denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

peer_cfg now knows about group memberships

Browse Source
This commit is contained in:
Andreas Steffen
2007-09-13 15:33:17 +00:00
parent eff806eb5a
commit 15a9d460c0
9 changed files with 517 additions and 273 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/Makefile.am
+1
View File
@@ -32,6 +32,7 @@ crypto/hashers/sha1_hasher.c crypto/hashers/sha1_hasher.h \
crypto/hashers/sha2_hasher.c crypto/hashers/sha2_hasher.h \
crypto/hashers/md5_hasher.c crypto/hashers/md5_hasher.h \
crypto/hmac.c crypto/hmac.h \
crypto/ietf_attr_list.c crypto/ietf_attr_list.h \
crypto/ocsp.c crypto/ocsp.h \
crypto/prfs/fips_prf.c crypto/prfs/fips_prf.h \
crypto/prfs/hmac_prf.c crypto/prfs/hmac_prf.h \
src/libstrongswan/crypto/ac.c
+7 -257
View File
@@ -30,8 +30,10 @@
#include <asn1/asn1.h>
#include <asn1/pem.h>
#include <crypto/x509.h>
#include <crypto/ietf_attr_list.h>
#include <utils/identification.h>
#include <utils/linked_list.h>
#include <utils/lexparser.h>
#include "ac.h"
@@ -144,219 +146,6 @@ struct private_x509ac_t {
chunk_t signature;
};
/**
* definition of ietfAttribute kinds
*/
typedef enum {
IETF_ATTRIBUTE_OCTETS = 0,
IETF_ATTRIBUTE_OID = 1,
IETF_ATTRIBUTE_STRING = 2
} ietfAttribute_t;
/**
* access structure for an ietfAttribute
*/
typedef struct ietfAttr_t ietfAttr_t;
struct ietfAttr_t {
/**
* IETF attribute kind
*/
ietfAttribute_t kind;
/**
* IETF attribute valuse
*/
chunk_t value;
/**
* Compares two ietfAttributes
*
* return -1 if this is earlier in the alphabet than other
* return 0 if this equals other
* return +1 if this is later in the alphabet than other
*
* @param this calling object
* @param other other object
*/
int (*compare) (const ietfAttr_t *this ,const ietfAttr_t *other);
/**
* Destroys the ietfAttr_t object.
*
* @param this ietfAttr_t to destroy
*/
void (*destroy) (ietfAttr_t *this);
};
/**
* Implements ietfAttr_t.compare.
*/
static int ietfAttr_compare(const ietfAttr_t *this ,const ietfAttr_t *other)
{
int cmp_len, len, cmp_value;
/* OID attributes are appended after STRING and OCTETS attributes */
if (this->kind != IETF_ATTRIBUTE_OID && other->kind == IETF_ATTRIBUTE_OID)
{
return -1;
}
if (this->kind == IETF_ATTRIBUTE_OID && other->kind != IETF_ATTRIBUTE_OID)
{
return 1;
}
cmp_len = this->value.len - other->value.len;
len = (cmp_len < 0)? this->value.len : other->value.len;
cmp_value = memcmp(this->value.ptr, other->value.ptr, len);
return (cmp_value == 0)? cmp_len : cmp_value;
}
/**
* Adds an ietfAttr_t object to a sorted linked list
*/
static void ietfAttr_add(linked_list_t *list, ietfAttr_t *attr)
{
iterator_t *iterator = list->create_iterator(list, TRUE);
ietfAttr_t *current_attr;
bool found = FALSE;
while (iterator->iterate(iterator, (void **)&current_attr))
{
int cmp = attr->compare(attr, current_attr);
if (cmp > 0)
{
continue;
}
if (cmp == 0)
{
attr->destroy(attr);
}
else
{
iterator->insert_before(iterator, attr);
}
found = TRUE;
break;
}
iterator->destroy(iterator);
if (!found)
{
list->insert_last(list, attr);
}
}
/**
* Create a linked list of ietfAttr_t objects from a string
*/
static void ietfAttr_create_from_string(linked_list_t *list, const char *msg)
{
}
/**
* Lists a linked list of ietfAttr_t objects
*/
static void ietfAttr_list(linked_list_t *list, FILE *out)
{
iterator_t *iterator = list->create_iterator(list, TRUE);
ietfAttr_t *attr;
bool first = TRUE;
while (iterator->iterate(iterator, (void **)&attr))
{
if (first)
{
first = FALSE;
}
else
{
fprintf(out, ", ");
}
switch (attr->kind)
{
case IETF_ATTRIBUTE_OCTETS:
case IETF_ATTRIBUTE_STRING:
fprintf(out, "%.*s", (int)attr->value.len, attr->value.ptr);
break;
case IETF_ATTRIBUTE_OID:
{
int oid = known_oid(attr->value);
if (oid == OID_UNKNOWN)
{
fprintf(out, "0x#B", &attr->value);
}
else
{
fprintf(out, "%s", oid_names[oid]);
}
}
break;
default:
break;
}
}
iterator->destroy(iterator);
}
/**
* Destroys an ietfAttr_t object
*/
static void ietfAttr_destroy(ietfAttr_t *this)
{
free(this->value.ptr);
free(this);
}
/**
* Creates an ietfAttr_t object.
*/
ietfAttr_t *ietfAttr_create(ietfAttribute_t kind, chunk_t value)
{
ietfAttr_t *this = malloc_thing(ietfAttr_t);
/* initialize */
this->kind = kind;
this->value = chunk_clone(value);
/* function */
this->compare = ietfAttr_compare;
this->destroy = ietfAttr_destroy;
return this;
}
/**
* ASN.1 definition of ietfAttrSyntax
*/
static const asn1Object_t ietfAttrSyntaxObjects[] =
{
{ 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */
{ 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT |
ASN1_BODY }, /* 1 */
{ 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */
{ 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */
{ 2, "octets", ASN1_OCTET_STRING, ASN1_OPT |
ASN1_BODY }, /* 4 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 5 */
{ 2, "oid", ASN1_OID, ASN1_OPT |
ASN1_BODY }, /* 6 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 7 */
{ 2, "string", ASN1_UTF8STRING, ASN1_OPT |
ASN1_BODY }, /* 8 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 9 */
{ 1, "end loop", ASN1_EOC, ASN1_END } /* 10 */
};
#define IETF_ATTR_OCTETS 4
#define IETF_ATTR_OID 6
#define IETF_ATTR_STRING 8
#define IETF_ATTR_ROOF 11
/**
* ASN.1 definition of roleSyntax
*/
@@ -548,43 +337,6 @@ static bool parse_directoryName(chunk_t blob, int level, bool implicit, identifi
return has_directoryName;
}
/**
* parses ietfAttrSyntax
*/
static void parse_ietfAttrSyntax(chunk_t blob, int level0, linked_list_t *list)
{
asn1_ctx_t ctx;
chunk_t object;
u_int level;
int objectID = 0;
asn1_init(&ctx, blob, level0, FALSE, FALSE);
while (objectID < IETF_ATTR_ROOF)
{
if (!extract_object(ietfAttrSyntaxObjects, &objectID, &object, &level, &ctx))
{
return;
}
switch (objectID)
{
case IETF_ATTR_OCTETS:
case IETF_ATTR_OID:
case IETF_ATTR_STRING:
{
ietfAttribute_t kind = (objectID - IETF_ATTR_OCTETS) / 2;
ietfAttr_t *attr = ietfAttr_create(kind, object);
ietfAttr_add(list, attr);
}
break;
default:
break;
}
objectID++;
}
}
/**
* parses roleSyntax
*/
@@ -700,10 +452,10 @@ static bool parse_certificate(chunk_t blob, private_x509ac_t *this)
DBG2(" need to parse accessIdentity");
break;
case OID_CHARGING_IDENTITY:
parse_ietfAttrSyntax(object, level, this->charging);
ietfAttr_list_create_from_chunk(object, this->charging, level);
break;
case OID_GROUP:
parse_ietfAttrSyntax(object, level, this->groups);
ietfAttr_list_create_from_chunk(object, this->groups, level);
break;
case OID_ROLE:
parse_roleSyntax(object, level);
@@ -781,7 +533,7 @@ static void list(const private_x509ac_t *this, FILE *out, bool utc)
/* list all group attributes on a single line */
fprintf(out, " groups: ");
ietfAttr_list(this->groups, out);
ietfAttr_list_list(this->groups, out);
fprintf(out, "\n");
fprintf(out, " issuer: '%D'\n", this->issuerName);
@@ -830,10 +582,8 @@ static void destroy(private_x509ac_t *this)
DESTROY_IF(this->holderIssuer);
DESTROY_IF(this->entityName);
DESTROY_IF(this->issuerName);
this->charging->destroy_offset(this->charging,
offsetof(ietfAttr_t, destroy));
this->groups->destroy_offset(this->groups,
offsetof(ietfAttr_t, destroy));
ietfAttr_list_destroy(this->charging);
ietfAttr_list_destroy(this->groups);
free(this->certificate.ptr);
free(this);
}
src/libstrongswan/crypto/ac.h
+5 -4
View File
@@ -26,6 +26,8 @@
#ifndef AC_H_
#define AC_H_
#include <library.h>
typedef struct x509ac_t x509ac_t;
/**
@@ -94,14 +96,13 @@ x509ac_t *x509ac_create_from_chunk(chunk_t chunk);
/**
* @brief Read a x509 attribute certificate from a DER encoded file.
*
*
* @param filename file containing DER encoded data
* @return created x509ac_t certificate, or NULL if invalid.
*
* @return created x509ac_t certificate, or NULL if invalid.
*
* @ingroup crypto
*/
x509ac_t *x509ac_create_from_file(const char *filename);
#endif /* AC_H_ */
src/libstrongswan/crypto/ietf_attr_list.c
+353
View File
@@ -0,0 +1,353 @@
/**
* @file ietf_attr.c
*
* @brief Implementation of ietfAttr_t.
*
*/
/*
* Copyright (C) 2007 Andreas Steffen, Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <string.h>
#include <stdio.h>
#include <debug.h>
#include <asn1/asn1.h>
#include <utils/lexparser.h>
#include "ietf_attr_list.h"
/**
* Private definition of ietfAttribute kinds
*/
typedef enum {
IETF_ATTRIBUTE_OCTETS = 0,
IETF_ATTRIBUTE_OID = 1,
IETF_ATTRIBUTE_STRING = 2
} ietfAttribute_t;
typedef struct ietfAttr_t ietfAttr_t;
/**
* Private definition of an ietfAttribute
*/
struct ietfAttr_t {
/**
* IETF attribute kind
*/
ietfAttribute_t kind;
/**
* IETF attribute valuse
*/
chunk_t value;
/**
* Compares two ietfAttributes
*
* return -1 if this is earlier in the alphabet than other
* return 0 if this equals other
* return +1 if this is later in the alphabet than other
*
* @param this calling object
* @param other other object
*/
int (*compare) (const ietfAttr_t *this ,const ietfAttr_t *other);
/**
* Destroys the ietfAttr_t object.
*
* @param this ietfAttr_t to destroy
*/
void (*destroy) (ietfAttr_t *this);
};
/**
* Implements ietfAttr_t.compare.
*/
static int ietfAttr_compare(const ietfAttr_t *this ,const ietfAttr_t *other)
{
int cmp_len, len, cmp_value;
/* OID attributes are appended after STRING and OCTETS attributes */
if (this->kind != IETF_ATTRIBUTE_OID && other->kind == IETF_ATTRIBUTE_OID)
{
return -1;
}
if (this->kind == IETF_ATTRIBUTE_OID && other->kind != IETF_ATTRIBUTE_OID)
{
return 1;
}
cmp_len = this->value.len - other->value.len;
len = (cmp_len < 0)? this->value.len : other->value.len;
cmp_value = memcmp(this->value.ptr, other->value.ptr, len);
return (cmp_value == 0)? cmp_len : cmp_value;
}
/**
* Implements ietfAttr_t.destroy.
*/
static void ietfAttr_destroy(ietfAttr_t *this)
{
free(this->value.ptr);
free(this);
}
/**
* Creates an ietfAttr_t object.
*/
static ietfAttr_t *ietfAttr_create(ietfAttribute_t kind, chunk_t value)
{
ietfAttr_t *this = malloc_thing(ietfAttr_t);
/* initialize */
this->kind = kind;
this->value = chunk_clone(value);
/* function */
this->compare = ietfAttr_compare;
this->destroy = ietfAttr_destroy;
return this;
}
/**
* Adds an ietfAttr_t object to a sorted linked list
*/
static void ietfAttr_add(linked_list_t *list, ietfAttr_t *attr)
{
iterator_t *iterator = list->create_iterator(list, TRUE);
ietfAttr_t *current_attr;
bool found = FALSE;
while (iterator->iterate(iterator, (void **)&current_attr))
{
int cmp = attr->compare(attr, current_attr);
if (cmp > 0)
{
continue;
}
if (cmp == 0)
{
attr->destroy(attr);
}
else
{
iterator->insert_before(iterator, attr);
}
found = TRUE;
break;
}
iterator->destroy(iterator);
if (!found)
{
list->insert_last(list, attr);
}
}
/*
* Described in header.
*/
bool ietfAttr_list_equals(linked_list_t *list_a, linked_list_t *list_b)
{
bool result = TRUE;
/* lists must have the same number of attributes */
if (list_a->get_count(list_a) != list_b->get_count(list_b))
{
return FALSE;
}
/* empty lists - no attributes */
if (list_a->get_count(list_a) == 0)
{
return TRUE;
}
/* compare two alphabetically-sorted lists */
{
iterator_t *iterator_a = list_a->create_iterator(list_a, TRUE);
iterator_t *iterator_b = list_b->create_iterator(list_b, TRUE);
ietfAttr_t *attr_a, *attr_b;
while (iterator_a->iterate(iterator_a, (void **)&attr_a) &&
iterator_b->iterate(iterator_b, (void **)&attr_b))
{
if (attr_a->compare(attr_a, attr_b) != 0)
{
/* we have a mismatch */
result = FALSE;
break;
}
}
iterator_a->destroy(iterator_a);
iterator_b->destroy(iterator_b);
}
return result;
}
/*
* Described in header.
*/
void ietfAttr_list_list(linked_list_t *list, FILE *out)
{
iterator_t *iterator = list->create_iterator(list, TRUE);
ietfAttr_t *attr;
bool first = TRUE;
while (iterator->iterate(iterator, (void **)&attr))
{
if (first)
{
first = FALSE;
}
else
{
fprintf(out, ", ");
}
switch (attr->kind)
{
case IETF_ATTRIBUTE_OCTETS:
case IETF_ATTRIBUTE_STRING:
fprintf(out, "%.*s", (int)attr->value.len, attr->value.ptr);
break;
case IETF_ATTRIBUTE_OID:
{
int oid = known_oid(attr->value);
if (oid == OID_UNKNOWN)
{
fprintf(out, "0x#B", &attr->value);
}
else
{
fprintf(out, "%s", oid_names[oid]);
}
}
break;
default:
break;
}
}
iterator->destroy(iterator);
}
/*
* Described in header.
*/
void ietfAttr_list_create_from_string(char *msg, linked_list_t *list)
{
chunk_t line = { msg, strlen(msg) };
while (eat_whitespace(&line))
{
chunk_t group;
/* extract the next comma-separated group attribute */
if (!extract_token(&group, ',', &line))
{
group = line;
line.len = 0;
}
/* remove any trailing spaces */
while (group.len > 0 && *(group.ptr + group.len - 1) == ' ')
{
group.len--;
}
/* add the group attribute to the list */
if (group.len > 0)
{
ietfAttr_t *attr = ietfAttr_create(IETF_ATTRIBUTE_STRING, group);
ietfAttr_add(list, attr);
}
}
}
/**
* ASN.1 definition of ietfAttrSyntax
*/
static const asn1Object_t ietfAttrSyntaxObjects[] =
{
{ 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */
{ 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT |
ASN1_BODY }, /* 1 */
{ 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */
{ 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */
{ 2, "octets", ASN1_OCTET_STRING, ASN1_OPT |
ASN1_BODY }, /* 4 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 5 */
{ 2, "oid", ASN1_OID, ASN1_OPT |
ASN1_BODY }, /* 6 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 7 */
{ 2, "string", ASN1_UTF8STRING, ASN1_OPT |
ASN1_BODY }, /* 8 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 9 */
{ 1, "end loop", ASN1_EOC, ASN1_END } /* 10 */
};
#define IETF_ATTR_OCTETS 4
#define IETF_ATTR_OID 6
#define IETF_ATTR_STRING 8
#define IETF_ATTR_ROOF 11
/*
* Described in header.
*/
void ietfAttr_list_create_from_chunk(chunk_t chunk, linked_list_t *list, int level0)
{
asn1_ctx_t ctx;
chunk_t object;
u_int level;
int objectID = 0;
asn1_init(&ctx, chunk, level0, FALSE, FALSE);
while (objectID < IETF_ATTR_ROOF)
{
if (!extract_object(ietfAttrSyntaxObjects, &objectID, &object, &level, &ctx))
{
return;
}
switch (objectID)
{
case IETF_ATTR_OCTETS:
case IETF_ATTR_OID:
case IETF_ATTR_STRING:
{
ietfAttribute_t kind = (objectID - IETF_ATTR_OCTETS) / 2;
ietfAttr_t *attr = ietfAttr_create(kind, object);
ietfAttr_add(list, attr);
}
break;
default:
break;
}
objectID++;
}
}
/*
* Described in header.
*/
void ietfAttr_list_destroy(linked_list_t *list)
{
list->destroy_offset(list, offsetof(ietfAttr_t, destroy));
}
src/libstrongswan/crypto/ietf_attr_list.h
+81
View File
@@ -0,0 +1,81 @@
/**
* @file ietf_attr_list.h
*
* @brief Handling of ietfAttr_t linked lists
*
*/
/*
* Copyright (C) 2007 Andreas Steffen
*
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef IETF_ATTR_LIST_H_
#define IETF_ATTR_LIST_H_
#include <library.h>
#include <utils/linked_list.h>
/**
* @brief Compare two linked lists of ietfAttr_t objects for equality
*
* @param list_a first alphabetically-sorted list
* @param list_b second alphabetically-sorted list
* @return TRUE if equal
*
* @ingroup crypto
*/
bool ietfAttr_list_equals(linked_list_t *list_a, linked_list_t *list_b);
/**
* @brief Lists a linked list of ietfAttr_t objects
*
* @param list alphabetically-sorted linked list of attributes
@param out output file
*
* @ingroup crypto
*/
void ietfAttr_list_list(linked_list_t *list, FILE *out);
/**
* @brief Create a linked list of ietfAttr_t objects from a string
*
* @param msg string with comma-separated group names
* @param list alphabetically-sorted linked list of attributes
*
* @ingroup crypto
*/
void ietfAttr_list_create_from_string(char *msg, linked_list_t *list);
/**
* @brief Create a linked list of ietfAttr_t objects from an ASN.1-coded chunk
*
* @param chunk chunk containing ASN.1-coded attributes
* @param list alphabetically-sorted linked list of attributes
* @param level0 parsing level
*/
void ietfAttr_list_create_from_chunk(chunk_t chunk, linked_list_t *list, int level0);
/**
* @brief Destroys a linked list of ietfAttr_t objects
*
* @param list list to be destroyed
*
* @ingroup crypto
*/
void ietfAttr_list_destroy(linked_list_t *list);
#endif /* IETF_ATTR_LIST_H_ */