src/charon/plugins/stroke/stroke_cred.c

   1 /*
   2  * Copyright (C) 2008 Tobias Brunner
   3  * Copyright (C) 2008 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <sys/stat.h>
  18 #include <limits.h>
  19 #include <glob.h>
  20 #include <libgen.h>
  21
  22 #include "stroke_cred.h"
  23 #include "stroke_shared_key.h"
  24
  25 #include <credentials/certificates/x509.h>
  26 #include <credentials/certificates/crl.h>
  27 #include <credentials/certificates/ac.h>
  28 #include <utils/linked_list.h>
  29 #include <utils/lexparser.h>
  30 #include <utils/mutex.h>
  31 #include <daemon.h>
  32
  33 /* configuration directories and files */
  34 #define CONFIG_DIR IPSEC_CONFDIR
  35 #define IPSEC_D_DIR CONFIG_DIR "/ipsec.d"
  36 #define PRIVATE_KEY_DIR IPSEC_D_DIR "/private"
  37 #define CERTIFICATE_DIR IPSEC_D_DIR "/certs"
  38 #define CA_CERTIFICATE_DIR IPSEC_D_DIR "/cacerts"
  39 #define AA_CERTIFICATE_DIR IPSEC_D_DIR "/aacerts"
  40 #define ATTR_CERTIFICATE_DIR IPSEC_D_DIR "/acerts"
  41 #define OCSP_CERTIFICATE_DIR IPSEC_D_DIR "/ocspcerts"
  42 #define CRL_DIR IPSEC_D_DIR "/crls"
  43 #define SECRETS_FILE CONFIG_DIR "/ipsec.secrets"
  44
  45 #define MAX_SECRETS_RECURSION 10
  46
  47 typedef struct private_stroke_cred_t private_stroke_cred_t;
  48
  49 /**
  50  * private data of stroke_cred
  51  */
  52 struct private_stroke_cred_t {
  53
  54         /**
  55          * public functions
  56          */
  57         stroke_cred_t public;
  58
  59         /**
  60          * list of trusted peer/signer/CA certificates (certificate_t)
  61          */
  62         linked_list_t *certs;
  63
  64         /**
  65          * list of shared secrets (private_shared_key_t)
  66          */
  67         linked_list_t *shared;
  68
  69         /**
  70          * list of private keys (private_key_t)
  71          */
  72         linked_list_t *private;
  73
  74         /**
  75          * read-write lock to lists
  76          */
  77         rwlock_t *lock;
  78
  79         /**
  80          * cache CRLs to disk?
  81          */
  82         bool cachecrl;
  83 };
  84
  85 /**
  86  * data to pass to various filters
  87  */
  88 typedef struct {
  89         private_stroke_cred_t *this;
  90         identification_t *id;
  91 } id_data_t;
  92
  93 /**
  94  * destroy id enumerator data and unlock list
  95  */
  96 static void id_data_destroy(id_data_t *data)
  97 {
  98         data->this->lock->unlock(data->this->lock);
  99         free(data);
 100 }
 101
 102 /**
 103  * filter function for private key enumerator
 104  */
 105 static bool private_filter(id_data_t *data,
 106                                                    private_key_t **in, private_key_t **out)
 107 {
 108         private_key_t *key;
 109         chunk_t keyid;
 110
 111         key = *in;
 112         if (data->id == NULL)
 113         {
 114                 *out = key;
 115                 return TRUE;
 116         }
 117         if (key->get_fingerprint(key, KEY_ID_PUBKEY_SHA1, &keyid) &&
 118                 chunk_equals(keyid, data->id->get_encoding(data->id)))
 119         {
 120                 *out = key;
 121                 return TRUE;
 122         }
 123         return FALSE;
 124 }
 125
 126 /**
 127  * Implements credential_set_t.create_private_enumerator
 128  */
 129 static enumerator_t* create_private_enumerator(private_stroke_cred_t *this,
 130                                                         key_type_t type, identification_t *id)
 131 {
 132         id_data_t *data;
 133
 134         data = malloc_thing(id_data_t);
 135         data->this = this;
 136         data->id = id;
 137
 138         this->lock->read_lock(this->lock);
 139         return enumerator_create_filter(this->private->create_enumerator(this->private),
 140                                                                         (void*)private_filter, data,
 141                                                                         (void*)id_data_destroy);
 142 }
 143
 144 /**
 145  * filter function for certs enumerator
 146  */
 147 static bool certs_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 148 {
 149         public_key_t *public;
 150         certificate_t *cert = *in;
 151         chunk_t keyid;
 152
 153         if (cert->get_type(cert) == CERT_X509_CRL ||
 154                 cert->get_type(cert) == CERT_X509_AC)
 155         {
 156                 return FALSE;
 157         }
 158         if (data->id == NULL || cert->has_subject(cert, data->id))
 159         {
 160                 *out = *in;
 161                 return TRUE;
 162         }
 163
 164         public = cert->get_public_key(cert);
 165         if (public)
 166         {
 167                 if (public->get_fingerprint(public, KEY_ID_PUBKEY_SHA1, &keyid) &&
 168                         chunk_equals(keyid, data->id->get_encoding(data->id)))
 169                 {
 170                         public->destroy(public);
 171                         *out = *in;
 172                         return TRUE;
 173                 }
 174                 public->destroy(public);
 175         }
 176         return FALSE;
 177 }
 178
 179 /**
 180  * filter function for crl enumerator
 181  */
 182 static bool crl_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 183 {
 184         certificate_t *cert = *in;
 185
 186         if (cert->get_type(cert) != CERT_X509_CRL)
 187         {
 188                 return FALSE;
 189         }
 190
 191         if (data->id == NULL || cert->has_issuer(cert, data->id))
 192         {
 193                 *out = *in;
 194                 return TRUE;
 195         }
 196         return FALSE;
 197 }
 198
 199 /**
 200  * filter function for attribute certificate enumerator
 201  */
 202 static bool ac_filter(id_data_t *data, certificate_t **in, certificate_t **out)
 203 {
 204         certificate_t *cert = *in;
 205
 206         if (cert->get_type(cert) != CERT_X509_AC)
 207         {
 208                 return FALSE;
 209         }
 210
 211         if (data->id == NULL || cert->has_subject(cert, data->id))
 212         {
 213                 *out = *in;
 214                 return TRUE;
 215         }
 216         return FALSE;
 217 }
 218
 219 /**
 220  * Implements credential_set_t.create_cert_enumerator
 221  */
 222 static enumerator_t* create_cert_enumerator(private_stroke_cred_t *this,
 223                                                         certificate_type_t cert, key_type_t key,
 224                                                         identification_t *id, bool trusted)
 225 {
 226         id_data_t *data;
 227
 228         if (cert == CERT_X509_CRL || cert == CERT_X509_AC)
 229         {
 230                 if (trusted)
 231                 {
 232                         return NULL;
 233                 }
 234                 data = malloc_thing(id_data_t);
 235                 data->this = this;
 236                 data->id = id;
 237
 238                 this->lock->read_lock(this->lock);
 239                 return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 240                                         (cert == CERT_X509_CRL)? (void*)crl_filter : (void*)ac_filter,
 241                                         data, (void*)id_data_destroy);
 242         }
 243         if (cert != CERT_X509 && cert != CERT_ANY)
 244         {       /* we only have X509 certificates. TODO: ACs? */
 245                 return NULL;
 246         }
 247         data = malloc_thing(id_data_t);
 248         data->this = this;
 249         data->id = id;
 250
 251         this->lock->read_lock(this->lock);
 252         return enumerator_create_filter(this->certs->create_enumerator(this->certs),
 253                                                                         (void*)certs_filter, data,
 254                                                                         (void*)id_data_destroy);
 255 }
 256
 257 typedef struct {
 258         private_stroke_cred_t *this;
 259         identification_t *me;
 260         identification_t *other;
 261         shared_key_type_t type;
 262 } shared_data_t;
 263
 264 /**
 265  * free shared key enumerator data and unlock list
 266  */
 267 static void shared_data_destroy(shared_data_t *data)
 268 {
 269         data->this->lock->unlock(data->this->lock);
 270         free(data);
 271 }
 272
 273 /**
 274  * filter function for certs enumerator
 275  */
 276 static bool shared_filter(shared_data_t *data,
 277                                                   stroke_shared_key_t **in, shared_key_t **out,
 278                                                   void **unused1, id_match_t *me,
 279                                                   void **unused2, id_match_t *other)
 280 {
 281         id_match_t my_match, other_match;
 282         stroke_shared_key_t *stroke = *in;
 283         shared_key_t *shared = &stroke->shared;
 284
 285         if (data->type != SHARED_ANY && shared->get_type(shared) != data->type)
 286         {
 287                 return FALSE;
 288         }
 289
 290         my_match = stroke->has_owner(stroke, data->me);
 291         other_match = stroke->has_owner(stroke, data->other);
 292         if (!my_match && !other_match)
 293         {
 294                 return FALSE;
 295         }
 296         *out = shared;
 297         if (me)
 298         {
 299                 *me = my_match;
 300         }
 301         if (other)
 302         {
 303                 *other = other_match;
 304         }
 305         return TRUE;
 306 }
 307
 308 /**
 309  * Implements credential_set_t.create_shared_enumerator
 310  */
 311 static enumerator_t* create_shared_enumerator(private_stroke_cred_t *this,
 312                                                         shared_key_type_t type, identification_t *me,
 313                                                         identification_t *other)
 314 {
 315         shared_data_t *data = malloc_thing(shared_data_t);
 316
 317         data->this = this;
 318         data->me = me;
 319         data->other = other;
 320         data->type = type;
 321         this->lock->read_lock(this->lock);
 322         return enumerator_create_filter(this->shared->create_enumerator(this->shared),
 323                                                                         (void*)shared_filter, data,
 324                                                                         (void*)shared_data_destroy);
 325 }
 326
 327 /**
 328  * Add a certificate to chain
 329  */
 330 static certificate_t* add_cert(private_stroke_cred_t *this, certificate_t *cert)
 331 {
 332         certificate_t *current;
 333         enumerator_t *enumerator;
 334         bool new = TRUE;
 335
 336         this->lock->read_lock(this->lock);
 337         enumerator = this->certs->create_enumerator(this->certs);
 338         while (enumerator->enumerate(enumerator, (void**)&current))
 339         {
 340                 if (current->equals(current, cert))
 341                 {
 342                         /* cert already in queue */
 343                         cert->destroy(cert);
 344                         cert = current;
 345                         new = FALSE;
 346                         break;
 347                 }
 348         }
 349         enumerator->destroy(enumerator);
 350
 351         if (new)
 352         {
 353                 this->certs->insert_last(this->certs, cert);
 354         }
 355         this->lock->unlock(this->lock);
 356         return cert;
 357 }
 358
 359 /**
 360  * Implementation of stroke_cred_t.load_ca.
 361  */
 362 static certificate_t* load_ca(private_stroke_cred_t *this, char *filename)
 363 {
 364         certificate_t *cert;
 365         char path[PATH_MAX];
 366
 367         if (*filename == '/')
 368         {
 369                 snprintf(path, sizeof(path), "%s", filename);
 370         }
 371         else
 372         {
 373                 snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
 374         }
 375
 376         cert = lib->creds->create(lib->creds,
 377                                                           CRED_CERTIFICATE, CERT_X509,
 378                                                           BUILD_FROM_FILE, path,
 379                                                           BUILD_END);
 380         if (cert)
 381         {
 382                 x509_t *x509 = (x509_t*)cert;
 383
 384                 if (!(x509->get_flags(x509) & X509_CA))
 385                 {
 386                         DBG1(DBG_CFG, "  ca certificate '%Y' misses ca basic constraint, "
 387                                  "discarded", cert->get_subject(cert));
 388                         cert->destroy(cert);
 389                         return NULL;
 390                 }
 391                 return (certificate_t*)add_cert(this, cert);
 392         }
 393         return NULL;
 394 }
 395
 396 /**
 397  * Add X.509 CRL to chain
 398  */
 399 static bool add_crl(private_stroke_cred_t *this, crl_t* crl)
 400 {
 401         certificate_t *current, *cert = &crl->certificate;
 402         enumerator_t *enumerator;
 403         bool new = TRUE, found = FALSE;
 404
 405         this->lock->write_lock(this->lock);
 406         enumerator = this->certs->create_enumerator(this->certs);
 407         while (enumerator->enumerate(enumerator, (void**)&current))
 408         {
 409                 if (current->get_type(current) == CERT_X509_CRL)
 410                 {
 411                         crl_t *crl_c = (crl_t*)current;
 412                         chunk_t authkey = crl->get_authKeyIdentifier(crl);
 413                         chunk_t authkey_c = crl_c->get_authKeyIdentifier(crl_c);
 414
 415                         /* if compare authorityKeyIdentifiers if available */
 416                         if (authkey.ptr && authkey_c.ptr && chunk_equals(authkey, authkey_c))
 417                         {
 418                                 found = TRUE;
 419                         }
 420                         else
 421                         {
 422                                 identification_t *issuer = cert->get_issuer(cert);
 423                                 identification_t *issuer_c = current->get_issuer(current);
 424
 425                                 /* otherwise compare issuer distinguished names */
 426                                 if (issuer->equals(issuer, issuer_c))
 427                                 {
 428                                         found = TRUE;
 429                                 }
 430                         }
 431                         if (found)
 432                         {
 433                                 new = cert->is_newer(cert, current);
 434                                 if (new)
 435                                 {
 436                                         this->certs->remove_at(this->certs, enumerator);
 437                                 }
 438                                 else
 439                                 {
 440                                         cert->destroy(cert);
 441                                 }
 442                                 break;
 443                         }
 444                 }
 445         }
 446         enumerator->destroy(enumerator);
 447
 448         if (new)
 449         {
 450                 this->certs->insert_last(this->certs, cert);
 451         }
 452         this->lock->unlock(this->lock);
 453         return new;
 454 }
 455
 456 /**
 457  * Add X.509 attribute certificate to chain
 458  */
 459 static bool add_ac(private_stroke_cred_t *this, ac_t* ac)
 460 {
 461         certificate_t *cert = &ac->certificate;
 462
 463         this->lock->write_lock(this->lock);
 464         this->certs->insert_last(this->certs, cert);
 465         this->lock->unlock(this->lock);
 466         return TRUE;
 467 }
 468
 469 /**
 470  * Implementation of stroke_cred_t.load_peer.
 471  */
 472 static certificate_t* load_peer(private_stroke_cred_t *this, char *filename)
 473 {
 474         certificate_t *cert;
 475         char path[PATH_MAX];
 476
 477         if (*filename == '/')
 478         {
 479                 snprintf(path, sizeof(path), "%s", filename);
 480         }
 481         else
 482         {
 483                 snprintf(path, sizeof(path), "%s/%s", CERTIFICATE_DIR, filename);
 484         }
 485
 486         cert = lib->creds->create(lib->creds,
 487                                                           CRED_CERTIFICATE, CERT_X509,
 488                                                           BUILD_FROM_FILE, path,
 489                                                           BUILD_X509_FLAG, 0,
 490                                                           BUILD_END);
 491         if (cert)
 492         {
 493                 cert = add_cert(this, cert);
 494                 DBG1(DBG_CFG, "  loaded certificate '%Y' from "
 495                                  "file '%s'", cert->get_subject(cert), filename);
 496                 return cert->get_ref(cert);
 497         }
 498         DBG1(DBG_CFG, "  loading certificate from file "
 499                  "'%s' failed", filename);
 500         return NULL;
 501 }
 502
 503 /**
 504  * load trusted certificates from a directory
 505  */
 506 static void load_certdir(private_stroke_cred_t *this, char *path,
 507                                                  certificate_type_t type, x509_flag_t flag)
 508 {
 509         struct stat st;
 510         char *file;
 511
 512         enumerator_t *enumerator = enumerator_create_directory(path);
 513
 514         if (!enumerator)
 515         {
 516                 DBG1(DBG_CFG, "  reading directory failed");
 517                 return;
 518         }
 519
 520         while (enumerator->enumerate(enumerator, NULL, &file, &st))
 521         {
 522                 certificate_t *cert;
 523
 524                 if (!S_ISREG(st.st_mode))
 525                 {
 526                         /* skip special file */
 527                         continue;
 528                 }
 529                 switch (type)
 530                 {
 531                         case CERT_X509:
 532                                 if (flag & X509_CA)
 533                                 {       /* for CA certificates, we strictly require CA
 534                                          * basicconstraints to be set */
 535                                         cert = lib->creds->create(lib->creds,
 536                                                                                 CRED_CERTIFICATE, CERT_X509,
 537                                                                                 BUILD_FROM_FILE, file, BUILD_END);
 538                                         if (cert)
 539                                         {
 540                                                 x509_t *x509 = (x509_t*)cert;
 541
 542                                                 if (!(x509->get_flags(x509) & X509_CA))
 543                                                 {
 544                                                         DBG1(DBG_CFG, "  ca certificate '%Y' misses "
 545                                                                  "ca basic constraint, discarded",
 546                                                                  cert->get_subject(cert));
 547                                                         cert->destroy(cert);
 548                                                         cert = NULL;
 549                                                 }
 550                                                 else
 551                                                 {
 552                                                         DBG1(DBG_CFG, "  loaded CA certificate '%Y' from "
 553                                                                  "file '%s'", cert->get_subject(cert), file);
 554                                                 }
 555                                         }
 556                                         else
 557                                         {
 558                                                 DBG1(DBG_CFG, "  loading CA certificate from file "
 559                                                          "'%s' failed", file);
 560                                         }
 561                                 }
 562                                 else
 563                                 {       /* for all other flags, we add them to the certificate. */
 564                                         cert = lib->creds->create(lib->creds,
 565                                                                                 CRED_CERTIFICATE, CERT_X509,
 566                                                                                 BUILD_FROM_FILE, file,
 567                                                                                 BUILD_X509_FLAG, flag, BUILD_END);
 568                                         if (cert)
 569                                         {
 570                                                 DBG1(DBG_CFG, "  loaded certificate '%Y' from "
 571                                                                  "file '%s'", cert->get_subject(cert), file);
 572                                         }
 573                                         else
 574                                         {
 575                                                 DBG1(DBG_CFG, "  loading certificate from file "
 576                                                          "'%s' failed", file);
 577                                         }
 578                                 }
 579                                 if (cert)
 580                                 {
 581                                         add_cert(this, cert);
 582                                 }
 583                                 break;
 584                         case CERT_X509_CRL:
 585                                 cert = lib->creds->create(lib->creds,
 586                                                                                   CRED_CERTIFICATE, CERT_X509_CRL,
 587                                                                                   BUILD_FROM_FILE, file,
 588                                                                                   BUILD_END);
 589                                 if (cert)
 590                                 {
 591                                         add_crl(this, (crl_t*)cert);
 592                                         DBG1(DBG_CFG, "  loaded crl from file '%s'",  file);
 593                                 }
 594                                 else
 595                                 {
 596                                         DBG1(DBG_CFG, "  loading crl from file '%s' failed", file);
 597                                 }
 598                                 break;
 599                         case CERT_X509_AC:
 600                                 cert = lib->creds->create(lib->creds,
 601                                                                                   CRED_CERTIFICATE, CERT_X509_AC,
 602                                                                                   BUILD_FROM_FILE, file,
 603                                                                                   BUILD_END);
 604                                 if (cert)
 605                                 {
 606                                         add_ac(this, (ac_t*)cert);
 607                                         DBG1(DBG_CFG, "  loaded attribute certificate from "
 608                                                  "file '%s'", file);
 609                                 }
 610                                 else
 611                                 {
 612                                         DBG1(DBG_CFG, "  loading attribute certificate from "
 613                                                  "file '%s' failed", file);
 614                                 }
 615                                 break;
 616                         default:
 617                                 break;
 618                 }
 619         }
 620         enumerator->destroy(enumerator);
 621 }
 622
 623 /**
 624  * Implementation of credential_set_t.cache_cert.
 625  */
 626 static void cache_cert(private_stroke_cred_t *this, certificate_t *cert)
 627 {
 628         if (cert->get_type(cert) == CERT_X509_CRL && this->cachecrl)
 629         {
 630                 /* CRLs get written to /etc/ipsec.d/crls/<authkeyId>.crl */
 631                 crl_t *crl = (crl_t*)cert;
 632
 633                 cert->get_ref(cert);
 634                 if (add_crl(this, crl))
 635                 {
 636                         char buf[BUF_LEN];
 637                         chunk_t chunk, hex;
 638
 639                         chunk = crl->get_authKeyIdentifier(crl);
 640                         hex = chunk_to_hex(chunk, NULL, FALSE);
 641                         snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex);
 642                         free(hex.ptr);
 643
 644                         chunk = cert->get_encoding(cert);
 645                         chunk_write(chunk, buf, "crl", 022, TRUE);
 646                         free(chunk.ptr);
 647                 }
 648         }
 649 }
 650
 651 /**
 652  * Implementation of stroke_cred_t.cachecrl.
 653  */
 654 static void cachecrl(private_stroke_cred_t *this, bool enabled)
 655 {
 656         DBG1(DBG_CFG, "crl caching to %s %s",
 657                  CRL_DIR, enabled ? "enabled" : "disabled");
 658         this->cachecrl = enabled;
 659 }
 660
 661
 662 /**
 663  * Convert a string of characters into a binary secret
 664  * A string between single or double quotes is treated as ASCII characters
 665  * A string prepended by 0x is treated as HEX and prepended by 0s as Base64
 666  */
 667 static err_t extract_secret(chunk_t *secret, chunk_t *line)
 668 {
 669         chunk_t raw_secret;
 670         char delimiter = ' ';
 671         bool quotes = FALSE;
 672
 673         if (!eat_whitespace(line))
 674         {
 675                 return "missing secret";
 676         }
 677
 678         if (*line->ptr == '\'' || *line->ptr == '"')
 679         {
 680                 quotes = TRUE;
 681                 delimiter = *line->ptr;
 682                 line->ptr++;  line->len--;
 683         }
 684
 685         if (!extract_token(&raw_secret, delimiter, line))
 686         {
 687                 if (delimiter == ' ')
 688                 {
 689                         raw_secret = *line;
 690                 }
 691                 else
 692                 {
 693                         return "missing second delimiter";
 694                 }
 695         }
 696
 697         if (quotes)
 698         {
 699                 /* treat as an ASCII string */
 700                 *secret = chunk_clone(raw_secret);
 701                 return NULL;
 702         }
 703         /* treat 0x as hex, 0s as base64 */
 704         if (raw_secret.len > 2)
 705         {
 706                 if (strncasecmp("0x", raw_secret.ptr, 2) == 0)
 707                 {
 708                         *secret = chunk_from_hex(chunk_skip(raw_secret, 2), NULL);
 709                         return NULL;
 710                 }
 711                 if (strncasecmp("0s", raw_secret.ptr, 2) == 0)
 712                 {
 713                         *secret = chunk_from_base64(chunk_skip(raw_secret, 2), NULL);
 714                         return NULL;
 715                 }
 716         }
 717         *secret = chunk_clone(raw_secret);
 718         return NULL;
 719 }
 720
 721 /**
 722  * Data to pass to passphrase_cb
 723  */
 724 typedef struct {
 725         /** socket we use for prompting */
 726         FILE *prompt;
 727         /** private key file */
 728         char *file;
 729         /** buffer for passphrase */
 730         char buf[256];
 731 } passphrase_cb_data_t;
 732
 733 /**
 734  * Passphrase callback to read from whack fd
 735  */
 736 chunk_t passphrase_cb(passphrase_cb_data_t *data, int try)
 737 {
 738         chunk_t secret = chunk_empty;;
 739
 740         if (try > 5)
 741         {
 742                 fprintf(data->prompt, "invalid passphrase, too many trials\n");
 743                 return chunk_empty;
 744         }
 745         if (try == 1)
 746         {
 747                 fprintf(data->prompt, "Private key '%s' is encrypted\n", data->file);
 748         }
 749         else
 750         {
 751                 fprintf(data->prompt, "invalid passphrase\n");
 752         }
 753         fprintf(data->prompt, "Passphrase:\n");
 754         if (fgets(data->buf, sizeof(data->buf), data->prompt))
 755         {
 756                 secret = chunk_create(data->buf, strlen(data->buf));
 757                 if (secret.len)
 758                 {       /* trim appended \n */
 759                         secret.len--;
 760                 }
 761         }
 762         return secret;
 763 }
 764
 765 /**
 766  * reload ipsec.secrets
 767  */
 768 static void load_secrets(private_stroke_cred_t *this, char *file, int level,
 769                                                  FILE *prompt)
 770 {
 771         size_t bytes;
 772         int line_nr = 0;
 773         chunk_t chunk, src, line;
 774         FILE *fd;
 775         private_key_t *private;
 776         shared_key_t *shared;
 777
 778         DBG1(DBG_CFG, "loading secrets from '%s'", file);
 779
 780         fd = fopen(file, "r");
 781         if (fd == NULL)
 782         {
 783                 DBG1(DBG_CFG, "opening secrets file '%s' failed");
 784                 return;
 785         }
 786
 787         /* TODO: do error checks */
 788         fseek(fd, 0, SEEK_END);
 789         chunk.len = ftell(fd);
 790         rewind(fd);
 791         chunk.ptr = malloc(chunk.len);
 792         bytes = fread(chunk.ptr, 1, chunk.len, fd);
 793         fclose(fd);
 794         src = chunk;
 795
 796         this->lock->write_lock(this->lock);
 797         if (level == 0)
 798         {
 799                 /* flush secrets on non-recursive invocation */
 800                 while (this->shared->remove_last(this->shared,
 801                                                                                  (void**)&shared) == SUCCESS)
 802                 {
 803                         shared->destroy(shared);
 804                 }
 805                 while (this->private->remove_last(this->private,
 806                                                                                   (void**)&private) == SUCCESS)
 807                 {
 808                         private->destroy(private);
 809                 }
 810         }
 811
 812         while (fetchline(&src, &line))
 813         {
 814                 chunk_t ids, token;
 815                 shared_key_type_t type;
 816
 817                 line_nr++;
 818
 819                 if (!eat_whitespace(&line))
 820                 {
 821                         continue;
 822                 }
 823                 if (line.len > strlen("include ") &&
 824                         strneq(line.ptr, "include ", strlen("include ")))
 825                 {
 826                         glob_t buf;
 827                         char **expanded, *dir, pattern[PATH_MAX];
 828                         u_char *pos;
 829
 830                         if (level > MAX_SECRETS_RECURSION)
 831                         {
 832                                 DBG1(DBG_CFG, "maximum level of %d includes reached, ignored",
 833                                          MAX_SECRETS_RECURSION);
 834                                 continue;
 835                         }
 836                         /* terminate filename by space */
 837                         line = chunk_skip(line, strlen("include "));
 838                         pos = memchr(line.ptr, ' ', line.len);
 839                         if (pos)
 840                         {
 841                                 line.len = pos - line.ptr;
 842                         }
 843                         if (line.len && line.ptr[0] == '/')
 844                         {
 845                                 if (line.len + 1 > sizeof(pattern))
 846                                 {
 847                                         DBG1(DBG_CFG, "include pattern too long, ignored");
 848                                         continue;
 849                                 }
 850                                 snprintf(pattern, sizeof(pattern), "%.*s", line.len, line.ptr);
 851                         }
 852                         else
 853                         {       /* use directory of current file if relative */
 854                                 dir = strdup(file);
 855                                 dir = dirname(dir);
 856
 857                                 if (line.len + 1 + strlen(dir) + 1 > sizeof(pattern))
 858                                 {
 859                                         DBG1(DBG_CFG, "include pattern too long, ignored");
 860                                         free(dir);
 861                                         continue;
 862                                 }
 863                                 snprintf(pattern, sizeof(pattern), "%s/%.*s",
 864                                                  dir, line.len, line.ptr);
 865                                 free(dir);
 866                         }
 867                         if (glob(pattern, GLOB_ERR, NULL, &buf) != 0)
 868                         {
 869                                 DBG1(DBG_CFG, "expanding file expression '%s' failed", pattern);
 870                                 globfree(&buf);
 871                         }
 872                         else
 873                         {
 874                                 for (expanded = buf.gl_pathv; *expanded != NULL; expanded++)
 875                                 {
 876                                         load_secrets(this, *expanded, level + 1, prompt);
 877                                 }
 878                         }
 879                         globfree(&buf);
 880                         continue;
 881                 }
 882
 883                 if (line.len > 2 && strneq(": ", line.ptr, 2))
 884                 {
 885                         /* no ids, skip the ':' */
 886                         ids = chunk_empty;
 887                         line.ptr++;
 888                         line.len--;
 889                 }
 890                 else if (extract_token_str(&ids, " : ", &line))
 891                 {
 892                         /* NULL terminate the extracted id string */
 893                         *(ids.ptr + ids.len) = '\0';
 894                 }
 895                 else
 896                 {
 897                         DBG1(DBG_CFG, "line %d: missing ' : ' separator", line_nr);
 898                         goto error;
 899                 }
 900
 901                 if (!eat_whitespace(&line) || !extract_token(&token, ' ', &line))
 902                 {
 903                         DBG1(DBG_CFG, "line %d: missing token", line_nr);
 904                         goto error;
 905                 }
 906                 if (match("RSA", &token) || match("ECDSA", &token))
 907                 {
 908                         char path[PATH_MAX];
 909                         chunk_t filename;
 910                         chunk_t secret = chunk_empty;
 911                         private_key_t *key = NULL;
 912                         key_type_t key_type = match("RSA", &token) ? KEY_RSA : KEY_ECDSA;
 913
 914                         err_t ugh = extract_value(&filename, &line);
 915
 916                         if (ugh != NULL)
 917                         {
 918                                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 919                                 goto error;
 920                         }
 921                         if (filename.len == 0)
 922                         {
 923                                 DBG1(DBG_CFG, "line %d: empty filename", line_nr);
 924                                 goto error;
 925                         }
 926                         if (*filename.ptr == '/')
 927                         {
 928                                 /* absolute path name */
 929                                 snprintf(path, sizeof(path), "%.*s", filename.len, filename.ptr);
 930                         }
 931                         else
 932                         {
 933                                 /* relative path name */
 934                                 snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
 935                                                  filename.len, filename.ptr);
 936                         }
 937
 938                         /* check for optional passphrase */
 939                         if (eat_whitespace(&line))
 940                         {
 941                                 ugh = extract_secret(&secret, &line);
 942                                 if (ugh != NULL)
 943                                 {
 944                                         DBG1(DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
 945                                         goto error;
 946                                 }
 947                         }
 948                         if (secret.len == 7 && strneq(secret.ptr, "%prompt", 7))
 949                         {
 950                                 if (prompt)
 951                                 {
 952                                         passphrase_cb_data_t data;
 953
 954                                         data.prompt = prompt;
 955                                         data.file = path;
 956                                         key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 957                                                                                          key_type, BUILD_FROM_FILE, path,
 958                                                                                          BUILD_PASSPHRASE_CALLBACK,
 959                                                                                          passphrase_cb, &data, BUILD_END);
 960                                 }
 961                         }
 962                         else
 963                         {
 964                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, key_type,
 965                                                                                  BUILD_FROM_FILE, path,
 966                                                                                  BUILD_PASSPHRASE, secret, BUILD_END);
 967                         }
 968                         if (key)
 969                         {
 970                                 DBG1(DBG_CFG, "  loaded %N private key file '%s'",
 971                                          key_type_names, key->get_type(key), path);
 972                                 this->private->insert_last(this->private, key);
 973                         }
 974                         else
 975                         {
 976                                 DBG1(DBG_CFG, "  skipped private key file '%s'", path);
 977                         }
 978                         chunk_clear(&secret);
 979                 }
 980                 else if (match("PIN", &token))
 981                 {
 982                         chunk_t sc = chunk_empty, secret = chunk_empty;
 983                         char smartcard[32], keyid[22], pin[32];
 984                         private_key_t *key;
 985                         u_int slot;
 986
 987                         err_t ugh = extract_value(&sc, &line);
 988
 989                         if (ugh != NULL)
 990                         {
 991                                 DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
 992                                 goto error;
 993                         }
 994                         if (sc.len == 0)
 995                         {
 996                                 DBG1(DBG_CFG, "line %d: expected %%smartcard specifier", line_nr);
 997                                 goto error;
 998                         }
 999                         snprintf(smartcard, sizeof(smartcard), "%.*s", sc.len, sc.ptr);
1000                         smartcard[sizeof(smartcard) - 1] = '\0';
1001
1002                         /* parse slot and key id. only two formats are supported.
1003                          * first try %smartcard<slot>:<keyid> */
1004                         if (sscanf(smartcard, "%%smartcard%u:%s", &slot, keyid) == 2)
1005                         {
1006                                 snprintf(smartcard, sizeof(smartcard), "%u:%s", slot, keyid);
1007                         }
1008                         /* then try %smartcard:<keyid> */
1009                         else if (sscanf(smartcard, "%%smartcard:%s", keyid) == 1)
1010                         {
1011                                 snprintf(smartcard, sizeof(smartcard), "%s", keyid);
1012                         }
1013                         else
1014                         {
1015                                 DBG1(DBG_CFG, "line %d: the given %%smartcard specifier is not"
1016                                                 " supported or invalid", line_nr);
1017                                 goto error;
1018                         }
1019
1020                         if (!eat_whitespace(&line))
1021                         {
1022                                 DBG1(DBG_CFG, "line %d: expected PIN", line_nr);
1023                                 goto error;
1024                         }
1025                         ugh = extract_secret(&secret, &line);
1026                         if (ugh != NULL)
1027                         {
1028                                 DBG1(DBG_CFG, "line %d: malformed PIN: %s", line_nr, ugh);
1029                                 goto error;
1030                         }
1031                         snprintf(pin, sizeof(pin), "%.*s", secret.len, secret.ptr);
1032                         pin[sizeof(pin) - 1] = '\0';
1033
1034                         /* we assume an RSA key */
1035                         key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
1036                                                                          BUILD_SMARTCARD_KEYID, smartcard,
1037                                                                          BUILD_SMARTCARD_PIN, pin, BUILD_END);
1038
1039                         if (key)
1040                         {
1041                                 DBG1(DBG_CFG, "  loaded private key from %.*s", sc.len, sc.ptr);
1042                                 this->private->insert_last(this->private, key);
1043                         }
1044                         memset(pin, 0, sizeof(pin));
1045                         chunk_clear(&secret);
1046                 }
1047                 else if ((match("PSK", &token) && (type = SHARED_IKE)) ||
1048                                  (match("EAP", &token) && (type = SHARED_EAP)) ||
1049                                  (match("XAUTH", &token) && (type = SHARED_EAP)))
1050                 {
1051                         stroke_shared_key_t *shared_key;
1052                         chunk_t secret = chunk_empty;
1053                         bool any = TRUE;
1054
1055                         err_t ugh = extract_secret(&secret, &line);
1056                         if (ugh != NULL)
1057                         {
1058                                 DBG1(DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
1059                                 goto error;
1060                         }
1061                         shared_key = stroke_shared_key_create(type, secret);
1062                         DBG1(DBG_CFG, "  loaded %N secret for %s", shared_key_type_names, type,
1063                                  ids.len > 0 ? (char*)ids.ptr : "%any");
1064                         DBG4(DBG_CFG, "  secret: %#B", &secret);
1065
1066                         this->shared->insert_last(this->shared, shared_key);
1067                         while (ids.len > 0)
1068                         {
1069                                 chunk_t id;
1070                                 identification_t *peer_id;
1071
1072                                 ugh = extract_value(&id, &ids);
1073                                 if (ugh != NULL)
1074                                 {
1075                                         DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
1076                                         goto error;
1077                                 }
1078                                 if (id.len == 0)
1079                                 {
1080                                         continue;
1081                                 }
1082
1083                                 /* NULL terminate the ID string */
1084                                 *(id.ptr + id.len) = '\0';
1085                                 peer_id = identification_create_from_string(id.ptr);
1086                                 if (peer_id->get_type(peer_id) == ID_ANY)
1087                                 {
1088                                         peer_id->destroy(peer_id);
1089                                         continue;
1090                                 }
1091
1092                                 shared_key->add_owner(shared_key, peer_id);
1093                                 any = FALSE;
1094                         }
1095                         if (any)
1096                         {
1097                                 shared_key->add_owner(shared_key,
1098                                         identification_create_from_encoding(ID_ANY, chunk_empty));
1099                         }
1100                 }
1101                 else
1102                 {
1103                         DBG1(DBG_CFG, "line %d: token must be either "
1104                                  "RSA, ECDSA, PSK, EAP, XAUTH or PIN", line_nr);
1105                         goto error;
1106                 }
1107         }
1108 error:
1109         this->lock->unlock(this->lock);
1110         chunk_clear(&chunk);
1111 }
1112
1113 /**
1114  * load all certificates from ipsec.d
1115  */
1116 static void load_certs(private_stroke_cred_t *this)
1117 {
1118         DBG1(DBG_CFG, "loading ca certificates from '%s'",
1119                  CA_CERTIFICATE_DIR);
1120         load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
1121
1122         DBG1(DBG_CFG, "loading aa certificates from '%s'",
1123                  AA_CERTIFICATE_DIR);
1124         load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
1125
1126         DBG1(DBG_CFG, "loading ocsp signer certificates from '%s'",
1127                  OCSP_CERTIFICATE_DIR);
1128         load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509, X509_OCSP_SIGNER);
1129
1130         DBG1(DBG_CFG, "loading attribute certificates from '%s'",
1131                  ATTR_CERTIFICATE_DIR);
1132         load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
1133
1134         DBG1(DBG_CFG, "loading crls from '%s'",
1135                  CRL_DIR);
1136         load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
1137 }
1138
1139 /**
1140  * Implementation of stroke_cred_t.reread.
1141  */
1142 static void reread(private_stroke_cred_t *this, stroke_msg_t *msg, FILE *prompt)
1143 {
1144         if (msg->reread.flags & REREAD_SECRETS)
1145         {
1146                 DBG1(DBG_CFG, "rereading secrets");
1147                 load_secrets(this, SECRETS_FILE, 0, prompt);
1148         }
1149         if (msg->reread.flags & REREAD_CACERTS)
1150         {
1151                 DBG1(DBG_CFG, "rereading ca certificates from '%s'",
1152                          CA_CERTIFICATE_DIR);
1153                 load_certdir(this, CA_CERTIFICATE_DIR, CERT_X509, X509_CA);
1154         }
1155         if (msg->reread.flags & REREAD_OCSPCERTS)
1156         {
1157                 DBG1(DBG_CFG, "rereading ocsp signer certificates from '%s'",
1158                          OCSP_CERTIFICATE_DIR);
1159                 load_certdir(this, OCSP_CERTIFICATE_DIR, CERT_X509,
1160                          X509_OCSP_SIGNER);
1161         }
1162         if (msg->reread.flags & REREAD_AACERTS)
1163         {
1164                 DBG1(DBG_CFG, "rereading aa certificates from '%s'",
1165                          AA_CERTIFICATE_DIR);
1166                 load_certdir(this, AA_CERTIFICATE_DIR, CERT_X509, X509_AA);
1167         }
1168         if (msg->reread.flags & REREAD_ACERTS)
1169         {
1170                 DBG1(DBG_CFG, "rereading attribute certificates from '%s'",
1171                          ATTR_CERTIFICATE_DIR);
1172                 load_certdir(this, ATTR_CERTIFICATE_DIR, CERT_X509_AC, 0);
1173         }
1174         if (msg->reread.flags & REREAD_CRLS)
1175         {
1176                 DBG1(DBG_CFG, "rereading crls from '%s'",
1177                          CRL_DIR);
1178                 load_certdir(this, CRL_DIR, CERT_X509_CRL, 0);
1179         }
1180 }
1181
1182 /**
1183  * Implementation of stroke_cred_t.destroy
1184  */
1185 static void destroy(private_stroke_cred_t *this)
1186 {
1187         this->certs->destroy_offset(this->certs, offsetof(certificate_t, destroy));
1188         this->shared->destroy_offset(this->shared, offsetof(shared_key_t, destroy));
1189         this->private->destroy_offset(this->private, offsetof(private_key_t, destroy));
1190         this->lock->destroy(this->lock);
1191         free(this);
1192 }
1193
1194 /*
1195  * see header file
1196  */
1197 stroke_cred_t *stroke_cred_create()
1198 {
1199         private_stroke_cred_t *this = malloc_thing(private_stroke_cred_t);
1200
1201         this->public.set.create_private_enumerator = (void*)create_private_enumerator;
1202         this->public.set.create_cert_enumerator = (void*)create_cert_enumerator;
1203         this->public.set.create_shared_enumerator = (void*)create_shared_enumerator;
1204         this->public.set.create_cdp_enumerator = (void*)return_null;
1205         this->public.set.cache_cert = (void*)cache_cert;
1206         this->public.reread = (void(*)(stroke_cred_t*, stroke_msg_t *msg, FILE*))reread;
1207         this->public.load_ca = (certificate_t*(*)(stroke_cred_t*, char *filename))load_ca;
1208         this->public.load_peer = (certificate_t*(*)(stroke_cred_t*, char *filename))load_peer;
1209         this->public.cachecrl = (void(*)(stroke_cred_t*, bool enabled))cachecrl;
1210         this->public.destroy = (void(*)(stroke_cred_t*))destroy;
1211
1212         this->certs = linked_list_create();
1213         this->shared = linked_list_create();
1214         this->private = linked_list_create();
1215         this->lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
1216
1217         load_certs(this);
1218         load_secrets(this, SECRETS_FILE, 0, NULL);
1219
1220         this->cachecrl = FALSE;
1221
1222         return &this->public;
1223 }
1224