aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndreas Steffen <andreas.steffen@strongswan.org>2016-09-15 11:39:16 +0200
committerAndreas Steffen <andreas.steffen@strongswan.org>2016-09-15 11:39:16 +0200
commit29a48b4c69992a0f1f6014069fd93fba53bfc0c0 (patch)
tree293197bdf8582e733fdc9c81d705e11d6fefdb4e
parent8efcc78f2b1c5a231fda6a2bfe401c0afafc4697 (diff)
parent2c7cfe76303bce498ce302da31bc1e028a6af53a (diff)
downloadstrongswan-29a48b4c69992a0f1f6014069fd93fba53bfc0c0.tar.bz2
strongswan-29a48b4c69992a0f1f6014069fd93fba53bfc0c0.tar.xz
Merge branch 'flush-certs'
-rw-r--r--src/libcharon/plugins/vici/README.md13
-rw-r--r--src/libcharon/plugins/vici/perl/Vici-Session/README.pod15
-rw-r--r--src/libcharon/plugins/vici/perl/Vici-Session/lib/Vici/Session.pm4
-rw-r--r--src/libcharon/plugins/vici/python/vici/session.py11
-rw-r--r--src/libcharon/plugins/vici/ruby/lib/vici.rb6
-rw-r--r--src/libcharon/plugins/vici/vici_cred.c19
-rw-r--r--src/swanctl/Makefile.am1
-rw-r--r--src/swanctl/command.h2
-rw-r--r--src/swanctl/commands/flush_certs.c90
9 files changed, 160 insertions, 1 deletions
diff --git a/src/libcharon/plugins/vici/README.md b/src/libcharon/plugins/vici/README.md
index cf5a85a8d..18a3ef7b5 100644
--- a/src/libcharon/plugins/vici/README.md
+++ b/src/libcharon/plugins/vici/README.md
@@ -481,6 +481,19 @@ Load a shared IKE PSK, EAP or XAuth secret into the daemon.
errmsg = <error string on failure>
}
+### flush-certs() ###
+
+Flushes the certificate cache. The optional type argument allows to flush
+only certificates of a given type, e.g. all cached CRLs.
+
+ {
+ type = <certificate type to filter for, X509|X509_AC|X509_CRL|
+ OCSP_RESPONSE|PUBKEY or ANY>
+ } => {
+ success = <yes or no>
+ errmsg = <error string on failure>
+ }
+
### clear-creds() ###
Clear all loaded certificate, private key and shared key credentials. This
diff --git a/src/libcharon/plugins/vici/perl/Vici-Session/README.pod b/src/libcharon/plugins/vici/perl/Vici-Session/README.pod
index de374aa11..d19739709 100644
--- a/src/libcharon/plugins/vici/perl/Vici-Session/README.pod
+++ b/src/libcharon/plugins/vici/perl/Vici-Session/README.pod
@@ -560,6 +560,21 @@ print "----- unload-authority -----\n";
($res, $errmsg) = $session->unload_authority(Vici::Message->new(\%vars));
print $res ? "ok\n" : "failed: $errmsg\n";
+=item flush_certs()
+
+flushes the volatile certificate cache. Optionally only a given certificate
+type is flushed.
+
+ my %vars = ( type => 'x509_crl' );
+ my ($res, $errmsg) = $session->flush_certs(Vici::Message->new(\%vars));
+
+=cut
+
+print "----- flush-certs -----\n";
+%vars = ( type => 'x509_crl' );
+($res, $errmsg) = $session->flush_certs(Vici::Message->new(\%vars));
+print $res ? "ok\n" : "failed: $errmsg\n";
+
=item clear_creds()
clears all loaded certificate, private key and shared key credentials. This
diff --git a/src/libcharon/plugins/vici/perl/Vici-Session/lib/Vici/Session.pm b/src/libcharon/plugins/vici/perl/Vici-Session/lib/Vici/Session.pm
index 78197136a..5c09b14ed 100644
--- a/src/libcharon/plugins/vici/perl/Vici-Session/lib/Vici/Session.pm
+++ b/src/libcharon/plugins/vici/perl/Vici-Session/lib/Vici/Session.pm
@@ -96,6 +96,10 @@ sub load_shared {
return request_vars_res('load-shared', @_);
}
+sub flush_certs {
+ return request_vars_res('flush-certs', @_);
+}
+
sub clear_creds {
return request_res('clear-creds', @_);
}
diff --git a/src/libcharon/plugins/vici/python/vici/session.py b/src/libcharon/plugins/vici/python/vici/session.py
index 66de8590a..eabdb4226 100644
--- a/src/libcharon/plugins/vici/python/vici/session.py
+++ b/src/libcharon/plugins/vici/python/vici/session.py
@@ -166,6 +166,17 @@ class Session(object):
"""
self.handler.request("load-shared", secret)
+ def flush_certs(self, filter=None):
+ """Flush the volatile certificate cache.
+
+ Flush the certificate stored temporarily in the cache. The filter
+ allows to flush only a certain type of certificates, e.g. CRLs.
+
+ :param filter: flush only certificates of a given type (optional)
+ :type filter: dict
+ """
+ self.handler.request("flush-certs", filter)
+
def clear_creds(self):
"""Clear credentials loaded over vici.
diff --git a/src/libcharon/plugins/vici/ruby/lib/vici.rb b/src/libcharon/plugins/vici/ruby/lib/vici.rb
index 018f50766..1a95fc3dd 100644
--- a/src/libcharon/plugins/vici/ruby/lib/vici.rb
+++ b/src/libcharon/plugins/vici/ruby/lib/vici.rb
@@ -449,6 +449,12 @@ module Vici
end
##
+ # Flush credential cache.
+ def flush_certs((match = nil)
+ check_success(@transp.request("flush-certs", Message.new(match)))
+ end
+
+ ##
# Clear all loaded credentials.
def clear_creds()
check_success(@transp.request("clear-creds"))
diff --git a/src/libcharon/plugins/vici/vici_cred.c b/src/libcharon/plugins/vici/vici_cred.c
index 3411b7d6c..40ba57e98 100644
--- a/src/libcharon/plugins/vici/vici_cred.c
+++ b/src/libcharon/plugins/vici/vici_cred.c
@@ -287,6 +287,24 @@ CALLBACK(clear_creds, vici_message_t*,
return create_reply(NULL);
}
+CALLBACK(flush_certs, vici_message_t*,
+ private_vici_cred_t *this, char *name, u_int id, vici_message_t *message)
+{
+ certificate_type_t type = CERT_ANY;
+ x509_flag_t flag = X509_NONE;
+ char *str;
+
+ str = message->get_str(message, NULL, "type");
+ if (str && !enum_from_name(certificate_type_names, str, &type) &&
+ !vici_cert_info_from_str(str, &type, &flag))
+ {
+ return create_reply("invalid certificate type '%s'", str);
+ }
+ lib->credmgr->flush_cache(lib->credmgr, type);
+
+ return create_reply(NULL);
+}
+
static void manage_command(private_vici_cred_t *this,
char *name, vici_command_cb_t cb, bool reg)
{
@@ -300,6 +318,7 @@ static void manage_command(private_vici_cred_t *this,
static void manage_commands(private_vici_cred_t *this, bool reg)
{
manage_command(this, "clear-creds", clear_creds, reg);
+ manage_command(this, "flush-certs", flush_certs, reg);
manage_command(this, "load-cert", load_cert, reg);
manage_command(this, "load-key", load_key, reg);
manage_command(this, "load-shared", load_shared, reg);
diff --git a/src/swanctl/Makefile.am b/src/swanctl/Makefile.am
index 37a0224c3..409387849 100644
--- a/src/swanctl/Makefile.am
+++ b/src/swanctl/Makefile.am
@@ -13,6 +13,7 @@ swanctl_SOURCES = \
commands/list_certs.c \
commands/list_pools.c \
commands/list_algs.c \
+ commands/flush_certs.c \
commands/load_all.c \
commands/load_authorities.h commands/load_authorities.c \
commands/load_conns.c commands/load_conns.h \
diff --git a/src/swanctl/command.h b/src/swanctl/command.h
index 8d0a2e6b9..7b92ae91a 100644
--- a/src/swanctl/command.h
+++ b/src/swanctl/command.h
@@ -27,7 +27,7 @@
/**
* Maximum number of commands (+1).
*/
-#define MAX_COMMANDS 23
+#define MAX_COMMANDS 24
/**
* Maximum number of options in a command (+3)
diff --git a/src/swanctl/commands/flush_certs.c b/src/swanctl/commands/flush_certs.c
new file mode 100644
index 000000000..527419f88
--- /dev/null
+++ b/src/swanctl/commands/flush_certs.c
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2016 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include <errno.h>
+
+#include "command.h"
+
+static int flush_certs(vici_conn_t *conn)
+{
+ vici_req_t *req;
+ vici_res_t *res;
+ command_format_options_t format = COMMAND_FORMAT_NONE;
+ char *arg, *type = NULL;
+ int ret;
+
+ while (TRUE)
+ {
+ switch (command_getopt(&arg))
+ {
+ case 'h':
+ return command_usage(NULL);
+ case 't':
+ type = arg;
+ continue;
+ case 'P':
+ format |= COMMAND_FORMAT_PRETTY;
+ /* fall through to raw */
+ case 'r':
+ format |= COMMAND_FORMAT_RAW;
+ continue;
+ case EOF:
+ break;
+ default:
+ return command_usage("invalid --flush-certs option");
+ }
+ break;
+ }
+ req = vici_begin("flush-certs");
+
+ if (type)
+ {
+ vici_add_key_valuef(req, "type", "%s", type);
+ }
+ res = vici_submit(req, conn);
+
+ if (!res)
+ {
+ ret = errno;
+ fprintf(stderr, "flush-certs request failed: %s\n", strerror(errno));
+ return ret;
+ }
+ if (format & COMMAND_FORMAT_RAW)
+ {
+ vici_dump(res, "flush-certs reply", format & COMMAND_FORMAT_PRETTY,
+ stdout);
+ }
+ vici_free_res(res);
+
+ return 0;
+}
+
+/**
+ * Register the command.
+ */
+static void __attribute__ ((constructor))reg()
+{
+ command_register((command_t) {
+ flush_certs, 'f', "flush-certs", "flush cached certificates",
+ {"[--type x509|x509_ac|x509_crl|ocsp_response|pubkey]",
+ "[--raw|--pretty]"},
+ {
+ {"help", 'h', 0, "show usage information"},
+ {"type", 't', 1, "filter by certificate type"},
+ {"raw", 'r', 0, "dump raw response message"},
+ {"pretty", 'P', 0, "dump raw response message in pretty print"},
+ }
+ });
+}