From de5609b2974b0a98ebd19178c4a001bc89b30431 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 21 Jun 2021 11:39:07 +0200 Subject: [PATCH 1/3] vici: Use the more generic BUILD_BLOB to parse certificates/public keys --- src/libcharon/plugins/vici/vici_config.c | 4 ++-- src/libcharon/plugins/vici/vici_cred.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c index 2a4d58eab..4659f8f6a 100644 --- a/src/libcharon/plugins/vici/vici_config.c +++ b/src/libcharon/plugins/vici/vici_config.c @@ -1469,7 +1469,7 @@ static bool parse_cert(auth_data_t *auth, auth_rule_t rule, chunk_t v) certificate_t *cert; cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, - BUILD_BLOB_PEM, v, BUILD_END); + BUILD_BLOB, v, BUILD_END); if (cert) { return add_cert(auth, rule, cert); @@ -1504,7 +1504,7 @@ CALLBACK(parse_pubkeys, bool, certificate_t *cert; cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_TRUSTED_PUBKEY, - BUILD_BLOB_PEM, v, BUILD_END); + BUILD_BLOB, v, BUILD_END); if (cert) { return add_cert(auth, AUTH_RULE_SUBJECT_CERT, cert); diff --git a/src/libcharon/plugins/vici/vici_cred.c b/src/libcharon/plugins/vici/vici_cred.c index 6310fdcb8..02a3db7f1 100644 --- a/src/libcharon/plugins/vici/vici_cred.c +++ b/src/libcharon/plugins/vici/vici_cred.c @@ -173,7 +173,7 @@ CALLBACK(load_cert, vici_message_t*, ext_flag = (flag & X509_CA) ? X509_NONE : flag; cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, type, - BUILD_BLOB_PEM, data, + BUILD_BLOB, data, BUILD_X509_FLAG, ext_flag, BUILD_END); if (!cert) From 4dfa31c8a0b197d20fa7bce034c6a3bac2d96cec Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 21 Jun 2021 11:44:51 +0200 Subject: [PATCH 2/3] pubkey: Don't assume blobs are only ASN.1 DER Also forward the blob's type when parsing pubkeys. --- src/libstrongswan/plugins/pubkey/pubkey_cert.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/libstrongswan/plugins/pubkey/pubkey_cert.c b/src/libstrongswan/plugins/pubkey/pubkey_cert.c index a7bf87e5b..68866d2ad 100644 --- a/src/libstrongswan/plugins/pubkey/pubkey_cert.c +++ b/src/libstrongswan/plugins/pubkey/pubkey_cert.c @@ -264,15 +264,20 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args) { public_key_t *key = NULL; chunk_t blob = chunk_empty; + builder_part_t part, blob_type = BUILD_END; identification_t *subject = NULL; time_t notBefore = UNDEFINED_TIME, notAfter = UNDEFINED_TIME; while (TRUE) { - switch (va_arg(args, builder_part_t)) + part = va_arg(args, builder_part_t); + switch (part) { + case BUILD_BLOB: + case BUILD_BLOB_PEM: case BUILD_BLOB_ASN1_DER: blob = va_arg(args, chunk_t); + blob_type = part; continue; case BUILD_PUBLIC_KEY: key = va_arg(args, public_key_t*); @@ -300,7 +305,7 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args) else if (blob.ptr) { key = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY, - BUILD_BLOB_ASN1_DER, blob, BUILD_END); + blob_type, blob, BUILD_END); } if (key) { From 5821f2cc0164f2731e039260a16408f2b307e19c Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 22 Jun 2021 10:35:10 +0200 Subject: [PATCH 3/3] pubkey: Ignore X.509 flags passed to the parser --- src/libstrongswan/plugins/pubkey/pubkey_cert.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/pubkey/pubkey_cert.c b/src/libstrongswan/plugins/pubkey/pubkey_cert.c index 68866d2ad..177785865 100644 --- a/src/libstrongswan/plugins/pubkey/pubkey_cert.c +++ b/src/libstrongswan/plugins/pubkey/pubkey_cert.c @@ -17,6 +17,7 @@ #include +#include #include typedef struct private_pubkey_cert_t private_pubkey_cert_t; @@ -291,6 +292,10 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args) case BUILD_SUBJECT: subject = va_arg(args, identification_t*); continue; + case BUILD_X509_FLAG: + /* just ignore the flags */ + va_arg(args, x509_flag_t); + continue; case BUILD_END: break; default: @@ -313,4 +318,3 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args) } return NULL; } -