aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/libcharon/plugins/stroke/stroke_cred.c6
-rw-r--r--src/libcharon/plugins/stroke/stroke_socket.c2
-rw-r--r--src/libcharon/plugins/vici/Makefile.am1
-rw-r--r--src/libcharon/plugins/vici/vici_cred.c64
-rw-r--r--src/libcharon/plugins/vici/vici_cred.h10
-rw-r--r--src/libcharon/plugins/vici/vici_plugin.c4
6 files changed, 83 insertions, 4 deletions
diff --git a/src/libcharon/plugins/stroke/stroke_cred.c b/src/libcharon/plugins/stroke/stroke_cred.c
index 929e6fc84..44be512c0 100644
--- a/src/libcharon/plugins/stroke/stroke_cred.c
+++ b/src/libcharon/plugins/stroke/stroke_cred.c
@@ -562,7 +562,7 @@ static void load_certdir(private_stroke_cred_t *this, char *path,
}
}
-METHOD(stroke_cred_t, cache_cert, void,
+METHOD(credential_set_t, cache_cert, void,
private_stroke_cred_t *this, certificate_t *cert)
{
if (cert->get_type(cert) == CERT_X509_CRL && this->cachecrl)
@@ -1497,6 +1497,10 @@ stroke_cred_t *stroke_cred_create(stroke_ca_t *ca)
.ca = ca,
);
+ if (lib->settings->get_bool(lib->settings, "%s.cache_crls", FALSE, lib->ns))
+ {
+ cachecrl(this, TRUE);
+ }
lib->credmgr->add_set(lib->credmgr, &this->creds->set);
lib->credmgr->add_set(lib->credmgr, &this->aacerts->set);
diff --git a/src/libcharon/plugins/stroke/stroke_socket.c b/src/libcharon/plugins/stroke/stroke_socket.c
index 4f7483666..46de90ca6 100644
--- a/src/libcharon/plugins/stroke/stroke_socket.c
+++ b/src/libcharon/plugins/stroke/stroke_socket.c
@@ -1,7 +1,7 @@
/*
* Copyright (C) 2011-2013 Tobias Brunner
* Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
+ * HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
diff --git a/src/libcharon/plugins/vici/Makefile.am b/src/libcharon/plugins/vici/Makefile.am
index ca9b49906..af0b65cd0 100644
--- a/src/libcharon/plugins/vici/Makefile.am
+++ b/src/libcharon/plugins/vici/Makefile.am
@@ -2,6 +2,7 @@ AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libstrongswan/plugins/pubkey \
-I$(top_srcdir)/src/libcharon \
+ -DSWANCTLDIR=\""${swanctldir}\"" \
-DIPSEC_PIDDIR=\"${piddir}\"
AM_CFLAGS = \
diff --git a/src/libcharon/plugins/vici/vici_cred.c b/src/libcharon/plugins/vici/vici_cred.c
index 40ba57e98..453b743a1 100644
--- a/src/libcharon/plugins/vici/vici_cred.c
+++ b/src/libcharon/plugins/vici/vici_cred.c
@@ -2,7 +2,7 @@
* Copyright (C) 2014 Martin Willi
* Copyright (C) 2014 revosec AG
*
- * Copyright (C) 2015 Andreas Steffen
+ * Copyright (C) 2015-2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -25,9 +25,16 @@
#include <credentials/certificates/crl.h>
#include <credentials/certificates/x509.h>
+#include <errno.h>
+
typedef struct private_vici_cred_t private_vici_cred_t;
/**
+ * Directory for saved X.509 CRLs
+ */
+#define CRL_DIR SWANCTLDIR "/x509crl"
+
+/**
* Private data of an vici_cred_t object.
*/
struct private_vici_cred_t {
@@ -46,8 +53,51 @@ struct private_vici_cred_t {
* credentials
*/
mem_cred_t *creds;
+
+ /**
+ * cache CRLs to disk?
+ */
+ bool cachecrl;
+
};
+METHOD(credential_set_t, cache_cert, void,
+ private_vici_cred_t *this, certificate_t *cert)
+{
+ if (cert->get_type(cert) == CERT_X509_CRL && this->cachecrl)
+ {
+ /* CRLs get written to /etc/swanctl/x509crl/<authkeyId>.crl */
+ crl_t *crl = (crl_t*)cert;
+
+ cert->get_ref(cert);
+ if (this->creds->add_crl(this->creds, crl))
+ {
+ char buf[BUF_LEN];
+ chunk_t chunk, hex;
+
+ chunk = crl->get_authKeyIdentifier(crl);
+ hex = chunk_to_hex(chunk, NULL, FALSE);
+ snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex.ptr);
+ free(hex.ptr);
+
+ if (cert->get_encoding(cert, CERT_ASN1_DER, &chunk))
+ {
+ if (chunk_write(chunk, buf, 022, TRUE))
+ {
+ DBG1(DBG_CFG, " written crl file '%s' (%d bytes)",
+ buf, chunk.len);
+ }
+ else
+ {
+ DBG1(DBG_CFG, " writing crl file '%s' failed: %s",
+ buf, strerror(errno));
+ }
+ free(chunk.ptr);
+ }
+ }
+ }
+}
+
/**
* Create a (error) reply message
*/
@@ -349,6 +399,13 @@ vici_cred_t *vici_cred_create(vici_dispatcher_t *dispatcher)
INIT(this,
.public = {
+ .set = {
+ .create_private_enumerator = (void*)return_null,
+ .create_cert_enumerator = (void*)return_null,
+ .create_shared_enumerator = (void*)return_null,
+ .create_cdp_enumerator = (void*)return_null,
+ .cache_cert = (void*)_cache_cert,
+ },
.add_cert = _add_cert,
.destroy = _destroy,
},
@@ -356,6 +413,11 @@ vici_cred_t *vici_cred_create(vici_dispatcher_t *dispatcher)
.creds = mem_cred_create(),
);
+ if (lib->settings->get_bool(lib->settings, "%s.cache_crls", FALSE, lib->ns))
+ {
+ this->cachecrl = TRUE;
+ DBG1(DBG_CFG, "crl caching to %s enabled", CRL_DIR);
+ }
lib->credmgr->add_set(lib->credmgr, &this->creds->set);
manage_commands(this, TRUE);
diff --git a/src/libcharon/plugins/vici/vici_cred.h b/src/libcharon/plugins/vici/vici_cred.h
index 8359c0e88..6ce514786 100644
--- a/src/libcharon/plugins/vici/vici_cred.h
+++ b/src/libcharon/plugins/vici/vici_cred.h
@@ -2,6 +2,9 @@
* Copyright (C) 2014 Martin Willi
* Copyright (C) 2014 revosec AG
*
+ * Copyright (C) 2016 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
@@ -23,6 +26,8 @@
#include "vici_dispatcher.h"
+#include <credentials/credential_set.h>
+
typedef struct vici_cred_t vici_cred_t;
/**
@@ -31,6 +36,11 @@ typedef struct vici_cred_t vici_cred_t;
struct vici_cred_t {
/**
+ * Implements credential_set_t
+ */
+ credential_set_t set;
+
+ /**
* Add a certificate to the certificate store
*
* @param cert certificate to be added to store
diff --git a/src/libcharon/plugins/vici/vici_plugin.c b/src/libcharon/plugins/vici/vici_plugin.c
index ed7c743c7..136651261 100644
--- a/src/libcharon/plugins/vici/vici_plugin.c
+++ b/src/libcharon/plugins/vici/vici_plugin.c
@@ -2,7 +2,7 @@
* Copyright (C) 2014 Martin Willi
* Copyright (C) 2014 revosec AG
*
- * Copyright (C) 2015 Andreas Steffen
+ * Copyright (C) 2015-2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -130,6 +130,7 @@ static bool register_vici(private_vici_plugin_t *this,
this->cred = vici_cred_create(this->dispatcher);
this->authority = vici_authority_create(this->dispatcher,
this->cred);
+ lib->credmgr->add_set(lib->credmgr, &this->cred->set);
lib->credmgr->add_set(lib->credmgr, &this->authority->set);
this->config = vici_config_create(this->dispatcher, this->authority,
this->cred);
@@ -158,6 +159,7 @@ static bool register_vici(private_vici_plugin_t *this,
this->logger->destroy(this->logger);
this->attrs->destroy(this->attrs);
this->config->destroy(this->config);
+ lib->credmgr->remove_set(lib->credmgr, &this->cred->set);
lib->credmgr->remove_set(lib->credmgr, &this->authority->set);
this->authority->destroy(this->authority);
this->cred->destroy(this->cred);
generated by cgit v1.2.3 (git 2.25.1) at 2025-09-14 04:14:52 +0000