src/libstrongswan/credentials/credential_manager.c

   1 /*
   2  * Copyright (C) 2007 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "credential_manager.h"
  17
  18 #include <library.h>
  19 #include <debug.h>
  20 #include <threading/thread_value.h>
  21 #include <threading/mutex.h>
  22 #include <threading/rwlock.h>
  23 #include <utils/linked_list.h>
  24 #include <credentials/sets/cert_cache.h>
  25 #include <credentials/sets/auth_cfg_wrapper.h>
  26 #include <credentials/certificates/x509.h>
  27
  28 /**
  29  * Maximum length of a certificate trust chain
  30  */
  31 #define MAX_TRUST_PATH_LEN 7
  32
  33 typedef struct private_credential_manager_t private_credential_manager_t;
  34
  35 /**
  36  * private data of credential_manager
  37  */
  38 struct private_credential_manager_t {
  39
  40         /**
  41          * public functions
  42          */
  43         credential_manager_t public;
  44
  45         /**
  46          * list of credential sets
  47          */
  48         linked_list_t *sets;
  49
  50         /**
  51          * thread local set of credentials, linked_list_t with credential_set_t's
  52          */
  53         thread_value_t *local_sets;
  54
  55         /**
  56          * trust relationship and certificate cache
  57          */
  58         cert_cache_t *cache;
  59
  60         /**
  61          * certificates queued for persistent caching
  62          */
  63         linked_list_t *cache_queue;
  64
  65         /**
  66          * list of certificate validators, cert_validator_t
  67          */
  68         linked_list_t *validators;
  69
  70         /**
  71          * read-write lock to sets list
  72          */
  73         rwlock_t *lock;
  74
  75         /**
  76          * mutex for cache queue
  77          */
  78         mutex_t *queue_mutex;
  79 };
  80
  81 /** data to pass to create_private_enumerator */
  82 typedef struct {
  83         private_credential_manager_t *this;
  84         key_type_t type;
  85         identification_t* keyid;
  86 } private_data_t;
  87
  88 /** data to pass to create_cert_enumerator */
  89 typedef struct {
  90         private_credential_manager_t *this;
  91         certificate_type_t cert;
  92         key_type_t key;
  93         identification_t *id;
  94         bool trusted;
  95 } cert_data_t;
  96
  97 /** data to pass to create_cdp_enumerator */
  98 typedef struct {
  99         private_credential_manager_t *this;
 100         certificate_type_t type;
 101         identification_t *id;
 102 } cdp_data_t;
 103
 104 /** data to pass to create_shared_enumerator */
 105 typedef struct {
 106         private_credential_manager_t *this;
 107         shared_key_type_t type;
 108         identification_t *me;
 109         identification_t *other;
 110 } shared_data_t;
 111
 112 /** enumerator over local and global sets */
 113 typedef struct {
 114         /** implements enumerator_t */
 115         enumerator_t public;
 116         /** enumerator over global sets */
 117         enumerator_t *global;
 118         /** enumerator over local sets */
 119         enumerator_t *local;
 120 } sets_enumerator_t;
 121
 122
 123 METHOD(enumerator_t, sets_enumerate, bool,
 124         sets_enumerator_t *this, credential_set_t **set)
 125 {
 126         if (this->global)
 127         {
 128                 if (this->global->enumerate(this->global, set))
 129                 {
 130                         return TRUE;
 131                 }
 132                 /* end of global sets, look for local */
 133                 this->global->destroy(this->global);
 134                 this->global = NULL;
 135         }
 136         if (this->local)
 137         {
 138                 return this->local->enumerate(this->local, set);
 139         }
 140         return FALSE;
 141 }
 142
 143 METHOD(enumerator_t, sets_destroy, void,
 144         sets_enumerator_t *this)
 145 {
 146         DESTROY_IF(this->global);
 147         DESTROY_IF(this->local);
 148         free(this);
 149 }
 150
 151 /**
 152  * create an enumerator over both, global and local sets
 153  */
 154 static enumerator_t *create_sets_enumerator(private_credential_manager_t *this)
 155 {
 156         sets_enumerator_t *enumerator;
 157         linked_list_t *local;
 158
 159         INIT(enumerator,
 160                 .public = {
 161                         .enumerate = (void*)_sets_enumerate,
 162                         .destroy = _sets_destroy,
 163                 },
 164                 .global = this->sets->create_enumerator(this->sets),
 165         );
 166         local = this->local_sets->get(this->local_sets);
 167         if (local)
 168         {
 169                 enumerator->local = local->create_enumerator(local);
 170         }
 171         return &enumerator->public;
 172 }
 173
 174 /**
 175  * cleanup function for cert data
 176  */
 177 static void destroy_cert_data(cert_data_t *data)
 178 {
 179         data->this->lock->unlock(data->this->lock);
 180         free(data);
 181 }
 182
 183 /**
 184  * enumerator constructor for certificates
 185  */
 186 static enumerator_t *create_cert(credential_set_t *set, cert_data_t *data)
 187 {
 188         return set->create_cert_enumerator(set, data->cert, data->key,
 189                                                                            data->id, data->trusted);
 190 }
 191
 192 METHOD(credential_manager_t, create_cert_enumerator, enumerator_t*,
 193         private_credential_manager_t *this, certificate_type_t certificate,
 194         key_type_t key, identification_t *id, bool trusted)
 195 {
 196         cert_data_t *data = malloc_thing(cert_data_t);
 197         data->this = this;
 198         data->cert = certificate;
 199         data->key = key;
 200         data->id = id;
 201         data->trusted = trusted;
 202
 203         this->lock->read_lock(this->lock);
 204         return enumerator_create_nested(create_sets_enumerator(this),
 205                                                                         (void*)create_cert, data,
 206                                                                         (void*)destroy_cert_data);
 207 }
 208
 209 METHOD(credential_manager_t, get_cert, certificate_t*,
 210         private_credential_manager_t *this, certificate_type_t cert, key_type_t key,
 211         identification_t *id, bool trusted)
 212 {
 213         certificate_t *current, *found = NULL;
 214         enumerator_t *enumerator;
 215
 216         enumerator = create_cert_enumerator(this, cert, key, id, trusted);
 217         if (enumerator->enumerate(enumerator, &current))
 218         {
 219                 /* TODO: best match? order by keyid, subject, sualtname */
 220                 found = current->get_ref(current);
 221         }
 222         enumerator->destroy(enumerator);
 223         return found;
 224 }
 225
 226
 227 /**
 228  * cleanup function for cdp data
 229  */
 230 static void destroy_cdp_data(cdp_data_t *data)
 231 {
 232         data->this->lock->unlock(data->this->lock);
 233         free(data);
 234 }
 235
 236 /**
 237  * enumerator constructor for CDPs
 238  */
 239 static enumerator_t *create_cdp(credential_set_t *set, cdp_data_t *data)
 240 {
 241         return set->create_cdp_enumerator(set, data->type, data->id);
 242 }
 243
 244 METHOD(credential_manager_t, create_cdp_enumerator, enumerator_t*,
 245         private_credential_manager_t *this, certificate_type_t type,
 246         identification_t *id)
 247 {
 248         cdp_data_t *data;
 249
 250         INIT(data,
 251                 .this = this,
 252                 .type = type,
 253                 .id = id,
 254         );
 255         this->lock->read_lock(this->lock);
 256         return enumerator_create_nested(create_sets_enumerator(this),
 257                                                                         (void*)create_cdp, data,
 258                                                                         (void*)destroy_cdp_data);
 259 }
 260
 261 /**
 262  * cleanup function for private data
 263  */
 264 static void destroy_private_data(private_data_t *data)
 265 {
 266         data->this->lock->unlock(data->this->lock);
 267         free(data);
 268 }
 269
 270 /**
 271  * enumerator constructor for private keys
 272  */
 273 static enumerator_t *create_private(credential_set_t *set, private_data_t *data)
 274 {
 275         return set->create_private_enumerator(set, data->type, data->keyid);
 276 }
 277
 278 /**
 279  * Create an enumerator over private keys
 280  */
 281 static enumerator_t *create_private_enumerator(
 282         private_credential_manager_t *this, key_type_t key, identification_t *keyid)
 283 {
 284         private_data_t *data;
 285
 286         INIT(data,
 287                 .this = this,
 288                 .type = key,
 289                 .keyid = keyid,
 290         );
 291         this->lock->read_lock(this->lock);
 292         return enumerator_create_nested(create_sets_enumerator(this),
 293                                                                         (void*)create_private, data,
 294                                                                         (void*)destroy_private_data);
 295 }
 296
 297 /**
 298  * Look up a private key by its key identifier
 299  */
 300 static private_key_t* get_private_by_keyid(private_credential_manager_t *this,
 301                                                                         key_type_t key, identification_t *keyid)
 302 {
 303         private_key_t *found = NULL;
 304         enumerator_t *enumerator;
 305
 306         enumerator = create_private_enumerator(this, key, keyid);
 307         if (enumerator->enumerate(enumerator, &found))
 308         {
 309                 found->get_ref(found);
 310         }
 311         enumerator->destroy(enumerator);
 312         return found;
 313 }
 314
 315 /**
 316  * cleanup function for shared data
 317  */
 318 static void destroy_shared_data(shared_data_t *data)
 319 {
 320         data->this->lock->unlock(data->this->lock);
 321         free(data);
 322 }
 323
 324 /**
 325  * enumerator constructor for shared keys
 326  */
 327 static enumerator_t *create_shared(credential_set_t *set, shared_data_t *data)
 328 {
 329         return set->create_shared_enumerator(set, data->type, data->me, data->other);
 330 }
 331
 332 METHOD(credential_manager_t, create_shared_enumerator, enumerator_t*,
 333         private_credential_manager_t *this, shared_key_type_t type,
 334         identification_t *me, identification_t *other)
 335 {
 336         shared_data_t *data;
 337
 338         INIT(data,
 339                 .this = this,
 340                 .type = type,
 341                 .me = me,
 342                 .other = other,
 343         );
 344         this->lock->read_lock(this->lock);
 345         return enumerator_create_nested(create_sets_enumerator(this),
 346                                                                         (void*)create_shared, data,
 347                                                                         (void*)destroy_shared_data);
 348 }
 349
 350 METHOD(credential_manager_t, get_shared, shared_key_t*,
 351         private_credential_manager_t *this, shared_key_type_t type,
 352         identification_t *me, identification_t *other)
 353 {
 354         shared_key_t *current, *found = NULL;
 355         id_match_t *best_me = ID_MATCH_NONE, *best_other = ID_MATCH_NONE;
 356         id_match_t *match_me, *match_other;
 357         enumerator_t *enumerator;
 358
 359         enumerator = create_shared_enumerator(this, type, me, other);
 360         while (enumerator->enumerate(enumerator, &current, &match_me, &match_other))
 361         {
 362                 if (match_other > best_other ||
 363                         (match_other == best_other && match_me > best_me))
 364                 {
 365                         DESTROY_IF(found);
 366                         found = current->get_ref(current);
 367                         best_me = match_me;
 368                         best_other = match_other;
 369                 }
 370         }
 371         enumerator->destroy(enumerator);
 372         return found;
 373 }
 374
 375 METHOD(credential_manager_t, add_local_set, void,
 376         private_credential_manager_t *this, credential_set_t *set)
 377 {
 378         linked_list_t *sets;
 379
 380         sets = this->local_sets->get(this->local_sets);
 381         if (!sets)
 382         {       /* first invocation */
 383                 sets = linked_list_create();
 384                 this->local_sets->set(this->local_sets, sets);
 385         }
 386         sets->insert_last(sets, set);
 387 }
 388
 389 METHOD(credential_manager_t, remove_local_set, void,
 390         private_credential_manager_t *this, credential_set_t *set)
 391 {
 392         linked_list_t *sets;
 393
 394         sets = this->local_sets->get(this->local_sets);
 395         sets->remove(sets, set, NULL);
 396 }
 397
 398 METHOD(credential_manager_t, cache_cert, void,
 399         private_credential_manager_t *this, certificate_t *cert)
 400 {
 401         credential_set_t *set;
 402         enumerator_t *enumerator;
 403
 404         if (this->lock->try_write_lock(this->lock))
 405         {
 406                 enumerator = this->sets->create_enumerator(this->sets);
 407                 while (enumerator->enumerate(enumerator, &set))
 408                 {
 409                         set->cache_cert(set, cert);
 410                 }
 411                 enumerator->destroy(enumerator);
 412                 this->lock->unlock(this->lock);
 413         }
 414         else
 415         {       /* we can't cache now as other threads are active, queue for later */
 416                 this->queue_mutex->lock(this->queue_mutex);
 417                 this->cache_queue->insert_last(this->cache_queue, cert->get_ref(cert));
 418                 this->queue_mutex->unlock(this->queue_mutex);
 419         }
 420 }
 421
 422 /**
 423  * Try to cache certificates queued for caching
 424  */
 425 static void cache_queue(private_credential_manager_t *this)
 426 {
 427         credential_set_t *set;
 428         certificate_t *cert;
 429         enumerator_t *enumerator;
 430
 431         this->queue_mutex->lock(this->queue_mutex);
 432         if (this->cache_queue->get_count(this->cache_queue) > 0 &&
 433                 this->lock->try_write_lock(this->lock))
 434         {
 435                 while (this->cache_queue->remove_last(this->cache_queue,
 436                                                                                           (void**)&cert) == SUCCESS)
 437                 {
 438                         enumerator = this->sets->create_enumerator(this->sets);
 439                         while (enumerator->enumerate(enumerator, &set))
 440                         {
 441                                 set->cache_cert(set, cert);
 442                         }
 443                         enumerator->destroy(enumerator);
 444                         cert->destroy(cert);
 445                 }
 446                 this->lock->unlock(this->lock);
 447         }
 448         this->queue_mutex->unlock(this->queue_mutex);
 449 }
 450
 451 /**
 452  * check a certificate for its lifetime
 453  */
 454 static bool check_certificate(private_credential_manager_t *this,
 455                                 certificate_t *subject, certificate_t *issuer, bool online,
 456                                 int pathlen, bool trusted, auth_cfg_t *auth)
 457 {
 458         time_t not_before, not_after;
 459         cert_validator_t *validator;
 460         enumerator_t *enumerator;
 461
 462         if (!subject->get_validity(subject, NULL, &not_before, &not_after))
 463         {
 464                 DBG1(DBG_CFG, "subject certificate invalid (valid from %T to %T)",
 465                          &not_before, FALSE, &not_after, FALSE);
 466                 return FALSE;
 467         }
 468         if (!issuer->get_validity(issuer, NULL, &not_before, &not_after))
 469         {
 470                 DBG1(DBG_CFG, "issuer certificate invalid (valid from %T to %T)",
 471                          &not_before, FALSE, &not_after, FALSE);
 472                 return FALSE;
 473         }
 474
 475         enumerator = this->validators->create_enumerator(this->validators);
 476         while (enumerator->enumerate(enumerator, &validator))
 477         {
 478                 if (!validator->validate(validator, subject, issuer,
 479                                                                  online, pathlen, trusted, auth))
 480                 {
 481                         enumerator->destroy(enumerator);
 482                         return FALSE;
 483                 }
 484         }
 485         enumerator->destroy(enumerator);
 486         return TRUE;
 487 }
 488
 489 /**
 490  * Get a trusted certificate from a credential set
 491  */
 492 static certificate_t *get_pretrusted_cert(private_credential_manager_t *this,
 493                                                                                   key_type_t type, identification_t *id)
 494 {
 495         certificate_t *subject;
 496         public_key_t *public;
 497
 498         subject = get_cert(this, CERT_ANY, type, id, TRUE);
 499         if (!subject)
 500         {
 501                 return NULL;
 502         }
 503         public = subject->get_public_key(subject);
 504         if (!public)
 505         {
 506                 subject->destroy(subject);
 507                 return NULL;
 508         }
 509         public->destroy(public);
 510         return subject;
 511 }
 512
 513 /**
 514  * Get the issuing certificate of a subject certificate
 515  */
 516 static certificate_t *get_issuer_cert(private_credential_manager_t *this,
 517                                                                           certificate_t *subject, bool trusted)
 518 {
 519         enumerator_t *enumerator;
 520         certificate_t *issuer = NULL, *candidate;
 521
 522         enumerator = create_cert_enumerator(this, subject->get_type(subject), KEY_ANY,
 523                                                                                 subject->get_issuer(subject), trusted);
 524         while (enumerator->enumerate(enumerator, &candidate))
 525         {
 526                 if (this->cache->issued_by(this->cache, subject, candidate))
 527                 {
 528                         issuer = candidate->get_ref(candidate);
 529                         break;
 530                 }
 531         }
 532         enumerator->destroy(enumerator);
 533         return issuer;
 534 }
 535
 536 /**
 537  * Get the strength of certificate, add it to auth
 538  */
 539 static void get_key_strength(certificate_t *cert, auth_cfg_t *auth)
 540 {
 541         uintptr_t strength;
 542         public_key_t *key;
 543         key_type_t type;
 544
 545         key = cert->get_public_key(cert);
 546         if (key)
 547         {
 548                 type = key->get_type(key);
 549                 strength = key->get_keysize(key);
 550                 DBG2(DBG_CFG, "  certificate \"%Y\" key: %d bit %N",
 551                          cert->get_subject(cert), strength, key_type_names, type);
 552                 switch (type)
 553                 {
 554                         case KEY_RSA:
 555                                 auth->add(auth, AUTH_RULE_RSA_STRENGTH, strength);
 556                                 break;
 557                         case KEY_ECDSA:
 558                                 auth->add(auth, AUTH_RULE_ECDSA_STRENGTH, strength);
 559                                 break;
 560                         default:
 561                                 break;
 562                 }
 563                 key->destroy(key);
 564         }
 565 }
 566
 567 /**
 568  * try to verify the trust chain of subject, return TRUE if trusted
 569  */
 570 static bool verify_trust_chain(private_credential_manager_t *this,
 571                                                            certificate_t *subject, auth_cfg_t *result,
 572                                                            bool trusted, bool online)
 573 {
 574         certificate_t *current, *issuer;
 575         auth_cfg_t *auth;
 576         int pathlen;
 577
 578         auth = auth_cfg_create();
 579         get_key_strength(subject, auth);
 580         current = subject->get_ref(subject);
 581         auth->add(auth, AUTH_RULE_SUBJECT_CERT, current->get_ref(current));
 582
 583         for (pathlen = 0; pathlen <= MAX_TRUST_PATH_LEN; pathlen++)
 584         {
 585                 issuer = get_issuer_cert(this, current, TRUE);
 586                 if (issuer)
 587                 {
 588                         /* accept only self-signed CAs as trust anchor */
 589                         if (this->cache->issued_by(this->cache, issuer, issuer))
 590                         {
 591                                 auth->add(auth, AUTH_RULE_CA_CERT, issuer->get_ref(issuer));
 592                                 DBG1(DBG_CFG, "  using trusted ca certificate \"%Y\"",
 593                                                           issuer->get_subject(issuer));
 594                                 trusted = TRUE;
 595                         }
 596                         else
 597                         {
 598                                 auth->add(auth, AUTH_RULE_IM_CERT, issuer->get_ref(issuer));
 599                                 DBG1(DBG_CFG, "  using trusted intermediate ca certificate "
 600                                          "\"%Y\"", issuer->get_subject(issuer));
 601                         }
 602                 }
 603                 else
 604                 {
 605                         issuer = get_issuer_cert(this, current, FALSE);
 606                         if (issuer)
 607                         {
 608                                 if (current->equals(current, issuer))
 609                                 {
 610                                         DBG1(DBG_CFG, "  self-signed certificate \"%Y\" is not trusted",
 611                                                  current->get_subject(current));
 612                                         issuer->destroy(issuer);
 613                                         break;
 614                                 }
 615                                 auth->add(auth, AUTH_RULE_IM_CERT, issuer->get_ref(issuer));
 616                                 DBG1(DBG_CFG, "  using untrusted intermediate certificate "
 617                                          "\"%Y\"", issuer->get_subject(issuer));
 618                         }
 619                         else
 620                         {
 621                                 DBG1(DBG_CFG, "no issuer certificate found for \"%Y\"",
 622                                          current->get_subject(current));
 623                                 break;
 624                         }
 625                 }
 626                 if (!check_certificate(this, current, issuer, online,
 627                                                            pathlen, trusted, auth))
 628                 {
 629                         trusted = FALSE;
 630                         issuer->destroy(issuer);
 631                         break;
 632                 }
 633                 if (issuer)
 634                 {
 635                         get_key_strength(issuer, auth);
 636                 }
 637                 current->destroy(current);
 638                 current = issuer;
 639                 if (trusted)
 640                 {
 641                         DBG1(DBG_CFG, "  reached self-signed root ca with a path length of %d",
 642                                                   pathlen);
 643                         break;
 644                 }
 645         }
 646         current->destroy(current);
 647         if (pathlen > MAX_TRUST_PATH_LEN)
 648         {
 649                 DBG1(DBG_CFG, "maximum path length of %d exceeded", MAX_TRUST_PATH_LEN);
 650         }
 651         if (trusted)
 652         {
 653                 result->merge(result, auth, FALSE);
 654         }
 655         auth->destroy(auth);
 656         return trusted;
 657 }
 658
 659 /**
 660  * List find match function for certificates
 661  */
 662 static bool cert_equals(certificate_t *a, certificate_t *b)
 663 {
 664         return a->equals(a, b);
 665 }
 666
 667 /**
 668  * enumerator for trusted certificates
 669  */
 670 typedef struct {
 671         /** implements enumerator_t interface */
 672         enumerator_t public;
 673         /** enumerator over candidate peer certificates */
 674         enumerator_t *candidates;
 675         /** reference to the credential_manager */
 676         private_credential_manager_t *this;
 677         /** type of the requested key */
 678         key_type_t type;
 679         /** identity the requested key belongs to */
 680         identification_t *id;
 681         /** TRUE to do CRL/OCSP checking */
 682         bool online;
 683         /** pretrusted certificate we have served at first invocation */
 684         certificate_t *pretrusted;
 685         /** currently enumerating auth config */
 686         auth_cfg_t *auth;
 687         /** list of failed candidates */
 688         linked_list_t *failed;
 689 } trusted_enumerator_t;
 690
 691 METHOD(enumerator_t, trusted_enumerate, bool,
 692         trusted_enumerator_t *this, certificate_t **cert, auth_cfg_t **auth)
 693 {
 694         certificate_t *current;
 695
 696         DESTROY_IF(this->auth);
 697         this->auth = auth_cfg_create();
 698
 699         if (!this->candidates)
 700         {
 701                 /* first invocation, build enumerator for next one */
 702                 this->candidates = create_cert_enumerator(this->this, CERT_ANY,
 703                                                                                                   this->type, this->id, FALSE);
 704                 /* check if we have a trusted certificate for that peer */
 705                 this->pretrusted = get_pretrusted_cert(this->this, this->type, this->id);
 706                 if (this->pretrusted)
 707                 {
 708                         /* if we find a trusted self signed certificate, we just accept it.
 709                          * However, in order to fulfill authorization rules, we try to build
 710                          * the trust chain if it is not self signed */
 711                         if (this->this->cache->issued_by(this->this->cache,
 712                                                                    this->pretrusted, this->pretrusted) ||
 713                                 verify_trust_chain(this->this, this->pretrusted, this->auth,
 714                                                                    TRUE, this->online))
 715                         {
 716                                 DBG1(DBG_CFG, "  using trusted certificate \"%Y\"",
 717                                          this->pretrusted->get_subject(this->pretrusted));
 718                                 *cert = this->pretrusted;
 719                                 if (!this->auth->get(this->auth, AUTH_RULE_SUBJECT_CERT))
 720                                 {       /* add cert to auth info, if not returned by trustchain */
 721                                         this->auth->add(this->auth, AUTH_RULE_SUBJECT_CERT,
 722                                                                         this->pretrusted->get_ref(this->pretrusted));
 723                                 }
 724                                 if (auth)
 725                                 {
 726                                         *auth = this->auth;
 727                                 }
 728                                 return TRUE;
 729                         }
 730                 }
 731         }
 732         /* try to verify the trust chain for each certificate found */
 733         while (this->candidates->enumerate(this->candidates, &current))
 734         {
 735                 if (this->pretrusted &&
 736                         this->pretrusted->equals(this->pretrusted, current))
 737                 {       /* skip pretrusted certificate we already served */
 738                         continue;
 739                 }
 740
 741                 if (this->failed->find_first(this->failed, (void*)cert_equals,
 742                                                                          NULL, current) == SUCCESS)
 743                 {       /* check each candidate only once */
 744                         continue;
 745                 }
 746
 747                 DBG1(DBG_CFG, "  using certificate \"%Y\"",
 748                          current->get_subject(current));
 749                 if (verify_trust_chain(this->this, current, this->auth, FALSE,
 750                                                            this->online))
 751                 {
 752                         *cert = current;
 753                         if (auth)
 754                         {
 755                                 *auth = this->auth;
 756                         }
 757                         return TRUE;
 758                 }
 759                 this->failed->insert_last(this->failed, current->get_ref(current));
 760         }
 761         return FALSE;
 762 }
 763
 764 METHOD(enumerator_t, trusted_destroy, void,
 765         trusted_enumerator_t *this)
 766 {
 767         DESTROY_IF(this->pretrusted);
 768         DESTROY_IF(this->auth);
 769         DESTROY_IF(this->candidates);
 770         this->failed->destroy_offset(this->failed, offsetof(certificate_t, destroy));
 771         free(this);
 772 }
 773
 774 METHOD(credential_manager_t, create_trusted_enumerator, enumerator_t*,
 775         private_credential_manager_t *this, key_type_t type,
 776         identification_t *id, bool online)
 777 {
 778         trusted_enumerator_t *enumerator;
 779
 780         INIT(enumerator,
 781                 .public = {
 782                         .enumerate = (void*)_trusted_enumerate,
 783                         .destroy = _trusted_destroy,
 784                 },
 785                 .this = this,
 786                 .type = type,
 787                 .id = id,
 788                 .online = online,
 789                 .failed = linked_list_create(),
 790         );
 791         return &enumerator->public;
 792 }
 793
 794 /**
 795  * enumerator for public keys
 796  */
 797 typedef struct {
 798         /** implements enumerator_t interface */
 799         enumerator_t public;
 800         /** enumerator over candidate peer certificates */
 801         enumerator_t *inner;
 802         /** reference to the credential_manager */
 803         private_credential_manager_t *this;
 804         /** currently enumerating key */
 805         public_key_t *current;
 806         /** credset wrapper around auth config */
 807         auth_cfg_wrapper_t *wrapper;
 808 } public_enumerator_t;
 809
 810 METHOD(enumerator_t, public_enumerate, bool,
 811         public_enumerator_t *this, public_key_t **key, auth_cfg_t **auth)
 812 {
 813         certificate_t *cert;
 814
 815         while (this->inner->enumerate(this->inner, &cert, auth))
 816         {
 817                 DESTROY_IF(this->current);
 818                 this->current = cert->get_public_key(cert);
 819                 if (this->current)
 820                 {
 821                         *key = this->current;
 822                         return TRUE;
 823                 }
 824         }
 825         return FALSE;
 826 }
 827
 828 METHOD(enumerator_t, public_destroy, void,
 829         public_enumerator_t *this)
 830 {
 831         DESTROY_IF(this->current);
 832         this->inner->destroy(this->inner);
 833         if (this->wrapper)
 834         {
 835                 remove_local_set(this->this, &this->wrapper->set);
 836                 this->wrapper->destroy(this->wrapper);
 837         }
 838         this->this->lock->unlock(this->this->lock);
 839
 840         /* check for delayed certificate cache queue */
 841         cache_queue(this->this);
 842         free(this);
 843 }
 844
 845 METHOD(credential_manager_t, create_public_enumerator, enumerator_t*,
 846         private_credential_manager_t *this, key_type_t type, identification_t *id,
 847         auth_cfg_t *auth)
 848 {
 849         public_enumerator_t *enumerator;
 850
 851         INIT(enumerator,
 852                 .public = {
 853                         .enumerate = (void*)_public_enumerate,
 854                         .destroy = _public_destroy,
 855                 },
 856                 .inner = create_trusted_enumerator(this, type, id, TRUE),
 857                 .this = this,
 858         );
 859         if (auth)
 860         {
 861                 enumerator->wrapper = auth_cfg_wrapper_create(auth);
 862                 add_local_set(this, &enumerator->wrapper->set);
 863         }
 864         this->lock->read_lock(this->lock);
 865         return &enumerator->public;
 866 }
 867
 868 /**
 869  * Check if an helper contains a certificate as trust anchor
 870  */
 871 static bool auth_contains_cacert(auth_cfg_t *auth, certificate_t *cert)
 872 {
 873         enumerator_t *enumerator;
 874         identification_t *value;
 875         auth_rule_t type;
 876         bool found = FALSE;
 877
 878         enumerator = auth->create_enumerator(auth);
 879         while (enumerator->enumerate(enumerator, &type, &value))
 880         {
 881                 if (type == AUTH_RULE_CA_CERT &&
 882                         cert->equals(cert, (certificate_t*)value))
 883                 {
 884                         found = TRUE;
 885                         break;
 886                 }
 887         }
 888         enumerator->destroy(enumerator);
 889         return found;
 890 }
 891
 892 /**
 893  * build a trustchain from subject up to a trust anchor in trusted
 894  */
 895 static auth_cfg_t *build_trustchain(private_credential_manager_t *this,
 896                                                                          certificate_t *subject, auth_cfg_t *auth)
 897 {
 898         certificate_t *issuer, *current;
 899         auth_cfg_t *trustchain;
 900         int pathlen = 0;
 901         bool has_anchor;
 902
 903         trustchain = auth_cfg_create();
 904         has_anchor = auth->get(auth, AUTH_RULE_CA_CERT) != NULL;
 905         current = subject->get_ref(subject);
 906         while (TRUE)
 907         {
 908                 if (auth_contains_cacert(auth, current))
 909                 {
 910                         trustchain->add(trustchain, AUTH_RULE_CA_CERT, current);
 911                         return trustchain;
 912                 }
 913                 if (subject == current)
 914                 {
 915                         trustchain->add(trustchain, AUTH_RULE_SUBJECT_CERT, current);
 916                 }
 917                 else
 918                 {
 919                         if (!has_anchor &&
 920                                 this->cache->issued_by(this->cache, current, current))
 921                         {       /* If no trust anchor specified, accept any CA */
 922                                 trustchain->add(trustchain, AUTH_RULE_CA_CERT, current);
 923                                 return trustchain;
 924                         }
 925                         trustchain->add(trustchain, AUTH_RULE_IM_CERT, current);
 926                 }
 927                 if (pathlen++ > MAX_TRUST_PATH_LEN)
 928                 {
 929                         break;
 930                 }
 931                 issuer = get_issuer_cert(this, current, FALSE);
 932                 if (!issuer)
 933                 {
 934                         if (!has_anchor)
 935                         {       /* If no trust anchor specified, accept incomplete chains */
 936                                 return trustchain;
 937                         }
 938                         break;
 939                 }
 940                 if (has_anchor && issuer->equals(issuer, current))
 941                 {
 942                         issuer->destroy(issuer);
 943                         break;
 944                 }
 945                 current = issuer;
 946         }
 947         trustchain->destroy(trustchain);
 948         return NULL;
 949 }
 950
 951 /**
 952  * find a private key of a give certificate
 953  */
 954 static private_key_t *get_private_by_cert(private_credential_manager_t *this,
 955                                                                                   certificate_t *cert, key_type_t type)
 956 {
 957         private_key_t *private = NULL;
 958         identification_t *keyid;
 959         chunk_t chunk;
 960         public_key_t *public;
 961
 962         public = cert->get_public_key(cert);
 963         if (public)
 964         {
 965                 if (public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &chunk))
 966                 {
 967                         keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
 968                         private = get_private_by_keyid(this, type, keyid);
 969                         keyid->destroy(keyid);
 970                 }
 971                 public->destroy(public);
 972         }
 973         return private;
 974 }
 975
 976 METHOD(credential_manager_t, get_private, private_key_t*,
 977         private_credential_manager_t *this, key_type_t type, identification_t *id,
 978         auth_cfg_t *auth)
 979 {
 980         enumerator_t *enumerator;
 981         certificate_t *cert;
 982         private_key_t *private = NULL;
 983         auth_cfg_t *trustchain;
 984
 985         /* check if this is a lookup by key ID, and do it if so */
 986         if (id && id->get_type(id) == ID_KEY_ID)
 987         {
 988                 private = get_private_by_keyid(this, type, id);
 989                 if (private)
 990                 {
 991                         return private;
 992                 }
 993         }
 994
 995         /* if a specific certificate is preferred, check for a matching key */
 996         cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
 997         if (cert)
 998         {
 999                 private = get_private_by_cert(this, cert, type);
1000                 if (private)
1001                 {
1002                         trustchain = build_trustchain(this, cert, auth);
1003                         if (trustchain)
1004                         {
1005                                 auth->merge(auth, trustchain, FALSE);
1006                                 trustchain->destroy(trustchain);
1007                         }
1008                         return private;
1009                 }
1010         }
1011
1012         /* try to build a trust chain for each certificate found */
1013         enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE);
1014         while (enumerator->enumerate(enumerator, &cert))
1015         {
1016                 private = get_private_by_cert(this, cert, type);
1017                 if (private)
1018                 {
1019                         trustchain = build_trustchain(this, cert, auth);
1020                         if (trustchain)
1021                         {
1022                                 auth->merge(auth, trustchain, FALSE);
1023                                 trustchain->destroy(trustchain);
1024                                 break;
1025                         }
1026                         private->destroy(private);
1027                         private = NULL;
1028                 }
1029         }
1030         enumerator->destroy(enumerator);
1031
1032         /* if no valid trustchain was found, fall back to the first usable cert */
1033         if (!private)
1034         {
1035                 enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE);
1036                 while (enumerator->enumerate(enumerator, &cert))
1037                 {
1038                         private = get_private_by_cert(this, cert, type);
1039                         if (private)
1040                         {
1041                                 auth->add(auth, AUTH_RULE_SUBJECT_CERT, cert->get_ref(cert));
1042                                 break;
1043                         }
1044                 }
1045                 enumerator->destroy(enumerator);
1046         }
1047         return private;
1048 }
1049
1050 METHOD(credential_manager_t, flush_cache, void,
1051         private_credential_manager_t *this, certificate_type_t type)
1052 {
1053         this->cache->flush(this->cache, type);
1054 }
1055
1056 METHOD(credential_manager_t, issued_by, bool,
1057         private_credential_manager_t *this, certificate_t *subject,
1058         certificate_t *issuer)
1059 {
1060         return this->cache->issued_by(this->cache, subject, issuer);
1061 }
1062
1063 METHOD(credential_manager_t, add_set, void,
1064         private_credential_manager_t *this, credential_set_t *set)
1065 {
1066         this->lock->write_lock(this->lock);
1067         this->sets->insert_last(this->sets, set);
1068         this->lock->unlock(this->lock);
1069 }
1070
1071 METHOD(credential_manager_t, remove_set, void,
1072         private_credential_manager_t *this, credential_set_t *set)
1073 {
1074         this->lock->write_lock(this->lock);
1075         this->sets->remove(this->sets, set, NULL);
1076         this->lock->unlock(this->lock);
1077 }
1078
1079 METHOD(credential_manager_t, add_validator, void,
1080         private_credential_manager_t *this, cert_validator_t *vdtr)
1081 {
1082         this->lock->write_lock(this->lock);
1083         this->sets->insert_last(this->validators, vdtr);
1084         this->lock->unlock(this->lock);
1085 }
1086
1087 METHOD(credential_manager_t, remove_validator, void,
1088         private_credential_manager_t *this, cert_validator_t *vdtr)
1089 {
1090         this->lock->write_lock(this->lock);
1091         this->validators->remove(this->validators, vdtr, NULL);
1092         this->lock->unlock(this->lock);
1093 }
1094
1095 METHOD(credential_manager_t, destroy, void,
1096         private_credential_manager_t *this)
1097 {
1098         cache_queue(this);
1099         this->cache_queue->destroy(this->cache_queue);
1100         this->sets->remove(this->sets, this->cache, NULL);
1101         this->sets->destroy(this->sets);
1102         this->local_sets->destroy(this->local_sets);
1103         this->cache->destroy(this->cache);
1104         this->validators->destroy(this->validators);
1105         this->lock->destroy(this->lock);
1106         this->queue_mutex->destroy(this->queue_mutex);
1107         free(this);
1108 }
1109
1110 /*
1111  * see header file
1112  */
1113 credential_manager_t *credential_manager_create()
1114 {
1115         private_credential_manager_t *this;
1116
1117         INIT(this,
1118                 .public = {
1119                         .create_cert_enumerator = _create_cert_enumerator,
1120                         .create_shared_enumerator = _create_shared_enumerator,
1121                         .create_cdp_enumerator = _create_cdp_enumerator,
1122                         .get_cert = _get_cert,
1123                         .get_shared = _get_shared,
1124                         .get_private = _get_private,
1125                         .create_trusted_enumerator = _create_trusted_enumerator,
1126                         .create_public_enumerator = _create_public_enumerator,
1127                         .flush_cache = _flush_cache,
1128                         .cache_cert = _cache_cert,
1129                         .issued_by = _issued_by,
1130                         .add_set = _add_set,
1131                         .remove_set = _remove_set,
1132                         .add_local_set = _add_local_set,
1133                         .remove_local_set = _remove_local_set,
1134                         .add_validator = _add_validator,
1135                         .remove_validator = _remove_validator,
1136                         .destroy = _destroy,
1137                 },
1138                 .sets = linked_list_create(),
1139                 .validators = linked_list_create(),
1140                 .cache = cert_cache_create(),
1141                 .cache_queue = linked_list_create(),
1142                 .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
1143                 .queue_mutex = mutex_create(MUTEX_TYPE_DEFAULT),
1144         );
1145
1146         this->local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy);
1147         this->sets->insert_first(this->sets, this->cache);
1148
1149         return &this->public;
1150 }