))
 726         {
 727                 secret = chunk_create(buf, strlen(buf));
 728                 if (secret.len > 1)
 729                 {       /* trim appended \n */
 730                         secret.len--;
 731                         if (match_me)
 732                         {
 733                                 *match_me = ID_MATCH_PERFECT;
 734                         }
 735                         if (match_other)
 736                         {
 737                                 *match_other = ID_MATCH_NONE;
 738                         }
 739                         return shared_key_create(SHARED_PRIVATE_KEY_PASS, chunk_clone(secret));
 740                 }
 741         }
 742         return NULL;
 743 }
 744
 745 /**
 746  * Data for PIN callback
 747  */
 748 typedef struct {
 749         /** socket we use for prompting */
 750         FILE *prompt;
 751         /** card label */
 752         char *card;
 753         /** card keyid */
 754         chunk_t keyid;
 755         /** number of tries */
 756         int try;
 757 } pin_cb_data_t;
 758
 759 /**
 760  * Callback function to receive PINs
 761  */
 762 static shared_key_t* pin_cb(pin_cb_data_t *data, shared_key_type_t type,
 763                                                         identification_t *me, identification_t *other,
 764                                                         id_match_t *match_me, id_match_t *match_other)
 765 {
 766         chunk_t secret;
 767         char buf[256];
 768
 769         if (type != SHARED_ANY && type != SHARED_PIN)
 770         {
 771                 return NULL;
 772         }
 773
 774         if (!me || !chunk_equals(me->get_encoding(me), data->keyid))
 775         {
 776                 return NULL;
 777         }
 778
 779         if (data->try > 1)
 780         {
 781                 fprintf(data->prompt, "PIN invalid, aborting.\n");
 782                 return NULL;
 783         }
 784         data->try++;
 785         fprintf(data->prompt, "Login to '%s' required\n", data->card);
 786         fprintf(data->prompt, "PIN:\n");
 787         if (fgets(buf, sizeof(buf), data->prompt))
 788         {
 789                 secret = chunk_create(buf, strlen(buf));
 790                 if (secret.len > 1)
 791                 {       /* trim appended \n */
 792                         secret.len--;
 793                         if (match_me)
 794                         {
 795                                 *match_me = ID_MATCH_PERFECT;
 796                         }
 797                         if (match_other)
 798                         {
 799                                 *match_other = ID_MATCH_NONE;
 800                         }
 801                         return shared_key_create(SHARED_PIN, chunk_clone(secret));
 802                 }
 803         }
 804         return NULL;
 805 }
 806
 807 /**
 808  * Load a smartcard with a PIN
 809  */
 810 static bool load_pin(private_stroke_cred_t *this, chunk_t line, int line_nr,
 811                                          FILE *prompt)
 812 {
 813         chunk_t sc = chunk_empty, secret = chunk_empty;
 814         char smartcard[64], keyid[64], module[64], *pos;
 815         private_key_t *key = NULL;
 816         u_int slot;
 817         chunk_t chunk;
 818         shared_key_t *shared;
 819         identification_t *id;
 820         mem_cred_t *mem = NULL;
 821         callback_cred_t *cb = NULL;
 822         pin_cb_data_t pin_data;
 823         enum {
 824                 SC_FORMAT_SLOT_MODULE_KEYID,
 825                 SC_FORMAT_SLOT_KEYID,
 826                 SC_FORMAT_KEYID,
 827         } format;
 828
 829         err_t ugh = extract_value(&sc, &line);
 830
 831         if (ugh != NULL)
 832         {
 833                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 834                 return FALSE;
 835         }
 836         if (sc.len == 0)
 837         {
 838                 DBG1(DBG_CFG, "line %d: expected %%smartcard specifier", line_nr);
 839                 return FALSE;
 840         }
 841         snprintf(smartcard, sizeof(smartcard), "%.*s", sc.len, sc.ptr);
 842         smartcard[sizeof(smartcard) - 1] = '\0';
 843
 844         /* parse slot and key id. Three formats are supported:
 845          * - %smartcard<slot>@<module>:<keyid>
 846          * - %smartcard<slot>:<keyid>
 847          * - %smartcard:<keyid>
 848          */
 849         if (sscanf(smartcard, "%%smartcard%u@%s", &slot, module) == 2)
 850         {
 851                 pos = strchr(module, ':');
 852                 if (!pos)
 853                 {
 854                         DBG1(DBG_CFG, "line %d: the given %%smartcard specifier is "
 855                                  "invalid", line_nr);
 856                         return FALSE;
 857                 }
 858                 *pos = '\0';
 859                 strcpy(keyid, pos + 1);
 860                 format = SC_FORMAT_SLOT_MODULE_KEYID;
 861         }
 862         else if (sscanf(smartcard, "%%smartcard%u:%s", &slot, keyid) == 2)
 863         {
 864                 format = SC_FORMAT_SLOT_KEYID;
 865         }
 866         else if (sscanf(smartcard, "%%smartcard:%s", keyid) == 1)
 867         {
 868                 format = SC_FORMAT_KEYID;
 869         }
 870         else
 871         {
 872                 DBG1(DBG_CFG, "line %d: the given %%smartcard specifier is not"
 873                                 " supported or invalid", line_nr);
 874                 return FALSE;
 875         }
 876
 877         if (!eat_whitespace(&line))
 878         {
 879                 DBG1(DBG_CFG, "line %d: expected PIN", line_nr);
 880                 return FALSE;
 881         }
 882         ugh = extract_secret(&secret, &line);
 883         if (ugh != NULL)
 884         {
 885                 DBG1(DBG_CFG, "line %d: malformed PIN: %s", line_nr, ugh);
 886                 return FALSE;
 887         }
 888
 889         chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
 890         if (secret.len == 7 && strneq(secret.ptr, "%prompt", 7))
 891         {
 892                 free(secret.ptr);
 893                 if (!prompt)
 894                 {       /* no IO channel to prompt, skip */
 895                         free(chunk.ptr);
 896                         return TRUE;
 897                 }
 898                 /* use callback credential set to prompt for the pin */
 899                 pin_data.prompt = prompt;
 900                 pin_data.card = smartcard;
 901                 pin_data.keyid = chunk;
 902                 pin_data.try = 1;
 903                 cb = callback_cred_create_shared((void*)pin_cb, &pin_data);
 904                 lib->credmgr->add_local_set(lib->credmgr, &cb->set);
 905         }
 906         else
 907         {
 908                 /* provide our pin in a temporary credential set */
 909                 shared = shared_key_create(SHARED_PIN, secret);
 910                 id = identification_create_from_encoding(ID_KEY_ID, chunk);
 911                 mem = mem_cred_create();
 912                 mem->add_shared(mem, shared, id, NULL);
 913                 lib->credmgr->add_local_set(lib->credmgr, &mem->set);
 914         }
 915
 916         /* unlock: smartcard needs the pin and potentially calls public set */
 917         this->lock->unlock(this->lock);
 918         switch (format)
 919         {
 920                 case SC_FORMAT_SLOT_MODULE_KEYID:
 921                         key = lib->creds->create(lib->creds,
 922                                                         CRED_PRIVATE_KEY, KEY_ANY,
 923                                                         BUILD_PKCS11_SLOT, slot,
 924                                                         BUILD_PKCS11_MODULE, module,
 925                                                         BUILD_PKCS11_KEYID, chunk, BUILD_END);
 926                         break;
 927                 case SC_FORMAT_SLOT_KEYID:
 928                         key = lib->creds->create(lib->creds,
 929                                                         CRED_PRIVATE_KEY, KEY_ANY,
 930                                                         BUILD_PKCS11_SLOT, slot,
 931                                                         BUILD_PKCS11_KEYID, chunk, BUILD_END);
 932                         break;
 933                 case SC_FORMAT_KEYID:
 934                         key = lib->creds->create(lib->creds,
 935                                                         CRED_PRIVATE_KEY, KEY_ANY,
 936                                                         BUILD_PKCS11_KEYID, chunk, BUILD_END);
 937                         break;
 938         }
 939         this->lock->write_lock(this->lock);
 940         if (mem)
 941         {
 942                 lib->credmgr->remove_local_set(lib->credmgr, &mem->set);
 943                 mem->destroy(mem);
 944         }
 945         if (cb)
 946         {
 947                 lib->credmgr->remove_local_set(lib->credmgr, &cb->set);
 948                 cb->destroy(cb);
 949         }
 950
 951         if (key)
 952         {
 953                 DBG1(DBG_CFG, "  loaded private key from %.*s", sc.len, sc.ptr);
 954                 this->private->insert_last(this->private, key);
 955         }
 956         return TRUE;
 957 }
 958
 959 /**
 960  * Load a private key
 961  */
 962 static bool load_private(private_stroke_cred_t *this, chunk_t line, int line_nr,
 963                                                  FILE *prompt, key_type_t key_type)
 964 {
 965         char path[PATH_MAX];
 966         chunk_t filename;
 967         chunk_t secret = chunk_empty;
 968         private_key_t *key;
 969
 970         err_t ugh = extract_value(&filename, &line);
 971
 972         if (ugh != NULL)
 973         {
 974                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 975                 return FALSE;
 976         }
 977         if (filename.len == 0)
 978         {
 979                 DBG1(DBG_CFG, "line %d: empty filename", line_nr);
 980                 return FALSE;
 981         }
 982         if (*filename.ptr == '/')
 983         {
 984                 /* absolute path name */
 985                 snprintf(path, sizeof(path), "%.*s", filename.len, filename.ptr);
 986         }
 987         else
 988         {
 989                 /* relative path name */
 990                 snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
 991                                  filename.len, filename.ptr);
 992         }
 993
 994         /* check for optional passphrase */
 995         if (eat_whitespace(&line))
 996         {
 997                 ugh = extract_secret(&secret, &line);
 998                 if (ugh != NULL)
 999                 {
1000                         DBG1(DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
1001                         return FALSE;
1002                 }
1003         }
1004         if (secret.len == 7 && strneq(secret.ptr, "%prompt", 7))
1005         {
1006                 callback_cred_t *cb = NULL;
1007                 passphrase_cb_data_t pp_data = {
1008                         .prompt = prompt,
1009                         .path = path,
1010                         .try = 1,
1011                 };
1012
1013                 free(secret.ptr);
1014                 if (!prompt)
1015                 {
1016                         return TRUE;
1017                 }
1018                 /* use callback credential set to prompt for the passphrase */
1019                 pp_data.prompt = prompt;
1020                 pp_data.path = path;
1021                 pp_data.try = 1;
1022                 cb = callback_cred_create_shared((void*)passphrase_cb, &pp_data);
1023                 lib->credmgr->add_local_set(lib->credmgr, &cb->set);
1024
1025                 /* unlock, as the builder might ask for a secret */
1026                 this->lock->unlock(this->lock);
1027                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
1028                                                                  BUILD_FROM_FILE, path, BUILD_END);
1029                 this->lock->write_lock(this->lock);
1030
1031                 lib->credmgr->remove_local_set(lib->credmgr, &cb->set);
1032                 cb->destroy(cb);
1033         }
1034         else
1035         {
1036                 mem_cred_t *mem = NULL;
1037                 shared_key_t *shared;
1038
1039                 /* provide our pin in a temporary credential set */
1040                 shared = shared_key_create(SHARED_PRIVATE_KEY_PASS, secret);
1041                 mem = mem_cred_create();
1042                 mem->add_shared(mem, shared, NULL);
1043                 lib->credmgr->add_local_set(lib->credmgr, &mem->set);
1044
1045                 /* unlock, as the builder might ask for a secret */
1046                 this->lock->unlock(this->lock);
1047                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
1048                                                                  BUILD_FROM_FILE, path, BUILD_END);
1049                 this->lock->write_lock(this->lock);
1050
1051                 lib->credmgr->remove_local_set(lib->credmgr, &mem->set);
1052                 mem->destroy(mem);
1053         }
1054         if (key)
1055         {
1056                 DBG1(DBG_CFG, "  loaded %N private key from '%s'",
1057                          key_type_names, key->get_type(key), path);
1058                 this->private->insert_last(this->private, key);
1059         }
1060         else
1061         {
1062                 DBG1(DBG_CFG, "  loading private key from '%s' failed", path);
1063         }
1064         return TRUE;
1065 }
1066
1067 /**
1068  * Load a shared key
1069  */
1070 static bool load_shared(private_stroke_cred_t *this, chunk_t line, int line_nr,
1071                                                 shared_key_type_t type, chunk_t ids)
1072 {
1073         stroke_shared_key_t *shared_key;
1074         chunk_t secret = chunk_empty;
1075         bool any = TRUE;
1076
1077         err_t ugh = extract_secret(&secret, &line);
1078         if (ugh != NULL)
1079         {
1080                 DBG1(DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
1081                 return FALSE;
1082         }
1083         shared_key = stroke_shared_key_create(type, secret);
1084         DBG1(DBG_CFG, "  loaded %N secret for %s", shared_key_type_names, type,
1085                  ids.len > 0 ? (char*)ids.ptr : "%any");
1086         DBG4(DBG_CFG, "  secret: %#B", &secret);
1087
1088         this->shared->insert_last(this->shared, shared_key);
1089         while (ids.len > 0)
1090         {
1091                 chunk_t id;
1092                 identification_t *peer_id;
1093
1094                 ugh = extract_value(&id, &ids);
1095                 if (ugh != NULL)
1096                 {
1097                         DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
1098                         return FALSE;
1099                 }
1100                 if (id.len == 0)
1101                 {
1102                         continue;
1103                 }
1104
1105                 /* NULL terminate the ID string */
1106                 *(id.ptr + id.len) = '\0';
1107                 peer_id = identification_create_from_string(id.ptr);
1108                 if (peer_id->get_type(peer_id) == ID_ANY)
1109                 {
1110                         peer_id->destroy(peer_id);
1111                         continue;
1112                 }
1113
1114                 shared_key->add_owner(shared_key, peer_id);
1115                 any = FALSE;
1116         }
1117         if (any)
1118         {
1119                 shared_key->add_owner(shared_key,
1120                                         identification_create_from_encoding(ID_ANY, chunk_empty));
1121         }
1122         return TRUE;
1123 }
1124
1125 /**
1126  * reload ipsec.secrets
1127  */
1128 static void load_secrets(private_stroke_cred_t *this, char *file, int level,
1129                                                  FILE *prompt)
1130 {
1131         int line_nr = 0, fd;
1132         chunk_t src, line;
1133         private_key_t *private;
1134         shared_key_t *shared;
1135         struct stat sb;
1136         void *addr;
1137
1138         DBG1(DBG_CFG, "loading secrets from '%s'", file);
1139         fd = open(file, O_RDONLY);
1140         if (fd == -1)
1141         {
1142                 DBG1(DBG_CFG, "opening secrets file '%s' failed: %s", file,
1143                          strerror(errno));
1144                 return;
1145         }
1146         if (fstat(fd, &sb) == -1)
1147         {
1148                 DBG1(DBG_LIB, "getting file size of '%s' failed: %s", file,
1149                          strerror(errno));
1150                 close(fd);
1151                 return;
1152         }
1153         addr = mmap(NULL, sb.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
1154         if (addr == MAP_FAILED)
1155         {
1156                 DBG1(DBG_LIB, "mapping '%s' failed: %s", file, strerror(errno));
1157                 close(fd);
1158                 return;
1159         }
1160         src = chunk_create(addr, sb.st_size);
1161
1162         if (level == 0)
1163         {
1164                 this->lock->write_lock(this->lock);
1165
1166                 /* flush secrets on non-recursive invocation */
1167                 while (this->shared->remove_last(this->shared,
1168                                                                                  (void**)&shared) == SUCCESS)
1169                 {
1170                         shared->destroy(shared);
1171                 }
1172                 while (this->private->remove_last(this->private,
1173                                                                                   (void**)&private) == SUCCESS)
1174                 {
1175                         private->destroy(private);
1176                 }
1177         }
1178
1179         while (fetchline(&src, &line))
1180         {
1181                 chunk_t ids, token;
1182                 shared_key_type_t type;
1183
1184                 line_nr++;
1185
1186                 if (!eat_whitespace(&line))
1187                 {
1188                         continue;
1189                 }
1190                 if (line.len > strlen("include ") &&
1191                         strneq(line.ptr, "include ", strlen("include ")))
1192                 {
1193                         glob_t buf;
1194                         char **expanded, *dir, pattern[PATH_MAX];
1195                         u_char *pos;
1196
1197                         if (level > MAX_SECRETS_RECURSION)
1198                         {
1199                                 DBG1(DBG_CFG, "maximum level of %d includes reached, ignored",
1200                                          MAX_SECRETS_RECURSION);
1201                                 continue;
1202                         }
1203                         /* terminate filename by space */
1204                         line = chunk_skip(line, strlen("include "));
1205                         pos = memchr(line.ptr, ' ', line.len);
1206                         if (pos)
1207                         {
1208                                 line.len = pos - line.ptr;
1209                         }
1210                         if (line.len && line.ptr[0] == '/')
1211                         {
1212                                 if (line.len + 1 > sizeof(pattern))
1213                                 {
1214                                         DBG1(DBG_CFG, "include pattern too long, ignored");
1215                                         continue;
1216                                 }
1217                                 snprintf(pattern, sizeof(pattern), "%.*s", line.len, line.ptr);
1218                         }
1219                         else
1220                         {       /* use directory of current file if relative */
1221                                 dir = strdup(file);
1222                                 dir = dirname(dir);
1223
1224                                 if (line.len + 1 + strlen(dir) + 1 > sizeof(pattern))
1225                                 {
1226                                         DBG1(DBG_CFG, "include pattern too long, ignored");
1227                                         free(dir);
1228                                         continue;
1229                                 }
1230                                 snprintf(pattern, sizeof(pattern), "%s/%.*s",
1231                                                  dir, line.len, line.ptr);
1232                                 free(dir);
1233                         }
1234                         if (glob(pattern, GLOB_ERR, NULL, &buf) != 0)
1235                         {
1236                                 DBG1(DBG_CFG, "expanding file expression '%s' failed", pattern);
1237                         }
1238                         else
1239                         {
1240                                 for (expanded = buf.gl_pathv; *expanded != NULL; expanded++)
1241                                 {
1242                                         load_secrets(this, *expanded, level + 1, prompt);
1243                                 }
1244                         }
1245                         globfree(&buf);
1246                         continue;
1247                 }
1248
1249                 if (line.len > 2 && strneq(": ", line.ptr, 2))
1250                 {
1251                         /* no ids, skip the ':' */
1252                         ids = chunk_empty;
1253                         line.ptr++;
1254                         line.len--;
1255                 }
1256                 else if (extract_token_str(&ids, " : ", &line))
1257                 {
1258                         /* NULL terminate the extracted id string */
1259                         *(ids.ptr + ids.len) = '\0';
1260                 }
1261                 else
1262                 {
1263                         DBG1(DBG_CFG, "line %d: missing ' : ' separator", line_nr);
1264                         break;
1265                 }
1266
1267                 if (!eat_whitespace(&line) || !extract_token(&token, ' ', &line))
1268                 {
1269                         DBG1(DBG_CFG, "line %d: missing token", line_nr);
1270                         break;
1271                 }
1272                 if (match("RSA", &token) || match("ECDSA", &token))
1273                 {
1274                         if (!load_private(this, line, line_nr, prompt,
1275                                                           match("RSA", &token) ? KEY_RSA : KEY_ECDSA))
1276                         {
1277                                 break;
1278                         }
1279                 }
1280                 else if (match("PIN", &token))
1281                 {
1282                         if (!load_pin(this, line, line_nr, prompt))
1283                         {
1284                                 break;
1285                         }
1286                 }
1287                 else if ((match("PSK", &token) && (type = SHARED_IKE)) ||
1288                                  (match("EAP", &token) && (type = SHARED_EAP)) ||
1289                                  (match("NTLM", &token) && (type = SHARED_NT_HASH)) ||
1290                                  (match("XAUTH", &token) && (type = SHARED_EAP)))
1291                 {
1292                         if (!load_shared(this, line, line_nr, type, ids))
1293                         {
1294                                 break;
1295                         }
1296                 }
1297                 else
1298                 {
1299                         DBG1(DBG_CFG, "line %d: token must be either "
1300                                  "RSA, ECDSA, PSK, EAP, XAUTH or PIN", line_nr);
1301                         break;
1302                 }
1303         }
1304         if (level == 0)
1305         {
1306                 this->lock->unlock(this->lock);
1307         }
1308         munmap(addr, sb.st_size);
1309         close(fd);
1310 }
1311
1312 /**
1313  * load all certificates from ipsec.d
1314  */
1315 static void load_certs(private_stroke_cred_t *this)
1316 {
1317         DBG1(DBG_CFG, "loading ca certificates from '%s'",
1318                  CA_CERTIFICATE_DIR);
1319         load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
1320
1321         DBG1(DBG_CFG, "loading aa certificates from '%s'",
1322                  AA_CERTIFICATE_DIR);
1323         load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
1324
1325         DBG1(DBG_CFG, "loading ocsp signer certificates from '%s'",
1326                  OCSP_CERTIFICATE_DIR);
1327         load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509, X509_OCSP_SIGNER);
1328
1329         DBG1(DBG_CFG, "loading attribute certificates from '%s'",
1330                  ATTR_CERTIFICATE_DIR);
1331         load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
1332
1333         DBG1(DBG_CFG, "loading crls from '%s'",
1334                  CRL_DIR);
1335         load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
1336 }
1337
1338 /**
1339  * Implementation of stroke_cred_t.reread.
1340  */
1341 static void reread(private_stroke_cred_t *this, stroke_msg_t *msg, FILE *prompt)
1342 {
1343         if (msg->reread.flags & REREAD_SECRETS)
1344         {
1345                 DBG1(DBG_CFG, "rereading secrets");
1346                 load_secrets(this, SECRETS_FILE, 0, prompt);
1347         }
1348         if (msg->reread.flags & REREAD_CACERTS)
1349         {
1350                 DBG1(DBG_CFG, "rereading ca certificates from '%s'",
1351                          CA_CERTIFICATE_DIR);
1352                 load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
1353         }
1354         if (msg->reread.flags & REREAD_OCSPCERTS)
1355         {
1356                 DBG1(DBG_CFG, "rereading ocsp signer certificates from '%s'",
1357                          OCSP_CERTIFICATE_DIR);
1358                 load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509,
1359                          X509_OCSP_SIGNER);
1360         }
1361         if (msg->reread.flags & REREAD_AACERTS)
1362         {
1363                 DBG1(DBG_CFG, "rereading aa certificates from '%s'",
1364                          AA_CERTIFICATE_DIR);
1365                 load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
1366         }
1367         if (msg->reread.flags & REREAD_ACERTS)
1368         {
1369                 DBG1(DBG_CFG, "rereading attribute certificates from '%s'",
1370                          ATTR_CERTIFICATE_DIR);
1371                 load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
1372         }
1373         if (msg->reread.flags & REREAD_CRLS)
1374         {
1375                 DBG1(DBG_CFG, "rereading crls from '%s'",
1376                          CRL_DIR);
1377                 load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
1378         }
1379 }
1380
1381 /**
1382  * Implementation of stroke_cred_t.destroy
1383  */
1384 static void destroy(private_stroke_cred_t *this)
1385 {
1386         this->certs->destroy_offset(this->certs, offsetof(certificate_t, destroy));
1387         this->shared->destroy_offset(this->shared, offsetof(shared_key_t, destroy));
1388         this->private->destroy_offset(this->private, offsetof(private_key_t, destroy));
1389         this->lock->destroy(this->lock);
1390         free(this);
1391 }
1392
1393 /*
1394  * see header file
1395  */
1396 stroke_cred_t *stroke_cred_create()
1397 {
1398         private_stroke_cred_t *this = malloc_thing(private_stroke_cred_t);
1399
1400         this->public.set.create_private_enumerator = (void*)create_private_enumerator;
1401         this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
1402         this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
1403         this->public.set.create_cdp_enumerator = (void*)return_null;
1404         this->public.set.cache_cert = (void*)cache_cert;
1405         this->public.reread = (void(*)(stroke_cred_t*, stroke_msg_t *msg, FILE*))reread;
1406         this->public.load_ca = (certificate_t*(*)(stroke_cred_t*, char *filename))load_ca;
1407         this->public.load_peer = (certificate_t*(*)(stroke_cred_t*, char *filename))load_peer;
1408         this->public.cachecrl = (void(*)(stroke_cred_t*, bool enabled))cachecrl;
1409         this->public.destroy = (void(*)(stroke_cred_t*))destroy;
1410
1411         this->certs = linked_list_create();
1412         this->shared = linked_list_create();
1413         this->private = linked_list_create();
1414         this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
1415
1416         load_certs(this);
1417         load_secrets(this, SECRETS_FILE, 0, NULL);
1418
1419         this->cachecrl = FALSE;
1420
1421         return &this->public;
1422 }
1423