revocation: More accurately describe the flags to disable OCSP/CRL validation
[strongswan.git] / src / libstrongswan / plugins / revocation / revocation_validator.c
1 /*
2 * Copyright (C) 2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 * Copyright (C) 2009 Andreas Steffen
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include "revocation_validator.h"
19
20 #include <utils/debug.h>
21 #include <credentials/certificates/x509.h>
22 #include <credentials/certificates/crl.h>
23 #include <credentials/certificates/ocsp_request.h>
24 #include <credentials/certificates/ocsp_response.h>
25 #include <credentials/sets/ocsp_response_wrapper.h>
26 #include <selectors/traffic_selector.h>
27
28 typedef struct private_revocation_validator_t private_revocation_validator_t;
29
30 /**
31 * Private data of an revocation_validator_t object.
32 */
33 struct private_revocation_validator_t {
34
35 /**
36 * Public revocation_validator_t interface.
37 */
38 revocation_validator_t public;
39
40 /**
41 * Enable OCSP validation
42 */
43 bool enable_ocsp;
44
45 /**
46 * Enable CRL validation
47 */
48 bool enable_crl;
49
50 };
51
52 /**
53 * Do an OCSP request
54 */
55 static certificate_t *fetch_ocsp(char *url, certificate_t *subject,
56 certificate_t *issuer)
57 {
58 certificate_t *request, *response;
59 chunk_t send, receive;
60
61 /* TODO: requestor name, signature */
62 request = lib->creds->create(lib->creds,
63 CRED_CERTIFICATE, CERT_X509_OCSP_REQUEST,
64 BUILD_CA_CERT, issuer,
65 BUILD_CERT, subject, BUILD_END);
66 if (!request)
67 {
68 DBG1(DBG_CFG, "generating ocsp request failed");
69 return NULL;
70 }
71
72 if (!request->get_encoding(request, CERT_ASN1_DER, &send))
73 {
74 DBG1(DBG_CFG, "encoding ocsp request failed");
75 request->destroy(request);
76 return NULL;
77 }
78 request->destroy(request);
79
80 DBG1(DBG_CFG, " requesting ocsp status from '%s' ...", url);
81 if (lib->fetcher->fetch(lib->fetcher, url, &receive,
82 FETCH_REQUEST_DATA, send,
83 FETCH_REQUEST_TYPE, "application/ocsp-request",
84 FETCH_END) != SUCCESS)
85 {
86 DBG1(DBG_CFG, "ocsp request to %s failed", url);
87 chunk_free(&send);
88 return NULL;
89 }
90 chunk_free(&send);
91
92 response = lib->creds->create(lib->creds,
93 CRED_CERTIFICATE, CERT_X509_OCSP_RESPONSE,
94 BUILD_BLOB_ASN1_DER, receive, BUILD_END);
95 chunk_free(&receive);
96 if (!response)
97 {
98 DBG1(DBG_CFG, "parsing ocsp response failed");
99 return NULL;
100 }
101 return response;
102 }
103
104 /**
105 * check the signature of an OCSP response
106 */
107 static bool verify_ocsp(ocsp_response_t *response, certificate_t *ca)
108 {
109 certificate_t *issuer, *subject;
110 identification_t *responder;
111 ocsp_response_wrapper_t *wrapper;
112 enumerator_t *enumerator;
113 x509_t *x509;
114 bool verified = FALSE, found = FALSE;
115
116 wrapper = ocsp_response_wrapper_create((ocsp_response_t*)response);
117 lib->credmgr->add_local_set(lib->credmgr, &wrapper->set, FALSE);
118
119 subject = &response->certificate;
120 responder = subject->get_issuer(subject);
121
122 /* check OCSP response using CA or directly delegated OCSP signer */
123 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr, CERT_X509,
124 KEY_ANY, responder, FALSE);
125 while (enumerator->enumerate(enumerator, &issuer))
126 {
127 x509 = (x509_t*)issuer;
128 if (!issuer->get_validity(issuer, NULL, NULL, NULL))
129 { /* OCSP signer currently invalid */
130 continue;
131 }
132 if (!ca->equals(ca, issuer))
133 { /* delegated OCSP signer? */
134 if (!lib->credmgr->issued_by(lib->credmgr, issuer, ca, NULL))
135 { /* OCSP response not signed by CA, nor delegated OCSP signer */
136 continue;
137 }
138 if (!(x509->get_flags(x509) & X509_OCSP_SIGNER))
139 { /* delegated OCSP signer does not have OCSP signer flag */
140 continue;
141 }
142 }
143 found = TRUE;
144 if (lib->credmgr->issued_by(lib->credmgr, subject, issuer, NULL))
145 {
146 DBG1(DBG_CFG, " ocsp response correctly signed by \"%Y\"",
147 issuer->get_subject(issuer));
148 verified = TRUE;
149 break;
150 }
151 DBG1(DBG_CFG, "ocsp response verification failed, "
152 "invalid signature");
153 }
154 enumerator->destroy(enumerator);
155
156 if (!verified)
157 {
158 /* as fallback, use any locally installed OCSP signer certificate */
159 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
160 CERT_X509, KEY_ANY, responder, TRUE);
161 while (enumerator->enumerate(enumerator, &issuer))
162 {
163 x509 = (x509_t*)issuer;
164 /* while issued_by() accepts both OCSP signer or CA basic
165 * constraint flags to verify OCSP responses, unrelated but trusted
166 * OCSP signers must explicitly have the OCSP signer flag set. */
167 if ((x509->get_flags(x509) & X509_OCSP_SIGNER) &&
168 issuer->get_validity(issuer, NULL, NULL, NULL))
169 {
170 found = TRUE;
171 if (lib->credmgr->issued_by(lib->credmgr, subject, issuer, NULL))
172 {
173 DBG1(DBG_CFG, " ocsp response correctly signed by \"%Y\"",
174 issuer->get_subject(issuer));
175 verified = TRUE;
176 break;
177 }
178 DBG1(DBG_CFG, "ocsp response verification failed, "
179 "invalid signature");
180 }
181 }
182 enumerator->destroy(enumerator);
183 }
184
185 lib->credmgr->remove_local_set(lib->credmgr, &wrapper->set);
186 wrapper->destroy(wrapper);
187
188 if (!found)
189 {
190 DBG1(DBG_CFG, "ocsp response verification failed, "
191 "no signer certificate '%Y' found", responder);
192 }
193 return verified;
194 }
195
196 /**
197 * Get the better of two OCSP responses, and check for usable OCSP info
198 */
199 static certificate_t *get_better_ocsp(certificate_t *cand, certificate_t *best,
200 x509_t *subject, x509_t *issuer,
201 cert_validation_t *valid, bool cache)
202 {
203 ocsp_response_t *response;
204 time_t revocation, this_update, next_update, valid_until;
205 crl_reason_t reason;
206 bool revoked = FALSE;
207
208 response = (ocsp_response_t*)cand;
209
210 /* check ocsp signature */
211 if (!verify_ocsp(response, &issuer->interface))
212 {
213 cand->destroy(cand);
214 return best;
215 }
216 /* check if response contains our certificate */
217 switch (response->get_status(response, subject, issuer, &revocation, &reason,
218 &this_update, &next_update))
219 {
220 case VALIDATION_REVOKED:
221 /* subject has been revoked by a valid OCSP response */
222 DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N",
223 &revocation, TRUE, crl_reason_names, reason);
224 revoked = TRUE;
225 break;
226 case VALIDATION_GOOD:
227 /* results in either good or stale */
228 break;
229 default:
230 case VALIDATION_FAILED:
231 /* candidate unusable, does not contain our cert */
232 DBG1(DBG_CFG, " ocsp response contains no status on our certificate");
233 cand->destroy(cand);
234 return best;
235 }
236
237 /* select the better of the two responses */
238 if (best == NULL || certificate_is_newer(cand, best))
239 {
240 DESTROY_IF(best);
241 best = cand;
242 if (best->get_validity(best, NULL, NULL, &valid_until))
243 {
244 DBG1(DBG_CFG, " ocsp response is valid: until %T",
245 &valid_until, FALSE);
246 *valid = VALIDATION_GOOD;
247 if (cache)
248 { /* cache non-stale only, stale certs get refetched */
249 lib->credmgr->cache_cert(lib->credmgr, best);
250 }
251 }
252 else
253 {
254 DBG1(DBG_CFG, " ocsp response is stale: since %T",
255 &valid_until, FALSE);
256 *valid = VALIDATION_STALE;
257 }
258 }
259 else
260 {
261 *valid = VALIDATION_STALE;
262 cand->destroy(cand);
263 }
264 if (revoked)
265 { /* revoked always counts, even if stale */
266 *valid = VALIDATION_REVOKED;
267 }
268 return best;
269 }
270
271 /**
272 * validate a x509 certificate using OCSP
273 */
274 static cert_validation_t check_ocsp(x509_t *subject, x509_t *issuer,
275 auth_cfg_t *auth)
276 {
277 enumerator_t *enumerator;
278 cert_validation_t valid = VALIDATION_SKIPPED;
279 certificate_t *best = NULL, *current;
280 identification_t *keyid = NULL;
281 public_key_t *public;
282 chunk_t chunk;
283 char *uri = NULL;
284
285 /** lookup cache for valid OCSP responses */
286 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
287 CERT_X509_OCSP_RESPONSE, KEY_ANY, NULL, FALSE);
288 while (enumerator->enumerate(enumerator, &current))
289 {
290 current->get_ref(current);
291 best = get_better_ocsp(current, best, subject, issuer, &valid, FALSE);
292 if (best && valid != VALIDATION_STALE)
293 {
294 DBG1(DBG_CFG, " using cached ocsp response");
295 break;
296 }
297 }
298 enumerator->destroy(enumerator);
299
300 /* derive the authorityKeyIdentifier from the issuer's public key */
301 current = &issuer->interface;
302 public = current->get_public_key(current);
303 if (public && public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &chunk))
304 {
305 keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
306 }
307 /** fetch from configured OCSP responder URLs */
308 if (keyid && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
309 {
310 enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr,
311 CERT_X509_OCSP_RESPONSE, keyid);
312 while (enumerator->enumerate(enumerator, &uri))
313 {
314 current = fetch_ocsp(uri, &subject->interface, &issuer->interface);
315 if (current)
316 {
317 best = get_better_ocsp(current, best, subject, issuer,
318 &valid, TRUE);
319 if (best && valid != VALIDATION_STALE)
320 {
321 break;
322 }
323 }
324 }
325 enumerator->destroy(enumerator);
326 }
327 DESTROY_IF(public);
328 DESTROY_IF(keyid);
329
330 /* fallback to URL fetching from subject certificate's URIs */
331 if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
332 {
333 enumerator = subject->create_ocsp_uri_enumerator(subject);
334 while (enumerator->enumerate(enumerator, &uri))
335 {
336 current = fetch_ocsp(uri, &subject->interface, &issuer->interface);
337 if (current)
338 {
339 best = get_better_ocsp(current, best, subject, issuer,
340 &valid, TRUE);
341 if (best && valid != VALIDATION_STALE)
342 {
343 break;
344 }
345 }
346 }
347 enumerator->destroy(enumerator);
348 }
349 /* an uri was found, but no result. switch validation state to failed */
350 if (valid == VALIDATION_SKIPPED && uri)
351 {
352 valid = VALIDATION_FAILED;
353 }
354 if (auth)
355 {
356 auth->add(auth, AUTH_RULE_OCSP_VALIDATION, valid);
357 if (valid == VALIDATION_GOOD)
358 { /* successful OCSP check fulfills also CRL constraint */
359 auth->add(auth, AUTH_RULE_CRL_VALIDATION, VALIDATION_GOOD);
360 }
361 }
362 DESTROY_IF(best);
363 return valid;
364 }
365
366 /**
367 * fetch a CRL from an URL
368 */
369 static certificate_t* fetch_crl(char *url)
370 {
371 certificate_t *crl;
372 chunk_t chunk;
373
374 DBG1(DBG_CFG, " fetching crl from '%s' ...", url);
375 if (lib->fetcher->fetch(lib->fetcher, url, &chunk, FETCH_END) != SUCCESS)
376 {
377 DBG1(DBG_CFG, "crl fetching failed");
378 return NULL;
379 }
380 crl = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509_CRL,
381 BUILD_BLOB_PEM, chunk, BUILD_END);
382 chunk_free(&chunk);
383 if (!crl)
384 {
385 DBG1(DBG_CFG, "crl fetched successfully but parsing failed");
386 return NULL;
387 }
388 return crl;
389 }
390
391 /**
392 * check the signature of an CRL
393 */
394 static bool verify_crl(certificate_t *crl)
395 {
396 certificate_t *issuer;
397 enumerator_t *enumerator;
398 bool verified = FALSE;
399
400 enumerator = lib->credmgr->create_trusted_enumerator(lib->credmgr,
401 KEY_ANY, crl->get_issuer(crl), FALSE);
402 while (enumerator->enumerate(enumerator, &issuer, NULL))
403 {
404 if (lib->credmgr->issued_by(lib->credmgr, crl, issuer, NULL))
405 {
406 DBG1(DBG_CFG, " crl correctly signed by \"%Y\"",
407 issuer->get_subject(issuer));
408 verified = TRUE;
409 break;
410 }
411 }
412 enumerator->destroy(enumerator);
413
414 return verified;
415 }
416
417 /**
418 * Report the given CRL's validity and cache it if valid and requested
419 */
420 static bool is_crl_valid(certificate_t *crl, bool cache)
421 {
422 time_t valid_until;
423
424 if (crl->get_validity(crl, NULL, NULL, &valid_until))
425 {
426 DBG1(DBG_CFG, " crl is valid: until %T", &valid_until, FALSE);
427 if (cache)
428 {
429 lib->credmgr->cache_cert(lib->credmgr, crl);
430 }
431 return TRUE;
432 }
433 DBG1(DBG_CFG, " crl is stale: since %T", &valid_until, FALSE);
434 return FALSE;
435 }
436
437 /**
438 * Get the better of two CRLs, and check for usable CRL info
439 */
440 static certificate_t *get_better_crl(certificate_t *cand, certificate_t *best,
441 x509_t *subject, cert_validation_t *valid,
442 bool cache, crl_t *base)
443 {
444 enumerator_t *enumerator;
445 time_t revocation;
446 crl_reason_t reason;
447 chunk_t serial;
448 crl_t *crl = (crl_t*)cand;
449
450 if (base)
451 {
452 if (!crl->is_delta_crl(crl, &serial) ||
453 !chunk_equals(serial, base->get_serial(base)))
454 {
455 cand->destroy(cand);
456 return best;
457 }
458 }
459 else
460 {
461 if (crl->is_delta_crl(crl, NULL))
462 {
463 cand->destroy(cand);
464 return best;
465 }
466 }
467
468 /* check CRL signature */
469 if (!verify_crl(cand))
470 {
471 DBG1(DBG_CFG, "crl response verification failed");
472 cand->destroy(cand);
473 return best;
474 }
475
476 enumerator = crl->create_enumerator(crl);
477 while (enumerator->enumerate(enumerator, &serial, &revocation, &reason))
478 {
479 if (chunk_equals(serial, subject->get_serial(subject)))
480 {
481 if (reason != CRL_REASON_CERTIFICATE_HOLD)
482 {
483 *valid = VALIDATION_REVOKED;
484 }
485 else
486 {
487 /* if the cert is on hold, a newer CRL might not contain it */
488 *valid = VALIDATION_ON_HOLD;
489 }
490 is_crl_valid(cand, cache);
491 DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N",
492 &revocation, TRUE, crl_reason_names, reason);
493 enumerator->destroy(enumerator);
494 DESTROY_IF(best);
495 return cand;
496 }
497 }
498 enumerator->destroy(enumerator);
499
500 /* select the better of the two CRLs */
501 if (best == NULL || crl_is_newer(crl, (crl_t*)best))
502 {
503 DESTROY_IF(best);
504 best = cand;
505 if (is_crl_valid(best, cache))
506 {
507 *valid = VALIDATION_GOOD;
508 }
509 else
510 {
511 *valid = VALIDATION_STALE;
512 }
513 }
514 else
515 {
516 *valid = VALIDATION_STALE;
517 cand->destroy(cand);
518 }
519 return best;
520 }
521
522 /**
523 * Find or fetch a certificate for a given crlIssuer
524 */
525 static cert_validation_t find_crl(x509_t *subject, identification_t *issuer,
526 crl_t *base, certificate_t **best,
527 bool *uri_found)
528 {
529 cert_validation_t valid = VALIDATION_SKIPPED;
530 enumerator_t *enumerator;
531 certificate_t *current;
532 char *uri;
533
534 /* find a cached (delta) crl */
535 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
536 CERT_X509_CRL, KEY_ANY, issuer, FALSE);
537 while (enumerator->enumerate(enumerator, &current))
538 {
539 current->get_ref(current);
540 *best = get_better_crl(current, *best, subject, &valid, FALSE, base);
541 if (*best && valid != VALIDATION_STALE)
542 {
543 DBG1(DBG_CFG, " using cached crl");
544 break;
545 }
546 }
547 enumerator->destroy(enumerator);
548
549 /* fallback to fetching crls from credential sets cdps */
550 if (!base && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
551 {
552 enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr,
553 CERT_X509_CRL, issuer);
554 while (enumerator->enumerate(enumerator, &uri))
555 {
556 *uri_found = TRUE;
557 current = fetch_crl(uri);
558 if (current)
559 {
560 if (!current->has_issuer(current, issuer))
561 {
562 DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL "
563 "issuer '%Y'", current->get_issuer(current), issuer);
564 current->destroy(current);
565 continue;
566 }
567 *best = get_better_crl(current, *best, subject,
568 &valid, TRUE, base);
569 if (*best && valid != VALIDATION_STALE)
570 {
571 break;
572 }
573 }
574 }
575 enumerator->destroy(enumerator);
576 }
577 return valid;
578 }
579
580 /**
581 * Look for a delta CRL for a given base CRL
582 */
583 static cert_validation_t check_delta_crl(x509_t *subject, x509_t *issuer,
584 crl_t *base, cert_validation_t base_valid)
585 {
586 cert_validation_t valid = VALIDATION_SKIPPED;
587 certificate_t *best = NULL, *current;
588 enumerator_t *enumerator;
589 identification_t *id;
590 x509_cdp_t *cdp;
591 chunk_t chunk;
592 bool uri;
593
594 /* find cached delta CRL via subjectKeyIdentifier */
595 chunk = issuer->get_subjectKeyIdentifier(issuer);
596 if (chunk.len)
597 {
598 id = identification_create_from_encoding(ID_KEY_ID, chunk);
599 valid = find_crl(subject, id, base, &best, &uri);
600 id->destroy(id);
601 }
602
603 /* find delta CRL by CRLIssuer */
604 enumerator = subject->create_crl_uri_enumerator(subject);
605 while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
606 enumerator->enumerate(enumerator, &cdp))
607 {
608 if (cdp->issuer)
609 {
610 valid = find_crl(subject, cdp->issuer, base, &best, &uri);
611 }
612 }
613 enumerator->destroy(enumerator);
614
615 /* fetch from URIs found in Freshest CRL extension */
616 enumerator = base->create_delta_crl_uri_enumerator(base);
617 while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
618 enumerator->enumerate(enumerator, &cdp))
619 {
620 current = fetch_crl(cdp->uri);
621 if (current)
622 {
623 if (cdp->issuer && !current->has_issuer(current, cdp->issuer))
624 {
625 DBG1(DBG_CFG, "issuer of fetched delta CRL '%Y' does not match "
626 "certificates CRL issuer '%Y'",
627 current->get_issuer(current), cdp->issuer);
628 current->destroy(current);
629 continue;
630 }
631 best = get_better_crl(current, best, subject, &valid, TRUE, base);
632 if (best && valid != VALIDATION_STALE)
633 {
634 break;
635 }
636 }
637 }
638 enumerator->destroy(enumerator);
639
640 if (best)
641 {
642 best->destroy(best);
643 return valid;
644 }
645 return base_valid;
646 }
647
648 /**
649 * validate a x509 certificate using CRL
650 */
651 static cert_validation_t check_crl(x509_t *subject, x509_t *issuer,
652 auth_cfg_t *auth)
653 {
654 cert_validation_t valid = VALIDATION_SKIPPED;
655 certificate_t *best = NULL;
656 identification_t *id;
657 x509_cdp_t *cdp;
658 bool uri_found = FALSE;
659 certificate_t *current;
660 enumerator_t *enumerator;
661 chunk_t chunk;
662
663 /* use issuers subjectKeyIdentifier to find a cached CRL / fetch from CDP */
664 chunk = issuer->get_subjectKeyIdentifier(issuer);
665 if (chunk.len)
666 {
667 id = identification_create_from_encoding(ID_KEY_ID, chunk);
668 valid = find_crl(subject, id, NULL, &best, &uri_found);
669 id->destroy(id);
670 }
671
672 /* find a cached CRL or fetch via configured CDP via CRLIssuer */
673 enumerator = subject->create_crl_uri_enumerator(subject);
674 while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
675 enumerator->enumerate(enumerator, &cdp))
676 {
677 if (cdp->issuer)
678 {
679 valid = find_crl(subject, cdp->issuer, NULL, &best, &uri_found);
680 }
681 }
682 enumerator->destroy(enumerator);
683
684 /* fallback to fetching CRLs from CDPs found in subjects certificate */
685 if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
686 {
687 enumerator = subject->create_crl_uri_enumerator(subject);
688 while (enumerator->enumerate(enumerator, &cdp))
689 {
690 uri_found = TRUE;
691 current = fetch_crl(cdp->uri);
692 if (current)
693 {
694 if (cdp->issuer && !current->has_issuer(current, cdp->issuer))
695 {
696 DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match "
697 "certificates CRL issuer '%Y'",
698 current->get_issuer(current), cdp->issuer);
699 current->destroy(current);
700 continue;
701 }
702 best = get_better_crl(current, best, subject, &valid,
703 TRUE, NULL);
704 if (best && valid != VALIDATION_STALE)
705 {
706 break;
707 }
708 }
709 }
710 enumerator->destroy(enumerator);
711 }
712
713 /* look for delta CRLs */
714 if (best && (valid == VALIDATION_GOOD || valid == VALIDATION_STALE))
715 {
716 valid = check_delta_crl(subject, issuer, (crl_t*)best, valid);
717 }
718
719 /* an uri was found, but no result. switch validation state to failed */
720 if (valid == VALIDATION_SKIPPED && uri_found)
721 {
722 valid = VALIDATION_FAILED;
723 }
724 if (auth)
725 {
726 if (valid == VALIDATION_SKIPPED)
727 { /* if we skipped CRL validation, we use the result of OCSP for
728 * constraint checking */
729 auth->add(auth, AUTH_RULE_CRL_VALIDATION,
730 auth->get(auth, AUTH_RULE_OCSP_VALIDATION));
731 }
732 else
733 {
734 auth->add(auth, AUTH_RULE_CRL_VALIDATION, valid);
735 }
736 }
737 DESTROY_IF(best);
738 return valid;
739 }
740
741 METHOD(cert_validator_t, validate, bool,
742 private_revocation_validator_t *this, certificate_t *subject,
743 certificate_t *issuer, bool online, u_int pathlen, bool anchor,
744 auth_cfg_t *auth)
745 {
746 if (online && (this->enable_ocsp || this->enable_crl) &&
747 subject->get_type(subject) == CERT_X509 &&
748 issuer->get_type(issuer) == CERT_X509)
749 {
750 DBG1(DBG_CFG, "checking certificate status of \"%Y\"",
751 subject->get_subject(subject));
752
753 if (this->enable_ocsp)
754 {
755 switch (check_ocsp((x509_t*)subject, (x509_t*)issuer,
756 pathlen ? NULL : auth))
757 {
758 case VALIDATION_GOOD:
759 DBG1(DBG_CFG, "certificate status is good");
760 return TRUE;
761 case VALIDATION_REVOKED:
762 case VALIDATION_ON_HOLD:
763 /* has already been logged */
764 lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
765 subject);
766 return FALSE;
767 case VALIDATION_SKIPPED:
768 DBG2(DBG_CFG, "ocsp check skipped, no ocsp found");
769 break;
770 case VALIDATION_STALE:
771 DBG1(DBG_CFG, "ocsp information stale, fallback to crl");
772 break;
773 case VALIDATION_FAILED:
774 DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
775 break;
776 }
777 }
778
779 if (this->enable_crl)
780 {
781 switch (check_crl((x509_t*)subject, (x509_t*)issuer,
782 pathlen ? NULL : auth))
783 {
784 case VALIDATION_GOOD:
785 DBG1(DBG_CFG, "certificate status is good");
786 return TRUE;
787 case VALIDATION_REVOKED:
788 case VALIDATION_ON_HOLD:
789 /* has already been logged */
790 lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
791 subject);
792 return FALSE;
793 case VALIDATION_FAILED:
794 case VALIDATION_SKIPPED:
795 DBG1(DBG_CFG, "certificate status is not available");
796 break;
797 case VALIDATION_STALE:
798 DBG1(DBG_CFG, "certificate status is unknown, crl is stale");
799 break;
800 }
801 }
802
803 lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_VALIDATION_FAILED,
804 subject);
805 }
806 return TRUE;
807 }
808
809 METHOD(revocation_validator_t, destroy, void,
810 private_revocation_validator_t *this)
811 {
812 free(this);
813 }
814
815 /**
816 * See header
817 */
818 revocation_validator_t *revocation_validator_create()
819 {
820 private_revocation_validator_t *this;
821
822 INIT(this,
823 .public = {
824 .validator.validate = _validate,
825 .destroy = _destroy,
826 },
827 .enable_ocsp = lib->settings->get_bool(lib->settings,
828 "%s.plugins.revocation.enable_ocsp", TRUE, lib->ns),
829 .enable_crl = lib->settings->get_bool(lib->settings,
830 "%s.plugins.revocation.enable_crl", TRUE, lib->ns),
831 );
832
833 if (!this->enable_ocsp)
834 {
835 DBG1(DBG_LIB, "all OCSP validation disabled");
836 }
837 if (!this->enable_crl)
838 {
839 DBG1(DBG_LIB, "all CRL validation disabled");
840 }
841 return &this->public;
842 }