149 lines
3.5 KiB
C
149 lines
3.5 KiB
C
/*
|
|
* Copyright (C) 2011 Martin Willi
|
|
* Copyright (C) 2011 revosec AG
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* for more details.
|
|
*/
|
|
|
|
#include "certexpire_listener.h"
|
|
|
|
#include <daemon.h>
|
|
|
|
typedef struct private_certexpire_listener_t private_certexpire_listener_t;
|
|
|
|
/**
|
|
* Private data of an certexpire_listener_t object.
|
|
*/
|
|
struct private_certexpire_listener_t {
|
|
|
|
/**
|
|
* Public certexpire_listener_t interface.
|
|
*/
|
|
certexpire_listener_t public;
|
|
|
|
/**
|
|
* Export facility
|
|
*/
|
|
certexpire_export_t *export;
|
|
};
|
|
|
|
METHOD(listener_t, authorize, bool,
|
|
private_certexpire_listener_t *this, ike_sa_t *ike_sa,
|
|
bool final, bool *success)
|
|
{
|
|
enumerator_t *rounds, *enumerator;
|
|
certificate_t *cert, *ca = NULL;
|
|
linked_list_t *trustchain;
|
|
auth_cfg_t *auth;
|
|
auth_rule_t rule;
|
|
|
|
/* Check all rounds in final hook, as local authentication data are
|
|
* not completely available after round-invocation. */
|
|
if (!final)
|
|
{
|
|
return TRUE;
|
|
}
|
|
|
|
/* collect local certificates */
|
|
trustchain = linked_list_create();
|
|
rounds = ike_sa->create_auth_cfg_enumerator(ike_sa, TRUE);
|
|
while (rounds->enumerate(rounds, &auth))
|
|
{
|
|
cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
|
|
if (cert)
|
|
{
|
|
trustchain->insert_last(trustchain, cert);
|
|
|
|
enumerator = auth->create_enumerator(auth);
|
|
while (enumerator->enumerate(enumerator, &rule, &cert))
|
|
{
|
|
if (rule == AUTH_RULE_IM_CERT)
|
|
{
|
|
trustchain->insert_last(trustchain, cert);
|
|
}
|
|
if (rule == AUTH_RULE_CA_CERT)
|
|
{
|
|
/* the last CA cert is the one used in the trustchain.
|
|
* Previous CA certificates have been received as cert
|
|
* requests. */
|
|
ca = cert;
|
|
}
|
|
}
|
|
enumerator->destroy(enumerator);
|
|
if (ca)
|
|
{
|
|
trustchain->insert_last(trustchain, ca);
|
|
}
|
|
}
|
|
}
|
|
rounds->destroy(rounds);
|
|
this->export->add(this->export, trustchain, TRUE);
|
|
trustchain->destroy(trustchain);
|
|
|
|
/* collect remote certificates */
|
|
trustchain = linked_list_create();
|
|
rounds = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
|
|
while (rounds->enumerate(rounds, &auth))
|
|
{
|
|
cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
|
|
if (cert)
|
|
{
|
|
trustchain->insert_last(trustchain, cert);
|
|
|
|
enumerator = auth->create_enumerator(auth);
|
|
while (enumerator->enumerate(enumerator, &rule, &cert))
|
|
{
|
|
if (rule == AUTH_RULE_IM_CERT)
|
|
{
|
|
trustchain->insert_last(trustchain, cert);
|
|
}
|
|
}
|
|
enumerator->destroy(enumerator);
|
|
|
|
cert = auth->get(auth, AUTH_RULE_CA_CERT);
|
|
if (cert)
|
|
{
|
|
trustchain->insert_last(trustchain, cert);
|
|
}
|
|
}
|
|
}
|
|
rounds->destroy(rounds);
|
|
this->export->add(this->export, trustchain, FALSE);
|
|
trustchain->destroy(trustchain);
|
|
return TRUE;
|
|
}
|
|
|
|
METHOD(certexpire_listener_t, destroy, void,
|
|
private_certexpire_listener_t *this)
|
|
{
|
|
free(this);
|
|
}
|
|
|
|
/**
|
|
* See header
|
|
*/
|
|
certexpire_listener_t *certexpire_listener_create(certexpire_export_t *export)
|
|
{
|
|
private_certexpire_listener_t *this;
|
|
|
|
INIT(this,
|
|
.public = {
|
|
.listener = {
|
|
.authorize = _authorize,
|
|
},
|
|
.destroy = _destroy,
|
|
},
|
|
.export = export,
|
|
);
|
|
|
|
return &this->public;
|
|
}
|