src/libstrongswan/plugins/revocation/revocation_validator.c

   1 /*
   2  * Copyright (C) 2010 Martin Willi
   3  * Copyright (C) 2010 revosec AG
   4  * Copyright (C) 2009 Andreas Steffen
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  */
  17
  18 #include "revocation_validator.h"
  19
  20 #include <utils/debug.h>
  21 #include <credentials/certificates/x509.h>
  22 #include <credentials/certificates/crl.h>
  23 #include <credentials/certificates/ocsp_request.h>
  24 #include <credentials/certificates/ocsp_response.h>
  25 #include <credentials/sets/ocsp_response_wrapper.h>
  26 #include <selectors/traffic_selector.h>
  27
  28 typedef struct private_revocation_validator_t private_revocation_validator_t;
  29
  30 /**
  31  * Private data of an revocation_validator_t object.
  32  */
  33 struct private_revocation_validator_t {
  34
  35         /**
  36          * Public revocation_validator_t interface.
  37          */
  38         revocation_validator_t public;
  39
  40         /**
  41          * Enable OCSP validation
  42          */
  43         bool enable_ocsp;
  44
  45         /**
  46          * Enable CRL validation
  47          */
  48         bool enable_crl;
  49
  50 };
  51
  52 /**
  53  * Do an OCSP request
  54  */
  55 static certificate_t *fetch_ocsp(char *url, certificate_t *subject,
  56                                                                  certificate_t *issuer)
  57 {
  58         certificate_t *request, *response;
  59         chunk_t send, receive;
  60
  61         /* TODO: requestor name, signature */
  62         request = lib->creds->create(lib->creds,
  63                                                 CRED_CERTIFICATE, CERT_X509_OCSP_REQUEST,
  64                                                 BUILD_CA_CERT, issuer,
  65                                                 BUILD_CERT, subject, BUILD_END);
  66         if (!request)
  67         {
  68                 DBG1(DBG_CFG, "generating ocsp request failed");
  69                 return NULL;
  70         }
  71
  72         if (!request->get_encoding(request, CERT_ASN1_DER, &send))
  73         {
  74                 DBG1(DBG_CFG, "encoding ocsp request failed");
  75                 request->destroy(request);
  76                 return NULL;
  77         }
  78         request->destroy(request);
  79
  80         DBG1(DBG_CFG, "  requesting ocsp status from '%s' ...", url);
  81         if (lib->fetcher->fetch(lib->fetcher, url, &receive,
  82                                                         FETCH_REQUEST_DATA, send,
  83                                                         FETCH_REQUEST_TYPE, "application/ocsp-request",
  84                                                         FETCH_END) != SUCCESS)
  85         {
  86                 DBG1(DBG_CFG, "ocsp request to %s failed", url);
  87                 chunk_free(&send);
  88                 return NULL;
  89         }
  90         chunk_free(&send);
  91
  92         response = lib->creds->create(lib->creds,
  93                                                                   CRED_CERTIFICATE, CERT_X509_OCSP_RESPONSE,
  94                                                                   BUILD_BLOB_ASN1_DER, receive, BUILD_END);
  95         chunk_free(&receive);
  96         if (!response)
  97         {
  98                 DBG1(DBG_CFG, "parsing ocsp response failed");
  99                 return NULL;
 100         }
 101         return response;
 102 }
 103
 104 /**
 105  * check the signature of an OCSP response
 106  */
 107 static bool verify_ocsp(ocsp_response_t *response, certificate_t *ca)
 108 {
 109         certificate_t *issuer, *subject;
 110         identification_t *responder;
 111         ocsp_response_wrapper_t *wrapper;
 112         enumerator_t *enumerator;
 113         x509_t *x509;
 114         bool verified = FALSE, found = FALSE;
 115
 116         wrapper = ocsp_response_wrapper_create((ocsp_response_t*)response);
 117         lib->credmgr->add_local_set(lib->credmgr, &wrapper->set, FALSE);
 118
 119         subject = &response->certificate;
 120         responder = subject->get_issuer(subject);
 121
 122         /* check OCSP response using CA or directly delegated OCSP signer */
 123         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr, CERT_X509,
 124                                                                                                         KEY_ANY, responder, FALSE);
 125         while (enumerator->enumerate(enumerator, &issuer))
 126         {
 127                 x509 = (x509_t*)issuer;
 128                 if (!issuer->get_validity(issuer, NULL, NULL, NULL))
 129                 {       /* OCSP signer currently invalid */
 130                         continue;
 131                 }
 132                 if (!ca->equals(ca, issuer))
 133                 {       /* delegated OCSP signer? */
 134                         if (!lib->credmgr->issued_by(lib->credmgr, issuer, ca, NULL))
 135                         {       /* OCSP response not signed by CA, nor delegated OCSP signer */
 136                                 continue;
 137                         }
 138                         if (!(x509->get_flags(x509) & X509_OCSP_SIGNER))
 139                         {       /* delegated OCSP signer does not have OCSP signer flag */
 140                                 continue;
 141                         }
 142                 }
 143                 found = TRUE;
 144                 if (lib->credmgr->issued_by(lib->credmgr, subject, issuer, NULL))
 145                 {
 146                         DBG1(DBG_CFG, "  ocsp response correctly signed by \"%Y\"",
 147                                  issuer->get_subject(issuer));
 148                         verified = TRUE;
 149                         break;
 150                 }
 151                 DBG1(DBG_CFG, "ocsp response verification failed, "
 152                          "invalid signature");
 153         }
 154         enumerator->destroy(enumerator);
 155
 156         if (!verified)
 157         {
 158                 /* as fallback, use any locally installed OCSP signer certificate */
 159                 enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 160                                                                                 CERT_X509, KEY_ANY, responder, TRUE);
 161                 while (enumerator->enumerate(enumerator, &issuer))
 162                 {
 163                         x509 = (x509_t*)issuer;
 164                         /* while issued_by() accepts both OCSP signer or CA basic
 165                          * constraint flags to verify OCSP responses, unrelated but trusted
 166                          * OCSP signers must explicitly have the OCSP signer flag set. */
 167                         if ((x509->get_flags(x509) & X509_OCSP_SIGNER) &&
 168                                 issuer->get_validity(issuer, NULL, NULL, NULL))
 169                         {
 170                                 found = TRUE;
 171                                 if (lib->credmgr->issued_by(lib->credmgr, subject, issuer, NULL))
 172                                 {
 173                                         DBG1(DBG_CFG, "  ocsp response correctly signed by \"%Y\"",
 174                                                  issuer->get_subject(issuer));
 175                                         verified = TRUE;
 176                                         break;
 177                                 }
 178                                 DBG1(DBG_CFG, "ocsp response verification failed, "
 179                                          "invalid signature");
 180                         }
 181                 }
 182                 enumerator->destroy(enumerator);
 183         }
 184
 185         lib->credmgr->remove_local_set(lib->credmgr, &wrapper->set);
 186         wrapper->destroy(wrapper);
 187
 188         if (!found)
 189         {
 190                 DBG1(DBG_CFG, "ocsp response verification failed, "
 191                          "no signer certificate '%Y' found", responder);
 192         }
 193         return verified;
 194 }
 195
 196 /**
 197  * Get the better of two OCSP responses, and check for usable OCSP info
 198  */
 199 static certificate_t *get_better_ocsp(certificate_t *cand, certificate_t *best,
 200                                                                           x509_t *subject, x509_t *issuer,
 201                                                                           cert_validation_t *valid, bool cache)
 202 {
 203         ocsp_response_t *response;
 204         time_t revocation, this_update, next_update, valid_until;
 205         crl_reason_t reason;
 206         bool revoked = FALSE;
 207
 208         response = (ocsp_response_t*)cand;
 209
 210         /* check ocsp signature */
 211         if (!verify_ocsp(response, &issuer->interface))
 212         {
 213                 cand->destroy(cand);
 214                 return best;
 215         }
 216         /* check if response contains our certificate */
 217         switch (response->get_status(response, subject, issuer, &revocation, &reason,
 218                                                                  &this_update, &next_update))
 219         {
 220                 case VALIDATION_REVOKED:
 221                         /* subject has been revoked by a valid OCSP response */
 222                         DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N",
 223                                                   &revocation, TRUE, crl_reason_names, reason);
 224                         revoked = TRUE;
 225                         break;
 226                 case VALIDATION_GOOD:
 227                         /* results in either good or stale */
 228                         break;
 229                 default:
 230                 case VALIDATION_FAILED:
 231                         /* candidate unusable, does not contain our cert */
 232                         DBG1(DBG_CFG, "  ocsp response contains no status on our certificate");
 233                         cand->destroy(cand);
 234                         return best;
 235         }
 236
 237         /* select the better of the two responses */
 238         if (best == NULL || certificate_is_newer(cand, best))
 239         {
 240                 DESTROY_IF(best);
 241                 best = cand;
 242                 if (best->get_validity(best, NULL, NULL, &valid_until))
 243                 {
 244                         DBG1(DBG_CFG, "  ocsp response is valid: until %T",
 245                                                          &valid_until, FALSE);
 246                         *valid = VALIDATION_GOOD;
 247                         if (cache)
 248                         {       /* cache non-stale only, stale certs get refetched */
 249                                 lib->credmgr->cache_cert(lib->credmgr, best);
 250                         }
 251                 }
 252                 else
 253                 {
 254                         DBG1(DBG_CFG, "  ocsp response is stale: since %T",
 255                                                          &valid_until, FALSE);
 256                         *valid = VALIDATION_STALE;
 257                 }
 258         }
 259         else
 260         {
 261                 *valid = VALIDATION_STALE;
 262                 cand->destroy(cand);
 263         }
 264         if (revoked)
 265         {       /* revoked always counts, even if stale */
 266                 *valid = VALIDATION_REVOKED;
 267         }
 268         return best;
 269 }
 270
 271 /**
 272  * validate a x509 certificate using OCSP
 273  */
 274 static cert_validation_t check_ocsp(x509_t *subject, x509_t *issuer,
 275                                                                         auth_cfg_t *auth)
 276 {
 277         enumerator_t *enumerator;
 278         cert_validation_t valid = VALIDATION_SKIPPED;
 279         certificate_t *best = NULL, *current;
 280         identification_t *keyid = NULL;
 281         public_key_t *public;
 282         chunk_t chunk;
 283         char *uri = NULL;
 284
 285         /** lookup cache for valid OCSP responses */
 286         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 287                                                                 CERT_X509_OCSP_RESPONSE, KEY_ANY, NULL, FALSE);
 288         while (enumerator->enumerate(enumerator, &current))
 289         {
 290                 current->get_ref(current);
 291                 best = get_better_ocsp(current, best, subject, issuer, &valid, FALSE);
 292                 if (best && valid != VALIDATION_STALE)
 293                 {
 294                         DBG1(DBG_CFG, "  using cached ocsp response");
 295                         break;
 296                 }
 297         }
 298         enumerator->destroy(enumerator);
 299
 300         /* derive the authorityKeyIdentifier from the issuer's public key */
 301         current = &issuer->interface;
 302         public = current->get_public_key(current);
 303         if (public && public->get_fingerprint(public, KEYID_PUBKEY_SHA1, &chunk))
 304         {
 305                 keyid = identification_create_from_encoding(ID_KEY_ID, chunk);
 306         }
 307         /** fetch from configured OCSP responder URLs */
 308         if (keyid && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
 309         {
 310                 enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr,
 311                                                                                         CERT_X509_OCSP_RESPONSE, keyid);
 312                 while (enumerator->enumerate(enumerator, &uri))
 313                 {
 314                         current = fetch_ocsp(uri, &subject->interface, &issuer->interface);
 315                         if (current)
 316                         {
 317                                 best = get_better_ocsp(current, best, subject, issuer,
 318                                                                            &valid, TRUE);
 319                                 if (best && valid != VALIDATION_STALE)
 320                                 {
 321                                         break;
 322                                 }
 323                         }
 324                 }
 325                 enumerator->destroy(enumerator);
 326         }
 327         DESTROY_IF(public);
 328         DESTROY_IF(keyid);
 329
 330         /* fallback to URL fetching from subject certificate's URIs */
 331         if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
 332         {
 333                 enumerator = subject->create_ocsp_uri_enumerator(subject);
 334                 while (enumerator->enumerate(enumerator, &uri))
 335                 {
 336                         current = fetch_ocsp(uri, &subject->interface, &issuer->interface);
 337                         if (current)
 338                         {
 339                                 best = get_better_ocsp(current, best, subject, issuer,
 340                                                                            &valid, TRUE);
 341                                 if (best && valid != VALIDATION_STALE)
 342                                 {
 343                                         break;
 344                                 }
 345                         }
 346                 }
 347                 enumerator->destroy(enumerator);
 348         }
 349         /* an uri was found, but no result. switch validation state to failed */
 350         if (valid == VALIDATION_SKIPPED && uri)
 351         {
 352                 valid = VALIDATION_FAILED;
 353         }
 354         if (auth)
 355         {
 356                 auth->add(auth, AUTH_RULE_OCSP_VALIDATION, valid);
 357                 if (valid == VALIDATION_GOOD)
 358                 {       /* successful OCSP check fulfills also CRL constraint */
 359                         auth->add(auth, AUTH_RULE_CRL_VALIDATION, VALIDATION_GOOD);
 360                 }
 361         }
 362         DESTROY_IF(best);
 363         return valid;
 364 }
 365
 366 /**
 367  * fetch a CRL from an URL
 368  */
 369 static certificate_t* fetch_crl(char *url)
 370 {
 371         certificate_t *crl;
 372         chunk_t chunk;
 373
 374         DBG1(DBG_CFG, "  fetching crl from '%s' ...", url);
 375         if (lib->fetcher->fetch(lib->fetcher, url, &chunk, FETCH_END) != SUCCESS)
 376         {
 377                 DBG1(DBG_CFG, "crl fetching failed");
 378                 return NULL;
 379         }
 380         crl = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509_CRL,
 381                                                          BUILD_BLOB_PEM, chunk, BUILD_END);
 382         chunk_free(&chunk);
 383         if (!crl)
 384         {
 385                 DBG1(DBG_CFG, "crl fetched successfully but parsing failed");
 386                 return NULL;
 387         }
 388         return crl;
 389 }
 390
 391 /**
 392  * check the signature of an CRL
 393  */
 394 static bool verify_crl(certificate_t *crl)
 395 {
 396         certificate_t *issuer;
 397         enumerator_t *enumerator;
 398         bool verified = FALSE;
 399
 400         enumerator = lib->credmgr->create_trusted_enumerator(lib->credmgr,
 401                                                                                 KEY_ANY, crl->get_issuer(crl), FALSE);
 402         while (enumerator->enumerate(enumerator, &issuer, NULL))
 403         {
 404                 if (lib->credmgr->issued_by(lib->credmgr, crl, issuer, NULL))
 405                 {
 406                         DBG1(DBG_CFG, "  crl correctly signed by \"%Y\"",
 407                                                    issuer->get_subject(issuer));
 408                         verified = TRUE;
 409                         break;
 410                 }
 411         }
 412         enumerator->destroy(enumerator);
 413
 414         return verified;
 415 }
 416
 417 /**
 418  * Report the given CRL's validity and cache it if valid and requested
 419  */
 420 static bool is_crl_valid(certificate_t *crl, bool cache)
 421 {
 422         time_t valid_until;
 423
 424         if (crl->get_validity(crl, NULL, NULL, &valid_until))
 425         {
 426                 DBG1(DBG_CFG, "  crl is valid: until %T", &valid_until, FALSE);
 427                 if (cache)
 428                 {
 429                         lib->credmgr->cache_cert(lib->credmgr, crl);
 430                 }
 431                 return TRUE;
 432         }
 433         DBG1(DBG_CFG, "  crl is stale: since %T", &valid_until, FALSE);
 434         return FALSE;
 435 }
 436
 437 /**
 438  * Get the better of two CRLs, and check for usable CRL info
 439  */
 440 static certificate_t *get_better_crl(certificate_t *cand, certificate_t *best,
 441                                         x509_t *subject, cert_validation_t *valid,
 442                                         bool cache, crl_t *base)
 443 {
 444         enumerator_t *enumerator;
 445         time_t revocation;
 446         crl_reason_t reason;
 447         chunk_t subject_serial, serial;
 448         crl_t *crl = (crl_t*)cand;
 449
 450         if (base)
 451         {
 452                 if (!crl->is_delta_crl(crl, &serial) ||
 453                         !chunk_equals(serial, base->get_serial(base)))
 454                 {
 455                         cand->destroy(cand);
 456                         return best;
 457                 }
 458         }
 459         else
 460         {
 461                 if (crl->is_delta_crl(crl, NULL))
 462                 {
 463                         cand->destroy(cand);
 464                         return best;
 465                 }
 466         }
 467
 468         /* check CRL signature */
 469         if (!verify_crl(cand))
 470         {
 471                 DBG1(DBG_CFG, "crl response verification failed");
 472                 cand->destroy(cand);
 473                 return best;
 474         }
 475
 476         subject_serial = chunk_skip_zero(subject->get_serial(subject));
 477         enumerator = crl->create_enumerator(crl);
 478         while (enumerator->enumerate(enumerator, &serial, &revocation, &reason))
 479         {
 480                 if (chunk_equals(subject_serial, chunk_skip_zero(serial)))
 481                 {
 482                         if (reason != CRL_REASON_CERTIFICATE_HOLD)
 483                         {
 484                                 *valid = VALIDATION_REVOKED;
 485                         }
 486                         else
 487                         {
 488                                 /* if the cert is on hold, a newer CRL might not contain it */
 489                                 *valid = VALIDATION_ON_HOLD;
 490                         }
 491                         is_crl_valid(cand, cache);
 492                         DBG1(DBG_CFG, "certificate was revoked on %T, reason: %N",
 493                                  &revocation, TRUE, crl_reason_names, reason);
 494                         enumerator->destroy(enumerator);
 495                         DESTROY_IF(best);
 496                         return cand;
 497                 }
 498         }
 499         enumerator->destroy(enumerator);
 500
 501         /* select the better of the two CRLs */
 502         if (best == NULL || crl_is_newer(crl, (crl_t*)best))
 503         {
 504                 DESTROY_IF(best);
 505                 best = cand;
 506                 if (is_crl_valid(best, cache))
 507                 {
 508                         *valid = VALIDATION_GOOD;
 509                 }
 510                 else
 511                 {
 512                         *valid = VALIDATION_STALE;
 513                 }
 514         }
 515         else
 516         {
 517                 *valid = VALIDATION_STALE;
 518                 cand->destroy(cand);
 519         }
 520         return best;
 521 }
 522
 523 /**
 524  * Find or fetch a certificate for a given crlIssuer
 525  */
 526 static cert_validation_t find_crl(x509_t *subject, identification_t *issuer,
 527                                                                   crl_t *base, certificate_t **best,
 528                                                                   bool *uri_found)
 529 {
 530         cert_validation_t valid = VALIDATION_SKIPPED;
 531         enumerator_t *enumerator;
 532         certificate_t *current;
 533         char *uri;
 534
 535         /* find a cached (delta) crl */
 536         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 537                                                                                 CERT_X509_CRL, KEY_ANY, issuer, FALSE);
 538         while (enumerator->enumerate(enumerator, &current))
 539         {
 540                 current->get_ref(current);
 541                 *best = get_better_crl(current, *best, subject, &valid, FALSE, base);
 542                 if (*best && valid != VALIDATION_STALE)
 543                 {
 544                         DBG1(DBG_CFG, "  using cached crl");
 545                         break;
 546                 }
 547         }
 548         enumerator->destroy(enumerator);
 549
 550         /* fallback to fetching crls from credential sets cdps */
 551         if (!base && valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
 552         {
 553                 enumerator = lib->credmgr->create_cdp_enumerator(lib->credmgr,
 554                                                                                                                  CERT_X509_CRL, issuer);
 555                 while (enumerator->enumerate(enumerator, &uri))
 556                 {
 557                         *uri_found = TRUE;
 558                         current = fetch_crl(uri);
 559                         if (current)
 560                         {
 561                                 if (!current->has_issuer(current, issuer))
 562                                 {
 563                                         DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match CRL "
 564                                                  "issuer '%Y'", current->get_issuer(current), issuer);
 565                                         current->destroy(current);
 566                                         continue;
 567                                 }
 568                                 *best = get_better_crl(current, *best, subject,
 569                                                                            &valid, TRUE, base);
 570                                 if (*best && valid != VALIDATION_STALE)
 571                                 {
 572                                         break;
 573                                 }
 574                         }
 575                 }
 576                 enumerator->destroy(enumerator);
 577         }
 578         return valid;
 579 }
 580
 581 /**
 582  * Look for a delta CRL for a given base CRL
 583  */
 584 static cert_validation_t check_delta_crl(x509_t *subject, x509_t *issuer,
 585                                                                         crl_t *base, cert_validation_t base_valid)
 586 {
 587         cert_validation_t valid = VALIDATION_SKIPPED;
 588         certificate_t *best = NULL, *current;
 589         enumerator_t *enumerator;
 590         identification_t *id;
 591         x509_cdp_t *cdp;
 592         chunk_t chunk;
 593         bool uri;
 594
 595         /* find cached delta CRL via subjectKeyIdentifier */
 596         chunk = issuer->get_subjectKeyIdentifier(issuer);
 597         if (chunk.len)
 598         {
 599                 id = identification_create_from_encoding(ID_KEY_ID, chunk);
 600                 valid = find_crl(subject, id, base, &best, &uri);
 601                 id->destroy(id);
 602         }
 603
 604         /* find delta CRL by CRLIssuer */
 605         enumerator = subject->create_crl_uri_enumerator(subject);
 606         while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
 607                    enumerator->enumerate(enumerator, &cdp))
 608         {
 609                 if (cdp->issuer)
 610                 {
 611                         valid = find_crl(subject, cdp->issuer, base, &best, &uri);
 612                 }
 613         }
 614         enumerator->destroy(enumerator);
 615
 616         /* fetch from URIs found in Freshest CRL extension */
 617         enumerator = base->create_delta_crl_uri_enumerator(base);
 618         while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
 619                    enumerator->enumerate(enumerator, &cdp))
 620         {
 621                 current = fetch_crl(cdp->uri);
 622                 if (current)
 623                 {
 624                         if (cdp->issuer && !current->has_issuer(current, cdp->issuer))
 625                         {
 626                                 DBG1(DBG_CFG, "issuer of fetched delta CRL '%Y' does not match "
 627                                          "certificates CRL issuer '%Y'",
 628                                          current->get_issuer(current), cdp->issuer);
 629                                 current->destroy(current);
 630                                 continue;
 631                         }
 632                         best = get_better_crl(current, best, subject, &valid, TRUE, base);
 633                         if (best && valid != VALIDATION_STALE)
 634                         {
 635                                 break;
 636                         }
 637                 }
 638         }
 639         enumerator->destroy(enumerator);
 640
 641         if (best)
 642         {
 643                 best->destroy(best);
 644                 return valid;
 645         }
 646         return base_valid;
 647 }
 648
 649 /**
 650  * validate a x509 certificate using CRL
 651  */
 652 static cert_validation_t check_crl(x509_t *subject, x509_t *issuer,
 653                                                                    auth_cfg_t *auth)
 654 {
 655         cert_validation_t valid = VALIDATION_SKIPPED;
 656         certificate_t *best = NULL;
 657         identification_t *id;
 658         x509_cdp_t *cdp;
 659         bool uri_found = FALSE;
 660         certificate_t *current;
 661         enumerator_t *enumerator;
 662         chunk_t chunk;
 663
 664         /* use issuers subjectKeyIdentifier to find a cached CRL / fetch from CDP */
 665         chunk = issuer->get_subjectKeyIdentifier(issuer);
 666         if (chunk.len)
 667         {
 668                 id = identification_create_from_encoding(ID_KEY_ID, chunk);
 669                 valid = find_crl(subject, id, NULL, &best, &uri_found);
 670                 id->destroy(id);
 671         }
 672
 673         /* find a cached CRL or fetch via configured CDP via CRLIssuer */
 674         enumerator = subject->create_crl_uri_enumerator(subject);
 675         while (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED &&
 676                    enumerator->enumerate(enumerator, &cdp))
 677         {
 678                 if (cdp->issuer)
 679                 {
 680                         valid = find_crl(subject, cdp->issuer, NULL, &best, &uri_found);
 681                 }
 682         }
 683         enumerator->destroy(enumerator);
 684
 685         /* fallback to fetching CRLs from CDPs found in subjects certificate */
 686         if (valid != VALIDATION_GOOD && valid != VALIDATION_REVOKED)
 687         {
 688                 enumerator = subject->create_crl_uri_enumerator(subject);
 689                 while (enumerator->enumerate(enumerator, &cdp))
 690                 {
 691                         uri_found = TRUE;
 692                         current = fetch_crl(cdp->uri);
 693                         if (current)
 694                         {
 695                                 if (cdp->issuer && !current->has_issuer(current, cdp->issuer))
 696                                 {
 697                                         DBG1(DBG_CFG, "issuer of fetched CRL '%Y' does not match "
 698                                                  "certificates CRL issuer '%Y'",
 699                                                  current->get_issuer(current), cdp->issuer);
 700                                         current->destroy(current);
 701                                         continue;
 702                                 }
 703                                 best = get_better_crl(current, best, subject, &valid,
 704                                                                           TRUE, NULL);
 705                                 if (best && valid != VALIDATION_STALE)
 706                                 {
 707                                         break;
 708                                 }
 709                         }
 710                 }
 711                 enumerator->destroy(enumerator);
 712         }
 713
 714         /* look for delta CRLs */
 715         if (best && (valid == VALIDATION_GOOD || valid == VALIDATION_STALE))
 716         {
 717                 valid = check_delta_crl(subject, issuer, (crl_t*)best, valid);
 718         }
 719
 720         /* an uri was found, but no result. switch validation state to failed */
 721         if (valid == VALIDATION_SKIPPED && uri_found)
 722         {
 723                 valid = VALIDATION_FAILED;
 724         }
 725         if (auth)
 726         {
 727                 if (valid == VALIDATION_SKIPPED)
 728                 {       /* if we skipped CRL validation, we use the result of OCSP for
 729                          * constraint checking */
 730                         auth->add(auth, AUTH_RULE_CRL_VALIDATION,
 731                                           auth->get(auth, AUTH_RULE_OCSP_VALIDATION));
 732                 }
 733                 else
 734                 {
 735                         auth->add(auth, AUTH_RULE_CRL_VALIDATION, valid);
 736                 }
 737         }
 738         DESTROY_IF(best);
 739         return valid;
 740 }
 741
 742 METHOD(cert_validator_t, validate, bool,
 743         private_revocation_validator_t *this, certificate_t *subject,
 744         certificate_t *issuer, bool online, u_int pathlen, bool anchor,
 745         auth_cfg_t *auth)
 746 {
 747         if (online && (this->enable_ocsp || this->enable_crl) &&
 748                 subject->get_type(subject) == CERT_X509 &&
 749                 issuer->get_type(issuer) == CERT_X509)
 750         {
 751                 DBG1(DBG_CFG, "checking certificate status of \"%Y\"",
 752                                            subject->get_subject(subject));
 753
 754                 if (this->enable_ocsp)
 755                 {
 756                         switch (check_ocsp((x509_t*)subject, (x509_t*)issuer,
 757                                                            pathlen ? NULL : auth))
 758                         {
 759                                 case VALIDATION_GOOD:
 760                                         DBG1(DBG_CFG, "certificate status is good");
 761                                         return TRUE;
 762                                 case VALIDATION_REVOKED:
 763                                 case VALIDATION_ON_HOLD:
 764                                         /* has already been logged */
 765                                         lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
 766                                                                                         subject);
 767                                         return FALSE;
 768                                 case VALIDATION_SKIPPED:
 769                                         DBG2(DBG_CFG, "ocsp check skipped, no ocsp found");
 770                                         break;
 771                                 case VALIDATION_STALE:
 772                                         DBG1(DBG_CFG, "ocsp information stale, fallback to crl");
 773                                         break;
 774                                 case VALIDATION_FAILED:
 775                                         DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
 776                                         break;
 777                         }
 778                 }
 779
 780                 if (this->enable_crl)
 781                 {
 782                         switch (check_crl((x509_t*)subject, (x509_t*)issuer,
 783                                                           pathlen ? NULL : auth))
 784                         {
 785                                 case VALIDATION_GOOD:
 786                                         DBG1(DBG_CFG, "certificate status is good");
 787                                         return TRUE;
 788                                 case VALIDATION_REVOKED:
 789                                 case VALIDATION_ON_HOLD:
 790                                         /* has already been logged */
 791                                         lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
 792                                                                                         subject);
 793                                         return FALSE;
 794                                 case VALIDATION_FAILED:
 795                                 case VALIDATION_SKIPPED:
 796                                         DBG1(DBG_CFG, "certificate status is not available");
 797                                         break;
 798                                 case VALIDATION_STALE:
 799                                         DBG1(DBG_CFG, "certificate status is unknown, crl is stale");
 800                                         break;
 801                         }
 802                 }
 803
 804                 lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_VALIDATION_FAILED,
 805                                                                 subject);
 806         }
 807         return TRUE;
 808 }
 809
 810 METHOD(revocation_validator_t, destroy, void,
 811         private_revocation_validator_t *this)
 812 {
 813         free(this);
 814 }
 815
 816 /**
 817  * See header
 818  */
 819 revocation_validator_t *revocation_validator_create()
 820 {
 821         private_revocation_validator_t *this;
 822
 823         INIT(this,
 824                 .public = {
 825                         .validator.validate = _validate,
 826                         .destroy = _destroy,
 827                 },
 828                 .enable_ocsp = lib->settings->get_bool(lib->settings,
 829                                                         "%s.plugins.revocation.enable_ocsp", TRUE, lib->ns),
 830                 .enable_crl  = lib->settings->get_bool(lib->settings,
 831                                                         "%s.plugins.revocation.enable_crl",  TRUE, lib->ns),
 832         );
 833
 834         if (!this->enable_ocsp)
 835         {
 836                 DBG1(DBG_LIB, "all OCSP validation disabled");
 837         }
 838         if (!this->enable_crl)
 839         {
 840                 DBG1(DBG_LIB, "all CRL validation disabled");
 841         }
 842         return &this->public;
 843 }