-diff --git a/src/pluto/ca.c b/src/pluto/ca.c
-index 2f59a90..d9db082 100644
---- a/src/pluto/ca.c
-+++ b/src/pluto/ca.c
-@@ -27,7 +27,6 @@
- #include "constants.h"
- #include "defs.h"
- #include "log.h"
--#include "x509.h"
- #include "ca.h"
- #include "certs.h"
- #include "whack.h"
-@@ -36,13 +35,180 @@
-
- /* chained list of X.509 authority certificates (ca, aa, and ocsp) */
-
--static x509cert_t *x509authcerts = NULL;
-+static linked_list_t *authcerts = NULL;
-
- /* chained list of X.509 certification authority information records */
-
- static ca_info_t *ca_infos = NULL;
-
-+/**
-+ * Initialize the linked list of authority certificates
-+ */
-+void ca_initialize(void)
-+{
-+ authcerts = linked_list_create();
-+}
-+
-+/**
-+ * Free the linked list of authority certificates
-+ */
-+void ca_finalize(void)
-+{
-+ lock_authcert_list("free_authcerts");
-+ authcerts->destroy_offset(authcerts, offsetof(certificate_t, destroy));
-+ unlock_authcert_list("free_authcerts");
-+}
-+
- /*
-+ * get a X.509 authority certificate with a given subject or keyid
-+ */
-+certificate_t* ca_get_cert(identification_t *subject, chunk_t keyid,
-+ x509_flag_t auth_flags)
-+{
-+ enumerator_t *enumerator;
-+ certificate_t *cert, *found = NULL;
-+
-+ enumerator = authcerts->create_enumerator(authcerts);
-+ while (enumerator->enumerate(enumerator, &cert))
-+ {
-+ x509_t *x509 = (x509_t*)cert;
-+
-+ /* skip non-matching types of authority certificates */
-+ if (!(x509->get_flags(x509) & auth_flags))
-+ {
-+ continue;
-+ }
-+
-+ /* compare the keyid with the certificate's subjectKeyIdentifier */
-+ if (keyid.ptr)
-+ {
-+ chunk_t subjectKeyId;
-+
-+ subjectKeyId = x509->get_subjectKeyIdentifier(x509);
-+ if (subjectKeyId.ptr && !chunk_equals(keyid, subjectKeyId))
-+ {
-+ continue;
-+ }
-+ }
-+
-+ /* compare the subjectDistinguishedNames */
-+ if (cert->has_subject(cert, subject))
-+ {
-+ found = cert;
-+ break;
-+ }
-+ }
-+ enumerator->destroy(enumerator);
-+ return found;
-+}
-+
-+/**
-+ * Add an authority certificate to the chained list
-+ */
-+certificate_t* ca_add_cert(certificate_t *cert)
-+{
-+ identification_t *subject = cert->get_subject(cert);
-+ x509_t *x509 = (x509_t*)cert;
-+ x509_flag_t flags = x509->get_flags(x509);
-+ chunk_t keyid = x509->get_subjectKeyIdentifier(x509);
-+
-+ certificate_t *old_cert;
-+ enumerator_t *enumerator;
-+ bool add = TRUE;
-+
-+ lock_authcert_list("add_authcert");
-+
-+ enumerator = acerts->create_enumerator(acerts);
-+ while (enumerator->enumerate(enumerator, &cert_old))
-+ {
-+ x509_t *x509_old = (x509_t*)cert_old;
-+
-+ /* skip non-matching types of authority certificates */
-+ if (!(x509_old->get_flags(x509_old) & flags))
-+ {
-+ continue;
-+ }
-+
-+ /* compare the keyid with the certificate's subjectKeyIdentifier */
-+ if (keyid.ptr)
-+ {
-+ chunk_t subjectKeyId;
-+
-+ subjectKeyId = x509_old->get_subjectKeyIdentifier(x509_old);
-+ if (subjectKeyId.ptr && !chunk_equals(keyid, subjectKeyId))
-+ {
-+ continue;
-+ }
-+ }
-+
-+ /* compare the subjectDistinguishedNames */
-+ if (!cert_old->has_subject(cert_old, subject))
-+ {
-+ continue,
-+ }
-+
-+ if (cert->equals(cert, cert_old))
-+ {
-+ DBG1(" authcert is already present and identical")
-+
-+ cert->destroy(cert);
-+ cert = cert_old;
-+ add = FALSE;
-+ }
-+ else
-+ {
-+ authcerts->remove_at(authcerts, enumerator);
-+ DBG1(" existing authcert replaced");
-+ }
-+ break;
-+ }
-+ enumerator->destroy(enumerator);
-+
-+ if (add)
-+ {
-+ authcerts->insert_last(authcerts, cert);
-+ }
-+ unlock_authcert_list("add_authcert");
-+
-+ return cert;
-+}
-+
-+/**
-+ * Loads authority certificates
-+ */
-+void ca_load_authcerts(char *type, char *path, x509_flag_t auth_flags)
-+{
-+ enumerator_t *enumerator;
-+ struct stat st;
-+ char *file;
-+
-+ DBG1("loading %s certificates from '%s'", type, path);
-+
-+ enumerator = enumerator_create_directory(path);
-+ if (!enumerator)
-+ {
-+ DBG1(" reading directory '%s' failed");
-+ return;
-+ }
-+
-+ while (enumerator->enumerate(enumerator, NULL, &file, &st))
-+ {
-+ cert_t cert;
-+
-+ if (!S_ISREG(st.st_mode))
-+ {
-+ /* skip special file */
-+ continue;
-+ }
-+ if (load_cert(file, type, auth_flags, &cert))
-+ {
-+ add_authcert(cert.u.x509, auth_flags);
-+ }
-+ }
-+ enumerator->destroy(enumerator);
-+}
-+
-+/**
- * Checks if CA a is trusted by CA b
- */
- bool trusted_ca(identification_t *a, identification_t *b, int *pathlen)
-@@ -76,20 +242,18 @@ bool trusted_ca(identification_t *a, identification_t *b, int *pathlen)
-
- while ((*pathlen)++ < MAX_CA_PATH_LEN)
- {
-- certificate_t *certificate;
-+ certificate_t *cacert;
- identification_t *issuer;
-- x509cert_t *cacert;
-
-- cacert = get_authcert(a, chunk_empty, X509_CA);
-+ cacert = ca_get_cert(a, chunk_empty, X509_CA);
- if (cacert == NULL)
- {
- break;
- }
-- certificate = cacert->cert;
-
- /* is the certificate self-signed? */
- {
-- x509_t *x509 = (x509_t*)certificate;
-+ x509_t *x509 = (x509_t*)cacert;
-
- if (x509->get_flags(x509) & X509_SELF_SIGNED)
- {
-@@ -98,7 +262,7 @@ bool trusted_ca(identification_t *a, identification_t *b, int *pathlen)
- }
-
- /* does the issuer of CA a match CA b? */
-- issuer = certificate->get_issuer(certificate);
-+ issuer = cert->get_issuer(cert);
- match = b->equals(b, issuer);
-
- /* we have a match and exit the loop */
-@@ -114,8 +278,8 @@ bool trusted_ca(identification_t *a, identification_t *b, int *pathlen)
- return match;
- }
-
--/*
-- * does our CA match one of the requested CAs?
-+/**
-+ * Does our CA match one of the requested CAs?
- */
- bool match_requested_ca(linked_list_t *requested_ca, identification_t *our_ca,
- int *our_pathlen)
-@@ -156,167 +320,6 @@ bool match_requested_ca(linked_list_t *requested_ca, identification_t *our_ca,
- }
-
- /*
-- * free the first authority certificate in the chain
-- */
--static void free_first_authcert(void)
--{
-- x509cert_t *first = x509authcerts;
-- x509authcerts = first->next;
-- free_x509cert(first);
--}
--
--/*
-- * free all CA certificates
-- */
--void free_authcerts(void)
--{
-- lock_authcert_list("free_authcerts");
--
-- while (x509authcerts != NULL)
-- free_first_authcert();
--
-- unlock_authcert_list("free_authcerts");
--}
--
--/*
-- * get a X.509 authority certificate with a given subject or keyid
-- */
--x509cert_t* get_authcert(identification_t *subject, chunk_t keyid,
-- x509_flag_t auth_flags)
--{
-- x509cert_t *cert, *prev_cert = NULL;
--
-- /* the authority certificate list is empty */
-- if (x509authcerts == NULL)
-- {
-- return NULL;
-- }
--
-- for (cert = x509authcerts; cert != NULL; prev_cert = cert, cert = cert->next)
-- {
-- certificate_t *certificate = cert->cert;
-- x509_t *x509 = (x509_t*)certificate;
--
-- /* skip non-matching types of authority certificates */
-- if (!(x509->get_flags(x509) & auth_flags))
-- {
-- continue;
-- }
--
-- /* compare the keyid with the certificate's subjectKeyIdentifier */
-- if (keyid.ptr)
-- {
-- chunk_t subjectKeyId;
--
-- subjectKeyId = x509->get_subjectKeyIdentifier(x509);
-- if (subjectKeyId.ptr && !chunk_equals(keyid, subjectKeyId))
-- {
-- continue;
-- }
-- }
--
-- /* compare the subjectDistinguishedNames */
-- if (!certificate->has_subject(certificate, subject))
-- {
-- continue;
-- }
--
-- /* found the authcert */
-- if (cert != x509authcerts)
-- {
-- /* bring the certificate up front */
-- prev_cert->next = cert->next;
-- cert->next = x509authcerts;
-- x509authcerts = cert;
-- }
-- return cert;
-- }
-- return NULL;
--}
--
--/*
-- * add an authority certificate to the chained list
-- */
--x509cert_t* add_authcert(x509cert_t *cert, x509_flag_t auth_flags)
--{
-- certificate_t *certificate = cert->cert;
-- x509_t *x509 = (x509_t*)certificate;
-- x509cert_t *old_cert;
--
-- lock_authcert_list("add_authcert");
--
-- old_cert = get_authcert(certificate->get_subject(certificate),
-- x509->get_subjectKeyIdentifier(x509),
-- auth_flags);
-- if (old_cert)
-- {
-- if (certificate->equals(certificate, old_cert->cert))
-- {
-- DBG(DBG_CONTROL | DBG_PARSING ,
-- DBG_log(" authcert is already present and identical")
-- )
-- unlock_authcert_list("add_authcert");
--
-- free_x509cert(cert);
-- return old_cert;
-- }
-- else
-- {
-- /* cert is already present but will be replaced by new cert */
-- free_first_authcert();
-- DBG(DBG_CONTROL | DBG_PARSING ,
-- DBG_log(" existing authcert deleted")
-- )
-- }
-- }
--
-- /* add new authcert to chained list */
-- cert->next = x509authcerts;
-- x509authcerts = cert;
-- share_x509cert(cert); /* set count to one */
-- DBG(DBG_CONTROL | DBG_PARSING,
-- DBG_log(" authcert inserted")
-- )
-- unlock_authcert_list("add_authcert");
-- return cert;
--}
--
--/*
-- * Loads authority certificates
-- */
--void load_authcerts(char *type, char *path, x509_flag_t auth_flags)
--{
-- enumerator_t *enumerator;
-- struct stat st;
-- char *file;
--
-- DBG1("loading %s certificates from '%s'", type, path);
--
-- enumerator = enumerator_create_directory(path);
-- if (!enumerator)
-- {
-- DBG1(" reading directory '%s' failed");
-- return;
-- }
--
-- while (enumerator->enumerate(enumerator, NULL, &file, &st))
-- {
-- cert_t cert;
--
-- if (!S_ISREG(st.st_mode))
-- {
-- /* skip special file */
-- continue;
-- }
-- if (load_cert(file, type, auth_flags, &cert))
-- {
-- add_authcert(cert.u.x509, auth_flags);
-- }
-- }
-- enumerator->destroy(enumerator);
--}
--
--/*
- * list all X.509 authcerts with given auth flags in a chained list
- */
- void list_authcerts(const char *caption, x509_flag_t auth_flags, bool utc)
-@@ -368,7 +371,7 @@ static const x509cert_t* get_alt_cacert(identification_t *subject, chunk_t keyid
- /* establish trust into a candidate authcert by going up the trust chain.
- * validity and revocation status are not checked.
- */
--bool trust_authcert_candidate(const x509cert_t *cert, const x509cert_t *alt_chain)
-+bool trust_authcert_candidate(certificate_t *cert, linked_list_t *alt_chain)
- {
- int pathlen;
-
-@@ -448,8 +451,8 @@ bool trust_authcert_candidate(const x509cert_t *cert, const x509cert_t *alt_chai
- return FALSE;
- }
-
--/*
-- * get a CA info record with a given authName or authKeyID
-+/**
-+ * Get a CA info record with a given authName or authKeyID
- */
- ca_info_t* get_ca_info(identification_t *name, chunk_t keyid)
- {
-@@ -468,11 +471,10 @@ ca_info_t* get_ca_info(identification_t *name, chunk_t keyid)
- }
-
-
--/*
-- * free the dynamic memory used by a ca_info record
-+/**
-+ * Free the dynamic memory used by a ca_info record
- */
--static void
--free_ca_info(ca_info_t* ca_info)
-+static void free_ca_info(ca_info_t* ca_info)
- {
- if (ca_info == NULL)
- {
-@@ -502,8 +504,8 @@ void free_ca_infos(void)
- }
- }
-
--/*
-- * find a CA information record by name and optionally delete it
-+/**
-+ * Find a CA information record by name and optionally delete it
- */
- bool find_ca_info_by_name(const char *name, bool delete)
- {
-@@ -531,7 +533,7 @@ bool find_ca_info_by_name(const char *name, bool delete)
- return FALSE;
- }
-
--/*
-+/**
- * Create an empty ca_info_t record
- */
- ca_info_t* create_ca_info(void)
-@@ -659,8 +661,8 @@ void add_ca_info(const whack_message_t *msg)
- }
- }
-
--/*
-- * list all ca_info records in the chained list
-+/**
-+ * List all ca_info records in the chained list
- */
- void list_ca_infos(bool utc)
- {
-diff --git a/src/pluto/ca.h b/src/pluto/ca.h
-index 77dfe33..3b9e4c9 100644
---- a/src/pluto/ca.h
-+++ b/src/pluto/ca.h
-@@ -17,8 +17,8 @@
-
- #include <utils/linked_list.h>
- #include <utils/identification.h>
-+#include <credentials/certificates/certificate.h>
-
--#include "x509.h"
- #include "whack.h"
-
- #define MAX_CA_PATH_LEN 7
-@@ -39,17 +39,21 @@ struct ca_info {
- bool strictcrlpolicy;
- };
-
-+extern void ca_initialize(void);
-+extern void ca_finalize(void);
-+extern void ca_load_certs(char *type, char *path, x509_flag_t auth_flags);
-+extern void ca_list_certs(const char *caption, x509_flag_t auth_flags, bool utc);
-+
-+extern certificate_t* ca_add_cert(certificate_t *cert);
-+
-+extern certificate_t* ca_get_cert(identification_t *subject, chunk_t keyid,
-+ x509_flag_t auth_flags)
-+
- extern bool trusted_ca(identification_t *a, identification_t *b, int *pathlen);
- extern bool match_requested_ca(linked_list_t *requested_ca,
- identification_t *our_ca, int *our_pathlen);
--extern x509cert_t* get_authcert(identification_t *subject, chunk_t keyid,
-- x509_flag_t auth_flags);
--extern void load_authcerts(char *type, char *path, x509_flag_t auth_flags);
--extern x509cert_t* add_authcert(x509cert_t *cert, x509_flag_t auth_flags);
--extern void free_authcerts(void);
--extern void list_authcerts(const char *caption, x509_flag_t auth_flags, bool utc);
--extern bool trust_authcert_candidate(const x509cert_t *cert,
-- const x509cert_t *alt_chain);
-+extern bool trust_authcert_candidate(certificate_t *cert,
-+ linked_list_t *alt_chain);
- extern ca_info_t* get_ca_info(identification_t *name, chunk_t keyid);
- extern bool find_ca_info_by_name(const char *name, bool delete);
- extern void add_ca_info(const whack_message_t *msg);
-diff --git a/src/pluto/plutomain.c b/src/pluto/plutomain.c
-index 0471d26..a9e3aa0 100644
---- a/src/pluto/plutomain.c
-+++ b/src/pluto/plutomain.c
-@@ -675,6 +675,7 @@ int main(int argc, char **argv)
- init_adns();
- init_myid();
- init_fetch();
-+ ca_initialize();
- ac_initialize();
-
- /* drop unneeded capabilities and change UID/GID */
-@@ -752,12 +753,12 @@ void exit_pluto(int status)
- delete_every_connection();
- free_crl_fetch(); /* free chain of crl fetch requests */
- free_ocsp_fetch(); /* free chain of ocsp fetch requests */
-- free_authcerts(); /* free chain of X.509 authority certificates */
- free_crls(); /* free chain of X.509 CRLs */
- free_ca_infos(); /* free chain of X.509 CA information records */
- free_ocsp(); /* free ocsp cache */
- free_ifaces();
- ac_finalize(); /* free X.509 attribute certificates */
-+ ca_finalize(); /* free X.509 authority certificates */
- scx_finalize(); /* finalize and unload PKCS #11 module */
- xauth_finalize(); /* finalize and unload XAUTH module */
- stop_adns();
projects / strongswan.git / commitdiff