denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scepclient and pluto use asn1 from libstrongswan

Browse Source
This commit is contained in:
Andreas Steffen
2009-04-20 20:53:38 +00:00
parent 09f706ec3e
commit 08b2d288a1
38 changed files with 1518 additions and 2565 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/scepclient/Makefile.am
+5 -7
View File
@@ -18,15 +18,16 @@ INCLUDES = \
AM_CFLAGS = \
-DIPSEC_CONFDIR=\"${confdir}\" \
-DSTRONGSWAN_CONF=\"${strongswan_conf}\" \
-DDEBUG -DNO_PLUTO
-DDEBUG -DNO_PLUTO \
-Wformat=0
LIBFREESWANBUILDDIR=$(top_builddir)/src/libfreeswan
LIBCRYPTOBUILDDIR=$(top_builddir)/src/libcrypto
scepclient_LDADD = \
asn1.o ca.o crl.o certs.o constants.o defs.o fetch.o id.o keys.o \
lex.o library.o md2.o md5.o mp_defs.o ocsp.o pem.o pgp.o pkcs1.o \
pkcs7.o rnd.o sha1.o smartcard.o x509.o \
ca.o crl.o certs.o constants.o defs.o fetch.o id.o keys.o lex.o library.o \
md2.o md5.o mp_defs.o ocsp.o pem.o pgp.o pkcs1.o pkcs7.o rnd.o sha1.o \
smartcard.o x509.o \
$(LIBSTRONGSWANDIR)/libstrongswan-lite.la \
$(LIBFREESWANBUILDDIR)/libfreeswan.a \
$(LIBCRYPTOBUILDDIR)/libcrypto.a \
@@ -51,9 +52,6 @@ endif
dist_man_MANS = scepclient.8
asn1.o : $(PLUTODIR)/asn1.c $(PLUTODIR)/asn1.h
$(COMPILE) $(INCLUDES) -c -o $@ $<
ca.o : $(PLUTODIR)/ca.c $(PLUTODIR)/ca.h
$(COMPILE) $(INCLUDES) -c -o $@ $<
src/scepclient/pkcs10.c
+2 -2
View File
@@ -26,11 +26,11 @@
#include <arpa/inet.h>
#include <freeswan.h>
#include <asn1/asn1.h>
#include <asn1/oid.h>
#include "../pluto/constants.h"
#include "../pluto/defs.h"
#include "../pluto/asn1.h"
#include "../pluto/pkcs1.h"
#include "../pluto/log.h"
#include "../pluto/x509.h"
@@ -133,7 +133,7 @@ build_req_info_attributes(pkcs10_t* pkcs10)
if (pkcs10->challengePassword.len > 0)
{
asn1_t type = is_printablestring(pkcs10->challengePassword)
asn1_t type = asn1_is_printablestring(pkcs10->challengePassword)
? ASN1_PRINTABLESTRING : ASN1_T61STRING;
challengePassword = asn1_wrap(ASN1_SEQUENCE, "cm"
src/scepclient/rsakey.c
-1
View File
@@ -36,7 +36,6 @@
#include "../pluto/defs.h"
#include "../pluto/mp_defs.h"
#include "../pluto/log.h"
#include "../pluto/asn1.h"
#include "../pluto/pkcs1.h"
#include "rsakey.h"
src/scepclient/scep.c
+55 -55
View File
@@ -24,6 +24,9 @@
#include <stdlib.h>
#include <freeswan.h>
#include <asn1/asn1.h>
#include <asn1/asn1_parser.h>
#include <asn1/oid.h>
#ifdef LIBCURL
@@ -33,7 +36,6 @@
#include "../pluto/constants.h"
#include "../pluto/defs.h"
#include "../pluto/rnd.h"
#include "../pluto/asn1.h"
#include "../pluto/pkcs1.h"
#include "../pluto/fetch.h"
#include "../pluto/log.h"
@@ -62,62 +64,60 @@ static const chunk_t ASN1_transId_oid =
static const char *pkiStatus_values[] = { "0", "2", "3" };
static const char *pkiStatus_names[] = {
"SUCCESS",
"FAILURE",
"PENDING",
"UNKNOWN"
"SUCCESS",
"FAILURE",
"PENDING",
"UNKNOWN"
};
static const char *msgType_values[] = { "3", "19", "20", "21", "22" };
static const char *msgType_names[] = {
"CertRep",
"PKCSReq",
"GetCertInitial",
"GetCert",
"GetCRL",
"Unknown"
"CertRep",
"PKCSReq",
"GetCertInitial",
"GetCert",
"GetCRL",
"Unknown"
};
static const char *failInfo_reasons[] = {
"badAlg - unrecognized or unsupported algorithm identifier",
"badMessageCheck - integrity check failed",
"badRequest - transaction not permitted or supported",
"badTime - Message time field was not sufficiently close to the system time",
"badCertId - No certificate could be identified matching the provided criteria"
"badAlg - unrecognized or unsupported algorithm identifier",
"badMessageCheck - integrity check failed",
"badRequest - transaction not permitted or supported",
"badTime - Message time field was not sufficiently close to the system time",
"badCertId - No certificate could be identified matching the provided criteria"
};
const scep_attributes_t empty_scep_attributes = {
SCEP_Unknown_MSG , /* msgType */
SCEP_UNKNOWN , /* pkiStatus */
SCEP_unknown_REASON, /* failInfo */
{ NULL, 0 } , /* transID */
{ NULL, 0 } , /* senderNonce */
{ NULL, 0 } , /* recipientNonce */
SCEP_Unknown_MSG , /* msgType */
SCEP_UNKNOWN , /* pkiStatus */
SCEP_unknown_REASON, /* failInfo */
{ NULL, 0 } , /* transID */
{ NULL, 0 } , /* senderNonce */
{ NULL, 0 } , /* recipientNonce */
};
/* ASN.1 definition of the X.501 atttribute type */
static const asn1Object_t attributesObjects[] = {
{ 0, "attributes", ASN1_SET, ASN1_LOOP }, /* 0 */
{ 1, "attribute", ASN1_SEQUENCE, ASN1_NONE }, /* 1 */
{ 2, "type", ASN1_OID, ASN1_BODY }, /* 2 */
{ 2, "values", ASN1_SET, ASN1_LOOP }, /* 3 */
{ 3, "value", ASN1_EOC, ASN1_RAW }, /* 4 */
{ 2, "end loop", ASN1_EOC, ASN1_END }, /* 5 */
{ 0, "end loop", ASN1_EOC, ASN1_END }, /* 6 */
{ 0, "attributes", ASN1_SET, ASN1_LOOP }, /* 0 */
{ 1, "attribute", ASN1_SEQUENCE, ASN1_NONE }, /* 1 */
{ 2, "type", ASN1_OID, ASN1_BODY }, /* 2 */
{ 2, "values", ASN1_SET, ASN1_LOOP }, /* 3 */
{ 3, "value", ASN1_EOC, ASN1_RAW }, /* 4 */
{ 2, "end loop", ASN1_EOC, ASN1_END }, /* 5 */
{ 0, "end loop", ASN1_EOC, ASN1_END }, /* 6 */
{ 0, "exit", ASN1_EOC, ASN1_EXIT }
};
#define ATTRIBUTE_OBJ_TYPE 2
#define ATTRIBUTE_OBJ_VALUE 4
#define ATTRIBUTE_OBJ_ROOF 7
/*
* extract and store an attribute
/**
* Extract and store an attribute
*/
static bool
extract_attribute(int oid, chunk_t object, u_int level
, scep_attributes_t *attrs)
static bool extract_attribute(int oid, chunk_t object, u_int level,
scep_attributes_t *attrs)
{
asn1_t type = ASN1_EOC;
const char *name = "none";
@@ -167,7 +167,7 @@ extract_attribute(int oid, chunk_t object, u_int level
if (type == ASN1_EOC)
return TRUE;
if (!parse_asn1_simple_object(&object, type, level+1, name))
if (!asn1_parse_simple_object(&object, type, level+1, name))
return FALSE;
switch (oid)
@@ -227,41 +227,41 @@ extract_attribute(int oid, chunk_t object, u_int level
return TRUE;
}
/*
* parse X.501 attributes
/**
* Parse X.501 attributes
*/
bool
parse_attributes(chunk_t blob, scep_attributes_t *attrs)
bool parse_attributes(chunk_t blob, scep_attributes_t *attrs)
{
asn1_ctx_t ctx;
asn1_parser_t *parser;
chunk_t object;
u_int level;
int oid = OID_UNKNOWN;
int objectID = 0;
asn1_init(&ctx, blob, 0, FALSE, DBG_RAW);
int objectID;
bool success = FALSE;
parser = asn1_parser_create(attributesObjects, blob);
DBG(DBG_CONTROL | DBG_PARSING,
DBG_log("parsing attributes")
)
while (objectID < ATTRIBUTE_OBJ_ROOF)
while (parser->iterate(parser, &objectID, &object))
{
if (!extract_object(attributesObjects, &objectID
, &object, &level, &ctx))
return FALSE;
switch (objectID)
{
case ATTRIBUTE_OBJ_TYPE:
oid = asn1_known_oid(object);
break;
case ATTRIBUTE_OBJ_VALUE:
if (!extract_attribute(oid, object, level, attrs))
return FALSE;
if (!extract_attribute(oid, object, parser->get_level(parser), attrs))
{
goto end;
}
}
objectID++;
}
return TRUE;
success = parser->success(parser);
end:
parser->destroy(parser);
return success;
}
/* generates a unique fingerprint of the pkcs10 request
src/scepclient/scepclient.c
+12 -12
View File
@@ -38,13 +38,13 @@
#include <freeswan.h>
#include <library.h>
#include <debug.h>
#include <asn1/asn1.h>
#include <asn1/oid.h>
#include <utils/optionsfrom.h>
#include "../pluto/constants.h"
#include "../pluto/defs.h"
#include "../pluto/log.h"
#include "../pluto/asn1.h"
#include "../pluto/pkcs1.h"
#include "../pluto/pkcs7.h"
#include "../pluto/certs.h"
@@ -604,7 +604,7 @@ int main(int argc, char **argv)
usage("date format must be YYMMDDHHMMSSZ");
{
chunk_t date = { optarg, 13 };
notBefore = asn1totime(&date, ASN1_UTCTIME);
notBefore = asn1_to_time(&date, ASN1_UTCTIME);
}
continue;
@@ -613,7 +613,7 @@ int main(int argc, char **argv)
usage("date format must be YYMMDDHHMMSSZ");
{
chunk_t date = { optarg, 13 };
notAfter = asn1totime(&date, ASN1_UTCTIME);
notAfter = asn1_to_time(&date, ASN1_UTCTIME);
}
continue;
@@ -800,7 +800,7 @@ int main(int argc, char **argv)
if (filetype_in & PKCS1) /* load an RSA key pair from file */
{
prompt_pass_t pass = { "", FALSE, STDIN_FILENO };
const char *path = concatenate_paths(PRIVATE_KEY_PATH, file_in_pkcs1);
char *path = concatenate_paths(PRIVATE_KEY_PATH, file_in_pkcs1);
ugh = load_rsa_private_key(path, &pass, private_key);
}
@@ -877,9 +877,9 @@ int main(int argc, char **argv)
*/
if (filetype_out & PKCS10)
{
const char *path = concatenate_paths(REQ_PATH, file_out_pkcs10);
char *path = concatenate_paths(REQ_PATH, file_out_pkcs10);
if (!chunk_write(pkcs10->request,path, "pkcs10", 0022, force))
if (!chunk_write(pkcs10->request, path, "pkcs10", 0022, force))
exit_scepclient("could not write pkcs10 file '%s'", path);
filetype_out &= ~PKCS10; /* delete PKCS10 flag */
@@ -895,7 +895,7 @@ int main(int argc, char **argv)
*/
if (filetype_out & PKCS1)
{
const char *path = concatenate_paths(PRIVATE_KEY_PATH, file_out_pkcs1);
char *path = concatenate_paths(PRIVATE_KEY_PATH, file_out_pkcs1);
DBG(DBG_CONTROL,
DBG_log("building pkcs1 object:")
@@ -938,7 +938,7 @@ int main(int argc, char **argv)
*/
if (filetype_out & CERT_SELF)
{
const char *path = concatenate_paths(HOST_CERT_PATH, file_out_cert_self);
char *path = concatenate_paths(HOST_CERT_PATH, file_out_cert_self);
if (!chunk_write(x509_signer->certificate, path, "self-signed cert", 0022, force))
exit_scepclient("could not write self-signed cert file '%s'", path);
@@ -955,7 +955,7 @@ int main(int argc, char **argv)
* load ca encryption certificate
*/
{
const char *path = concatenate_paths(CA_CERT_PATH, file_in_cacert_enc);
char *path = concatenate_paths(CA_CERT_PATH, file_in_cacert_enc);
cert_t cert;
if (!load_cert(path, "encryption cacert", &cert))
@@ -994,7 +994,7 @@ int main(int argc, char **argv)
*/
if (filetype_out & PKCS7)
{
const char *path = concatenate_paths(REQ_PATH, file_out_pkcs7);
char *path = concatenate_paths(REQ_PATH, file_out_pkcs7);
if (!chunk_write(pkcs7, path, "pkcs7 encrypted request", 0022, force))
exit_scepclient("could not write pkcs7 file '%s'", path);
@@ -1012,7 +1012,7 @@ int main(int argc, char **argv)
*/
if (filetype_out & CERT)
{
const char *path = concatenate_paths(CA_CERT_PATH, file_in_cacert_sig);
char *path = concatenate_paths(CA_CERT_PATH, file_in_cacert_sig);
cert_t cert;
time_t poll_start;
@@ -1094,7 +1094,7 @@ int main(int argc, char **argv)
envelopedData = data.content;
if (data.type != OID_PKCS7_DATA
|| !parse_asn1_simple_object(&envelopedData, ASN1_OCTET_STRING, 0, "data"))
|| !asn1_parse_simple_object(&envelopedData, ASN1_OCTET_STRING, 0, "data"))
{
exit_scepclient("contentInfo is not of type 'data'");
}