src/libcharon/plugins/stroke/stroke_cred.c

   1 /*
   2  * Copyright (C) 2008 Tobias Brunner
   3  * Copyright (C) 2008 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <sys/types.h>
  18 #include <sys/stat.h>
  19 #include <limits.h>
  20 #include <glob.h>
  21 #include <libgen.h>
  22 #include <sys/mman.h>
  23 #include <fcntl.h>
  24 #include <errno.h>
  25 #include <unistd.h>
  26
  27 #include "stroke_cred.h"
  28 #include "stroke_shared_key.h"
  29
  30 #include <credentials/certificates/x509.h>
  31 #include <credentials/certificates/crl.h>
  32 #include <credentials/certificates/ac.h>
  33 #include <credentials/sets/mem_cred.h>
  34 #include <credentials/sets/callback_cred.h>
  35 #include <utils/linked_list.h>
  36 #include <utils/lexparser.h>
  37 #include <threading/rwlock.h>
  38 #include <daemon.h>
  39
  40 /* configuration directories and files */
  41 #define CONFIG_DIR IPSEC_CONFDIR
  42 #define IPSEC_D_DIR CONFIG_DIR "/ipsec.d"
  43 #define PRIVATE_KEY_DIR IPSEC_D_DIR "/private"
  44 #define CERTIFICATE_DIR IPSEC_D_DIR "/certs"
  45 #define CA_CERTIFICATE_DIR IPSEC_D_DIR "/cacerts"
  46 #define AA_CERTIFICATE_DIR IPSEC_D_DIR "/aacerts"
  47 #define ATTR_CERTIFICATE_DIR IPSEC_D_DIR "/acerts"
  48 #define OCSP_CERTIFICATE_DIR IPSEC_D_DIR "/ocspcerts"
  49 #define CRL_DIR IPSEC_D_DIR "/crls"
  50 #define SECRETS_FILE CONFIG_DIR "/ipsec.secrets"
  51
  52 #define MAX_SECRETS_RECURSION 10
  53
  54 typedef struct private_stroke_cred_t private_stroke_cred_t;
  55
  56 /**
  57  * private data of stroke_cred
  58  */
  59 struct private_stroke_cred_t {
  60
  61         /**
  62          * public functions
  63          */
  64         stroke_cred_t public;
  65
  66         /**
  67          * list of trusted peer/signer/CA certificates (certificate_t)
  68          */
  69         linked_list_t *certs;
  70
  71         /**
  72          * list of shared secrets (private_shared_key_t)
  73          */
  74         linked_list_t *shared;
  75
  76         /**
  77          * list of private keys (private_key_t)
  78          */
  79         linked_list_t *private;
  80
  81         /**
  82          * read-write lock to lists
  83          */
  84         rwlock_t *lock;
  85
  86         /**
  87          * cache CRLs to disk?
  88          */
  89         bool cachecrl;
  90 };
  91
  92 /**
  93  * data to pass to various filters
  94  */
  95 typedef struct {
  96         private_stroke_cred_t *this;
  97         identification_t *id;
  98         certificate_type_t type;
  99 } id_data_t;
 100
 101 /**
 102  * destroy id enumerator data and unlock list
 103  */
 104 static void id_data_destroy(id_data_t *data)
 105 {
 106         data->this->lock->unlock(data->this->lock);
 107         free(data);
 108 }
 109
 110 /**
 111  * filter function for private key enumerator
 112  */
 113 static bool private_filter(id_data_t *data,
 114                                                    private_key_t **in, private_key_t **out)
 115 {
 116         private_key_t *key;
 117
 118         key = *in;
 119         if (data->id == NULL)
 120         {
 121                 *out = key;
 122                 return TRUE;
 123         }
 124         if (key->has_fingerprint(key, data->id->get_encoding(data->id)))
 125         {
 126                 *out = key;
 127                 return TRUE;
 128         }
 129         return FALSE;
 130 }
 131
 132 /**
 133  * Implements credential_set_t.create_private_enumerator
 134  */
 135 static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
 136                                                         key_type_t type, identification_t *id)
 137 {
 138         id_data_t *data;
 139
 140         data = malloc_thing(id_data_t);
 141         data->this = this;
 142         data->id = id;
 143
 144         this->lock->read_lock(this->lock);
 145         return enumerator_create_filter(this->private->create_enumerator(this->private),
 146                                                                         (void*)private_filter, data,
 147                                                                         (void*)id_data_destroy);
 148 }
 149
 150 /**
 151  * filter function for certs enumerator
 152  */
 153 static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 154 {
 155         public_key_t *public;
 156         certificate_t *cert = *in;
 157
 158         if (data->type != CERT_ANY && data->type != cert->get_type(cert))
 159         {
 160                 return FALSE;
 161         }
 162         if (data->id == NULL || cert->has_subject(cert, data->id))
 163         {
 164                 *out = *in;
 165                 return TRUE;
 166         }
 167
 168         public = cert->get_public_key(cert);
 169         if (public)
 170         {
 171                 if (public->has_fingerprint(public, data->id->get_encoding(data->id)))
 172                 {
 173                         public->destroy(public);
 174                         *out = *in;
 175                         return TRUE;
 176                 }
 177                 public->destroy(public);
 178         }
 179         return FALSE;
 180 }
 181
 182 /**
 183  * Implements credential_set_t.create_cert_enumerator
 184  */
 185 static enumerator_t* create_cert_enumerator(private_stroke_cred_t *this,
 186                                                         certificate_type_t cert, key_type_t key,
 187                                                         identification_t *id, bool trusted)
 188 {
 189         id_data_t *data;
 190
 191         if (trusted && (cert == CERT_X509_CRL || cert == CERT_X509_AC))
 192         {
 193                 return NULL;
 194         }
 195         data = malloc_thing(id_data_t);
 196         data->this = this;
 197         data->id = id;
 198         data->type = cert;
 199
 200         this->lock->read_lock(this->lock);
 201         return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 202                                                                         (void*)certs_filter, data,
 203                                                                         (void*)id_data_destroy);
 204 }
 205
 206 typedef struct {
 207         private_stroke_cred_t *this;
 208         identification_t *me;
 209         identification_t *other;
 210         shared_key_type_t type;
 211 } shared_data_t;
 212
 213 /**
 214  * free shared key enumerator data and unlock list
 215  */
 216 static void shared_data_destroy(shared_data_t *data)
 217 {
 218         data->this->lock->unlock(data->this->lock);
 219         free(data);
 220 }
 221
 222 /**
 223  * filter function for certs enumerator
 224  */
 225 static bool shared_filter(shared_data_t *data,
 226                                                   stroke_shared_key_t **in, shared_key_t **out,
 227                                                   void **unused1, id_match_t *me,
 228                                                   void **unused2, id_match_t *other)
 229 {
 230         id_match_t my_match = ID_MATCH_NONE, other_match = ID_MATCH_NONE;
 231         stroke_shared_key_t *stroke = *in;
 232         shared_key_t *shared = &stroke->shared;
 233
 234         if (data->type != SHARED_ANY && shared->get_type(shared) != data->type)
 235         {
 236                 return FALSE;
 237         }
 238
 239         if (data->me)
 240         {
 241                 my_match = stroke->has_owner(stroke, data->me);
 242         }
 243         if (data->other)
 244         {
 245                 other_match = stroke->has_owner(stroke, data->other);
 246         }
 247         if ((data->me || data->other) && (!my_match && !other_match))
 248         {
 249                 return FALSE;
 250         }
 251         *out = shared;
 252         if (me)
 253         {
 254                 *me = my_match;
 255         }
 256         if (other)
 257         {
 258                 *other = other_match;
 259         }
 260         return TRUE;
 261 }
 262
 263 /**
 264  * Implements credential_set_t.create_shared_enumerator
 265  */
 266 static enumerator_t* create_shared_enumerator(private_stroke_cred_t *this,
 267                                                         shared_key_type_t type, identification_t *me,
 268                                                         identification_t *other)
 269 {
 270         shared_data_t *data = malloc_thing(shared_data_t);
 271
 272         data->this = this;
 273         data->me = me;
 274         data->other = other;
 275         data->type = type;
 276         this->lock->read_lock(this->lock);
 277         return enumerator_create_filter(this->shared->create_enumerator(this->shared),
 278                                                                         (void*)shared_filter, data,
 279                                                                         (void*)shared_data_destroy);
 280 }
 281
 282 /**
 283  * Add a certificate to chain
 284  */
 285 static certificate_t* add_cert(private_stroke_cred_t *this, certificate_t *cert)
 286 {
 287         certificate_t *current;
 288         enumerator_t *enumerator;
 289         bool new = TRUE;
 290
 291         this->lock->read_lock(this->lock);
 292         enumerator = this->certs->create_enumerator(this->certs);
 293         while (enumerator->enumerate(enumerator, (void**)&current))
 294         {
 295                 if (current->equals(current, cert))
 296                 {
 297                         /* cert already in queue */
 298                         cert->destroy(cert);
 299                         cert = current;
 300                         new = FALSE;
 301                         break;
 302                 }
 303         }
 304         enumerator->destroy(enumerator);
 305
 306         if (new)
 307         {
 308                 this->certs->insert_last(this->certs, cert);
 309         }
 310         this->lock->unlock(this->lock);
 311         return cert;
 312 }
 313
 314 /**
 315  * Implementation of stroke_cred_t.load_ca.
 316  */
 317 static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
 318 {
 319         certificate_t *cert;
 320         char path[PATH_MAX];
 321
 322         if (*filename == '/')
 323         {
 324                 snprintf(path, sizeof(path), "%s", filename);
 325         }
 326         else
 327         {
 328                 snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
 329         }
 330
 331         cert = lib->creds->create(lib->creds,
 332                                                           CRED_CERTIFICATE, CERT_X509,
 333                                                           BUILD_FROM_FILE, path,
 334                                                           BUILD_END);
 335         if (cert)
 336         {
 337                 x509_t *x509 = (x509_t*)cert;
 338
 339                 if (!(x509->get_flags(x509) & X509_CA))
 340                 {
 341                         DBG1(DBG_CFG, "  ca certificate \"%Y\" misses ca basic constraint, "
 342                                  "discarded", cert->get_subject(cert));
 343                         cert->destroy(cert);
 344                         return NULL;
 345                 }
 346                 return (certificate_t*)add_cert(this, cert);
 347         }
 348         return NULL;
 349 }
 350
 351 /**
 352  * Add X.509 CRL to chain
 353  */
 354 static bool add_crl(private_stroke_cred_t *this, crl_t* crl)
 355 {
 356         certificate_t *current, *cert = &crl->certificate;
 357         enumerator_t *enumerator;
 358         bool new = TRUE, found = FALSE;
 359
 360         this->lock->write_lock(this->lock);
 361         enumerator = this->certs->create_enumerator(this->certs);
 362         while (enumerator->enumerate(enumerator, (void**)&current))
 363         {
 364                 if (current->get_type(current) == CERT_X509_CRL)
 365                 {
 366                         crl_t *crl_c = (crl_t*)current;
 367                         chunk_t authkey = crl->get_authKeyIdentifier(crl);
 368                         chunk_t authkey_c = crl_c->get_authKeyIdentifier(crl_c);
 369
 370                         /* if compare authorityKeyIdentifiers if available */
 371                         if (authkey.ptr && authkey_c.ptr && chunk_equals(authkey, authkey_c))
 372                         {
 373                                 found = TRUE;
 374                         }
 375                         else
 376                         {
 377                                 identification_t *issuer = cert->get_issuer(cert);
 378                                 identification_t *issuer_c = current->get_issuer(current);
 379
 380                                 /* otherwise compare issuer distinguished names */
 381                                 if (issuer->equals(issuer, issuer_c))
 382                                 {
 383                                         found = TRUE;
 384                                 }
 385                         }
 386                         if (found)
 387                         {
 388                                 new = crl_is_newer(crl, crl_c);
 389                                 if (new)
 390                                 {
 391                                         this->certs->remove_at(this->certs, enumerator);
 392                                 }
 393                                 else
 394                                 {
 395                                         cert->destroy(cert);
 396                                 }
 397                                 break;
 398                         }
 399                 }
 400         }
 401         enumerator->destroy(enumerator);
 402
 403         if (new)
 404         {
 405                 this->certs->insert_last(this->certs, cert);
 406         }
 407         this->lock->unlock(this->lock);
 408         return new;
 409 }
 410
 411 /**
 412  * Add X.509 attribute certificate to chain
 413  */
 414 static bool add_ac(private_stroke_cred_t *this, ac_t* ac)
 415 {
 416         certificate_t *cert = &ac->certificate;
 417
 418         this->lock->write_lock(this->lock);
 419         this->certs->insert_last(this->certs, cert);
 420         this->lock->unlock(this->lock);
 421         return TRUE;
 422 }
 423
 424 /**
 425  * Implementation of stroke_cred_t.load_peer.
 426  */
 427 static certificate_t* load_peer(private_stroke_cred_t *this, char *filename)
 428 {
 429         certificate_t *cert;
 430         char path[PATH_MAX];
 431
 432         if (*filename == '/')
 433         {
 434                 snprintf(path, sizeof(path), "%s", filename);
 435         }
 436         else
 437         {
 438                 snprintf(path, sizeof(path), "%s/%s", CERTIFICATE_DIR, filename);
 439         }
 440
 441         cert = lib->creds->create(lib->creds,
 442                                                           CRED_CERTIFICATE, CERT_ANY,
 443                                                           BUILD_FROM_FILE, path,
 444                                                           BUILD_END);
 445         if (cert)
 446         {
 447                 cert = add_cert(this, cert);
 448                 DBG1(DBG_CFG, "  loaded certificate \"%Y\" from '%s'",
 449                                           cert->get_subject(cert), filename);
 450                 return cert->get_ref(cert);
 451         }
 452         DBG1(DBG_CFG, "  loading certificate from '%s' failed", filename);
 453         return NULL;
 454 }
 455
 456 /**
 457  * load trusted certificates from a directory
 458  */
 459 static void load_certdir(private_stroke_cred_t *this, char *path,
 460                                                  certificate_type_t type, x509_flag_t flag)
 461 {
 462         struct stat st;
 463         char *file;
 464
 465         enumerator_t *enumerator = enumerator_create_directory(path);
 466
 467         if (!enumerator)
 468         {
 469                 DBG1(DBG_CFG, "  reading directory failed");
 470                 return;
 471         }
 472
 473         while (enumerator->enumerate(enumerator, NULL, &file, &st))
 474         {
 475                 certificate_t *cert;
 476
 477                 if (!S_ISREG(st.st_mode))
 478                 {
 479                         /* skip special file */
 480                         continue;
 481                 }
 482                 switch (type)
 483                 {
 484                         case CERT_X509:
 485                                 if (flag & X509_CA)
 486                                 {       /* for CA certificates, we strictly require
 487                                          * the CA basic constraint to be set */
 488                                         cert = lib->creds->create(lib->creds,
 489                                                                                 CRED_CERTIFICATE, CERT_X509,
 490                                                                                 BUILD_FROM_FILE, file, BUILD_END);
 491                                         if (cert)
 492                                         {
 493                                                 x509_t *x509 = (x509_t*)cert;
 494
 495                                                 if (!(x509->get_flags(x509) & X509_CA))
 496                                                 {
 497                                                         DBG1(DBG_CFG, "  ca certificate \"%Y\" lacks "
 498                                                                  "ca basic constraint, discarded",
 499                                                                  cert->get_subject(cert));
 500                                                         cert->destroy(cert);
 501                                                         cert = NULL;
 502                                                 }
 503                                                 else
 504                                                 {
 505                                                         DBG1(DBG_CFG, "  loaded ca certificate \"%Y\" from '%s'",
 506                                                                                   cert->get_subject(cert), file);
 507                                                 }
 508                                         }
 509                                         else
 510                                         {
 511                                                 DBG1(DBG_CFG, "  loading ca certificate from '%s' "
 512                                                                           "failed", file);
 513                                         }
 514                                 }
 515                                 else
 516                                 {       /* for all other flags, we add them to the certificate. */
 517                                         cert = lib->creds->create(lib->creds,
 518                                                                                 CRED_CERTIFICATE, CERT_X509,
 519                                                                                 BUILD_FROM_FILE, file,
 520                                                                                 BUILD_X509_FLAG, flag, BUILD_END);
 521                                         if (cert)
 522                                         {
 523                                                 DBG1(DBG_CFG, "  loaded certificate \"%Y\" from '%s'",
 524                                                                           cert->get_subject(cert), file);
 525                                         }
 526                                         else
 527                                         {
 528                                                 DBG1(DBG_CFG, "  loading certificate from '%s' "
 529                                                                           "failed", file);
 530                                         }
 531                                 }
 532                                 if (cert)
 533                                 {
 534                                         add_cert(this, cert);
 535                                 }
 536                                 break;
 537                         case CERT_X509_CRL:
 538                                 cert = lib->creds->create(lib->creds,
 539                                                                                   CRED_CERTIFICATE, CERT_X509_CRL,
 540                                                                                   BUILD_FROM_FILE, file,
 541                                                                                   BUILD_END);
 542                                 if (cert)
 543                                 {
 544                                         add_crl(this, (crl_t*)cert);
 545                                         DBG1(DBG_CFG, "  loaded crl from '%s'",  file);
 546                                 }
 547                                 else
 548                                 {
 549                                         DBG1(DBG_CFG, "  loading crl from '%s' failed", file);
 550                                 }
 551                                 break;
 552                         case CERT_X509_AC:
 553                                 cert = lib->creds->create(lib->creds,
 554                                                                                   CRED_CERTIFICATE, CERT_X509_AC,
 555                                                                                   BUILD_FROM_FILE, file,
 556                                                                                   BUILD_END);
 557                                 if (cert)
 558                                 {
 559                                         add_ac(this, (ac_t*)cert);
 560                                         DBG1(DBG_CFG, "  loaded attribute certificate from '%s'",
 561                                                                   file);
 562                                 }
 563                                 else
 564                                 {
 565                                         DBG1(DBG_CFG, "  loading attribute certificate from '%s' "
 566                                                                   "failed", file);
 567                                 }
 568                                 break;
 569                         default:
 570                                 break;
 571                 }
 572         }
 573         enumerator->destroy(enumerator);
 574 }
 575
 576 /**
 577  * Implementation of credential_set_t.cache_cert.
 578  */
 579 static void cache_cert(private_stroke_cred_t *this, certificate_t *cert)
 580 {
 581         if (cert->get_type(cert) == CERT_X509_CRL && this->cachecrl)
 582         {
 583                 /* CRLs get written to /etc/ipsec.d/crls/<authkeyId>.crl */
 584                 crl_t *crl = (crl_t*)cert;
 585
 586                 cert->get_ref(cert);
 587                 if (add_crl(this, crl))
 588                 {
 589                         char buf[BUF_LEN];
 590                         chunk_t chunk, hex;
 591
 592                         chunk = crl->get_authKeyIdentifier(crl);
 593                         hex = chunk_to_hex(chunk, NULL, FALSE);
 594                         snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex);
 595                         free(hex.ptr);
 596
 597                         if (cert->get_encoding(cert, CERT_ASN1_DER, &chunk))
 598                         {
 599                                 chunk_write(chunk, buf, "crl", 022, TRUE);
 600                                 free(chunk.ptr);
 601                         }
 602                 }
 603         }
 604 }
 605
 606 /**
 607  * Implementation of stroke_cred_t.cachecrl.
 608  */
 609 static void cachecrl(private_stroke_cred_t *this, bool enabled)
 610 {
 611         DBG1(DBG_CFG, "crl caching to %s %s",
 612                  CRL_DIR, enabled ? "enabled" : "disabled");
 613         this->cachecrl = enabled;
 614 }
 615
 616
 617 /**
 618  * Convert a string of characters into a binary secret
 619  * A string between single or double quotes is treated as ASCII characters
 620  * A string prepended by 0x is treated as HEX and prepended by 0s as Base64
 621  */
 622 static err_t extract_secret(chunk_t *secret, chunk_t *line)
 623 {
 624         chunk_t raw_secret;
 625         char delimiter = ' ';
 626         bool quotes = FALSE;
 627
 628         if (!eat_whitespace(line))
 629         {
 630                 return "missing secret";
 631         }
 632
 633         if (*line->ptr == '\'' || *line->ptr == '"')
 634         {
 635                 quotes = TRUE;
 636                 delimiter = *line->ptr;
 637                 line->ptr++;  line->len--;
 638         }
 639
 640         if (!extract_token(&raw_secret, delimiter, line))
 641         {
 642                 if (delimiter == ' ')
 643                 {
 644                         raw_secret = *line;
 645                 }
 646                 else
 647                 {
 648                         return "missing second delimiter";
 649                 }
 650         }
 651
 652         if (quotes)
 653         {
 654                 /* treat as an ASCII string */
 655                 *secret = chunk_clone(raw_secret);
 656                 return NULL;
 657         }
 658         /* treat 0x as hex, 0s as base64 */
 659         if (raw_secret.len > 2)
 660         {
 661                 if (strncasecmp("0x", raw_secret.ptr, 2) == 0)
 662                 {
 663                         *secret = chunk_from_hex(chunk_skip(raw_secret, 2), NULL);
 664                         return NULL;
 665                 }
 666                 if (strncasecmp("0s", raw_secret.ptr, 2) == 0)
 667                 {
 668                         *secret = chunk_from_base64(chunk_skip(raw_secret, 2), NULL);
 669                         return NULL;
 670                 }
 671         }
 672         *secret = chunk_clone(raw_secret);
 673         return NULL;
 674 }
 675
 676 /**
 677  * Data for passphrase callback
 678  */
 679 typedef struct {
 680         /** socket we use for prompting */
 681         FILE *prompt;
 682         /** private key file */
 683         char *path;
 684         /** number of tries */
 685         int try;
 686 } passphrase_cb_data_t;
 687
 688 /**
 689  * Callback function to receive Passphrases
 690  */
 691 static shared_key_t* passphrase_cb(passphrase_cb_data_t *data,
 692                                                                 shared_key_type_t type,
 693                                                                 identification_t *me, identification_t *other,
 694                                                                 id_match_t *match_me, id_match_t *match_other)
 695 {
 696         chunk_t secret;
 697         char buf[256];
 698
 699         if (type != SHARED_ANY && type != SHARED_PRIVATE_KEY_PASS)
 700         {
 701                 return NULL;
 702         }
 703
 704         if (data->try > 1)
 705         {
 706                 if (data->try > 5)
 707                 {
 708                         fprintf(data->prompt, "PIN invalid, giving up.\n");
 709                         return NULL;
 710                 }
 711                 fprintf(data->prompt, "PIN invalid!\n");
 712         }
 713         data->try++;
 714         fprintf(data->prompt, "Private key '%s' is encrypted.\n", data->path);
 715         fprintf(data->prompt, "Passphrase:\n");
 716         if (fgets(buf, sizeof(buf), data->prompt))
 717         {
 718                 secret = chunk_create(buf, strlen(buf));
 719                 if (secret.len > 1)
 720                 {       /* trim appended \n */
 721                         secret.len--;
 722                         if (match_me)
 723                         {
 724                                 *match_me = ID_MATCH_PERFECT;
 725                         }
 726                         if (match_other)
 727                         {
 728                                 *match_other = ID_MATCH_NONE;
 729                         }
 730                         return shared_key_create(SHARED_PRIVATE_KEY_PASS, chunk_clone(secret));
 731                 }
 732         }
 733         return NULL;
 734 }
 735
 736 /**
 737  * Data for PIN callback
 738  */
 739 typedef struct {
 740         /** socket we use for prompting */
 741         FILE *prompt;
 742         /** card label */
 743         char *card;
 744         /** card keyid */
 745         chunk_t keyid;
 746         /** number of tries */
 747         int try;
 748 } pin_cb_data_t;
 749
 750 /**
 751  * Callback function to receive PINs
 752  */
 753 static shared_key_t* pin_cb(pin_cb_data_t *data, shared_key_type_t type,
 754                                                         identification_t *me, identification_t *other,
 755                                                         id_match_t *match_me, id_match_t *match_other)
 756 {
 757         chunk_t secret;
 758         char buf[256];
 759
 760         if (type != SHARED_ANY && type != SHARED_PIN)
 761         {
 762                 return NULL;
 763         }
 764
 765         if (!me || !chunk_equals(me->get_encoding(me), data->keyid))
 766         {
 767                 return NULL;
 768         }
 769
 770         if (data->try > 1)
 771         {
 772                 fprintf(data->prompt, "PIN invalid, aborting.\n");
 773                 return NULL;
 774         }
 775         data->try++;
 776         fprintf(data->prompt, "Login to '%s' required\n", data->card);
 777         fprintf(data->prompt, "PIN:\n");
 778         if (fgets(buf, sizeof(buf), data->prompt))
 779         {
 780                 secret = chunk_create(buf, strlen(buf));
 781                 if (secret.len > 1)
 782                 {       /* trim appended \n */
 783                         secret.len--;
 784                         if (match_me)
 785                         {
 786                                 *match_me = ID_MATCH_PERFECT;
 787                         }
 788                         if (match_other)
 789                         {
 790                                 *match_other = ID_MATCH_NONE;
 791                         }
 792                         return shared_key_create(SHARED_PIN, chunk_clone(secret));
 793                 }
 794         }
 795         return NULL;
 796 }
 797
 798 /**
 799  * Load a smartcard with a PIN
 800  */
 801 static bool load_pin(private_stroke_cred_t *this, chunk_t line, int line_nr,
 802                                          FILE *prompt)
 803 {
 804         chunk_t sc = chunk_empty, secret = chunk_empty;
 805         char smartcard[64], keyid[64], module[64], *pos;
 806         private_key_t *key = NULL;
 807         u_int slot;
 808         chunk_t chunk;
 809         shared_key_t *shared;
 810         identification_t *id;
 811         mem_cred_t *mem = NULL;
 812         callback_cred_t *cb = NULL;
 813         pin_cb_data_t pin_data;
 814         enum {
 815                 SC_FORMAT_SLOT_MODULE_KEYID,
 816                 SC_FORMAT_SLOT_KEYID,
 817                 SC_FORMAT_KEYID,
 818         } format;
 819
 820         err_t ugh = extract_value(&sc, &line);
 821
 822         if (ugh != NULL)
 823         {
 824                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 825                 return FALSE;
 826         }
 827         if (sc.len == 0)
 828         {
 829                 DBG1(DBG_CFG, "line %d: expected %%smartcard specifier", line_nr);
 830                 return FALSE;
 831         }
 832         snprintf(smartcard, sizeof(smartcard), "%.*s", sc.len, sc.ptr);
 833         smartcard[sizeof(smartcard) - 1] = '\0';
 834
 835         /* parse slot and key id. Three formats are supported:
 836          * - %smartcard<slot>@<module>:<keyid>
 837          * - %smartcard<slot>:<keyid>
 838          * - %smartcard:<keyid>
 839          */
 840         if (sscanf(smartcard, "%%smartcard%u@%s", &slot, module) == 2)
 841         {
 842                 pos = strchr(module, ':');
 843                 if (!pos)
 844                 {
 845                         DBG1(DBG_CFG, "line %d: the given %%smartcard specifier is "
 846                                  "invalid", line_nr);
 847                         return FALSE;
 848                 }
 849                 *pos = '\0';
 850                 strcpy(keyid, pos + 1);
 851                 format = SC_FORMAT_SLOT_MODULE_KEYID;
 852         }
 853         else if (sscanf(smartcard, "%%smartcard%u:%s", &slot, keyid) == 2)
 854         {
 855                 format = SC_FORMAT_SLOT_KEYID;
 856         }
 857         else if (sscanf(smartcard, "%%smartcard:%s", keyid) == 1)
 858         {
 859                 format = SC_FORMAT_KEYID;
 860         }
 861         else
 862         {
 863                 DBG1(DBG_CFG, "line %d: the given %%smartcard specifier is not"
 864                                 " supported or invalid", line_nr);
 865                 return FALSE;
 866         }
 867
 868         if (!eat_whitespace(&line))
 869         {
 870                 DBG1(DBG_CFG, "line %d: expected PIN", line_nr);
 871                 return FALSE;
 872         }
 873         ugh = extract_secret(&secret, &line);
 874         if (ugh != NULL)
 875         {
 876                 DBG1(DBG_CFG, "line %d: malformed PIN: %s", line_nr, ugh);
 877                 return FALSE;
 878         }
 879
 880         chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
 881         if (secret.len == 7 && strneq(secret.ptr, "%prompt", 7))
 882         {
 883                 free(secret.ptr);
 884                 if (!prompt)
 885                 {       /* no IO channel to prompt, skip */
 886                         free(chunk.ptr);
 887                         return TRUE;
 888                 }
 889                 /* use callback credential set to prompt for the pin */
 890                 pin_data.prompt = prompt;
 891                 pin_data.card = smartcard;
 892                 pin_data.keyid = chunk;
 893                 pin_data.try = 1;
 894                 cb = callback_cred_create_shared((void*)pin_cb, &pin_data);
 895                 lib->credmgr->add_local_set(lib->credmgr, &cb->set);
 896         }
 897         else
 898         {
 899                 /* provide our pin in a temporary credential set */
 900                 shared = shared_key_create(SHARED_PIN, secret);
 901                 id = identification_create_from_encoding(ID_KEY_ID, chunk);
 902                 mem = mem_cred_create();
 903                 mem->add_shared(mem, shared, id, NULL);
 904                 lib->credmgr->add_local_set(lib->credmgr, &mem->set);
 905         }
 906
 907         /* unlock: smartcard needs the pin and potentially calls public set */
 908         this->lock->unlock(this->lock);
 909         switch (format)
 910         {
 911                 case SC_FORMAT_SLOT_MODULE_KEYID:
 912                         key = lib->creds->create(lib->creds,
 913                                                         CRED_PRIVATE_KEY, KEY_ANY,
 914                                                         BUILD_PKCS11_SLOT, slot,
 915                                                         BUILD_PKCS11_MODULE, module,
 916                                                         BUILD_PKCS11_KEYID, chunk, BUILD_END);
 917                         break;
 918                 case SC_FORMAT_SLOT_KEYID:
 919                         key = lib->creds->create(lib->creds,
 920                                                         CRED_PRIVATE_KEY, KEY_ANY,
 921                                                         BUILD_PKCS11_SLOT, slot,
 922                                                         BUILD_PKCS11_KEYID, chunk, BUILD_END);
 923                         break;
 924                 case SC_FORMAT_KEYID:
 925                         key = lib->creds->create(lib->creds,
 926                                                         CRED_PRIVATE_KEY, KEY_ANY,
 927                                                         BUILD_PKCS11_KEYID, chunk, BUILD_END);
 928                         break;
 929         }
 930         this->lock->write_lock(this->lock);
 931         if (mem)
 932         {
 933                 lib->credmgr->remove_local_set(lib->credmgr, &mem->set);
 934                 mem->destroy(mem);
 935         }
 936         if (cb)
 937         {
 938                 lib->credmgr->remove_local_set(lib->credmgr, &cb->set);
 939                 cb->destroy(cb);
 940         }
 941
 942         if (key)
 943         {
 944                 DBG1(DBG_CFG, "  loaded private key from %.*s", sc.len, sc.ptr);
 945                 this->private->insert_last(this->private, key);
 946         }
 947         return TRUE;
 948 }
 949
 950 /**
 951  * Load a private key
 952  */
 953 static bool load_private(private_stroke_cred_t *this, chunk_t line, int line_nr,
 954                                                  FILE *prompt, key_type_t key_type)
 955 {
 956         char path[PATH_MAX];
 957         chunk_t filename;
 958         chunk_t secret = chunk_empty;
 959         private_key_t *key;
 960
 961         err_t ugh = extract_value(&filename, &line);
 962
 963         if (ugh != NULL)
 964         {
 965                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 966                 return FALSE;
 967         }
 968         if (filename.len == 0)
 969         {
 970                 DBG1(DBG_CFG, "line %d: empty filename", line_nr);
 971                 return FALSE;
 972         }
 973         if (*filename.ptr == '/')
 974         {
 975                 /* absolute path name */
 976                 snprintf(path, sizeof(path), "%.*s", filename.len, filename.ptr);
 977         }
 978         else
 979         {
 980                 /* relative path name */
 981                 snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
 982                                  filename.len, filename.ptr);
 983         }
 984
 985         /* check for optional passphrase */
 986         if (eat_whitespace(&line))
 987         {
 988                 ugh = extract_secret(&secret, &line);
 989                 if (ugh != NULL)
 990                 {
 991                         DBG1(DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
 992                         return FALSE;
 993                 }
 994         }
 995         if (secret.len == 7 && strneq(secret.ptr, "%prompt", 7))
 996         {
 997                 callback_cred_t *cb = NULL;
 998                 passphrase_cb_data_t pp_data = {
 999                         .prompt = prompt,
1000                         .path = path,
1001                         .try = 1,
1002                 };
1003
1004                 free(secret.ptr);
1005                 if (!prompt)
1006                 {
1007                         return TRUE;
1008                 }
1009                 /* use callback credential set to prompt for the passphrase */
1010                 pp_data.prompt = prompt;
1011                 pp_data.path = path;
1012                 pp_data.try = 1;
1013                 cb = callback_cred_create_shared((void*)passphrase_cb, &pp_data);
1014                 lib->credmgr->add_local_set(lib->credmgr, &cb->set);
1015
1016                 /* unlock, as the builder might ask for a secret */
1017                 this->lock->unlock(this->lock);
1018                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
1019                                                                  BUILD_FROM_FILE, path, BUILD_END);
1020                 this->lock->write_lock(this->lock);
1021
1022                 lib->credmgr->remove_local_set(lib->credmgr, &cb->set);
1023                 cb->destroy(cb);
1024         }
1025         else
1026         {
1027                 mem_cred_t *mem = NULL;
1028                 shared_key_t *shared;
1029
1030                 /* provide our pin in a temporary credential set */
1031                 shared = shared_key_create(SHARED_PRIVATE_KEY_PASS, secret);
1032                 mem = mem_cred_create();
1033                 mem->add_shared(mem, shared, NULL);
1034                 lib->credmgr->add_local_set(lib->credmgr, &mem->set);
1035
1036                 /* unlock, as the builder might ask for a secret */
1037                 this->lock->unlock(this->lock);
1038                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
1039                                                                  BUILD_FROM_FILE, path, BUILD_END);
1040                 this->lock->write_lock(this->lock);
1041
1042                 lib->credmgr->remove_local_set(lib->credmgr, &mem->set);
1043                 mem->destroy(mem);
1044         }
1045         if (key)
1046         {
1047                 DBG1(DBG_CFG, "  loaded %N private key from '%s'",
1048                          key_type_names, key->get_type(key), path);
1049                 this->private->insert_last(this->private, key);
1050         }
1051         else
1052         {
1053                 DBG1(DBG_CFG, "  loading private key from '%s' failed", path);
1054         }
1055         return TRUE;
1056 }
1057
1058 /**
1059  * Load a shared key
1060  */
1061 static bool load_shared(private_stroke_cred_t *this, chunk_t line, int line_nr,
1062                                                 shared_key_type_t type, chunk_t ids)
1063 {
1064         stroke_shared_key_t *shared_key;
1065         chunk_t secret = chunk_empty;
1066         bool any = TRUE;
1067
1068         err_t ugh = extract_secret(&secret, &line);
1069         if (ugh != NULL)
1070         {
1071                 DBG1(DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
1072                 return FALSE;
1073         }
1074         shared_key = stroke_shared_key_create(type, secret);
1075         DBG1(DBG_CFG, "  loaded %N secret for %s", shared_key_type_names, type,
1076                  ids.len > 0 ? (char*)ids.ptr : "%any");
1077         DBG4(DBG_CFG, "  secret: %#B", &secret);
1078
1079         this->shared->insert_last(this->shared, shared_key);
1080         while (ids.len > 0)
1081         {
1082                 chunk_t id;
1083                 identification_t *peer_id;
1084
1085                 ugh = extract_value(&id, &ids);
1086                 if (ugh != NULL)
1087                 {
1088                         DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
1089                         return FALSE;
1090                 }
1091                 if (id.len == 0)
1092                 {
1093                         continue;
1094                 }
1095
1096                 /* NULL terminate the ID string */
1097                 *(id.ptr + id.len) = '\0';
1098                 peer_id = identification_create_from_string(id.ptr);
1099                 if (peer_id->get_type(peer_id) == ID_ANY)
1100                 {
1101                         peer_id->destroy(peer_id);
1102                         continue;
1103                 }
1104
1105                 shared_key->add_owner(shared_key, peer_id);
1106                 any = FALSE;
1107         }
1108         if (any)
1109         {
1110                 shared_key->add_owner(shared_key,
1111                                         identification_create_from_encoding(ID_ANY, chunk_empty));
1112         }
1113         return TRUE;
1114 }
1115
1116 /**
1117  * reload ipsec.secrets
1118  */
1119 static void load_secrets(private_stroke_cred_t *this, char *file, int level,
1120                                                  FILE *prompt)
1121 {
1122         int line_nr = 0, fd;
1123         chunk_t src, line;
1124         private_key_t *private;
1125         shared_key_t *shared;
1126         struct stat sb;
1127         void *addr;
1128
1129         DBG1(DBG_CFG, "loading secrets from '%s'", file);
1130         fd = open(file, O_RDONLY);
1131         if (fd == -1)
1132         {
1133                 DBG1(DBG_CFG, "opening secrets file '%s' failed: %s", file,
1134                          strerror(errno));
1135                 return;
1136         }
1137         if (fstat(fd, &sb) == -1)
1138         {
1139                 DBG1(DBG_LIB, "getting file size of '%s' failed: %s", file,
1140                          strerror(errno));
1141                 close(fd);
1142                 return;
1143         }
1144         addr = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
1145         if (addr == MAP_FAILED)
1146         {
1147                 DBG1(DBG_LIB, "mapping '%s' failed: %s", file, strerror(errno));
1148                 close(fd);
1149                 return;
1150         }
1151         src = chunk_create(addr, sb.st_size);
1152
1153         if (level == 0)
1154         {
1155                 this->lock->write_lock(this->lock);
1156
1157                 /* flush secrets on non-recursive invocation */
1158                 while (this->shared->remove_last(this->shared,
1159                                                                                  (void**)&shared) == SUCCESS)
1160                 {
1161                         shared->destroy(shared);
1162                 }
1163                 while (this->private->remove_last(this->private,
1164                                                                                   (void**)&private) == SUCCESS)
1165                 {
1166                         private->destroy(private);
1167                 }
1168         }
1169
1170         while (fetchline(&src, &line))
1171         {
1172                 chunk_t ids, token;
1173                 shared_key_type_t type;
1174
1175                 line_nr++;
1176
1177                 if (!eat_whitespace(&line))
1178                 {
1179                         continue;
1180                 }
1181                 if (line.len > strlen("include ") &&
1182                         strneq(line.ptr, "include ", strlen("include ")))
1183                 {
1184                         glob_t buf;
1185                         char **expanded, *dir, pattern[PATH_MAX];
1186                         u_char *pos;
1187
1188                         if (level > MAX_SECRETS_RECURSION)
1189                         {
1190                                 DBG1(DBG_CFG, "maximum level of %d includes reached, ignored",
1191                                          MAX_SECRETS_RECURSION);
1192                                 continue;
1193                         }
1194                         /* terminate filename by space */
1195                         line = chunk_skip(line, strlen("include "));
1196                         pos = memchr(line.ptr, ' ', line.len);
1197                         if (pos)
1198                         {
1199                                 line.len = pos - line.ptr;
1200                         }
1201                         if (line.len && line.ptr[0] == '/')
1202                         {
1203                                 if (line.len + 1 > sizeof(pattern))
1204                                 {
1205                                         DBG1(DBG_CFG, "include pattern too long, ignored");
1206                                         continue;
1207                                 }
1208                                 snprintf(pattern, sizeof(pattern), "%.*s", line.len, line.ptr);
1209                         }
1210                         else
1211                         {       /* use directory of current file if relative */
1212                                 dir = strdup(file);
1213                                 dir = dirname(dir);
1214
1215                                 if (line.len + 1 + strlen(dir) + 1 > sizeof(pattern))
1216                                 {
1217                                         DBG1(DBG_CFG, "include pattern too long, ignored");
1218                                         free(dir);
1219                                         continue;
1220                                 }
1221                                 snprintf(pattern, sizeof(pattern), "%s/%.*s",
1222                                                  dir, line.len, line.ptr);
1223                                 free(dir);
1224                         }
1225                         if (glob(pattern, GLOB_ERR, NULL, &buf) != 0)
1226                         {
1227                                 DBG1(DBG_CFG, "expanding file expression '%s' failed", pattern);
1228                                 globfree(&buf);
1229                         }
1230                         else
1231                         {
1232                                 for (expanded = buf.gl_pathv; *expanded != NULL; expanded++)
1233                                 {
1234                                         load_secrets(this, *expanded, level + 1, prompt);
1235                                 }
1236                         }
1237                         globfree(&buf);
1238                         continue;
1239                 }
1240
1241                 if (line.len > 2 && strneq(": ", line.ptr, 2))
1242                 {
1243                         /* no ids, skip the ':' */
1244                         ids = chunk_empty;
1245                         line.ptr++;
1246                         line.len--;
1247                 }
1248                 else if (extract_token_str(&ids, " : ", &line))
1249                 {
1250                         /* NULL terminate the extracted id string */
1251                         *(ids.ptr + ids.len) = '\0';
1252                 }
1253                 else
1254                 {
1255                         DBG1(DBG_CFG, "line %d: missing ' : ' separator", line_nr);
1256                         break;
1257                 }
1258
1259                 if (!eat_whitespace(&line) || !extract_token(&token, ' ', &line))
1260                 {
1261                         DBG1(DBG_CFG, "line %d: missing token", line_nr);
1262                         break;
1263                 }
1264                 if (match("RSA", &token) || match("ECDSA", &token))
1265                 {
1266                         if (!load_private(this, line, line_nr, prompt,
1267                                                           match("RSA", &token) ? KEY_RSA : KEY_ECDSA))
1268                         {
1269                                 break;
1270                         }
1271                 }
1272                 else if (match("PIN", &token))
1273                 {
1274                         if (!load_pin(this, line, line_nr, prompt))
1275                         {
1276                                 break;
1277                         }
1278                 }
1279                 else if ((match("PSK", &token) && (type = SHARED_IKE)) ||
1280                                  (match("EAP", &token) && (type = SHARED_EAP)) ||
1281                                  (match("NTLM", &token) && (type = SHARED_NT_HASH)) ||
1282                                  (match("XAUTH", &token) && (type = SHARED_EAP)))
1283                 {
1284                         if (!load_shared(this, line, line_nr, type, ids))
1285                         {
1286                                 break;
1287                         }
1288                 }
1289                 else
1290                 {
1291                         DBG1(DBG_CFG, "line %d: token must be either "
1292                                  "RSA, ECDSA, PSK, EAP, XAUTH or PIN", line_nr);
1293                         break;
1294                 }
1295         }
1296         if (level == 0)
1297         {
1298                 this->lock->unlock(this->lock);
1299         }
1300         munmap(addr, sb.st_size);
1301         close(fd);
1302 }
1303
1304 /**
1305  * load all certificates from ipsec.d
1306  */
1307 static void load_certs(private_stroke_cred_t *this)
1308 {
1309         DBG1(DBG_CFG, "loading ca certificates from '%s'",
1310                  CA_CERTIFICATE_DIR);
1311         load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
1312
1313         DBG1(DBG_CFG, "loading aa certificates from '%s'",
1314                  AA_CERTIFICATE_DIR);
1315         load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
1316
1317         DBG1(DBG_CFG, "loading ocsp signer certificates from '%s'",
1318                  OCSP_CERTIFICATE_DIR);
1319         load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509, X509_OCSP_SIGNER);
1320
1321         DBG1(DBG_CFG, "loading attribute certificates from '%s'",
1322                  ATTR_CERTIFICATE_DIR);
1323         load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
1324
1325         DBG1(DBG_CFG, "loading crls from '%s'",
1326                  CRL_DIR);
1327         load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
1328 }
1329
1330 /**
1331  * Implementation of stroke_cred_t.reread.
1332  */
1333 static void reread(private_stroke_cred_t *this, stroke_msg_t *msg, FILE *prompt)
1334 {
1335         if (msg->reread.flags & REREAD_SECRETS)
1336         {
1337                 DBG1(DBG_CFG, "rereading secrets");
1338                 load_secrets(this, SECRETS_FILE, 0, prompt);
1339         }
1340         if (msg->reread.flags & REREAD_CACERTS)
1341         {
1342                 DBG1(DBG_CFG, "rereading ca certificates from '%s'",
1343                          CA_CERTIFICATE_DIR);
1344                 load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
1345         }
1346         if (msg->reread.flags & REREAD_OCSPCERTS)
1347         {
1348                 DBG1(DBG_CFG, "rereading ocsp signer certificates from '%s'",
1349                          OCSP_CERTIFICATE_DIR);
1350                 load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509,
1351                          X509_OCSP_SIGNER);
1352         }
1353         if (msg->reread.flags & REREAD_AACERTS)
1354         {
1355                 DBG1(DBG_CFG, "rereading aa certificates from '%s'",
1356                          AA_CERTIFICATE_DIR);
1357                 load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
1358         }
1359         if (msg->reread.flags & REREAD_ACERTS)
1360         {
1361                 DBG1(DBG_CFG, "rereading attribute certificates from '%s'",
1362                          ATTR_CERTIFICATE_DIR);
1363                 load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
1364         }
1365         if (msg->reread.flags & REREAD_CRLS)
1366         {
1367                 DBG1(DBG_CFG, "rereading crls from '%s'",
1368                          CRL_DIR);
1369                 load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
1370         }
1371 }
1372
1373 /**
1374  * Implementation of stroke_cred_t.destroy
1375  */
1376 static void destroy(private_stroke_cred_t *this)
1377 {
1378         this->certs->destroy_offset(this->certs, offsetof(certificate_t, destroy));
1379         this->shared->destroy_offset(this->shared, offsetof(shared_key_t, destroy));
1380         this->private->destroy_offset(this->private, offsetof(private_key_t, destroy));
1381         this->lock->destroy(this->lock);
1382         free(this);
1383 }
1384
1385 /*
1386  * see header file
1387  */
1388 stroke_cred_t *stroke_cred_create()
1389 {
1390         private_stroke_cred_t *this = malloc_thing(private_stroke_cred_t);
1391
1392         this->public.set.create_private_enumerator = (void*)create_private_enumerator;
1393         this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
1394         this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
1395         this->public.set.create_cdp_enumerator = (void*)return_null;
1396         this->public.set.cache_cert = (void*)cache_cert;
1397         this->public.reread = (void(*)(stroke_cred_t*, stroke_msg_t *msg, FILE*))reread;
1398         this->public.load_ca = (certificate_t*(*)(stroke_cred_t*, char *filename))load_ca;
1399         this->public.load_peer = (certificate_t*(*)(stroke_cred_t*, char *filename))load_peer;
1400         this->public.cachecrl = (void(*)(stroke_cred_t*, bool enabled))cachecrl;
1401         this->public.destroy = (void(*)(stroke_cred_t*))destroy;
1402
1403         this->certs = linked_list_create();
1404         this->shared = linked_list_create();
1405         this->private = linked_list_create();
1406         this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
1407
1408         load_certs(this);
1409         load_secrets(this, SECRETS_FILE, 0, NULL);
1410
1411         this->cachecrl = FALSE;
1412
1413         return &this->public;
1414 }
1415