vici: Add support to load certificates from file paths

Probably not that useful via swanctl.conf but could be when used via VICI.

diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index 0a8fc29056af1d1b366d9bec2fad5b758699010e..b9f6b79b1d8d64114ff5d6e9ccdad6f33595b773 100644 (file)
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -254,6 +254,7 @@ typedef struct {
        char *handle;
        uint32_t slot;
        char *module;
+       char *file;
 } cert_data_t;
 
 /**
@@ -263,6 +264,7 @@ static void free_cert_data(cert_data_t *data)
 {
        free(data->handle);
        free(data->module);
+       free(data->file);
        free(data);
 }
 
@@ -1402,6 +1404,7 @@ CALLBACK(cert_kv, bool,
                { "handle",                     parse_string,           &cert->handle                           },
                { "slot",                       parse_uint32,           &cert->slot                                     },
                { "module",                     parse_string,           &cert->module                           },
+               { "file",                       parse_string,           &cert->file                                     },
        };
 
        return parse_rules(rules, countof(rules), name, value,
@@ -1556,30 +1559,46 @@ CALLBACK(auth_sn, bool,
                        free_cert_data(data);
                        return FALSE;
                }
-               if  (!data->handle)
+               if  (!data->handle && !data->file)
                {
-                       auth->request->reply = create_reply("CKA_ID missing: %s", name);
+                       auth->request->reply = create_reply("handle or file path missing: "
+                                                                                               "%s", name);
+                       free_cert_data(data);
+                       return FALSE;
+               }
+               else if (data->handle && data->file)
+               {
+                       auth->request->reply = create_reply("handle and file path given: "
+                                                                                               "%s", name);
                        free_cert_data(data);
                        return FALSE;
                }
 
-               handle = chunk_from_hex(chunk_from_str(data->handle), NULL);
-               if (data->slot != -1)
+               if (data->file)
                {
                        cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
-                                                       BUILD_PKCS11_KEYID, handle,
-                                                       BUILD_PKCS11_SLOT, data->slot,
-                                                       data->module ? BUILD_PKCS11_MODULE : BUILD_END,
-                                                       data->module, BUILD_END);
+                                                               BUILD_FROM_FILE, data->file, BUILD_END);
                }
                else
                {
-                       cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
-                                                       BUILD_PKCS11_KEYID, handle,
-                                                       data->module ? BUILD_PKCS11_MODULE : BUILD_END,
-                                                       data->module, BUILD_END);
+                       handle = chunk_from_hex(chunk_from_str(data->handle), NULL);
+                       if (data->slot != -1)
+                       {
+                               cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
+                                                               CERT_X509, BUILD_PKCS11_KEYID, handle,
+                                                               BUILD_PKCS11_SLOT, data->slot,
+                                                               data->module ? BUILD_PKCS11_MODULE : BUILD_END,
+                                                               data->module, BUILD_END);
+                       }
+                       else
+                       {
+                               cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
+                                                               CERT_X509, BUILD_PKCS11_KEYID, handle,
+                                                               data->module ? BUILD_PKCS11_MODULE : BUILD_END,
+                                                               data->module, BUILD_END);
+                       }
+                       chunk_free(&handle);
                }
-               chunk_free(&handle);
                free_cert_data(data);
                if (!cert)
                {

diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index 0bf1243d0ccac82003290e36aee83c97ac73da8c..f749564ea4d64c3073923cccb66073bd726e48be 100644 (file)
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -299,9 +299,21 @@ connections.<conn>.local<suffix>.cert<suffix> =
        in _certs_ are transmitted as binary blobs, these sections offer more
        flexibility.
 
+connections.<conn>.local<suffix>.cert<suffix>.file =
+       Absolute path to the certificate to load.
+
+       Absolute path to the certificate to load. Passed as-is to the daemon, so it
+       must be readable by it.
+
+       Configure either this or _handle_, but not both, in one section.
+
 connections.<conn>.local<suffix>.cert<suffix>.handle =
        Hex-encoded CKA_ID of the certificate on a token.
 
+       Hex-encoded CKA_ID of the certificate on a token.
+
+       Configure either this or _file_, but not both, in one section.
+
 connections.<conn>.local<suffix>.cert<suffix>.slot =
        Optional slot number of the token that stores the certificate.
 
@@ -442,9 +454,21 @@ connections.<conn>.remote<suffix>.cert<suffix> =
        in _certs_ are transmitted as binary blobs, these sections offer more
        flexibility.
 
+connections.<conn>.remote<suffix>.cert<suffix>.file =
+       Absolute path to the certificate to load.
+
+       Absolute path to the certificate to load. Passed as-is to the daemon, so it
+       must be readable by it.
+
+       Configure either this or _handle_, but not both, in one section.
+
 connections.<conn>.remote<suffix>.cert<suffix>.handle =
        Hex-encoded CKA_ID of the certificate on a token.
 
+       Hex-encoded CKA_ID of the certificate on a token.
+
+       Configure either this or _file_, but not both, in one section.
+
 connections.<conn>.remote<suffix>.cert<suffix>.slot =
        Optional slot number of the token that stores the certificate.
 
@@ -465,9 +489,21 @@ connections.<conn>.remote<suffix>.cacert<suffix> =
        in _cacerts_ are transmitted as binary blobs, these sections offer more
        flexibility.
 
+connections.<conn>.remote<suffix>.cacert<suffix>.file =
+       Absolute path to the certificate to load.
+
+       Absolute path to the certificate to load. Passed as-is to the daemon, so it
+       must be readable by it.
+
+       Configure either this or _handle_, but not both, in one section.
+
 connections.<conn>.remote<suffix>.cacert<suffix>.handle =
        Hex-encoded CKA_ID of the CA certificate on a token.
 
+       Hex-encoded CKA_ID of the CA certificate on a token.
+
+       Configure either this or _file_, but not both, in one section.
+
 connections.<conn>.remote<suffix>.cacert<suffix>.slot =
        Optional slot number of the token that stores the CA certificate.