denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stroke: Enable BLISS-based public key constraints

Browse Source
This commit is contained in:
Tobias Brunner
2015-03-04 13:54:11 +01:00
parent 83dcb2d46d
commit 31bccf4ba1
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_config.c
+19 -4
View File
@@ -301,7 +301,8 @@ static void build_crl_policy(auth_cfg_t *cfg, bool local, int policy)
static void parse_pubkey_constraints(char *auth, auth_cfg_t *cfg) static void parse_pubkey_constraints(char *auth, auth_cfg_t *cfg)
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
bool rsa = FALSE, ecdsa = FALSE, rsa_len = FALSE, ecdsa_len = FALSE; bool rsa = FALSE, ecdsa = FALSE, bliss = FALSE,
rsa_len = FALSE, ecdsa_len = FALSE, bliss_strength = FALSE;
int strength; int strength;
char *token; char *token;
@@ -328,6 +329,9 @@ static void parse_pubkey_constraints(char *auth, auth_cfg_t *cfg)
{ "sha256", SIGN_ECDSA_256, KEY_ECDSA, }, { "sha256", SIGN_ECDSA_256, KEY_ECDSA, },
{ "sha384", SIGN_ECDSA_384, KEY_ECDSA, }, { "sha384", SIGN_ECDSA_384, KEY_ECDSA, },
{ "sha512", SIGN_ECDSA_521, KEY_ECDSA, }, { "sha512", SIGN_ECDSA_521, KEY_ECDSA, },
{ "sha256", SIGN_BLISS_WITH_SHA256, KEY_BLISS, },
{ "sha384", SIGN_BLISS_WITH_SHA384, KEY_BLISS, },
{ "sha512", SIGN_BLISS_WITH_SHA512, KEY_BLISS, },
}; };
if (rsa_len || ecdsa_len) if (rsa_len || ecdsa_len)
@@ -343,8 +347,12 @@ static void parse_pubkey_constraints(char *auth, auth_cfg_t *cfg)
{ {
cfg->add(cfg, AUTH_RULE_ECDSA_STRENGTH, (uintptr_t)strength); cfg->add(cfg, AUTH_RULE_ECDSA_STRENGTH, (uintptr_t)strength);
} }
else if (bliss_strength)
{
cfg->add(cfg, AUTH_RULE_BLISS_STRENGTH, (uintptr_t)strength);
}
} }
rsa_len = ecdsa_len = FALSE; rsa_len = ecdsa_len = bliss_strength = FALSE;
if (strength) if (strength)
{ {
continue; continue;
@@ -360,6 +368,11 @@ static void parse_pubkey_constraints(char *auth, auth_cfg_t *cfg)
ecdsa = ecdsa_len = TRUE; ecdsa = ecdsa_len = TRUE;
continue; continue;
} }
if (streq(token, "bliss"))
{
bliss = bliss_strength = TRUE;
continue;
}
if (streq(token, "pubkey")) if (streq(token, "pubkey"))
{ {
continue; continue;
@@ -376,7 +389,8 @@ static void parse_pubkey_constraints(char *auth, auth_cfg_t *cfg)
*/ */
if ((rsa && schemes[i].key == KEY_RSA) || if ((rsa && schemes[i].key == KEY_RSA) ||
(ecdsa && schemes[i].key == KEY_ECDSA) || (ecdsa && schemes[i].key == KEY_ECDSA) ||
(!rsa && !ecdsa)) (bliss && schemes[i].key == KEY_BLISS) ||
(!rsa && !ecdsa && !bliss))
{ {
cfg->add(cfg, AUTH_RULE_SIGNATURE_SCHEME, cfg->add(cfg, AUTH_RULE_SIGNATURE_SCHEME,
(uintptr_t)schemes[i].scheme); (uintptr_t)schemes[i].scheme);
@@ -590,7 +604,8 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
/* authentication metod (class, actually) */ /* authentication metod (class, actually) */
if (strpfx(auth, "pubkey") || if (strpfx(auth, "pubkey") ||
strpfx(auth, "rsa") || strpfx(auth, "rsa") ||
strpfx(auth, "ecdsa")) strpfx(auth, "ecdsa") ||
strpfx(auth, "bliss"))
{ {
cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY); cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
build_crl_policy(cfg, local, msg->add_conn.crl_policy); build_crl_policy(cfg, local, msg->add_conn.crl_policy);