denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented parsing of pathLenConstraint

Browse Source
This commit is contained in:
Andreas Steffen
2009-11-04 00:03:10 +01:00
parent a58b1722b0
commit 00aa027503
2 changed files with 45 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/certificates/x509.h
+9
View File
@@ -24,6 +24,8 @@
#include <utils/enumerator.h> #include <utils/enumerator.h>
#include <credentials/certificates/certificate.h> #include <credentials/certificates/certificate.h>
#define NO_PATH_LEN_CONSTRAINT -1
typedef struct x509_t x509_t; typedef struct x509_t x509_t;
typedef enum x509_flag_t x509_flag_t; typedef enum x509_flag_t x509_flag_t;
@@ -91,6 +93,13 @@ struct x509_t {
*/ */
chunk_t (*get_authKeyIdentifier)(x509_t *this); chunk_t (*get_authKeyIdentifier)(x509_t *this);
/**
* Get an optional path length constraint.
*
* @return pathLenConstraint, -1 if no constraint exists
*/
int (*get_pathLenConstraint)(x509_t *this);
/** /**
* Create an enumerator over all subjectAltNames. * Create an enumerator over all subjectAltNames.
* *
src/libstrongswan/plugins/x509/x509_cert.c
+36 -11
View File
@@ -145,6 +145,11 @@ struct private_x509_cert_t {
*/ */
chunk_t authKeySerialNumber; chunk_t authKeySerialNumber;
/**
* Path Length Constraint
*/
int pathLenConstraint;
/** /**
* x509 constraints and other flags * x509 constraints and other flags
*/ */
@@ -185,12 +190,14 @@ static const asn1Object_t basicConstraintsObjects[] = {
{ 1, "end opt", ASN1_EOC, ASN1_END }, /* 3 */ { 1, "end opt", ASN1_EOC, ASN1_END }, /* 3 */
{ 0, "exit", ASN1_EOC, ASN1_EXIT } { 0, "exit", ASN1_EOC, ASN1_EXIT }
}; };
#define BASIC_CONSTRAINTS_CA 1 #define BASIC_CONSTRAINTS_CA 1
#define BASIC_CONSTRAINTS_PATH_LEN 2
/** /**
* Extracts the basicConstraints extension * Extracts the basicConstraints extension
*/ */
static bool parse_basicConstraints(chunk_t blob, int level0) static void parse_basicConstraints(chunk_t blob, int level0,
private_x509_cert_t *this)
{ {
asn1_parser_t *parser; asn1_parser_t *parser;
chunk_t object; chunk_t object;
@@ -202,15 +209,35 @@ static bool parse_basicConstraints(chunk_t blob, int level0)
while (parser->iterate(parser, &objectID, &object)) while (parser->iterate(parser, &objectID, &object))
{ {
if (objectID == BASIC_CONSTRAINTS_CA) switch (objectID)
{ {
isCA = object.len && *object.ptr; case BASIC_CONSTRAINTS_CA:
DBG2(" %s", isCA ? "TRUE" : "FALSE"); isCA = object.len && *object.ptr;
DBG2(" %s", isCA ? "TRUE" : "FALSE");
if (isCA)
{
this->flags |= X509_CA;
}
break;
case BASIC_CONSTRAINTS_PATH_LEN:
if (isCA)
{
if (object.len == 0)
{
this->pathLenConstraint = 0;
}
else if (object.len == 1)
{
this->pathLenConstraint = *object.ptr;
}
/* we ignore path length constraints > 127 */
}
break;
default:
break;
} }
} }
parser->destroy(parser); parser->destroy(parser);
return isCA;
} }
/** /**
@@ -785,10 +812,7 @@ static bool parse_certificate(private_x509_cert_t *this)
this->subjectAltNames); this->subjectAltNames);
break; break;
case OID_BASIC_CONSTRAINTS: case OID_BASIC_CONSTRAINTS:
if (parse_basicConstraints(object, level)) parse_basicConstraints(object, level, this);
{
this->flags |= X509_CA;
}
break; break;
case OID_CRL_DISTRIBUTION_POINTS: case OID_CRL_DISTRIBUTION_POINTS:
parse_crlDistributionPoints(object, level, this); parse_crlDistributionPoints(object, level, this);
@@ -1205,6 +1229,7 @@ static private_x509_cert_t* create_empty(void)
this->subjectKeyIdentifier = chunk_empty; this->subjectKeyIdentifier = chunk_empty;
this->authKeyIdentifier = chunk_empty; this->authKeyIdentifier = chunk_empty;
this->authKeySerialNumber = chunk_empty; this->authKeySerialNumber = chunk_empty;
this->pathLenConstraint = NO_PATH_LEN_CONSTRAINT;
this->algorithm = 0; this->algorithm = 0;
this->signature = chunk_empty; this->signature = chunk_empty;
this->flags = 0; this->flags = 0;