src/libstrongswan/plugins/revocation/revocation_validator.c

   1 /*
   2  * Copyright (C) 2015-2018 Tobias Brunner
   3  * Copyright (C) 2010 Martin Willi
   4  * Copyright (C) 2010 revosec AG
   5  * Copyright (C) 2009 Andreas Steffen
   6  * HSR Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include <time.h>
  20
  21 #include "revocation_validator.h"
  22
  23 #include <utils/debug.h>
  24 #include <credentials/certificates/x509.h>
  25 #include <credentials/certificates/crl.h>
  26 #include <credentials/certificates/ocsp_request.h>
  27 #include <credentials/certificates/ocsp_response.h>
  28 #include <credentials/sets/ocsp_response_wrapper.h>
  29 #include <selectors/traffic_selector.h>
  30
  31 typedef struct private_revocation_validator_t private_revocation_validator_t;
  32
  33 /**
  34  * Private data of an revocation_validator_t object.
  35  */
  36 struct private_revocation_validator_t {
  37
  38         /**
  39          * Public revocation_validator_t interface.
  40          */
  41         revocation_validator_t public;
  42
  43         /**
  44          * Enable OCSP validation
  45          */
  46         bool enable_ocsp;
  47
  48         /**
  49          * Enable CRL validation
  50          */
  51         bool enable_crl;
  52
  53 };
  54
  55 /**
  56  * Do an OCSP request
  57  */
  58 static certificate_t *fetch_ocsp(char *url, certificate_t *subject,
  59                                                                  certificate_t *issuer)
  60 {
  61         certificate_t *request, *response;
  62         chunk_t send, receive;
  63
  64         /* TODO: requestor name, signature */
  65         request = lib->creds->create(lib->creds,
  66                                                 CRED_CERTIFICATE, CERT_X509_OCSP_REQUEST,
  67                                                 BUILD_CA_CERT, issuer,
  68                                                 BUILD_CERT, subject, BUILD_END);
  69         if (!request)
  70         {
  71                 DBG1(DBG_CFG, "generating ocsp request failed");
  72                 return NULL;
  73         }
  74
  75         if (!request->get_encoding(request, CERT_ASN1_DER, &send))
  76         {
  77                 DBG1(DBG_CFG, "encoding ocsp request failed");
  78                 request->destroy(request);
  79                 return NULL;
  80         }
  81         request->destroy(request);
  82
  83         DBG1(DBG_CFG, "  requesting ocsp status from '%s' ...", url);
  84         if (lib->fetcher->fetch(lib->fetcher, url, &receive,
  85                                                         FETCH_REQUEST_DATA, send,
  86                                                         FETCH_REQUEST_TYPE, "application/ocsp-request",
  87                                                         FETCH_END) != SUCCESS)
  88         {
  89                 DBG1(DBG_CFG, "ocsp request to %s failed", url);
  90                 chunk_free(&send);
  91                 return NULL;
  92         }
  93         chunk_free(&send);
  94
  95         response = lib->creds->create(lib->creds,
  96                                                                   CRED_CERTIFICATE, CERT_X509_OCSP_RESPONSE,
  97                                                                   BUILD_BLOB_ASN1_DER, receive, BUILD_END);
  98         chunk_free(&receive);
  99         if (!response)
 100         {
 101                 DBG1(DBG_CFG, "parsing ocsp response failed");
 102                 return NULL;
 103         }
 104         return response;
 105 }
 106
 107 /**
 108  * check the signature of an OCSP response
 109  */
 110 static bool verify_ocsp(ocsp_response_t *response, certificate_t *ca)
 111 {
 112         certificate_t *issuer, *subject;
 113         identification_t *responder;
 114         ocsp_response_wrapper_t *wrapper;
 115         enumerator_t *enumerator;
 116         x509_t *x509;
 117         bool verified = FALSE, found = FALSE;
 118
 119         wrapper = ocsp_response_wrapper_create((ocsp_response_t*)response);
 120         lib->credmgr->add_local_set(lib->credmgr, &wrapper->set, FALSE);
 121
 122         subject = &response->certificate;
 123         responder = subject->get_issuer(subject);
 124
 125         /* check OCSP response using CA or directly delegated OCSP signer */
 126         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr, CERT_X509,
 127                                                                                                         KEY_ANY, responder, FALSE);
 128         while (enumerator->enumerate(enumerator, &issuer))
 129         {
 130                 x509 = (x509_t*)issuer;
 131                 if (!issuer->get_validity(issuer, NULL, NULL, NULL))
 132                 {       /* OCSP signer currently invalid */
 133                         continue;
 134                 }
 135                 if (!ca->equals(ca, issuer))
 136                 {       /* delegated OCSP signer? */
 137                         if (!lib->credmgr->issued_by(lib->credmgr, issuer, ca, NULL))
 138                         {       /* OCSP response not signed by CA, nor delegated OCSP signer */
 139                                 continue;
 140                         }
 141                         if (!(x509->get_flags(x509) & X509_OCSP_SIGNER))
 142                         {       /* delegated OCSP signer does not have OCSP signer flag */
 143                                 continue;
 144                         }
 145                 }
 146                 found = TRUE;
 147                 if (lib->credmgr->issued_by(lib->credmgr, subject, issuer, NULL))
 148                 {
 149                         DBG1(DBG_CFG, "  ocsp response correctly signed by \"%Y\"",
 150                                  issuer->get_subject(issuer));
 151                         verified = TRUE;
 152                         break;
 153                 }
 154                 DBG1(DBG_CFG, "ocsp response verification failed, "
 155                          "invalid signature");
 156         }
 157         enumerator->destroy(enumerator);
 158
 159         if (!verified)
 160         {
 161                 /* as fallback, use any locally installed OCSP signer certificate */
 162                 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 163                                                                                 CERT_X509, KEY_ANY, responder, TRUE);
 164                 while (enumerator->enumerate(enumerator, &issuer))
 165                 {
 166                         x509 = (x509_t*)issuer;
 167                         /* while issued_by() accepts both OCSP signer or CA basic
 168                          * constraint flags to verify OCSP responses, unrelated but trusted
 169                          * OCSP signers must explicitly have the OCSP signer flag set. */
 170                         if ((x509->get_flags(x509) & X509_OCSP_SIGNER) &&
 171                                 issuer->get_validity(issuer, NULL, NULL, NULL))
 172                         {
 173                                 found = TRUE;
 174                                 if (lib->credmgr->issued_by(lib->credmgr, subject, issuer, NULL))
 175                                 {
 176                                         DBG1(DBG_CFG, "  ocsp response correctly signed by \"%Y\"",
 177                                                  issuer->get_subject(issuer));
 178                                         verified = TRUE;
 179                                         break;
 180                                 }
 181                                 DBG1(DBG_CFG, "ocsp response verification failed, "
 182                                          "invalid signature");
 183                         }
 184                 }
 185                 enumerator->destroy(enumerator);
 186         }
 187
 188         lib->credmgr->remove_local_set(lib->credmgr, &wrapper->set);
 189         wrapper->destroy(wrapper);
 190
 191         if (!found)
 192         {
 193                 DBG1(DBG_CFG, "ocsp response verification failed, "
 194                          "no signer certificate '%Y' found", responder);
 195         }
 196         return verified;
 197 }
 198
 199 /**
 200  * Get the better of two OCSP responses, and check for usable OCSP info
 201  */
 202 static certificate_t *get_better_ocsp(certificate_t *cand, certificate_t *best,
 203                                                                           x509_t *subject, x509_t *issuer,
 204                                                                           cert_validation_t *valid, bool cache)
 205 {
 206         ocsp_response_t *response;
 207         time_t revocation, this_update, next_update, valid_until;
 208         crl_reason_t reason;
 209         bool revoked = FALSE;
 210
 211         response = (ocsp_response_t*)cand;
 212
 213         /* check ocsp signature */
 214         if (!verify_ocsp(response, &issuer->interface))
 215         {
 216                 cand->destroy(cand);
 217                 return best;
 218         }
 219         /* check if response contains our certificate */
 220         switch (response->get_status(response, subject, issuer, &revocation, &reason,
 221                                                                  &this_update, &next_update))
 222         {
 223                 case VALIDATION_REVOKED:
 224                         /* subject has been revoked by a valid OCSP response */
 225                         DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N",
 226                                                   &revocation, TRUE, crl_reason_names, reason);
 227                         revoked = TRUE;
 228                         break;
 229                 case VALIDATION_GOOD:
 230                         /* results in either good or stale */
 231                         break;
 232                 default:
 233                 case VALIDATION_FAILED:
 234                         /* candidate unusable, does not contain our cert */
 235                         DBG1(DBG_CFG, "  ocsp response contains no status on our certificate");
 236                         cand->destroy(cand);
 237                         return best;
 238         }
 239
 240         /* select the better of the two responses */
 241         if (best == NULL || certificate_is_newer(cand, best))
 242         {
 243                 DESTROY_IF(best);
 244                 best = cand;
 245                 if (best->get_validity(best, NULL, NULL, &valid_until))
 246                 {
 247                         DBG1(DBG_CFG, "  ocsp response is valid: until %T",
 248                                                          &valid_until, FALSE);
 249                         *valid = VALIDATION_GOOD;
 250                         if (cache)
 251                         {       /* cache non-stale only, stale certs get refetched */
 252                                 lib->credmgr->cache_cert(lib->credmgr, best);
 253                         }
 254                 }
 255                 else
 256                 {
 257                         DBG1(DBG_CFG, "  ocsp response is stale: since %T",
 258                                                          &valid_until, FALSE);
 259                         *valid = VALIDATION_STALE;
 260                 }
 261         }
 262         else
 263         {
 264                 *valid = VALIDATION_STALE;
 265                 cand->destroy(cand);
 266         }
 267         if (revoked)
 268         {       /* revoked always counts, even if stale */
 269                 *valid = VALIDATION_REVOKED;
 270         }
 271         return best;
 272 }
 273
 274 /**
 275  * validate a x509 certificate using OCSP
 276  */
 277 static cert_validation_t check_ocsp(x509_t *subject, x509_t *issuer,
 278                                                                         auth_cfg_t *auth)
 279 {
 280         enumerator_t *enumerator;
 281         cert_validation_t valid = VALIDATION_SKIPPED;
 282         certificate_t *best = NULL, *current;
 283         identification_t *keyid = NULL;
 284         public_key_t *public;
 285         chunk_t chunk;
 286         char *uri = NULL;
 287
 288         /** lookup cache for valid OCSP responses */
 289         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 290                                                                 CERT_X509_OCSP_RESPONSE, KEY_ANY, NULL, FALSE);
 291         while (enumerator->enumerate(enumerator, &current))
 292         {
 293                 current->get_ref(current);
 294                 best = get_better_ocsp(current, best, subject, issuer, &valid, FALSE);
 295                 if (best && valid != VALIDATION_STALE)
 296                 {
 297                         DBG1(DBG_CFG, "  using cached ocsp response");
 298                         break;
 299                 }
 300         }
 301         enumerator->destroy(enumerator);
 302
 303         /* derive the authorityKeyIdentifier from the issuer's public key */
 304         current = &issuer->interface;
 305         public = current->get_public_key(current);
 306         if (public && public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &chunk))
 307         {
 308                 keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
 309         }
 310         /** fetch from configured OCSP responder URLs */
 311         if (keyid && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
 312         {
 313                 enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr,
 314                                                                                         CERT_X509_OCSP_RESPONSE, keyid);
 315                 while (enumerator->enumerate(enumerator, &uri))
 316                 {
 317                         current = fetch_ocsp(uri, &subject->interface, &issuer->interface);
 318                         if (current)
 319                         {
 320                                 best = get_better_ocsp(current, best, subject, issuer,
 321                                                                            &valid, TRUE);
 322                                 if (best && valid != VALIDATION_STALE)
 323                                 {
 324                                         break;
 325                                 }
 326                         }
 327                 }
 328                 enumerator->destroy(enumerator);
 329         }
 330         DESTROY_IF(public);
 331         DESTROY_IF(keyid);
 332
 333         /* fallback to URL fetching from subject certificate's URIs */
 334         if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
 335         {
 336                 enumerator = subject->create_ocsp_uri_enumerator(subject);
 337                 while (enumerator->enumerate(enumerator, &uri))
 338                 {
 339                         current = fetch_ocsp(uri, &subject->interface, &issuer->interface);
 340                         if (current)
 341                         {
 342                                 best = get_better_ocsp(current, best, subject, issuer,
 343                                                                            &valid, TRUE);
 344                                 if (best && valid != VALIDATION_STALE)
 345                                 {
 346                                         break;
 347                                 }
 348                         }
 349                 }
 350                 enumerator->destroy(enumerator);
 351         }
 352         /* an uri was found, but no result. switch validation state to failed */
 353         if (valid == VALIDATION_SKIPPED && uri)
 354         {
 355                 valid = VALIDATION_FAILED;
 356         }
 357         if (auth)
 358         {
 359                 auth->add(auth, AUTH_RULE_OCSP_VALIDATION, valid);
 360                 if (valid == VALIDATION_GOOD)
 361                 {       /* successful OCSP check fulfills also CRL constraint */
 362                         auth->add(auth, AUTH_RULE_CRL_VALIDATION, VALIDATION_GOOD);
 363                 }
 364         }
 365         DESTROY_IF(best);
 366         return valid;
 367 }
 368
 369 /**
 370  * fetch a CRL from an URL
 371  */
 372 static certificate_t* fetch_crl(char *url)
 373 {
 374         certificate_t *crl;
 375         chunk_t chunk;
 376
 377         DBG1(DBG_CFG, "  fetching crl from '%s' ...", url);
 378         if (lib->fetcher->fetch(lib->fetcher, url, &chunk, FETCH_END) != SUCCESS)
 379         {
 380                 DBG1(DBG_CFG, "crl fetching failed");
 381                 return NULL;
 382         }
 383         crl = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509_CRL,
 384                                                          BUILD_BLOB_PEM, chunk, BUILD_END);
 385         chunk_free(&chunk);
 386         if (!crl)
 387         {
 388                 DBG1(DBG_CFG, "crl fetched successfully but parsing failed");
 389                 return NULL;
 390         }
 391         return crl;
 392 }
 393
 394 /**
 395  * check the signature of an CRL
 396  */
 397 static bool verify_crl(certificate_t *crl)
 398 {
 399         certificate_t *issuer;
 400         enumerator_t *enumerator;
 401         bool verified = FALSE;
 402
 403         enumerator = lib->credmgr->create_trusted_enumerator(lib->credmgr,
 404                                                                                 KEY_ANY, crl->get_issuer(crl), FALSE);
 405         while (enumerator->enumerate(enumerator, &issuer, NULL))
 406         {
 407                 if (lib->credmgr->issued_by(lib->credmgr, crl, issuer, NULL))
 408                 {
 409                         DBG1(DBG_CFG, "  crl correctly signed by \"%Y\"",
 410                                                    issuer->get_subject(issuer));
 411                         verified = TRUE;
 412                         break;
 413                 }
 414         }
 415         enumerator->destroy(enumerator);
 416
 417         return verified;
 418 }
 419
 420 /**
 421  * Report the given CRL's validity and cache it if valid and requested
 422  */
 423 static bool is_crl_valid(certificate_t *crl, time_t now, bool cache)
 424 {
 425         time_t valid_until;
 426
 427         if (crl->get_validity(crl, &now, NULL, &valid_until))
 428         {
 429                 DBG1(DBG_CFG, "  crl is valid: until %T", &valid_until, FALSE);
 430                 if (cache)
 431                 {
 432                         lib->credmgr->cache_cert(lib->credmgr, crl);
 433                 }
 434                 return TRUE;
 435         }
 436         DBG1(DBG_CFG, "  crl is stale: since %T", &valid_until, FALSE);
 437         return FALSE;
 438 }
 439
 440 /**
 441  * Check if the CRL should be used yet
 442  */
 443 static bool is_crl_not_valid_yet(certificate_t *crl, time_t now)
 444 {
 445         time_t this_update;
 446
 447         if (!crl->get_validity(crl, &now, &this_update, NULL))
 448         {
 449                 if (this_update > now)
 450                 {
 451                         DBG1(DBG_CFG, "  crl is not valid: until %T", &this_update, FALSE);
 452                         return TRUE;
 453                 }
 454                 /* we accept stale CRLs */
 455         }
 456         return FALSE;
 457 }
 458
 459 /**
 460  * Get the better of two CRLs, and check for usable CRL info
 461  */
 462 static certificate_t *get_better_crl(certificate_t *cand, certificate_t *best,
 463                                         x509_t *subject, cert_validation_t *valid,
 464                                         bool cache, crl_t *base)
 465 {
 466         enumerator_t *enumerator;
 467         time_t now, revocation;
 468         crl_reason_t reason;
 469         chunk_t subject_serial, serial;
 470         crl_t *crl = (crl_t*)cand;
 471
 472         if (base)
 473         {
 474                 if (!crl->is_delta_crl(crl, &serial) ||
 475                         !chunk_equals(serial, base->get_serial(base)))
 476                 {
 477                         cand->destroy(cand);
 478                         return best;
 479                 }
 480         }
 481         else
 482         {
 483                 if (crl->is_delta_crl(crl, NULL))
 484                 {
 485                         cand->destroy(cand);
 486                         return best;
 487                 }
 488         }
 489
 490         /* check CRL signature */
 491         if (!verify_crl(cand))
 492         {
 493                 DBG1(DBG_CFG, "crl response verification failed");
 494                 cand->destroy(cand);
 495                 return best;
 496         }
 497         now = time(NULL);
 498         if (is_crl_not_valid_yet(cand, now))
 499         {
 500                 cand->destroy(cand);
 501                 return best;
 502         }
 503
 504         subject_serial = chunk_skip_zero(subject->get_serial(subject));
 505         enumerator = crl->create_enumerator(crl);
 506         while (enumerator->enumerate(enumerator, &serial, &revocation, &reason))
 507         {
 508                 if (chunk_equals(subject_serial, chunk_skip_zero(serial)))
 509                 {
 510                         if (reason != CRL_REASON_CERTIFICATE_HOLD)
 511                         {
 512                                 *valid = VALIDATION_REVOKED;
 513                         }
 514                         else
 515                         {
 516                                 /* if the cert is on hold, a newer CRL might not contain it */
 517                                 *valid = VALIDATION_ON_HOLD;
 518                         }
 519                         is_crl_valid(cand, now, cache);
 520                         DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N",
 521                                  &revocation, TRUE, crl_reason_names, reason);
 522                         enumerator->destroy(enumerator);
 523                         DESTROY_IF(best);
 524                         return cand;
 525                 }
 526         }
 527         enumerator->destroy(enumerator);
 528
 529         /* select the better of the two CRLs */
 530         if (best == NULL || crl_is_newer(crl, (crl_t*)best))
 531         {
 532                 DESTROY_IF(best);
 533                 best = cand;
 534                 if (is_crl_valid(best, now, cache))
 535                 {
 536                         *valid = VALIDATION_GOOD;
 537                 }
 538                 else
 539                 {
 540                         *valid = VALIDATION_STALE;
 541                 }
 542         }
 543         else
 544         {
 545                 *valid = VALIDATION_STALE;
 546                 cand->destroy(cand);
 547         }
 548         return best;
 549 }
 550
 551 /**
 552  * Find or fetch a certificate for a given crlIssuer
 553  */
 554 static cert_validation_t find_crl(x509_t *subject, identification_t *issuer,
 555                                                                   crl_t *base, certificate_t **best,
 556                                                                   bool *uri_found)
 557 {
 558         cert_validation_t valid = VALIDATION_SKIPPED;
 559         enumerator_t *enumerator;
 560         certificate_t *current;
 561         char *uri;
 562
 563         /* find a cached (delta) crl */
 564         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 565                                                                                 CERT_X509_CRL, KEY_ANY, issuer, FALSE);
 566         while (enumerator->enumerate(enumerator, &current))
 567         {
 568                 current->get_ref(current);
 569                 *best = get_better_crl(current, *best, subject, &valid, FALSE, base);
 570                 if (*best && valid != VALIDATION_STALE)
 571                 {
 572                         DBG1(DBG_CFG, "  using cached crl");
 573                         break;
 574                 }
 575         }
 576         enumerator->destroy(enumerator);
 577
 578         /* fallback to fetching crls from credential sets cdps */
 579         if (!base && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
 580         {
 581                 enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr,
 582                                                                                                                  CERT_X509_CRL, issuer);
 583                 while (enumerator->enumerate(enumerator, &uri))
 584                 {
 585                         *uri_found = TRUE;
 586                         current = fetch_crl(uri);
 587                         if (current)
 588                         {
 589                                 if (!current->has_issuer(current, issuer))
 590                                 {
 591                                         DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL "
 592                                                  "issuer '%Y'", current->get_issuer(current), issuer);
 593                                         current->destroy(current);
 594                                         continue;
 595                                 }
 596                                 *best = get_better_crl(current, *best, subject,
 597                                                                            &valid, TRUE, base);
 598                                 if (*best && valid != VALIDATION_STALE)
 599                                 {
 600                                         break;
 601                                 }
 602                         }
 603                 }
 604                 enumerator->destroy(enumerator);
 605         }
 606         return valid;
 607 }
 608
 609 /**
 610  * Check if the issuer of the given CRL matches
 611  */
 612 static bool check_issuer(certificate_t *crl, x509_t *issuer, x509_cdp_t *cdp)
 613 {
 614         certificate_t *cissuer = (certificate_t*)issuer;
 615         identification_t *id;
 616         chunk_t chunk;
 617         bool matches = FALSE;
 618
 619         if (cdp->issuer)
 620         {
 621                 return crl->has_issuer(crl, cdp->issuer);
 622         }
 623         /* check SKI/AKI first, but fall back to DN matching */
 624         chunk = issuer->get_subjectKeyIdentifier(issuer);
 625         if (chunk.len)
 626         {
 627                 id = identification_create_from_encoding(ID_KEY_ID, chunk);
 628                 matches = crl->has_issuer(crl, id);
 629                 id->destroy(id);
 630         }
 631         return matches || crl->has_issuer(crl, cissuer->get_subject(cissuer));
 632 }
 633
 634 /**
 635  * Look for a delta CRL for a given base CRL
 636  */
 637 static cert_validation_t check_delta_crl(x509_t *subject, x509_t *issuer,
 638                                                                         crl_t *base, cert_validation_t base_valid)
 639 {
 640         cert_validation_t valid = VALIDATION_SKIPPED;
 641         certificate_t *best = NULL, *current, *cissuer = (certificate_t*)issuer;
 642         enumerator_t *enumerator;
 643         identification_t *id;
 644         x509_cdp_t *cdp;
 645         chunk_t chunk;
 646         bool uri;
 647
 648         /* find cached delta CRL via subjectKeyIdentifier */
 649         chunk = issuer->get_subjectKeyIdentifier(issuer);
 650         if (chunk.len)
 651         {
 652                 id = identification_create_from_encoding(ID_KEY_ID, chunk);
 653                 valid = find_crl(subject, id, base, &best, &uri);
 654                 id->destroy(id);
 655         }
 656
 657         /* find delta CRL by CRLIssuer */
 658         enumerator = subject->create_crl_uri_enumerator(subject);
 659         while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
 660                    enumerator->enumerate(enumerator, &cdp))
 661         {
 662                 if (cdp->issuer)
 663                 {
 664                         valid = find_crl(subject, cdp->issuer, base, &best, &uri);
 665                 }
 666         }
 667         enumerator->destroy(enumerator);
 668
 669         /* fetch from URIs found in Freshest CRL extension */
 670         enumerator = base->create_delta_crl_uri_enumerator(base);
 671         while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
 672                    enumerator->enumerate(enumerator, &cdp))
 673         {
 674                 current = fetch_crl(cdp->uri);
 675                 if (current)
 676                 {
 677                         if (!check_issuer(current, issuer, cdp))
 678                         {
 679                                 DBG1(DBG_CFG, "issuer of fetched delta CRL '%Y' does not match "
 680                                          "certificate's %sissuer '%Y'",
 681                                          current->get_issuer(current), cdp->issuer ? "CRL " : "",
 682                                          cdp->issuer ?: cissuer->get_subject(cissuer));
 683                                 current->destroy(current);
 684                                 continue;
 685                         }
 686                         best = get_better_crl(current, best, subject, &valid, TRUE, base);
 687                         if (best && valid != VALIDATION_STALE)
 688                         {
 689                                 break;
 690                         }
 691                 }
 692         }
 693         enumerator->destroy(enumerator);
 694
 695         if (best)
 696         {
 697                 best->destroy(best);
 698                 return valid;
 699         }
 700         return base_valid;
 701 }
 702
 703 /**
 704  * validate a x509 certificate using CRL
 705  */
 706 static cert_validation_t check_crl(x509_t *subject, x509_t *issuer,
 707                                                                    auth_cfg_t *auth)
 708 {
 709         cert_validation_t valid = VALIDATION_SKIPPED;
 710         certificate_t *best = NULL, *cissuer = (certificate_t*)issuer;
 711         identification_t *id;
 712         x509_cdp_t *cdp;
 713         bool uri_found = FALSE;
 714         certificate_t *current;
 715         enumerator_t *enumerator;
 716         chunk_t chunk;
 717
 718         /* use issuers subjectKeyIdentifier to find a cached CRL / fetch from CDP */
 719         chunk = issuer->get_subjectKeyIdentifier(issuer);
 720         if (chunk.len)
 721         {
 722                 id = identification_create_from_encoding(ID_KEY_ID, chunk);
 723                 valid = find_crl(subject, id, NULL, &best, &uri_found);
 724                 id->destroy(id);
 725         }
 726
 727         /* find a cached CRL or fetch via configured CDP via CRLIssuer */
 728         enumerator = subject->create_crl_uri_enumerator(subject);
 729         while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
 730                    enumerator->enumerate(enumerator, &cdp))
 731         {
 732                 if (cdp->issuer)
 733                 {
 734                         valid = find_crl(subject, cdp->issuer, NULL, &best, &uri_found);
 735                 }
 736         }
 737         enumerator->destroy(enumerator);
 738
 739         /* fallback to fetching CRLs from CDPs found in subjects certificate */
 740         if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
 741         {
 742                 enumerator = subject->create_crl_uri_enumerator(subject);
 743                 while (enumerator->enumerate(enumerator, &cdp))
 744                 {
 745                         uri_found = TRUE;
 746                         current = fetch_crl(cdp->uri);
 747                         if (current)
 748                         {
 749                                 if (!check_issuer(current, issuer, cdp))
 750                                 {
 751                                         DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match "
 752                                                  "certificate's %sissuer '%Y'",
 753                                                  current->get_issuer(current), cdp->issuer ? "CRL " : "",
 754                                                  cdp->issuer ?: cissuer->get_subject(cissuer));
 755                                         current->destroy(current);
 756                                         continue;
 757                                 }
 758                                 best = get_better_crl(current, best, subject, &valid,
 759                                                                           TRUE, NULL);
 760                                 if (best && valid != VALIDATION_STALE)
 761                                 {
 762                                         break;
 763                                 }
 764                         }
 765                 }
 766                 enumerator->destroy(enumerator);
 767         }
 768
 769         /* look for delta CRLs */
 770         if (best && (valid == VALIDATION_GOOD || valid == VALIDATION_STALE))
 771         {
 772                 valid = check_delta_crl(subject, issuer, (crl_t*)best, valid);
 773         }
 774
 775         /* an uri was found, but no result. switch validation state to failed */
 776         if (valid == VALIDATION_SKIPPED && uri_found)
 777         {
 778                 valid = VALIDATION_FAILED;
 779         }
 780         if (auth)
 781         {
 782                 if (valid == VALIDATION_SKIPPED)
 783                 {       /* if we skipped CRL validation, we use the result of OCSP for
 784                          * constraint checking */
 785                         auth->add(auth, AUTH_RULE_CRL_VALIDATION,
 786                                           auth->get(auth, AUTH_RULE_OCSP_VALIDATION));
 787                 }
 788                 else
 789                 {
 790                         auth->add(auth, AUTH_RULE_CRL_VALIDATION, valid);
 791                 }
 792         }
 793         DESTROY_IF(best);
 794         return valid;
 795 }
 796
 797 METHOD(cert_validator_t, validate, bool,
 798         private_revocation_validator_t *this, certificate_t *subject,
 799         certificate_t *issuer, bool online, u_int pathlen, bool anchor,
 800         auth_cfg_t *auth)
 801 {
 802         if (online && (this->enable_ocsp || this->enable_crl) &&
 803                 subject->get_type(subject) == CERT_X509 &&
 804                 issuer->get_type(issuer) == CERT_X509)
 805         {
 806                 DBG1(DBG_CFG, "checking certificate status of \"%Y\"",
 807                                            subject->get_subject(subject));
 808
 809                 if (this->enable_ocsp)
 810                 {
 811                         switch (check_ocsp((x509_t*)subject, (x509_t*)issuer,
 812                                                            pathlen ? NULL : auth))
 813                         {
 814                                 case VALIDATION_GOOD:
 815                                         DBG1(DBG_CFG, "certificate status is good");
 816                                         return TRUE;
 817                                 case VALIDATION_REVOKED:
 818                                 case VALIDATION_ON_HOLD:
 819                                         /* has already been logged */
 820                                         lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
 821                                                                                         subject);
 822                                         return FALSE;
 823                                 case VALIDATION_SKIPPED:
 824                                         DBG2(DBG_CFG, "ocsp check skipped, no ocsp found");
 825                                         break;
 826                                 case VALIDATION_STALE:
 827                                         DBG1(DBG_CFG, "ocsp information stale, fallback to crl");
 828                                         break;
 829                                 case VALIDATION_FAILED:
 830                                         DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
 831                                         break;
 832                         }
 833                 }
 834
 835                 if (this->enable_crl)
 836                 {
 837                         switch (check_crl((x509_t*)subject, (x509_t*)issuer,
 838                                                           pathlen ? NULL : auth))
 839                         {
 840                                 case VALIDATION_GOOD:
 841                                         DBG1(DBG_CFG, "certificate status is good");
 842                                         return TRUE;
 843                                 case VALIDATION_REVOKED:
 844                                 case VALIDATION_ON_HOLD:
 845                                         /* has already been logged */
 846                                         lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
 847                                                                                         subject);
 848                                         return FALSE;
 849                                 case VALIDATION_FAILED:
 850                                 case VALIDATION_SKIPPED:
 851                                         DBG1(DBG_CFG, "certificate status is not available");
 852                                         break;
 853                                 case VALIDATION_STALE:
 854                                         DBG1(DBG_CFG, "certificate status is unknown, crl is stale");
 855                                         break;
 856                         }
 857                 }
 858
 859                 lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_VALIDATION_FAILED,
 860                                                                 subject);
 861         }
 862         return TRUE;
 863 }
 864
 865 METHOD(revocation_validator_t, destroy, void,
 866         private_revocation_validator_t *this)
 867 {
 868         free(this);
 869 }
 870
 871 /**
 872  * See header
 873  */
 874 revocation_validator_t *revocation_validator_create()
 875 {
 876         private_revocation_validator_t *this;
 877
 878         INIT(this,
 879                 .public = {
 880                         .validator.validate = _validate,
 881                         .destroy = _destroy,
 882                 },
 883                 .enable_ocsp = lib->settings->get_bool(lib->settings,
 884                                                         "%s.plugins.revocation.enable_ocsp", TRUE, lib->ns),
 885                 .enable_crl  = lib->settings->get_bool(lib->settings,
 886                                                         "%s.plugins.revocation.enable_crl",  TRUE, lib->ns),
 887         );
 888
 889         if (!this->enable_ocsp)
 890         {
 891                 DBG1(DBG_LIB, "all OCSP validation disabled");
 892         }
 893         if (!this->enable_crl)
 894         {
 895                 DBG1(DBG_LIB, "all CRL validation disabled");
 896         }
 897         return &this->public;
 898 }