revocation: Skip any zero bytes when comparing serials in CRLs
[strongswan.git] / src / libstrongswan / plugins / revocation / revocation_validator.c
1 /*
2 * Copyright (C) 2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 * Copyright (C) 2009 Andreas Steffen
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include "revocation_validator.h"
19
20 #include <utils/debug.h>
21 #include <credentials/certificates/x509.h>
22 #include <credentials/certificates/crl.h>
23 #include <credentials/certificates/ocsp_request.h>
24 #include <credentials/certificates/ocsp_response.h>
25 #include <credentials/sets/ocsp_response_wrapper.h>
26 #include <selectors/traffic_selector.h>
27
28 typedef struct private_revocation_validator_t private_revocation_validator_t;
29
30 /**
31 * Private data of an revocation_validator_t object.
32 */
33 struct private_revocation_validator_t {
34
35 /**
36 * Public revocation_validator_t interface.
37 */
38 revocation_validator_t public;
39
40 /**
41 * Enable OCSP validation
42 */
43 bool enable_ocsp;
44
45 /**
46 * Enable CRL validation
47 */
48 bool enable_crl;
49
50 };
51
52 /**
53 * Do an OCSP request
54 */
55 static certificate_t *fetch_ocsp(char *url, certificate_t *subject,
56 certificate_t *issuer)
57 {
58 certificate_t *request, *response;
59 chunk_t send, receive;
60
61 /* TODO: requestor name, signature */
62 request = lib->creds->create(lib->creds,
63 CRED_CERTIFICATE, CERT_X509_OCSP_REQUEST,
64 BUILD_CA_CERT, issuer,
65 BUILD_CERT, subject, BUILD_END);
66 if (!request)
67 {
68 DBG1(DBG_CFG, "generating ocsp request failed");
69 return NULL;
70 }
71
72 if (!request->get_encoding(request, CERT_ASN1_DER, &send))
73 {
74 DBG1(DBG_CFG, "encoding ocsp request failed");
75 request->destroy(request);
76 return NULL;
77 }
78 request->destroy(request);
79
80 DBG1(DBG_CFG, " requesting ocsp status from '%s' ...", url);
81 if (lib->fetcher->fetch(lib->fetcher, url, &receive,
82 FETCH_REQUEST_DATA, send,
83 FETCH_REQUEST_TYPE, "application/ocsp-request",
84 FETCH_END) != SUCCESS)
85 {
86 DBG1(DBG_CFG, "ocsp request to %s failed", url);
87 chunk_free(&send);
88 return NULL;
89 }
90 chunk_free(&send);
91
92 response = lib->creds->create(lib->creds,
93 CRED_CERTIFICATE, CERT_X509_OCSP_RESPONSE,
94 BUILD_BLOB_ASN1_DER, receive, BUILD_END);
95 chunk_free(&receive);
96 if (!response)
97 {
98 DBG1(DBG_CFG, "parsing ocsp response failed");
99 return NULL;
100 }
101 return response;
102 }
103
104 /**
105 * check the signature of an OCSP response
106 */
107 static bool verify_ocsp(ocsp_response_t *response, certificate_t *ca)
108 {
109 certificate_t *issuer, *subject;
110 identification_t *responder;
111 ocsp_response_wrapper_t *wrapper;
112 enumerator_t *enumerator;
113 x509_t *x509;
114 bool verified = FALSE, found = FALSE;
115
116 wrapper = ocsp_response_wrapper_create((ocsp_response_t*)response);
117 lib->credmgr->add_local_set(lib->credmgr, &wrapper->set, FALSE);
118
119 subject = &response->certificate;
120 responder = subject->get_issuer(subject);
121
122 /* check OCSP response using CA or directly delegated OCSP signer */
123 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr, CERT_X509,
124 KEY_ANY, responder, FALSE);
125 while (enumerator->enumerate(enumerator, &issuer))
126 {
127 x509 = (x509_t*)issuer;
128 if (!issuer->get_validity(issuer, NULL, NULL, NULL))
129 { /* OCSP signer currently invalid */
130 continue;
131 }
132 if (!ca->equals(ca, issuer))
133 { /* delegated OCSP signer? */
134 if (!lib->credmgr->issued_by(lib->credmgr, issuer, ca, NULL))
135 { /* OCSP response not signed by CA, nor delegated OCSP signer */
136 continue;
137 }
138 if (!(x509->get_flags(x509) & X509_OCSP_SIGNER))
139 { /* delegated OCSP signer does not have OCSP signer flag */
140 continue;
141 }
142 }
143 found = TRUE;
144 if (lib->credmgr->issued_by(lib->credmgr, subject, issuer, NULL))
145 {
146 DBG1(DBG_CFG, " ocsp response correctly signed by \"%Y\"",
147 issuer->get_subject(issuer));
148 verified = TRUE;
149 break;
150 }
151 DBG1(DBG_CFG, "ocsp response verification failed, "
152 "invalid signature");
153 }
154 enumerator->destroy(enumerator);
155
156 if (!verified)
157 {
158 /* as fallback, use any locally installed OCSP signer certificate */
159 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
160 CERT_X509, KEY_ANY, responder, TRUE);
161 while (enumerator->enumerate(enumerator, &issuer))
162 {
163 x509 = (x509_t*)issuer;
164 /* while issued_by() accepts both OCSP signer or CA basic
165 * constraint flags to verify OCSP responses, unrelated but trusted
166 * OCSP signers must explicitly have the OCSP signer flag set. */
167 if ((x509->get_flags(x509) & X509_OCSP_SIGNER) &&
168 issuer->get_validity(issuer, NULL, NULL, NULL))
169 {
170 found = TRUE;
171 if (lib->credmgr->issued_by(lib->credmgr, subject, issuer, NULL))
172 {
173 DBG1(DBG_CFG, " ocsp response correctly signed by \"%Y\"",
174 issuer->get_subject(issuer));
175 verified = TRUE;
176 break;
177 }
178 DBG1(DBG_CFG, "ocsp response verification failed, "
179 "invalid signature");
180 }
181 }
182 enumerator->destroy(enumerator);
183 }
184
185 lib->credmgr->remove_local_set(lib->credmgr, &wrapper->set);
186 wrapper->destroy(wrapper);
187
188 if (!found)
189 {
190 DBG1(DBG_CFG, "ocsp response verification failed, "
191 "no signer certificate '%Y' found", responder);
192 }
193 return verified;
194 }
195
196 /**
197 * Get the better of two OCSP responses, and check for usable OCSP info
198 */
199 static certificate_t *get_better_ocsp(certificate_t *cand, certificate_t *best,
200 x509_t *subject, x509_t *issuer,
201 cert_validation_t *valid, bool cache)
202 {
203 ocsp_response_t *response;
204 time_t revocation, this_update, next_update, valid_until;
205 crl_reason_t reason;
206 bool revoked = FALSE;
207
208 response = (ocsp_response_t*)cand;
209
210 /* check ocsp signature */
211 if (!verify_ocsp(response, &issuer->interface))
212 {
213 cand->destroy(cand);
214 return best;
215 }
216 /* check if response contains our certificate */
217 switch (response->get_status(response, subject, issuer, &revocation, &reason,
218 &this_update, &next_update))
219 {
220 case VALIDATION_REVOKED:
221 /* subject has been revoked by a valid OCSP response */
222 DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N",
223 &revocation, TRUE, crl_reason_names, reason);
224 revoked = TRUE;
225 break;
226 case VALIDATION_GOOD:
227 /* results in either good or stale */
228 break;
229 default:
230 case VALIDATION_FAILED:
231 /* candidate unusable, does not contain our cert */
232 DBG1(DBG_CFG, " ocsp response contains no status on our certificate");
233 cand->destroy(cand);
234 return best;
235 }
236
237 /* select the better of the two responses */
238 if (best == NULL || certificate_is_newer(cand, best))
239 {
240 DESTROY_IF(best);
241 best = cand;
242 if (best->get_validity(best, NULL, NULL, &valid_until))
243 {
244 DBG1(DBG_CFG, " ocsp response is valid: until %T",
245 &valid_until, FALSE);
246 *valid = VALIDATION_GOOD;
247 if (cache)
248 { /* cache non-stale only, stale certs get refetched */
249 lib->credmgr->cache_cert(lib->credmgr, best);
250 }
251 }
252 else
253 {
254 DBG1(DBG_CFG, " ocsp response is stale: since %T",
255 &valid_until, FALSE);
256 *valid = VALIDATION_STALE;
257 }
258 }
259 else
260 {
261 *valid = VALIDATION_STALE;
262 cand->destroy(cand);
263 }
264 if (revoked)
265 { /* revoked always counts, even if stale */
266 *valid = VALIDATION_REVOKED;
267 }
268 return best;
269 }
270
271 /**
272 * validate a x509 certificate using OCSP
273 */
274 static cert_validation_t check_ocsp(x509_t *subject, x509_t *issuer,
275 auth_cfg_t *auth)
276 {
277 enumerator_t *enumerator;
278 cert_validation_t valid = VALIDATION_SKIPPED;
279 certificate_t *best = NULL, *current;
280 identification_t *keyid = NULL;
281 public_key_t *public;
282 chunk_t chunk;
283 char *uri = NULL;
284
285 /** lookup cache for valid OCSP responses */
286 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
287 CERT_X509_OCSP_RESPONSE, KEY_ANY, NULL, FALSE);
288 while (enumerator->enumerate(enumerator, &current))
289 {
290 current->get_ref(current);
291 best = get_better_ocsp(current, best, subject, issuer, &valid, FALSE);
292 if (best && valid != VALIDATION_STALE)
293 {
294 DBG1(DBG_CFG, " using cached ocsp response");
295 break;
296 }
297 }
298 enumerator->destroy(enumerator);
299
300 /* derive the authorityKeyIdentifier from the issuer's public key */
301 current = &issuer->interface;
302 public = current->get_public_key(current);
303 if (public && public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &chunk))
304 {
305 keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
306 }
307 /** fetch from configured OCSP responder URLs */
308 if (keyid && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
309 {
310 enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr,
311 CERT_X509_OCSP_RESPONSE, keyid);
312 while (enumerator->enumerate(enumerator, &uri))
313 {
314 current = fetch_ocsp(uri, &subject->interface, &issuer->interface);
315 if (current)
316 {
317 best = get_better_ocsp(current, best, subject, issuer,
318 &valid, TRUE);
319 if (best && valid != VALIDATION_STALE)
320 {
321 break;
322 }
323 }
324 }
325 enumerator->destroy(enumerator);
326 }
327 DESTROY_IF(public);
328 DESTROY_IF(keyid);
329
330 /* fallback to URL fetching from subject certificate's URIs */
331 if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
332 {
333 enumerator = subject->create_ocsp_uri_enumerator(subject);
334 while (enumerator->enumerate(enumerator, &uri))
335 {
336 current = fetch_ocsp(uri, &subject->interface, &issuer->interface);
337 if (current)
338 {
339 best = get_better_ocsp(current, best, subject, issuer,
340 &valid, TRUE);
341 if (best && valid != VALIDATION_STALE)
342 {
343 break;
344 }
345 }
346 }
347 enumerator->destroy(enumerator);
348 }
349 /* an uri was found, but no result. switch validation state to failed */
350 if (valid == VALIDATION_SKIPPED && uri)
351 {
352 valid = VALIDATION_FAILED;
353 }
354 if (auth)
355 {
356 auth->add(auth, AUTH_RULE_OCSP_VALIDATION, valid);
357 if (valid == VALIDATION_GOOD)
358 { /* successful OCSP check fulfills also CRL constraint */
359 auth->add(auth, AUTH_RULE_CRL_VALIDATION, VALIDATION_GOOD);
360 }
361 }
362 DESTROY_IF(best);
363 return valid;
364 }
365
366 /**
367 * fetch a CRL from an URL
368 */
369 static certificate_t* fetch_crl(char *url)
370 {
371 certificate_t *crl;
372 chunk_t chunk;
373
374 DBG1(DBG_CFG, " fetching crl from '%s' ...", url);
375 if (lib->fetcher->fetch(lib->fetcher, url, &chunk, FETCH_END) != SUCCESS)
376 {
377 DBG1(DBG_CFG, "crl fetching failed");
378 return NULL;
379 }
380 crl = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509_CRL,
381 BUILD_BLOB_PEM, chunk, BUILD_END);
382 chunk_free(&chunk);
383 if (!crl)
384 {
385 DBG1(DBG_CFG, "crl fetched successfully but parsing failed");
386 return NULL;
387 }
388 return crl;
389 }
390
391 /**
392 * check the signature of an CRL
393 */
394 static bool verify_crl(certificate_t *crl)
395 {
396 certificate_t *issuer;
397 enumerator_t *enumerator;
398 bool verified = FALSE;
399
400 enumerator = lib->credmgr->create_trusted_enumerator(lib->credmgr,
401 KEY_ANY, crl->get_issuer(crl), FALSE);
402 while (enumerator->enumerate(enumerator, &issuer, NULL))
403 {
404 if (lib->credmgr->issued_by(lib->credmgr, crl, issuer, NULL))
405 {
406 DBG1(DBG_CFG, " crl correctly signed by \"%Y\"",
407 issuer->get_subject(issuer));
408 verified = TRUE;
409 break;
410 }
411 }
412 enumerator->destroy(enumerator);
413
414 return verified;
415 }
416
417 /**
418 * Report the given CRL's validity and cache it if valid and requested
419 */
420 static bool is_crl_valid(certificate_t *crl, bool cache)
421 {
422 time_t valid_until;
423
424 if (crl->get_validity(crl, NULL, NULL, &valid_until))
425 {
426 DBG1(DBG_CFG, " crl is valid: until %T", &valid_until, FALSE);
427 if (cache)
428 {
429 lib->credmgr->cache_cert(lib->credmgr, crl);
430 }
431 return TRUE;
432 }
433 DBG1(DBG_CFG, " crl is stale: since %T", &valid_until, FALSE);
434 return FALSE;
435 }
436
437 /**
438 * Get the better of two CRLs, and check for usable CRL info
439 */
440 static certificate_t *get_better_crl(certificate_t *cand, certificate_t *best,
441 x509_t *subject, cert_validation_t *valid,
442 bool cache, crl_t *base)
443 {
444 enumerator_t *enumerator;
445 time_t revocation;
446 crl_reason_t reason;
447 chunk_t subject_serial, serial;
448 crl_t *crl = (crl_t*)cand;
449
450 if (base)
451 {
452 if (!crl->is_delta_crl(crl, &serial) ||
453 !chunk_equals(serial, base->get_serial(base)))
454 {
455 cand->destroy(cand);
456 return best;
457 }
458 }
459 else
460 {
461 if (crl->is_delta_crl(crl, NULL))
462 {
463 cand->destroy(cand);
464 return best;
465 }
466 }
467
468 /* check CRL signature */
469 if (!verify_crl(cand))
470 {
471 DBG1(DBG_CFG, "crl response verification failed");
472 cand->destroy(cand);
473 return best;
474 }
475
476 subject_serial = chunk_skip_zero(subject->get_serial(subject));
477 enumerator = crl->create_enumerator(crl);
478 while (enumerator->enumerate(enumerator, &serial, &revocation, &reason))
479 {
480 if (chunk_equals(subject_serial, chunk_skip_zero(serial)))
481 {
482 if (reason != CRL_REASON_CERTIFICATE_HOLD)
483 {
484 *valid = VALIDATION_REVOKED;
485 }
486 else
487 {
488 /* if the cert is on hold, a newer CRL might not contain it */
489 *valid = VALIDATION_ON_HOLD;
490 }
491 is_crl_valid(cand, cache);
492 DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N",
493 &revocation, TRUE, crl_reason_names, reason);
494 enumerator->destroy(enumerator);
495 DESTROY_IF(best);
496 return cand;
497 }
498 }
499 enumerator->destroy(enumerator);
500
501 /* select the better of the two CRLs */
502 if (best == NULL || crl_is_newer(crl, (crl_t*)best))
503 {
504 DESTROY_IF(best);
505 best = cand;
506 if (is_crl_valid(best, cache))
507 {
508 *valid = VALIDATION_GOOD;
509 }
510 else
511 {
512 *valid = VALIDATION_STALE;
513 }
514 }
515 else
516 {
517 *valid = VALIDATION_STALE;
518 cand->destroy(cand);
519 }
520 return best;
521 }
522
523 /**
524 * Find or fetch a certificate for a given crlIssuer
525 */
526 static cert_validation_t find_crl(x509_t *subject, identification_t *issuer,
527 crl_t *base, certificate_t **best,
528 bool *uri_found)
529 {
530 cert_validation_t valid = VALIDATION_SKIPPED;
531 enumerator_t *enumerator;
532 certificate_t *current;
533 char *uri;
534
535 /* find a cached (delta) crl */
536 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
537 CERT_X509_CRL, KEY_ANY, issuer, FALSE);
538 while (enumerator->enumerate(enumerator, &current))
539 {
540 current->get_ref(current);
541 *best = get_better_crl(current, *best, subject, &valid, FALSE, base);
542 if (*best && valid != VALIDATION_STALE)
543 {
544 DBG1(DBG_CFG, " using cached crl");
545 break;
546 }
547 }
548 enumerator->destroy(enumerator);
549
550 /* fallback to fetching crls from credential sets cdps */
551 if (!base && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
552 {
553 enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr,
554 CERT_X509_CRL, issuer);
555 while (enumerator->enumerate(enumerator, &uri))
556 {
557 *uri_found = TRUE;
558 current = fetch_crl(uri);
559 if (current)
560 {
561 if (!current->has_issuer(current, issuer))
562 {
563 DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL "
564 "issuer '%Y'", current->get_issuer(current), issuer);
565 current->destroy(current);
566 continue;
567 }
568 *best = get_better_crl(current, *best, subject,
569 &valid, TRUE, base);
570 if (*best && valid != VALIDATION_STALE)
571 {
572 break;
573 }
574 }
575 }
576 enumerator->destroy(enumerator);
577 }
578 return valid;
579 }
580
581 /**
582 * Look for a delta CRL for a given base CRL
583 */
584 static cert_validation_t check_delta_crl(x509_t *subject, x509_t *issuer,
585 crl_t *base, cert_validation_t base_valid)
586 {
587 cert_validation_t valid = VALIDATION_SKIPPED;
588 certificate_t *best = NULL, *current;
589 enumerator_t *enumerator;
590 identification_t *id;
591 x509_cdp_t *cdp;
592 chunk_t chunk;
593 bool uri;
594
595 /* find cached delta CRL via subjectKeyIdentifier */
596 chunk = issuer->get_subjectKeyIdentifier(issuer);
597 if (chunk.len)
598 {
599 id = identification_create_from_encoding(ID_KEY_ID, chunk);
600 valid = find_crl(subject, id, base, &best, &uri);
601 id->destroy(id);
602 }
603
604 /* find delta CRL by CRLIssuer */
605 enumerator = subject->create_crl_uri_enumerator(subject);
606 while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
607 enumerator->enumerate(enumerator, &cdp))
608 {
609 if (cdp->issuer)
610 {
611 valid = find_crl(subject, cdp->issuer, base, &best, &uri);
612 }
613 }
614 enumerator->destroy(enumerator);
615
616 /* fetch from URIs found in Freshest CRL extension */
617 enumerator = base->create_delta_crl_uri_enumerator(base);
618 while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
619 enumerator->enumerate(enumerator, &cdp))
620 {
621 current = fetch_crl(cdp->uri);
622 if (current)
623 {
624 if (cdp->issuer && !current->has_issuer(current, cdp->issuer))
625 {
626 DBG1(DBG_CFG, "issuer of fetched delta CRL '%Y' does not match "
627 "certificates CRL issuer '%Y'",
628 current->get_issuer(current), cdp->issuer);
629 current->destroy(current);
630 continue;
631 }
632 best = get_better_crl(current, best, subject, &valid, TRUE, base);
633 if (best && valid != VALIDATION_STALE)
634 {
635 break;
636 }
637 }
638 }
639 enumerator->destroy(enumerator);
640
641 if (best)
642 {
643 best->destroy(best);
644 return valid;
645 }
646 return base_valid;
647 }
648
649 /**
650 * validate a x509 certificate using CRL
651 */
652 static cert_validation_t check_crl(x509_t *subject, x509_t *issuer,
653 auth_cfg_t *auth)
654 {
655 cert_validation_t valid = VALIDATION_SKIPPED;
656 certificate_t *best = NULL;
657 identification_t *id;
658 x509_cdp_t *cdp;
659 bool uri_found = FALSE;
660 certificate_t *current;
661 enumerator_t *enumerator;
662 chunk_t chunk;
663
664 /* use issuers subjectKeyIdentifier to find a cached CRL / fetch from CDP */
665 chunk = issuer->get_subjectKeyIdentifier(issuer);
666 if (chunk.len)
667 {
668 id = identification_create_from_encoding(ID_KEY_ID, chunk);
669 valid = find_crl(subject, id, NULL, &best, &uri_found);
670 id->destroy(id);
671 }
672
673 /* find a cached CRL or fetch via configured CDP via CRLIssuer */
674 enumerator = subject->create_crl_uri_enumerator(subject);
675 while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
676 enumerator->enumerate(enumerator, &cdp))
677 {
678 if (cdp->issuer)
679 {
680 valid = find_crl(subject, cdp->issuer, NULL, &best, &uri_found);
681 }
682 }
683 enumerator->destroy(enumerator);
684
685 /* fallback to fetching CRLs from CDPs found in subjects certificate */
686 if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
687 {
688 enumerator = subject->create_crl_uri_enumerator(subject);
689 while (enumerator->enumerate(enumerator, &cdp))
690 {
691 uri_found = TRUE;
692 current = fetch_crl(cdp->uri);
693 if (current)
694 {
695 if (cdp->issuer && !current->has_issuer(current, cdp->issuer))
696 {
697 DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match "
698 "certificates CRL issuer '%Y'",
699 current->get_issuer(current), cdp->issuer);
700 current->destroy(current);
701 continue;
702 }
703 best = get_better_crl(current, best, subject, &valid,
704 TRUE, NULL);
705 if (best && valid != VALIDATION_STALE)
706 {
707 break;
708 }
709 }
710 }
711 enumerator->destroy(enumerator);
712 }
713
714 /* look for delta CRLs */
715 if (best && (valid == VALIDATION_GOOD || valid == VALIDATION_STALE))
716 {
717 valid = check_delta_crl(subject, issuer, (crl_t*)best, valid);
718 }
719
720 /* an uri was found, but no result. switch validation state to failed */
721 if (valid == VALIDATION_SKIPPED && uri_found)
722 {
723 valid = VALIDATION_FAILED;
724 }
725 if (auth)
726 {
727 if (valid == VALIDATION_SKIPPED)
728 { /* if we skipped CRL validation, we use the result of OCSP for
729 * constraint checking */
730 auth->add(auth, AUTH_RULE_CRL_VALIDATION,
731 auth->get(auth, AUTH_RULE_OCSP_VALIDATION));
732 }
733 else
734 {
735 auth->add(auth, AUTH_RULE_CRL_VALIDATION, valid);
736 }
737 }
738 DESTROY_IF(best);
739 return valid;
740 }
741
742 METHOD(cert_validator_t, validate, bool,
743 private_revocation_validator_t *this, certificate_t *subject,
744 certificate_t *issuer, bool online, u_int pathlen, bool anchor,
745 auth_cfg_t *auth)
746 {
747 if (online && (this->enable_ocsp || this->enable_crl) &&
748 subject->get_type(subject) == CERT_X509 &&
749 issuer->get_type(issuer) == CERT_X509)
750 {
751 DBG1(DBG_CFG, "checking certificate status of \"%Y\"",
752 subject->get_subject(subject));
753
754 if (this->enable_ocsp)
755 {
756 switch (check_ocsp((x509_t*)subject, (x509_t*)issuer,
757 pathlen ? NULL : auth))
758 {
759 case VALIDATION_GOOD:
760 DBG1(DBG_CFG, "certificate status is good");
761 return TRUE;
762 case VALIDATION_REVOKED:
763 case VALIDATION_ON_HOLD:
764 /* has already been logged */
765 lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
766 subject);
767 return FALSE;
768 case VALIDATION_SKIPPED:
769 DBG2(DBG_CFG, "ocsp check skipped, no ocsp found");
770 break;
771 case VALIDATION_STALE:
772 DBG1(DBG_CFG, "ocsp information stale, fallback to crl");
773 break;
774 case VALIDATION_FAILED:
775 DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
776 break;
777 }
778 }
779
780 if (this->enable_crl)
781 {
782 switch (check_crl((x509_t*)subject, (x509_t*)issuer,
783 pathlen ? NULL : auth))
784 {
785 case VALIDATION_GOOD:
786 DBG1(DBG_CFG, "certificate status is good");
787 return TRUE;
788 case VALIDATION_REVOKED:
789 case VALIDATION_ON_HOLD:
790 /* has already been logged */
791 lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
792 subject);
793 return FALSE;
794 case VALIDATION_FAILED:
795 case VALIDATION_SKIPPED:
796 DBG1(DBG_CFG, "certificate status is not available");
797 break;
798 case VALIDATION_STALE:
799 DBG1(DBG_CFG, "certificate status is unknown, crl is stale");
800 break;
801 }
802 }
803
804 lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_VALIDATION_FAILED,
805 subject);
806 }
807 return TRUE;
808 }
809
810 METHOD(revocation_validator_t, destroy, void,
811 private_revocation_validator_t *this)
812 {
813 free(this);
814 }
815
816 /**
817 * See header
818 */
819 revocation_validator_t *revocation_validator_create()
820 {
821 private_revocation_validator_t *this;
822
823 INIT(this,
824 .public = {
825 .validator.validate = _validate,
826 .destroy = _destroy,
827 },
828 .enable_ocsp = lib->settings->get_bool(lib->settings,
829 "%s.plugins.revocation.enable_ocsp", TRUE, lib->ns),
830 .enable_crl = lib->settings->get_bool(lib->settings,
831 "%s.plugins.revocation.enable_crl", TRUE, lib->ns),
832 );
833
834 if (!this->enable_ocsp)
835 {
836 DBG1(DBG_LIB, "all OCSP validation disabled");
837 }
838 if (!this->enable_crl)
839 {
840 DBG1(DBG_LIB, "all CRL validation disabled");
841 }
842 return &this->public;
843 }