source: creddy/id.c @ 3131b19

#include <assert.h>
#include <termios.h>

#include "creddy.h"
#include "id.h"

/* Size of password memory allocation */
#define PWLEN 128

//
// ID object
//
struct _creddy_id_t {
    char *keyid;
    char *cn;
    certificate_t *cert;
    private_key_t *key;
}; 

/* Callback configuration */
struct cb_opts {
    bool use_prompt;    /* Print a prompt to stderr */
    bool use_echo;      /* If true, turn off input echo on stdin */
    unsigned int tries; /* Number of attempts allowed */
    char prompt[20];    /* The prompt to display if use_echo is true */
};

static chunk_t _passphrase_callback(void *user, int try);

/**
 * Load an ID cert from a file.
 */
creddy_id_t *creddy_id_from_file(char *filename) {
    certificate_t *cert = lib->creds->create(lib->creds,
        CRED_CERTIFICATE, CERT_X509,
        BUILD_FROM_FILE, filename,
        BUILD_X509_FLAG, X509_AA,
        BUILD_END
    );

    if (cert == NULL)
        return NULL;

    creddy_id_t *id = xmalloc(sizeof(creddy_id_t));
    id->keyid = NULL;
    id->cn = NULL;
    id->cert = cert;
    id->key = NULL;

    // get the keyid
    x509_t *x509 = (x509_t *)cert;
    chunk_t keyid = x509->get_subjectKeyIdentifier(x509);
    chunk_t string = chunk_to_hex(keyid, NULL, 0);
    id->keyid = string.ptr;

    // TODO get CN

    return id;
}

int creddy_id_load_privkey(creddy_id_t *id, char *filename) {
    struct cb_opts c_opts = { 1, 0, 3, "Key password:" };

    assert(id != NULL);

    // load signer key
    private_key_t *key = lib->creds->create(lib->creds,
        CRED_PRIVATE_KEY, KEY_RSA,
        BUILD_FROM_FILE, filename,
        /* Ask for password if the key's encrypted */
        BUILD_PASSPHRASE_CALLBACK, _passphrase_callback, &c_opts, 
        BUILD_END
    );
    if (key == NULL)
        return 0;

    id->key = key;
}

char *creddy_id_keyid(creddy_id_t *id) {
    assert(id != NULL);

    return id->keyid;
}

certificate_t *creddy_id_cert(creddy_id_t *id) {
    assert(id != NULL);

    return id->cert;
}

private_key_t *creddy_id_privkey(creddy_id_t *id) {
    assert(id != NULL);

    return id->key;
}

void creddy_id_free(creddy_id_t *id) {
    if (id == NULL)
        return;

    DESTROY_IF(id->cert);
    DESTROY_IF(id->key);

    free(id->keyid);
    free(id);
}

//
// Helper functions below
//

static chunk_t _passphrase_callback(void *user, int try) {
    /* Get a password from stdin and return it as a chunk_t.  If too many tries
     * have occurred or there is any other problem, return an empty chunk_t,
     * which libstrongswan takes as giving up.  The chunk is alloated here
     * (inside getline), and presumably freed by libstrongswan. User points to
     * a cb_opts struct, which affects this routine in the obvious ways.
     */
    /* Configuration options */
    struct cb_opts *opts = (struct cb_opts *) user;
    chunk_t rv = chunk_empty;   /* Return value, starts empty */

    if (try -1 < opts->tries ) {
        struct termios t;   /* Terminal settings */
        size_t len = 0;     /* Length of string from getline */
        tcflag_t orig = 0;  /* Holds the original local flags (echo in here) */

        if (!opts->use_echo) {
            /* Use tc{get,set}attr to turn echo off and restore the intial
             * echo settings */
            if (!tcgetattr(0, &t)) { 
                orig = t.c_lflag;

                t.c_lflag &= ~ECHO;
                if ( tcsetattr(0, TCSANOW, &t) ) { 
                    perror("Cannot turn off echo"); 
                    return rv;
                }
            }
            else {
                perror("Cannot turn get attributes to off echo"); 
                return rv;
            }
        }
        if (opts->use_prompt) printf("%s", opts->prompt);

        /* Because rv.ptr starts as NULL, getline allocates memory.  The size
         * of the allocation returns in rv.len and the size of the string
         * (including newline and NUL) is in len.  */
        if ((rv.ptr = (u_char *) malloc(rv.len = PWLEN))) {
            if ( fgets(rv.ptr, rv.len, stdin) ) {
                /* Readjust the chunk_t's len field to the size of the string
                 * w/o the newline or NUL */
                /* would prefer strnlen, but no such luck in FBSD7 or earlier*/
                size_t len = strlen(rv.ptr);

                if (rv.ptr[len-2] == '\n') rv.len = len-2;
                else rv.len = len -1;
            }
            else {
                /* Read failed.  Deallocate and clear rv */
                free(rv.ptr);
                rv = chunk_empty;
            }
        }
        else {
            /* Failed malloc.  Restore rv to empty and return it */
            perror("malloc");
            rv = chunk_empty;
            return rv;
        }

        if (!opts->use_echo ) {
            /* Pop echo beck to its original setting. */
            t.c_lflag = orig;

            if ( tcsetattr(0, TCSANOW, &t) ) 
                perror("Cannot restore echo setting?"); 

            if (opts->use_prompt) printf("\n");
        }
    }
    else fprintf(stderr, "Too many tries (%d)", try-1);
    return rv;
}