vici: list-cert sends subject, not-before and not-after attributes for pubkeys

diff --git a/src/libcharon/plugins/vici/README.md b/src/libcharon/plugins/vici/README.md
index 133d9aee411635706c0b13a14c6f7c57ec35350d..405cfbad337c873bf9ca4babd65b0240f83468e9 100644 (file)
--- a/src/libcharon/plugins/vici/README.md
+++ b/src/libcharon/plugins/vici/README.md
@@ -760,6 +760,9 @@ _list-certs_ command.
                flag = <X.509 certificate flag, NONE|CA|AA|OCSP>
                has_privkey = <set if a private key for the certificate is available>
                data = <ASN1 encoded certificate data>
+               subject = <subject string if defined and certificate type is PUBKEY>
+               not-before = <time string if defined and certificate type is PUBKEY>
+               not-after  = <time string if defined and certificate type is PUBKEY>
        }
 
 ### list-authority ###

diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
index 99cd3481f4697ef5c5eafc82fd7e9ebd0b165c97..512c2ba7b343b56b913fd77887452e511ce25f70 100644 (file)
--- a/src/libcharon/plugins/vici/vici_query.c
+++ b/src/libcharon/plugins/vici/vici_query.c
@@ -52,6 +52,7 @@
 #endif
 
 #include <daemon.h>
+#include <asn1/asn1.h>
 #include <credentials/certificates/certificate.h>
 #include <credentials/certificates/x509.h>
 
@@ -866,8 +867,10 @@ static void enum_others(private_vici_query_t *this, u_int id,
        enumerator_t *enumerator;
        certificate_t *cert;
        vici_builder_t *b;
-       chunk_t encoding;
+       chunk_t encoding, t_ch;
        cred_encoding_type_t encoding_type;
+       identification_t *subject;
+       time_t not_before, not_after;
 
        encoding_type = (type == CERT_TRUSTED_PUBKEY) ? PUBKEY_SPKI_ASN1_DER :
                                                                                                        CERT_ASN1_DER;
@@ -886,6 +889,27 @@ static void enum_others(private_vici_query_t *this, u_int id,
                        b->add(b, VICI_KEY_VALUE, "data", encoding);
                        free(encoding.ptr);
 
+                       if (type == CERT_TRUSTED_PUBKEY)
+                       {
+                               subject = cert->get_subject(cert);
+                               if (subject->get_type(subject) != ID_KEY_ID)
+                               {
+                                       b->add_kv(b, "subject", "%Y", cert->get_subject(cert));
+                               }
+                               cert->get_validity(cert, NULL, &not_before, &not_after);
+                               if (not_before != UNDEFINED_TIME)
+                               {
+                                       t_ch = asn1_from_time(&not_before, ASN1_GENERALIZEDTIME);
+                                       b->add(b, VICI_KEY_VALUE, "not-before", chunk_skip(t_ch, 2));
+                                       chunk_free(&t_ch);
+                               }
+                               if (not_after != UNDEFINED_TIME)
+                               {
+                                       t_ch = asn1_from_time(&not_after, ASN1_GENERALIZEDTIME);
+                                       b->add(b, VICI_KEY_VALUE, "not-after", chunk_skip(t_ch, 2));
+                                       chunk_free(&t_ch);
+                               }
+                       }
                        this->dispatcher->raise_event(this->dispatcher, "list-cert", id,
                                                                                  b->finalize(b));
                }

diff --git a/src/libstrongswan/asn1/asn1.h b/src/libstrongswan/asn1/asn1.h
index 7a48292af81c8864734eaea5eca243a0ad7493a7..8ac00561004f097c43365f73a26a74b2abeead44 100644 (file)
--- a/src/libstrongswan/asn1/asn1.h
+++ b/src/libstrongswan/asn1/asn1.h
@@ -26,6 +26,7 @@
 #include <stdarg.h>
 
 #include <library.h>
+#include <asn1/asn1.h>
 
 /**
  * Definition of some primitive ASN1 types

diff --git a/src/swanctl/commands/list_certs.c b/src/swanctl/commands/list_certs.c
index 2c314d8b240ced4f4175e05d3ab60857354d9c3a..e9c964771564742c4603c0bd55a5bf7092a07048 100644 (file)
--- a/src/swanctl/commands/list_certs.c
+++ b/src/swanctl/commands/list_certs.c
@@ -58,6 +58,10 @@ CALLBACK(list_cb, void,
        certificate_t *cert;
        certificate_type_t type;
        x509_flag_t flag = X509_NONE;
+       identification_t *subject = NULL;
+       time_t not_before = UNDEFINED_TIME;
+       time_t not_after  = UNDEFINED_TIME;
+       chunk_t t_ch;
        bool has_privkey;
        char *str;
        void *buf;
@@ -93,11 +97,38 @@ CALLBACK(list_cb, void,
                        return;
                }
        }
-
-       /* Parse certificate data blob */
-       cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
-                                                         BUILD_BLOB_ASN1_DER, chunk_create(buf, len),
-                                                         BUILD_END);
+       if (type == CERT_TRUSTED_PUBKEY)
+       {
+               str = vici_find_str(res, NULL, "subject");
+               if (str)
+               {
+                       subject = identification_create_from_string(str);
+               }
+               str = vici_find_str(res, NULL, "not-before");
+               if (str)
+               {
+                       t_ch = chunk_from_str(str);
+                       not_before = asn1_to_time(&t_ch, ASN1_GENERALIZEDTIME);
+               }
+               str = vici_find_str(res, NULL, "not-after");
+               if (str)
+               {
+                       t_ch = chunk_from_str(str);
+                       not_after = asn1_to_time(&t_ch, ASN1_GENERALIZEDTIME);
+               }
+               cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
+                                                                 BUILD_BLOB_ASN1_DER, chunk_create(buf, len),
+                                                                 BUILD_NOT_BEFORE_TIME, not_before,
+                                                                 BUILD_NOT_AFTER_TIME, not_after,
+                                                                 BUILD_SUBJECT, subject, BUILD_END);
+               DESTROY_IF(subject);
+       }
+       else
+       {
+               cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
+                                                                 BUILD_BLOB_ASN1_DER, chunk_create(buf, len),
+                                                                 BUILD_END);
+       }
        if (cert)
        {
                if (*format & COMMAND_FORMAT_PEM)