denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

conversion from 8 spaces to 4 spaces per tab

Browse Source
This commit is contained in:
Andreas Steffen
2009-04-19 19:16:09 +00:00
parent d940c7638c
commit 3d7a244b54
138 changed files with 47306 additions and 47306 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/scepclient/loglite.c
+144 -144
View File
@@ -23,7 +23,7 @@
#include <errno.h>
#include <string.h>
#include <unistd.h>
#include <signal.h> /* used only if MSG_NOSIGNAL not defined */
#include <signal.h> /* used only if MSG_NOSIGNAL not defined */
#include <libgen.h>
#include <sys/stat.h>
#include <sys/types.h>
@@ -36,118 +36,118 @@
#include <whack.h>
bool
log_to_stderr = FALSE, /* should log go to stderr? */
log_to_syslog = TRUE; /* should log go to syslog? */
log_to_stderr = FALSE, /* should log go to stderr? */
log_to_syslog = TRUE; /* should log go to syslog? */
void
init_log(const char *program)
{
if (log_to_stderr)
setbuf(stderr, NULL);
if (log_to_syslog)
openlog(program, LOG_CONS | LOG_NDELAY | LOG_PID, LOG_AUTHPRIV);
if (log_to_stderr)
setbuf(stderr, NULL);
if (log_to_syslog)
openlog(program, LOG_CONS | LOG_NDELAY | LOG_PID, LOG_AUTHPRIV);
}
void
close_log(void)
{
if (log_to_syslog)
closelog();
if (log_to_syslog)
closelog();
}
void
plog(const char *message, ...)
{
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
if (log_to_stderr)
fprintf(stderr, "%s\n", m);
if (log_to_syslog)
syslog(LOG_WARNING, "%s", m);
if (log_to_stderr)
fprintf(stderr, "%s\n", m);
if (log_to_syslog)
syslog(LOG_WARNING, "%s", m);
}
void
loglog(int mess_no, const char *message, ...)
{
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
if (log_to_stderr)
fprintf(stderr, "%s\n", m);
if (log_to_syslog)
syslog(LOG_WARNING, "%s", m);
if (log_to_stderr)
fprintf(stderr, "%s\n", m);
if (log_to_syslog)
syslog(LOG_WARNING, "%s", m);
}
void
log_errno_routine(int e, const char *message, ...)
{
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
if (log_to_stderr)
fprintf(stderr, "ERROR: %s. Errno %d: %s\n", m, e, strerror(e));
if (log_to_syslog)
syslog(LOG_ERR, "ERROR: %s. Errno %d: %s", m, e, strerror(e));
if (log_to_stderr)
fprintf(stderr, "ERROR: %s. Errno %d: %s\n", m, e, strerror(e));
if (log_to_syslog)
syslog(LOG_ERR, "ERROR: %s. Errno %d: %s", m, e, strerror(e));
}
void
exit_log(const char *message, ...)
{
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
if (log_to_stderr)
fprintf(stderr, "FATAL ERROR: %s\n", m);
if (log_to_syslog)
syslog(LOG_ERR, "FATAL ERROR: %s", m);
exit(1);
if (log_to_stderr)
fprintf(stderr, "FATAL ERROR: %s\n", m);
if (log_to_syslog)
syslog(LOG_ERR, "FATAL ERROR: %s", m);
exit(1);
}
void
exit_log_errno_routine(int e, const char *message, ...)
{
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
if (log_to_stderr)
fprintf(stderr, "FATAL ERROR: %s. Errno %d: %s\n", m, e, strerror(e));
if (log_to_syslog)
syslog(LOG_ERR, "FATAL ERROR: %s. Errno %d: %s", m, e, strerror(e));
exit(1);
if (log_to_stderr)
fprintf(stderr, "FATAL ERROR: %s. Errno %d: %s\n", m, e, strerror(e));
if (log_to_syslog)
syslog(LOG_ERR, "FATAL ERROR: %s. Errno %d: %s", m, e, strerror(e));
exit(1);
}
void
whack_log(int mess_no, const char *message, ...)
{
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
fprintf(stderr, "%s\n", m);
fprintf(stderr, "%s\n", m);
}
/* Build up a diagnostic in a static buffer.
@@ -165,16 +165,16 @@ char diag_space[sizeof(diag_space)];
err_t
builddiag(const char *fmt, ...)
{
static char diag_space[LOG_WIDTH]; /* longer messages will be truncated */
char t[sizeof(diag_space)]; /* build result here first */
va_list args;
static char diag_space[LOG_WIDTH]; /* longer messages will be truncated */
char t[sizeof(diag_space)]; /* build result here first */
va_list args;
va_start(args, fmt);
t[0] = '\0'; /* in case nothing terminates string */
vsnprintf(t, sizeof(t), fmt, args);
va_end(args);
strcpy(diag_space, t);
return diag_space;
va_start(args, fmt);
t[0] = '\0'; /* in case nothing terminates string */
vsnprintf(t, sizeof(t), fmt, args);
va_end(args);
strcpy(diag_space, t);
return diag_space;
}
/* Debugging message support */
@@ -184,29 +184,29 @@ builddiag(const char *fmt, ...)
void
switch_fail(int n, const char *file_str, unsigned long line_no)
{
char buf[30];
char buf[30];
snprintf(buf, sizeof(buf), "case %d unexpected", n);
passert_fail(buf, file_str, line_no);
snprintf(buf, sizeof(buf), "case %d unexpected", n);
passert_fail(buf, file_str, line_no);
}
void
passert_fail(const char *pred_str, const char *file_str, unsigned long line_no)
{
/* we will get a possibly unplanned prefix. Hope it works */
loglog(RC_LOG_SERIOUS, "ASSERTION FAILED at %s:%lu: %s", file_str, line_no, pred_str);
abort(); /* exiting correctly doesn't always work */
/* we will get a possibly unplanned prefix. Hope it works */
loglog(RC_LOG_SERIOUS, "ASSERTION FAILED at %s:%lu: %s", file_str, line_no, pred_str);
abort(); /* exiting correctly doesn't always work */
}
lset_t
base_debugging = DBG_NONE, /* default to reporting nothing */
cur_debugging = DBG_NONE;
base_debugging = DBG_NONE, /* default to reporting nothing */
cur_debugging = DBG_NONE;
void
pexpect_log(const char *pred_str, const char *file_str, unsigned long line_no)
{
/* we will get a possibly unplanned prefix. Hope it works */
loglog(RC_LOG_SERIOUS, "EXPECTATION FAILED at %s:%lu: %s", file_str, line_no, pred_str);
/* we will get a possibly unplanned prefix. Hope it works */
loglog(RC_LOG_SERIOUS, "EXPECTATION FAILED at %s:%lu: %s", file_str, line_no, pred_str);
}
/* log a debugging message (prefixed by "| ") */
@@ -214,17 +214,17 @@ pexpect_log(const char *pred_str, const char *file_str, unsigned long line_no)
void
DBG_log(const char *message, ...)
{
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_list args;
char m[LOG_WIDTH]; /* longer messages will be truncated */
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
va_start(args, message);
vsnprintf(m, sizeof(m), message, args);
va_end(args);
if (log_to_stderr)
fprintf(stderr, "| %s\n", m);
if (log_to_syslog)
syslog(LOG_DEBUG, "| %s", m);
if (log_to_stderr)
fprintf(stderr, "| %s\n", m);
if (log_to_syslog)
syslog(LOG_DEBUG, "| %s", m);
}
/* dump raw bytes in hex to stderr (for lack of any better destination) */
@@ -232,62 +232,62 @@ DBG_log(const char *message, ...)
void
DBG_dump(const char *label, const void *p, size_t len)
{
# define DUMP_LABEL_WIDTH 20 /* arbitrary modest boundary */
# define DUMP_WIDTH (4 * (1 + 4 * 3) + 1)
char buf[DUMP_LABEL_WIDTH + DUMP_WIDTH];
char *bp;
const unsigned char *cp = p;
# define DUMP_LABEL_WIDTH 20 /* arbitrary modest boundary */
# define DUMP_WIDTH (4 * (1 + 4 * 3) + 1)
char buf[DUMP_LABEL_WIDTH + DUMP_WIDTH];
char *bp;
const unsigned char *cp = p;
bp = buf;
if (label != NULL && label[0] != '\0')
{
/* Handle the label. Care must be taken to avoid buffer overrun. */
size_t llen = strlen(label);
if (llen + 1 > sizeof(buf))
{
DBG_log("%s", label);
}
else
{
strcpy(buf, label);
if (buf[llen-1] == '\n')
{
buf[llen-1] = '\0'; /* get rid of newline */
DBG_log("%s", buf);
}
else if (llen < DUMP_LABEL_WIDTH)
{
bp = buf + llen;
}
else
{
DBG_log("%s", buf);
}
}
}
do {
int i, j;
for (i = 0; len!=0 && i!=4; i++)
{
*bp++ = ' ';
for (j = 0; len!=0 && j!=4; len--, j++)
{
static const char hexdig[] = "0123456789abcdef";
*bp++ = ' ';
*bp++ = hexdig[(*cp >> 4) & 0xF];
*bp++ = hexdig[*cp & 0xF];
cp++;
}
}
*bp = '\0';
DBG_log("%s", buf);
bp = buf;
} while (len != 0);
if (label != NULL && label[0] != '\0')
{
/* Handle the label. Care must be taken to avoid buffer overrun. */
size_t llen = strlen(label);
if (llen + 1 > sizeof(buf))
{
DBG_log("%s", label);
}
else
{
strcpy(buf, label);
if (buf[llen-1] == '\n')
{
buf[llen-1] = '\0'; /* get rid of newline */
DBG_log("%s", buf);
}
else if (llen < DUMP_LABEL_WIDTH)
{
bp = buf + llen;
}
else
{
DBG_log("%s", buf);
}
}
}
do {
int i, j;
for (i = 0; len!=0 && i!=4; i++)
{
*bp++ = ' ';
for (j = 0; len!=0 && j!=4; len--, j++)
{
static const char hexdig[] = "0123456789abcdef";
*bp++ = ' ';
*bp++ = hexdig[(*cp >> 4) & 0xF];
*bp++ = hexdig[*cp & 0xF];
cp++;
}
}
*bp = '\0';
DBG_log("%s", buf);
bp = buf;
} while (len != 0);
# undef DUMP_LABEL_WIDTH
# undef DUMP_WIDTH
}
src/scepclient/pkcs10.c
+100 -100
View File
@@ -40,13 +40,13 @@
/* some pre-coded OIDs */
static u_char ASN1_challengePassword_oid_str[] = {
0x06,0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x07
0x06,0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x07
};
static const chunk_t ASN1_challengePassword_oid = chunk_from_buf(ASN1_challengePassword_oid_str);
static u_char ASN1_extensionRequest_oid_str[] = {
0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x0E
0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x09, 0x0E
};
static const chunk_t ASN1_extensionRequest_oid = chunk_from_buf(ASN1_extensionRequest_oid_str);
@@ -54,52 +54,52 @@ static const chunk_t ASN1_extensionRequest_oid = chunk_from_buf(ASN1_extensionRe
/**
* @brief Adds a subjectAltName in DER-coded form to a linked list
*
* @param[in,out] subjectAltNames head of the linked list of subjectAltNames
* @param[in] kind type of the subjectAltName (which is a generalName)
* @param[in] value value of the subjectAltName as an ASCII string
* @param[in,out] subjectAltNames head of the linked list of subjectAltNames
* @param[in] kind type of the subjectAltName (which is a generalName)
* @param[in] value value of the subjectAltName as an ASCII string
*/
void
pkcs10_add_subjectAltName(generalName_t **subjectAltNames, generalNames_t kind
, char *value)
{
generalName_t *gn;
asn1_t asn1_type = ASN1_EOC;
chunk_t name = { value, strlen(value) };
generalName_t *gn;
asn1_t asn1_type = ASN1_EOC;
chunk_t name = { value, strlen(value) };
switch (kind)
{
case GN_RFC822_NAME:
asn1_type = ASN1_CONTEXT_S_1;
break;
case GN_DNS_NAME:
asn1_type = ASN1_CONTEXT_S_2;
break;
case GN_IP_ADDRESS:
switch (kind)
{
struct in_addr addr;
case GN_RFC822_NAME:
asn1_type = ASN1_CONTEXT_S_1;
break;
case GN_DNS_NAME:
asn1_type = ASN1_CONTEXT_S_2;
break;
case GN_IP_ADDRESS:
{
struct in_addr addr;
/* convert an ASCII dotted IPv4 address (e.g. 123.456.78.90)
* to a byte representation in network order
*/
if (!inet_aton(value, &addr))
{
fprintf(stderr, "error in IPv4 subjectAltName\n");
return;
}
asn1_type = ASN1_CONTEXT_S_7;
name.ptr = (u_char *) &addr.s_addr;
name.len = sizeof(addr.s_addr);
break;
}
default:
break;
}
/* convert an ASCII dotted IPv4 address (e.g. 123.456.78.90)
* to a byte representation in network order
*/
if (!inet_aton(value, &addr))
{
fprintf(stderr, "error in IPv4 subjectAltName\n");
return;
}
asn1_type = ASN1_CONTEXT_S_7;
name.ptr = (u_char *) &addr.s_addr;
name.len = sizeof(addr.s_addr);
break;
}
default:
break;
}
gn = malloc_thing(generalName_t);
gn->kind = kind;
gn->name = asn1_simple_object(asn1_type, name);
gn->next = *subjectAltNames;
*subjectAltNames = gn;
gn = malloc_thing(generalName_t);
gn->kind = kind;
gn->name = asn1_simple_object(asn1_type, name);
gn->next = *subjectAltNames;
*subjectAltNames = gn;
}
/**
@@ -108,71 +108,71 @@ pkcs10_add_subjectAltName(generalName_t **subjectAltNames, generalNames_t kind
* challenge password ans subjectAltNames are only included,
* when avaiable in given #pkcs10_t structure
*
* @param[in] pkcs10 Pointer to a #pkcs10_t structure
* @return 1 if succeeded, 0 otherwise
* @param[in] pkcs10 Pointer to a #pkcs10_t structure
* @return 1 if succeeded, 0 otherwise
*/
static chunk_t
build_req_info_attributes(pkcs10_t* pkcs10)
{
chunk_t subjectAltNames = chunk_empty;
chunk_t challengePassword = chunk_empty;
chunk_t subjectAltNames = chunk_empty;
chunk_t challengePassword = chunk_empty;
if (pkcs10->subjectAltNames != NULL)
{
if (pkcs10->subjectAltNames != NULL)
{
subjectAltNames = asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_extensionRequest_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_wrap(ASN1_SEQUENCE, "m"
, build_subjectAltNames(pkcs10->subjectAltNames)
)
)
);
}
subjectAltNames = asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_extensionRequest_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_wrap(ASN1_SEQUENCE, "m"
, build_subjectAltNames(pkcs10->subjectAltNames)
)
)
);
}
if (pkcs10->challengePassword.len > 0)
{
asn1_t type = is_printablestring(pkcs10->challengePassword)
? ASN1_PRINTABLESTRING : ASN1_T61STRING;
if (pkcs10->challengePassword.len > 0)
{
asn1_t type = is_printablestring(pkcs10->challengePassword)
? ASN1_PRINTABLESTRING : ASN1_T61STRING;
challengePassword = asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_challengePassword_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_simple_object(type, pkcs10->challengePassword)
)
);
}
challengePassword = asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_challengePassword_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_simple_object(type, pkcs10->challengePassword)
)
);
}
return asn1_wrap(ASN1_CONTEXT_C_0, "mm"
, subjectAltNames
, challengePassword);
return asn1_wrap(ASN1_CONTEXT_C_0, "mm"
, subjectAltNames
, challengePassword);
}
/**
* @brief Builds a DER-code pkcs#10 certificate request
*
* @param[in] pkcs10 pointer to a pkcs10_t struct
* @return DER-code pkcs10 request
* @param[in] pkcs10 pointer to a pkcs10_t struct
* @return DER-code pkcs10 request
*/
static chunk_t
pkcs10_build_request(pkcs10_t *pkcs10, int signature_alg)
{
RSA_public_key_t *rsak = (RSA_public_key_t *) pkcs10->private_key;
RSA_public_key_t *rsak = (RSA_public_key_t *) pkcs10->private_key;
chunk_t cert_req_info = asn1_wrap(ASN1_SEQUENCE, "ccmm"
, ASN1_INTEGER_0
, pkcs10->subject
, pkcs1_build_publicKeyInfo(rsak)
, build_req_info_attributes(pkcs10));
chunk_t cert_req_info = asn1_wrap(ASN1_SEQUENCE, "ccmm"
, ASN1_INTEGER_0
, pkcs10->subject
, pkcs1_build_publicKeyInfo(rsak)
, build_req_info_attributes(pkcs10));
chunk_t signature = pkcs1_build_signature(cert_req_info
, signature_alg, pkcs10->private_key, TRUE);
chunk_t signature = pkcs1_build_signature(cert_req_info
, signature_alg, pkcs10->private_key, TRUE);
return asn1_wrap(ASN1_SEQUENCE, "mcm"
, cert_req_info
, asn1_algorithmIdentifier(signature_alg)
, signature);
return asn1_wrap(ASN1_SEQUENCE, "mcm"
, cert_req_info
, asn1_algorithmIdentifier(signature_alg)
, signature);
}
/**
@@ -183,38 +183,38 @@ pkcs10_build_request(pkcs10_t *pkcs10, int signature_alg)
* (e.g. commonName, organization) are needed. An optional challenge
* password or some subjectAltNames may be included.
*
* @param[in] key rsakey of type #rsakey_t
* @param[in] subject DER-coded subject distinguished name
* @param[in] challengePassword challenge password or chunk_empty
* @param[in] subjectAltNames linked list of subjectAltNames or NULL
* @return pointer to a #pkcs10_t object
* @param[in] key rsakey of type #rsakey_t
* @param[in] subject DER-coded subject distinguished name
* @param[in] challengePassword challenge password or chunk_empty
* @param[in] subjectAltNames linked list of subjectAltNames or NULL
* @return pointer to a #pkcs10_t object
*/
pkcs10_t*
pkcs10_build(RSA_private_key_t *key, chunk_t subject, chunk_t challengePassword
, generalName_t *subjectAltNames, int signature_alg)
{
pkcs10_t *pkcs10 = malloc_thing(pkcs10_t);
pkcs10_t *pkcs10 = malloc_thing(pkcs10_t);
pkcs10->subject = subject;
pkcs10->private_key = key;
pkcs10->challengePassword = challengePassword;
pkcs10->subjectAltNames = subjectAltNames;
pkcs10->subject = subject;
pkcs10->private_key = key;
pkcs10->challengePassword = challengePassword;
pkcs10->subjectAltNames = subjectAltNames;
pkcs10->request = pkcs10_build_request(pkcs10, signature_alg);
return pkcs10;
pkcs10->request = pkcs10_build_request(pkcs10, signature_alg);
return pkcs10;
}
/**
* @brief Frees the resources used by an #pkcs10_t object
*
* @param[in] pkcs10 #pkcs10_t to free
* @param[in] pkcs10 #pkcs10_t to free
*/
void
pkcs10_free(pkcs10_t *pkcs10)
{
if (pkcs10 != NULL)
{
free(pkcs10->request.ptr);
free(pkcs10);
}
if (pkcs10 != NULL)
{
free(pkcs10->request.ptr);
free(pkcs10);
}
}
src/scepclient/pkcs10.h
+9 -9
View File
@@ -4,7 +4,7 @@
*
* Contains functions to build DER encoded pkcs#10 certificate requests
*/
/*
* Copyright (C) 2005 Jan Hutter, Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -38,20 +38,20 @@ typedef struct pkcs10_struct pkcs10_t;
* The RSA private key is needed to compute the signature of the given request
*/
struct pkcs10_struct {
RSA_private_key_t *private_key;
chunk_t request;
chunk_t subject;
chunk_t challengePassword;
generalName_t *subjectAltNames;
RSA_private_key_t *private_key;
chunk_t request;
chunk_t subject;
chunk_t challengePassword;
generalName_t *subjectAltNames;
};
extern const pkcs10_t empty_pkcs10;
extern void pkcs10_add_subjectAltName(generalName_t **subjectAltNames
, generalNames_t kind, char *value);
, generalNames_t kind, char *value);
extern pkcs10_t* pkcs10_build(RSA_private_key_t *key, chunk_t subject
, chunk_t challengePassword, generalName_t *subjectAltNames
, int signature_alg);
, chunk_t challengePassword, generalName_t *subjectAltNames
, int signature_alg);
extern void pkcs10_free(pkcs10_t *pkcs10);
#endif /* _PKCS10_H */
src/scepclient/rsakey.c
+217 -217
View File
@@ -20,7 +20,7 @@
*
* $Id: rsakey.c,v 1.5 2006/01/04 21:16:30 as Exp $
*/
#include <stdlib.h>
#include <sys/types.h>
@@ -42,62 +42,62 @@
#include "rsakey.h"
/* Number of times the probabilistic primality test is applied */
#define PRIMECHECK_ROUNDS 30
#define PRIMECHECK_ROUNDS 30
/* Public exponent used for signature key generation */
#define PUBLIC_EXPONENT 0x10001
#define PUBLIC_EXPONENT 0x10001
#ifndef DEV_RANDOM
#define DEV_RANDOM "/dev/random"
#define DEV_RANDOM "/dev/random"
#endif
/**
* @brief Reads a specific number of bytes from a given device/file
*
* @param[in] nbytes number of bytes to read from random device
* @param[out] buf pointer to buffer where to write the data in.
* size of buffer has to be at least nbytes.
* @return TRUE, if succeeded, FALSE otherwise
* @param[in] nbytes number of bytes to read from random device
* @param[out] buf pointer to buffer where to write the data in.
* size of buffer has to be at least nbytes.
* @return TRUE, if succeeded, FALSE otherwise
*/
static bool
get_true_random_bytes(size_t nbytes, char *buf)
{
size_t ndone;
size_t got;
char *device = DEV_RANDOM;
size_t ndone;
size_t got;
char *device = DEV_RANDOM;
int dev = open(DEV_RANDOM, 0);
int dev = open(DEV_RANDOM, 0);
if (dev < 0)
{
fprintf(stderr, "could not open random device %s", device);
return FALSE;
}
DBG(DBG_CONTROL,
DBG_log("getting %d bytes from %s...", (int) nbytes, device)
)
ndone = 0;
while (ndone < nbytes)
{
got = read(dev, buf + ndone, nbytes - ndone);
if (got < 0)
if (dev < 0)
{
fprintf(stderr, "read error on %s", device);
return FALSE;
fprintf(stderr, "could not open random device %s", device);
return FALSE;
}
if (got == 0)
DBG(DBG_CONTROL,
DBG_log("getting %d bytes from %s...", (int) nbytes, device)
)
ndone = 0;
while (ndone < nbytes)
{
fprintf(stderr, "eof on %s", device);
return FALSE;
got = read(dev, buf + ndone, nbytes - ndone);
if (got < 0)
{
fprintf(stderr, "read error on %s", device);
return FALSE;
}
if (got == 0)
{
fprintf(stderr, "eof on %s", device);
return FALSE;
}
ndone += got;
}
ndone += got;
}
close(dev);
return TRUE;
close(dev);
return TRUE;
}
/**
@@ -109,25 +109,25 @@ get_true_random_bytes(size_t nbytes, char *buf)
* Note that highmost and lowmost bits are forced on -- highmost to give a
* number of exactly the specified length, lowmost so it is an odd number.
*
* @param[out] var uninitialized mpz_t to store th random number in
* @param[in] nbits length of var in bits (known to be a multiple of BITS_PER_BYTE)
* @return TRUE on success, FALSE otherwise
* @param[out] var uninitialized mpz_t to store th random number in
* @param[in] nbits length of var in bits (known to be a multiple of BITS_PER_BYTE)
* @return TRUE on success, FALSE otherwise
*/
static bool
init_random(mpz_t var, int nbits)
{
size_t nbytes = (size_t)(nbits/BITS_PER_BYTE);
char random_buf[RSA_MAX_OCTETS/2];
size_t nbytes = (size_t)(nbits/BITS_PER_BYTE);
char random_buf[RSA_MAX_OCTETS/2];
assert(nbytes <= sizeof(random_buf));
assert(nbytes <= sizeof(random_buf));
if (!get_true_random_bytes(nbytes, random_buf))
return FALSE;
random_buf[0] |= 01 << (BITS_PER_BYTE-1); /* force high bit on */
random_buf[nbytes-1] |= 01; /* force low bit on */
n_to_mpz(var, random_buf, nbytes);
return TRUE;
if (!get_true_random_bytes(nbytes, random_buf))
return FALSE;
random_buf[0] |= 01 << (BITS_PER_BYTE-1); /* force high bit on */
random_buf[nbytes-1] |= 01; /* force low bit on */
n_to_mpz(var, random_buf, nbytes);
return TRUE;
}
/**
@@ -136,54 +136,54 @@ init_random(mpz_t var, int nbits)
* Efficiency tweak: we reject candidates that are 1 higher than a multiple
* of e, since they will make the internal modulus not relatively prime to e.
*
* @param[out] var mpz_t variable to initialize
* @param[in] nbits length of given prime in bits (known to be a multiple of BITS_PER_BYTE)
* @param[in] eval E-Value, 0 means don't bother w. tweak
* @return 1 on success, 0 otherwise
* @param[out] var mpz_t variable to initialize
* @param[in] nbits length of given prime in bits (known to be a multiple of BITS_PER_BYTE)
* @param[in] eval E-Value, 0 means don't bother w. tweak
* @return 1 on success, 0 otherwise
*/
static bool
init_prime(mpz_t var, int nbits, int eval)
{
unsigned long tries;
size_t len;
unsigned long tries;
size_t len;
/* get a random value of nbits length */
if (!init_random(var, nbits))
return FALSE;
/* get a random value of nbits length */
if (!init_random(var, nbits))
return FALSE;
/* check if odd number */
assert(mpz_fdiv_ui(var, 2) == 1);
DBG(DBG_CONTROLMORE,
DBG_log("looking for a prime starting there (can take a while)...")
)
tries = 1;
while (mpz_fdiv_ui(var, eval) == 1
|| !mpz_probab_prime_p(var, PRIMECHECK_ROUNDS))
{
/* not a prime, increase by 2 */
mpz_add_ui(var, var, 2);
tries++;
}
len = mpz_sizeinbase(var, 2);
/* check bit length of primee */
assert(len == (size_t)nbits || len == (size_t)(nbits+1));
if (len == (size_t)(nbits+1))
{
/* check if odd number */
assert(mpz_fdiv_ui(var, 2) == 1);
DBG(DBG_CONTROLMORE,
DBG_log("carry out occurred (!), retrying...")
DBG_log("looking for a prime starting there (can take a while)...")
)
mpz_clear(var);
/* recursive call */
return init_prime(var, nbits, eval);
}
DBG(DBG_CONTROLMORE,
DBG_log("found it after %lu tries.",tries)
)
return TRUE;
tries = 1;
while (mpz_fdiv_ui(var, eval) == 1
|| !mpz_probab_prime_p(var, PRIMECHECK_ROUNDS))
{
/* not a prime, increase by 2 */
mpz_add_ui(var, var, 2);
tries++;
}
len = mpz_sizeinbase(var, 2);
/* check bit length of primee */
assert(len == (size_t)nbits || len == (size_t)(nbits+1));
if (len == (size_t)(nbits+1))
{
DBG(DBG_CONTROLMORE,
DBG_log("carry out occurred (!), retrying...")
)
mpz_clear(var);
/* recursive call */
return init_prime(var, nbits, eval);
}
DBG(DBG_CONTROLMORE,
DBG_log("found it after %lu tries.",tries)
)
return TRUE;
}
/**
@@ -194,158 +194,158 @@ init_prime(mpz_t var, int nbits, int eval)
* These mpz_t parameters must not be initialized and have
* to be cleared with mpz_clear after using.
*
* @param[in] nbits size of rsa key in bits
* @return RSA_public_key_t containing the generated RSA key
* @param[in] nbits size of rsa key in bits
* @return RSA_public_key_t containing the generated RSA key
*/
err_t
generate_rsa_private_key(int nbits, RSA_private_key_t *key)
{
mpz_t p, q, n, e, d, exp1, exp2, coeff;
mpz_t m, q1, t; /* temporary variables*/
mpz_t p, q, n, e, d, exp1, exp2, coeff;
mpz_t m, q1, t; /* temporary variables*/
DBG(DBG_CONTROL,
DBG_log("generating %d bit RSA key:", nbits)
)
DBG(DBG_CONTROL,
DBG_log("generating %d bit RSA key:", nbits)
)
if (nbits <= 0)
return "negative rsa key length!";
if (nbits <= 0)
return "negative rsa key length!";
/* Get values of primes p and q */
DBG(DBG_CONTROLMORE,
DBG_log("initialize prime p")
)
if (!init_prime(p, nbits/2, PUBLIC_EXPONENT))
return "could not generate prime p";
DBG(DBG_CONTROLMORE,
DBG_log("initialize prime q")
)
if (!init_prime(q, nbits/2, PUBLIC_EXPONENT))
return "could not generate prime q";
mpz_init(t);
/* Swapping primes so p is larger then q */
if (mpz_cmp(p, q) < 0)
{
/* Get values of primes p and q */
DBG(DBG_CONTROLMORE,
DBG_log("swapping primes so p is the larger...")
);
mpz_set(t, p);
mpz_set(p, q);
mpz_set(q, t);
}
DBG(DBG_CONTROLMORE,
DBG_log("computing modulus...")
)
mpz_init(n);
/* n = p*q */
mpz_mul(n, p, q);
DBG_log("initialize prime p")
)
if (!init_prime(p, nbits/2, PUBLIC_EXPONENT))
return "could not generate prime p";
/* Assign e the value of defined PUBLIC_EXPONENT */
mpz_init_set_ui(e, PUBLIC_EXPONENT);
DBG(DBG_CONTROLMORE,
DBG_log("initialize prime q")
)
if (!init_prime(q, nbits/2, PUBLIC_EXPONENT))
return "could not generate prime q";
mpz_init(t);
DBG(DBG_CONTROLMORE,
DBG_log("computing lcm(p-1, q-1)...")
)
/* m = p */
mpz_init_set(m, p);
/* m = m-1 */
mpz_sub_ui(m, m, 1);
/* q1 = q */
mpz_init_set(q1, q);
/* q1 = q1-1 */
mpz_sub_ui(q1, q1, 1);
/* t = gcd(p-1, q-1) */
mpz_gcd(t, m, q1);
/* m = (p-1)*(q-1) */
mpz_mul(m, m, q1);
/* m = m / t */
mpz_divexact(m, m, t);
/* t = gcd(m, e) (greatest common divisor) */
mpz_gcd(t, m, e);
/* m and e relatively prime */
assert(mpz_cmp_ui(t, 1) == 0);
/* Swapping primes so p is larger then q */
if (mpz_cmp(p, q) < 0)
{
DBG(DBG_CONTROLMORE,
DBG_log("swapping primes so p is the larger...")
);
mpz_set(t, p);
mpz_set(p, q);
mpz_set(q, t);
}
DBG(DBG_CONTROLMORE,
DBG_log("computing modulus...")
)
mpz_init(n);
/* n = p*q */
mpz_mul(n, p, q);
/* decryption key */
DBG(DBG_CONTROLMORE,
DBG_log("computing d...")
)
mpz_init(d);
/* e has an inverse mod m */
assert(mpz_invert(d, e, m));
/* Assign e the value of defined PUBLIC_EXPONENT */
mpz_init_set_ui(e, PUBLIC_EXPONENT);
/* make sure d is positive */
if (mpz_cmp_ui(d, 0) < 0)
mpz_add(d, d, m);
DBG(DBG_CONTROLMORE,
DBG_log("computing lcm(p-1, q-1)...")
)
/* m = p */
mpz_init_set(m, p);
/* m = m-1 */
mpz_sub_ui(m, m, 1);
/* q1 = q */
mpz_init_set(q1, q);
/* q1 = q1-1 */
mpz_sub_ui(q1, q1, 1);
/* t = gcd(p-1, q-1) */
mpz_gcd(t, m, q1);
/* m = (p-1)*(q-1) */
mpz_mul(m, m, q1);
/* m = m / t */
mpz_divexact(m, m, t);
/* t = gcd(m, e) (greatest common divisor) */
mpz_gcd(t, m, e);
/* m and e relatively prime */
assert(mpz_cmp_ui(t, 1) == 0);
/* d has to be positive */
assert(mpz_cmp(d, m) < 0);
/* decryption key */
DBG(DBG_CONTROLMORE,
DBG_log("computing d...")
)
mpz_init(d);
/* e has an inverse mod m */
assert(mpz_invert(d, e, m));
/* the speedup hacks */
DBG(DBG_CONTROLMORE,
DBG_log("computing exp1, exp1, coeff...")
)
mpz_init(exp1);
/* t = p-1 */
mpz_sub_ui(t, p, 1);
/* exp1 = d mod p-1 */
mpz_mod(exp1, d, t);
/* make sure d is positive */
if (mpz_cmp_ui(d, 0) < 0)
mpz_add(d, d, m);
mpz_init(exp2);
/* t = q-1 */
mpz_sub_ui(t, q, 1);
/* exp2 = d mod q-1 */
mpz_mod(exp2, d, t);
/* d has to be positive */
assert(mpz_cmp(d, m) < 0);
mpz_init(coeff);
/* coeff = q^-1 mod p */
mpz_invert(coeff, q, p);
/* the speedup hacks */
DBG(DBG_CONTROLMORE,
DBG_log("computing exp1, exp1, coeff...")
)
mpz_init(exp1);
/* t = p-1 */
mpz_sub_ui(t, p, 1);
/* exp1 = d mod p-1 */
mpz_mod(exp1, d, t);
/* make sure coeff is positive */
if (mpz_cmp_ui(coeff, 0) < 0)
mpz_add(coeff, coeff, p);
mpz_init(exp2);
/* t = q-1 */
mpz_sub_ui(t, q, 1);
/* exp2 = d mod q-1 */
mpz_mod(exp2, d, t);
/* coeff has to be positive */
assert(mpz_cmp(coeff, p) < 0);
mpz_init(coeff);
/* coeff = q^-1 mod p */
mpz_invert(coeff, q, p);
/* Clear temporary variables */
mpz_clear(q1);
mpz_clear(m);
mpz_clear(t);
/* make sure coeff is positive */
if (mpz_cmp_ui(coeff, 0) < 0)
mpz_add(coeff, coeff, p);
/* form FreeS/WAN keyid */
{
size_t e_len = (mpz_sizeinbase(e,2)+BITS_PER_BYTE-1)/BITS_PER_BYTE;
size_t n_len = (mpz_sizeinbase(n,2)+BITS_PER_BYTE-1)/BITS_PER_BYTE;
chunk_t e_ch = mpz_to_n(e, e_len);
chunk_t n_ch = mpz_to_n(n, n_len);
/* coeff has to be positive */
assert(mpz_cmp(coeff, p) < 0);
form_keyid(e_ch, n_ch, key->pub.keyid, &key->pub.k);
free(e_ch.ptr);
free(n_ch.ptr);
}
/* Clear temporary variables */
mpz_clear(q1);
mpz_clear(m);
mpz_clear(t);
/* fill in the elements of the RSA private key */
key->p = *p;
key->q = *q;
key->pub.n = *n;
key->pub.e = *e;
key->d = *d;
key->dP = *exp1;
key->dQ = *exp2;
key->qInv = *coeff;
/* form FreeS/WAN keyid */
{
size_t e_len = (mpz_sizeinbase(e,2)+BITS_PER_BYTE-1)/BITS_PER_BYTE;
size_t n_len = (mpz_sizeinbase(n,2)+BITS_PER_BYTE-1)/BITS_PER_BYTE;
chunk_t e_ch = mpz_to_n(e, e_len);
chunk_t n_ch = mpz_to_n(n, n_len);
DBG(DBG_CONTROL,
DBG_log("RSA key *%s generated with %d bits", key->pub.keyid
, (int)mpz_sizeinbase(n,2))
)
form_keyid(e_ch, n_ch, key->pub.keyid, &key->pub.k);
free(e_ch.ptr);
free(n_ch.ptr);
}
/* fill in the elements of the RSA private key */
key->p = *p;
key->q = *q;
key->pub.n = *n;
key->pub.e = *e;
key->d = *d;
key->dP = *exp1;
key->dQ = *exp2;
key->qInv = *coeff;
DBG(DBG_CONTROL,
DBG_log("RSA key *%s generated with %d bits", key->pub.keyid
, (int)mpz_sizeinbase(n,2))
)
#ifdef DEBUG
DBG(DBG_PRIVATE,
RSA_show_private_key(key)
)
DBG(DBG_PRIVATE,
RSA_show_private_key(key)
)
#endif
return NULL;
return NULL;
}
src/scepclient/rsakey.h
+1 -1
View File
@@ -20,7 +20,7 @@
*
* $Id: rsakey.h,v 1.2 2005/08/11 21:52:56 as Exp $
*/
#ifndef RSAKEY_H_
#define RSAKEY_H_
src/scepclient/scep.c
+360 -360
View File
@@ -41,23 +41,23 @@
#include "scep.h"
static char ASN1_messageType_oid_str[] = {
0x06, 0x0A, 0x60, 0x86, 0x48, 0x01, 0x86, 0xF8, 0x45, 0x01, 0x09, 0x02
0x06, 0x0A, 0x60, 0x86, 0x48, 0x01, 0x86, 0xF8, 0x45, 0x01, 0x09, 0x02
};
static char ASN1_senderNonce_oid_str[] = {
0x06, 0x0A, 0x60, 0x86, 0x48, 0x01, 0x86, 0xF8, 0x45, 0x01, 0x09, 0x05
0x06, 0x0A, 0x60, 0x86, 0x48, 0x01, 0x86, 0xF8, 0x45, 0x01, 0x09, 0x05
};
static char ASN1_transId_oid_str[] = {
0x06, 0x0A, 0x60, 0x86, 0x48, 0x01, 0x86, 0xF8, 0x45, 0x01, 0x09, 0x07
0x06, 0x0A, 0x60, 0x86, 0x48, 0x01, 0x86, 0xF8, 0x45, 0x01, 0x09, 0x07
};
static const chunk_t ASN1_messageType_oid =
chunk_from_buf(ASN1_messageType_oid_str);
chunk_from_buf(ASN1_messageType_oid_str);
static const chunk_t ASN1_senderNonce_oid =
chunk_from_buf(ASN1_senderNonce_oid_str);
chunk_from_buf(ASN1_senderNonce_oid_str);
static const chunk_t ASN1_transId_oid =
chunk_from_buf(ASN1_transId_oid_str);
chunk_from_buf(ASN1_transId_oid_str);
static const char *pkiStatus_values[] = { "0", "2", "3" };
@@ -99,18 +99,18 @@ const scep_attributes_t empty_scep_attributes = {
/* ASN.1 definition of the X.501 atttribute type */
static const asn1Object_t attributesObjects[] = {
{ 0, "attributes", ASN1_SET, ASN1_LOOP }, /* 0 */
{ 1, "attribute", ASN1_SEQUENCE, ASN1_NONE }, /* 1 */
{ 2, "type", ASN1_OID, ASN1_BODY }, /* 2 */
{ 2, "values", ASN1_SET, ASN1_LOOP }, /* 3 */
{ 3, "value", ASN1_EOC, ASN1_RAW }, /* 4 */
{ 2, "end loop", ASN1_EOC, ASN1_END }, /* 5 */
{ 0, "end loop", ASN1_EOC, ASN1_END }, /* 6 */
{ 0, "attributes", ASN1_SET, ASN1_LOOP }, /* 0 */
{ 1, "attribute", ASN1_SEQUENCE, ASN1_NONE }, /* 1 */
{ 2, "type", ASN1_OID, ASN1_BODY }, /* 2 */
{ 2, "values", ASN1_SET, ASN1_LOOP }, /* 3 */
{ 3, "value", ASN1_EOC, ASN1_RAW }, /* 4 */
{ 2, "end loop", ASN1_EOC, ASN1_END }, /* 5 */
{ 0, "end loop", ASN1_EOC, ASN1_END }, /* 6 */
};
#define ATTRIBUTE_OBJ_TYPE 2
#define ATTRIBUTE_OBJ_VALUE 4
#define ATTRIBUTE_OBJ_ROOF 7
#define ATTRIBUTE_OBJ_TYPE 2
#define ATTRIBUTE_OBJ_VALUE 4
#define ATTRIBUTE_OBJ_ROOF 7
/*
* extract and store an attribute
@@ -119,112 +119,112 @@ static bool
extract_attribute(int oid, chunk_t object, u_int level
, scep_attributes_t *attrs)
{
asn1_t type = ASN1_EOC;
const char *name = "none";
asn1_t type = ASN1_EOC;
const char *name = "none";
switch (oid)
{
case OID_PKCS9_CONTENT_TYPE:
type = ASN1_OID;
name = "contentType";
break;
case OID_PKCS9_SIGNING_TIME:
type = ASN1_UTCTIME;
name = "signingTime";
break;
case OID_PKCS9_MESSAGE_DIGEST:
type = ASN1_OCTET_STRING;
name = "messageDigest";
break;
case OID_PKI_MESSAGE_TYPE:
type = ASN1_PRINTABLESTRING;
name = "messageType";
break;
case OID_PKI_STATUS:
type = ASN1_PRINTABLESTRING;
name = "pkiStatus";
break;
case OID_PKI_FAIL_INFO:
type = ASN1_PRINTABLESTRING;
name = "failInfo";
break;
case OID_PKI_SENDER_NONCE:
type = ASN1_OCTET_STRING;
name = "senderNonce";
break;
case OID_PKI_RECIPIENT_NONCE:
type = ASN1_OCTET_STRING;
name = "recipientNonce";
break;
case OID_PKI_TRANS_ID:
type = ASN1_PRINTABLESTRING;
name = "transID";
break;
default:
break;
}
switch (oid)
{
case OID_PKCS9_CONTENT_TYPE:
type = ASN1_OID;
name = "contentType";
break;
case OID_PKCS9_SIGNING_TIME:
type = ASN1_UTCTIME;
name = "signingTime";
break;
case OID_PKCS9_MESSAGE_DIGEST:
type = ASN1_OCTET_STRING;
name = "messageDigest";
break;
case OID_PKI_MESSAGE_TYPE:
type = ASN1_PRINTABLESTRING;
name = "messageType";
break;
case OID_PKI_STATUS:
type = ASN1_PRINTABLESTRING;
name = "pkiStatus";
break;
case OID_PKI_FAIL_INFO:
type = ASN1_PRINTABLESTRING;
name = "failInfo";
break;
case OID_PKI_SENDER_NONCE:
type = ASN1_OCTET_STRING;
name = "senderNonce";
break;
case OID_PKI_RECIPIENT_NONCE:
type = ASN1_OCTET_STRING;
name = "recipientNonce";
break;
case OID_PKI_TRANS_ID:
type = ASN1_PRINTABLESTRING;
name = "transID";
break;
default:
break;
}
if (type == ASN1_EOC)
if (type == ASN1_EOC)
return TRUE;
if (!parse_asn1_simple_object(&object, type, level+1, name))
return FALSE;
switch (oid)
{
case OID_PKCS9_CONTENT_TYPE:
break;
case OID_PKCS9_SIGNING_TIME:
break;
case OID_PKCS9_MESSAGE_DIGEST:
break;
case OID_PKI_MESSAGE_TYPE:
{
scep_msg_t m;
for (m = SCEP_CertRep_MSG; m < SCEP_Unknown_MSG; m++)
{
if (strncmp(msgType_values[m], object.ptr, object.len) == 0)
attrs->msgType = m;
}
DBG(DBG_CONTROL,
DBG_log("messageType: %s", msgType_names[attrs->msgType])
)
}
break;
case OID_PKI_STATUS:
{
pkiStatus_t s;
for (s = SCEP_SUCCESS; s < SCEP_UNKNOWN; s++)
{
if (strncmp(pkiStatus_values[s], object.ptr, object.len) == 0)
attrs->pkiStatus = s;
}
DBG(DBG_CONTROL,
DBG_log("pkiStatus: %s", pkiStatus_names[attrs->pkiStatus])
)
}
break;
case OID_PKI_FAIL_INFO:
if (object.len == 1
&& *object.ptr >= '0' && *object.ptr <= '4')
{
attrs->failInfo = (failInfo_t)(*object.ptr - '0');
}
if (attrs->failInfo != SCEP_unknown_REASON)
plog("failInfo: %s", failInfo_reasons[attrs->failInfo]);
break;
case OID_PKI_SENDER_NONCE:
attrs->senderNonce = object;
break;
case OID_PKI_RECIPIENT_NONCE:
attrs->recipientNonce = object;
break;
case OID_PKI_TRANS_ID:
attrs->transID = object;
}
return TRUE;
if (!parse_asn1_simple_object(&object, type, level+1, name))
return FALSE;
switch (oid)
{
case OID_PKCS9_CONTENT_TYPE:
break;
case OID_PKCS9_SIGNING_TIME:
break;
case OID_PKCS9_MESSAGE_DIGEST:
break;
case OID_PKI_MESSAGE_TYPE:
{
scep_msg_t m;
for (m = SCEP_CertRep_MSG; m < SCEP_Unknown_MSG; m++)
{
if (strncmp(msgType_values[m], object.ptr, object.len) == 0)
attrs->msgType = m;
}
DBG(DBG_CONTROL,
DBG_log("messageType: %s", msgType_names[attrs->msgType])
)
}
break;
case OID_PKI_STATUS:
{
pkiStatus_t s;
for (s = SCEP_SUCCESS; s < SCEP_UNKNOWN; s++)
{
if (strncmp(pkiStatus_values[s], object.ptr, object.len) == 0)
attrs->pkiStatus = s;
}
DBG(DBG_CONTROL,
DBG_log("pkiStatus: %s", pkiStatus_names[attrs->pkiStatus])
)
}
break;
case OID_PKI_FAIL_INFO:
if (object.len == 1
&& *object.ptr >= '0' && *object.ptr <= '4')
{
attrs->failInfo = (failInfo_t)(*object.ptr - '0');
}
if (attrs->failInfo != SCEP_unknown_REASON)
plog("failInfo: %s", failInfo_reasons[attrs->failInfo]);
break;
case OID_PKI_SENDER_NONCE:
attrs->senderNonce = object;
break;
case OID_PKI_RECIPIENT_NONCE:
attrs->recipientNonce = object;
break;
case OID_PKI_TRANS_ID:
attrs->transID = object;
}
return TRUE;
}
/*
@@ -233,35 +233,35 @@ extract_attribute(int oid, chunk_t object, u_int level
bool
parse_attributes(chunk_t blob, scep_attributes_t *attrs)
{
asn1_ctx_t ctx;
chunk_t object;
u_int level;
int oid = OID_UNKNOWN;
int objectID = 0;
asn1_ctx_t ctx;
chunk_t object;
u_int level;
int oid = OID_UNKNOWN;
int objectID = 0;
asn1_init(&ctx, blob, 0, FALSE, DBG_RAW);
asn1_init(&ctx, blob, 0, FALSE, DBG_RAW);
DBG(DBG_CONTROL | DBG_PARSING,
DBG_log("parsing attributes")
)
while (objectID < ATTRIBUTE_OBJ_ROOF)
{
if (!extract_object(attributesObjects, &objectID
, &object, &level, &ctx))
return FALSE;
switch (objectID)
DBG(DBG_CONTROL | DBG_PARSING,
DBG_log("parsing attributes")
)
while (objectID < ATTRIBUTE_OBJ_ROOF)
{
case ATTRIBUTE_OBJ_TYPE:
oid = asn1_known_oid(object);
break;
case ATTRIBUTE_OBJ_VALUE:
if (!extract_attribute(oid, object, level, attrs))
return FALSE;
if (!extract_object(attributesObjects, &objectID
, &object, &level, &ctx))
return FALSE;
switch (objectID)
{
case ATTRIBUTE_OBJ_TYPE:
oid = asn1_known_oid(object);
break;
case ATTRIBUTE_OBJ_VALUE:
if (!extract_attribute(oid, object, level, attrs))
return FALSE;
}
objectID++;
}
objectID++;
}
return TRUE;
return TRUE;
}
/* generates a unique fingerprint of the pkcs10 request
@@ -270,14 +270,14 @@ parse_attributes(chunk_t blob, scep_attributes_t *attrs)
void
scep_generate_pkcs10_fingerprint(chunk_t pkcs10, chunk_t *fingerprint)
{
char buf[MD5_DIGEST_SIZE];
chunk_t digest = { buf, sizeof(buf) };
char buf[MD5_DIGEST_SIZE];
chunk_t digest = { buf, sizeof(buf) };
/* the fingerprint is the MD5 hash in hexadecimal format */
compute_digest(pkcs10, OID_MD5, &digest);
fingerprint->len = 2*digest.len;
fingerprint->ptr = malloc(fingerprint->len + 1);
datatot(digest.ptr, digest.len, 16, fingerprint->ptr, fingerprint->len + 1);
/* the fingerprint is the MD5 hash in hexadecimal format */
compute_digest(pkcs10, OID_MD5, &digest);
fingerprint->len = 2*digest.len;
fingerprint->ptr = malloc(fingerprint->len + 1);
datatot(digest.ptr, digest.len, 16, fingerprint->ptr, fingerprint->len + 1);
}
/* generate a transaction id as the MD5 hash of an public key
@@ -287,36 +287,36 @@ void
scep_generate_transaction_id(const RSA_public_key_t *rsak
, chunk_t *transID, chunk_t *serialNumber)
{
char buf[MD5_DIGEST_SIZE];
char buf[MD5_DIGEST_SIZE];
chunk_t digest = { buf, sizeof(buf) };
chunk_t public_key = pkcs1_build_publicKeyInfo(rsak);
chunk_t digest = { buf, sizeof(buf) };
chunk_t public_key = pkcs1_build_publicKeyInfo(rsak);
bool msb_set;
u_char *pos;
bool msb_set;
u_char *pos;
compute_digest(public_key, OID_MD5, &digest);
free(public_key.ptr);
compute_digest(public_key, OID_MD5, &digest);
free(public_key.ptr);
/* is the most significant bit of the digest set? */
msb_set = (*digest.ptr & 0x80) == 0x80;
/* is the most significant bit of the digest set? */
msb_set = (*digest.ptr & 0x80) == 0x80;
/* allocate space for the serialNumber */
serialNumber->len = msb_set + digest.len;
serialNumber->ptr = malloc(serialNumber->len);
/* allocate space for the serialNumber */
serialNumber->len = msb_set + digest.len;
serialNumber->ptr = malloc(serialNumber->len);
/* the serial number as the two's complement of the digest */
pos = serialNumber->ptr;
if (msb_set)
{
*pos++ = 0x00;
}
memcpy(pos, digest.ptr, digest.len);
/* the serial number as the two's complement of the digest */
pos = serialNumber->ptr;
if (msb_set)
{
*pos++ = 0x00;
}
memcpy(pos, digest.ptr, digest.len);
/* the transaction id is the serial number in hex format */
transID->len = 2*digest.len;
transID->ptr = malloc(transID->len + 1);
datatot(digest.ptr, digest.len, 16, transID->ptr, transID->len + 1);
/* the transaction id is the serial number in hex format */
transID->len = 2*digest.len;
transID->ptr = malloc(transID->len + 1);
datatot(digest.ptr, digest.len, 16, transID->ptr, transID->len + 1);
}
/*
@@ -325,12 +325,12 @@ scep_generate_transaction_id(const RSA_public_key_t *rsak
chunk_t
scep_transId_attribute(chunk_t transID)
{
return asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_transId_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_simple_object(ASN1_PRINTABLESTRING, transID)
)
);
return asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_transId_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_simple_object(ASN1_PRINTABLESTRING, transID)
)
);
}
/*
@@ -339,17 +339,17 @@ scep_transId_attribute(chunk_t transID)
chunk_t
scep_messageType_attribute(scep_msg_t m)
{
chunk_t msgType = {
(u_char*)msgType_values[m],
strlen(msgType_values[m])
};
chunk_t msgType = {
(u_char*)msgType_values[m],
strlen(msgType_values[m])
};
return asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_messageType_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_simple_object(ASN1_PRINTABLESTRING, msgType)
)
);
return asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_messageType_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_simple_object(ASN1_PRINTABLESTRING, msgType)
)
);
}
/*
@@ -358,18 +358,18 @@ scep_messageType_attribute(scep_msg_t m)
chunk_t
scep_senderNonce_attribute(void)
{
const size_t nonce_len = 16;
u_char nonce_buf[nonce_len];
chunk_t senderNonce = { nonce_buf, nonce_len };
const size_t nonce_len = 16;
u_char nonce_buf[nonce_len];
chunk_t senderNonce = { nonce_buf, nonce_len };
get_rnd_bytes(nonce_buf, nonce_len);
return asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_senderNonce_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_simple_object(ASN1_OCTET_STRING, senderNonce)
)
);
get_rnd_bytes(nonce_buf, nonce_len);
return asn1_wrap(ASN1_SEQUENCE, "cm"
, ASN1_senderNonce_oid
, asn1_wrap(ASN1_SET, "m"
, asn1_simple_object(ASN1_OCTET_STRING, senderNonce)
)
);
}
/*
@@ -381,23 +381,23 @@ scep_build_request(chunk_t data, chunk_t transID, scep_msg_t msg
, const x509cert_t *signer_cert, int digest_alg
, const RSA_private_key_t *private_key)
{
chunk_t envelopedData, attributes, request;
chunk_t envelopedData, attributes, request;
envelopedData = pkcs7_build_envelopedData(data, enc_cert, enc_alg);
envelopedData = pkcs7_build_envelopedData(data, enc_cert, enc_alg);
attributes = asn1_wrap(ASN1_SET, "mmmmm"
, pkcs7_contentType_attribute()
, pkcs7_messageDigest_attribute(envelopedData
, digest_alg)
, scep_transId_attribute(transID)
, scep_messageType_attribute(msg)
, scep_senderNonce_attribute());
attributes = asn1_wrap(ASN1_SET, "mmmmm"
, pkcs7_contentType_attribute()
, pkcs7_messageDigest_attribute(envelopedData
, digest_alg)
, scep_transId_attribute(transID)
, scep_messageType_attribute(msg)
, scep_senderNonce_attribute());
request = pkcs7_build_signedData(envelopedData, attributes
, signer_cert, digest_alg, private_key);
free(envelopedData.ptr);
free(attributes.ptr);
return request;
request = pkcs7_build_signedData(envelopedData, attributes
, signer_cert, digest_alg, private_key);
free(envelopedData.ptr);
free(attributes.ptr);
return request;
}
#ifdef LIBCURL
@@ -407,58 +407,58 @@ scep_build_request(chunk_t data, chunk_t transID, scep_msg_t msg
static char*
escape_http_request(chunk_t req)
{
char *escaped_req = NULL;
char *p1, *p2;
int lines = 0;
int plus = 0;
int n = 0;
char *escaped_req = NULL;
char *p1, *p2;
int lines = 0;
int plus = 0;
int n = 0;
/* compute and allocate the size of the base64-encoded request */
int len = 1 + 4*((req.len + 2)/3);
char *encoded_req = malloc(len);
/* compute and allocate the size of the base64-encoded request */
int len = 1 + 4*((req.len + 2)/3);
char *encoded_req = malloc(len);
/* do the base64 conversion */
len = datatot(req.ptr, req.len, 64, encoded_req, len);
/* do the base64 conversion */
len = datatot(req.ptr, req.len, 64, encoded_req, len);
/* compute newline characters to be inserted every 64 characters */
lines = (len - 2) / 64;
/* compute newline characters to be inserted every 64 characters */
lines = (len - 2) / 64;
/* count number of + characters to be escaped */
p1 = encoded_req;
while (*p1 != '\0')
{
if (*p1++ == '+')
plus++;
}
escaped_req = malloc(len + 3*(lines + plus));
/* escape special characters in the request */
p1 = encoded_req;
p2 = escaped_req;
while (*p1 != '\0')
{
if (n == 64)
/* count number of + characters to be escaped */
p1 = encoded_req;
while (*p1 != '\0')
{
memcpy(p2, "%0A", 3);
p2 += 3;
n = 0;
if (*p1++ == '+')
plus++;
}
if (*p1 == '+')
escaped_req = malloc(len + 3*(lines + plus));
/* escape special characters in the request */
p1 = encoded_req;
p2 = escaped_req;
while (*p1 != '\0')
{
memcpy(p2, "%2B", 3);
p2 += 3;
if (n == 64)
{
memcpy(p2, "%0A", 3);
p2 += 3;
n = 0;
}
if (*p1 == '+')
{
memcpy(p2, "%2B", 3);
p2 += 3;
}
else
{
*p2++ = *p1;
}
p1++;
n++;
}
else
{
*p2++ = *p1;
}
p1++;
n++;
}
*p2 = '\0';
free(encoded_req);
return escaped_req;
*p2 = '\0';
free(encoded_req);
return escaped_req;
}
#endif
@@ -470,109 +470,109 @@ scep_http_request(const char *url, chunk_t pkcs7, scep_op_t op
, fetch_request_t req_type, chunk_t *response)
{
#ifdef LIBCURL
char errorbuffer[CURL_ERROR_SIZE] = "";
char *complete_url = NULL;
struct curl_slist *headers = NULL;
CURL *curl;
CURLcode res;
char errorbuffer[CURL_ERROR_SIZE] = "";
char *complete_url = NULL;
struct curl_slist *headers = NULL;
CURL *curl;
CURLcode res;
/* initialize response */
*response = chunk_empty;
/* initialize response */
*response = chunk_empty;
/* initialize curl context */
curl = curl_easy_init();
if (curl == NULL)
{
plog("could not initialize curl context");
return FALSE;
}
if (op == SCEP_PKI_OPERATION)
{
const char operation[] = "PKIOperation";
if (req_type == FETCH_GET)
/* initialize curl context */
curl = curl_easy_init();
if (curl == NULL)
{
char *escaped_req = escape_http_request(pkcs7);
/* form complete url */
int len = strlen(url) + 20 + strlen(operation) + strlen(escaped_req) + 1;
complete_url = malloc(len);
snprintf(complete_url, len, "%s?operation=%s&message=%s"
, url, operation, escaped_req);
free(escaped_req);
curl_easy_setopt(curl, CURLOPT_HTTPGET, TRUE);
headers = curl_slist_append(headers, "Pragma:");
headers = curl_slist_append(headers, "Host:");
headers = curl_slist_append(headers, "Accept:");
curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
plog("could not initialize curl context");
return FALSE;
}
else /* HTTP_POST */
if (op == SCEP_PKI_OPERATION)
{
/* form complete url */
int len = strlen(url) + 11 + strlen(operation) + 1;
const char operation[] = "PKIOperation";
complete_url = malloc(len);
snprintf(complete_url, len, "%s?operation=%s", url, operation);
if (req_type == FETCH_GET)
{
char *escaped_req = escape_http_request(pkcs7);
curl_easy_setopt(curl, CURLOPT_HTTPGET, FALSE);
headers = curl_slist_append(headers, "Content-Type:");
headers = curl_slist_append(headers, "Expect:");
curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
curl_easy_setopt(curl, CURLOPT_POSTFIELDS, (char*)pkcs7.ptr);
curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, pkcs7.len);
/* form complete url */
int len = strlen(url) + 20 + strlen(operation) + strlen(escaped_req) + 1;
complete_url = malloc(len);
snprintf(complete_url, len, "%s?operation=%s&message=%s"
, url, operation, escaped_req);
free(escaped_req);
curl_easy_setopt(curl, CURLOPT_HTTPGET, TRUE);
headers = curl_slist_append(headers, "Pragma:");
headers = curl_slist_append(headers, "Host:");
headers = curl_slist_append(headers, "Accept:");
curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
}
else /* HTTP_POST */
{
/* form complete url */
int len = strlen(url) + 11 + strlen(operation) + 1;
complete_url = malloc(len);
snprintf(complete_url, len, "%s?operation=%s", url, operation);
curl_easy_setopt(curl, CURLOPT_HTTPGET, FALSE);
headers = curl_slist_append(headers, "Content-Type:");
headers = curl_slist_append(headers, "Expect:");
curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
curl_easy_setopt(curl, CURLOPT_POSTFIELDS, (char*)pkcs7.ptr);
curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, pkcs7.len);
}
}
}
else /* SCEP_GET_CA_CERT */
{
const char operation[] = "GetCACert";
else /* SCEP_GET_CA_CERT */
{
const char operation[] = "GetCACert";
/* form complete url */
int len = strlen(url) + 32 + strlen(operation) + 1;
/* form complete url */
int len = strlen(url) + 32 + strlen(operation) + 1;
complete_url = malloc(len);
snprintf(complete_url, len, "%s?operation=%s&message=CAIdentifier"
, url, operation);
complete_url = malloc(len);
snprintf(complete_url, len, "%s?operation=%s&message=CAIdentifier"
, url, operation);
curl_easy_setopt(curl, CURLOPT_HTTPGET, TRUE);
}
curl_easy_setopt(curl, CURLOPT_HTTPGET, TRUE);
}
curl_easy_setopt(curl, CURLOPT_URL, complete_url);
curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_buffer);
curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)response);
curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, errorbuffer);
curl_easy_setopt(curl, CURLOPT_FAILONERROR, TRUE);
curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, FETCH_CMD_TIMEOUT);
DBG(DBG_CONTROL,
DBG_log("sending scep request to '%s'", url)
)
res = curl_easy_perform(curl);
if (res == CURLE_OK)
{
curl_easy_setopt(curl, CURLOPT_URL, complete_url);
curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_buffer);
curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)response);
curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, errorbuffer);
curl_easy_setopt(curl, CURLOPT_FAILONERROR, TRUE);
curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, FETCH_CMD_TIMEOUT);
DBG(DBG_CONTROL,
DBG_log("received scep response")
DBG_log("sending scep request to '%s'", url)
)
DBG(DBG_RAW,
DBG_dump_chunk("SCEP response:\n", *response)
)
}
else
{
plog("failed to fetch scep response from '%s': %s", url, errorbuffer);
}
curl_slist_free_all(headers);
curl_easy_cleanup(curl);
free(complete_url);
res = curl_easy_perform(curl);
if (res == CURLE_OK)
{
DBG(DBG_CONTROL,
DBG_log("received scep response")
)
DBG(DBG_RAW,
DBG_dump_chunk("SCEP response:\n", *response)
)
}
else
{
plog("failed to fetch scep response from '%s': %s", url, errorbuffer);
}
curl_slist_free_all(headers);
curl_easy_cleanup(curl);
free(complete_url);
return (res == CURLE_OK);
return (res == CURLE_OK);
#else /* !LIBCURL */
plog("scep error: pluto wasn't compiled with libcurl support");
return FALSE;
plog("scep error: pluto wasn't compiled with libcurl support");
return FALSE;
#endif /* !LIBCURL */
}
@@ -580,19 +580,19 @@ err_t
scep_parse_response(chunk_t response, chunk_t transID, contentInfo_t *data
, scep_attributes_t *attrs, x509cert_t *signer_cert)
{
chunk_t attributes;
chunk_t attributes;
if (!pkcs7_parse_signedData(response, data, NULL, &attributes, signer_cert))
{
return "error parsing the scep response";
}
if (!parse_attributes(attributes, attrs))
{
return "error parsing the scep response attributes";
}
if (!chunk_equals(transID, attrs->transID))
{
return "transaction ID of scep response does not match";
}
return NULL;
if (!pkcs7_parse_signedData(response, data, NULL, &attributes, signer_cert))
{
return "error parsing the scep response";
}
if (!parse_attributes(attributes, attrs))
{
return "error parsing the scep response attributes";
}
if (!chunk_equals(transID, attrs->transID))
{
return "transaction ID of scep response does not match";
}
return NULL;
}
src/scepclient/scep.h
+17 -17
View File
@@ -4,7 +4,7 @@
*
* Contains functions to build and parse SCEP requests and replies
*/
/*
* Copyright (C) 2005 Jan Hutter, Martin Willi
* Hochschule fuer Technik Rapperswil
@@ -19,7 +19,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef _SCEP_H
#define _SCEP_H
@@ -29,8 +29,8 @@
/* supported SCEP operation types */
typedef enum {
SCEP_PKI_OPERATION,
SCEP_GET_CA_CERT
SCEP_PKI_OPERATION,
SCEP_GET_CA_CERT
} scep_op_t;
/* SCEP pkiStatus values */
@@ -63,31 +63,31 @@ typedef enum {
/* SCEP attributes */
typedef struct {
scep_msg_t msgType;
pkiStatus_t pkiStatus;
failInfo_t failInfo;
chunk_t transID;
chunk_t senderNonce;
chunk_t recipientNonce;
scep_msg_t msgType;
pkiStatus_t pkiStatus;
failInfo_t failInfo;
chunk_t transID;
chunk_t senderNonce;
chunk_t recipientNonce;
} scep_attributes_t;
extern const scep_attributes_t empty_scep_attributes;
extern bool parse_attributes(chunk_t blob, scep_attributes_t *attrs);
extern void scep_generate_pkcs10_fingerprint(chunk_t pkcs10
, chunk_t *fingerprint);
, chunk_t *fingerprint);
extern void scep_generate_transaction_id(const RSA_public_key_t *rsak
, chunk_t *transID, chunk_t *serialNumber);
, chunk_t *transID, chunk_t *serialNumber);
extern chunk_t scep_transId_attribute(chunk_t transaction_id);
extern chunk_t scep_messageType_attribute(scep_msg_t m);
extern chunk_t scep_senderNonce_attribute(void);
extern chunk_t scep_build_request(chunk_t data, chunk_t transID, scep_msg_t msg
, const x509cert_t *enc_cert, int enc_alg
, const x509cert_t *signer_cert, int digest_alg
, const RSA_private_key_t *private_key);
, const x509cert_t *enc_cert, int enc_alg
, const x509cert_t *signer_cert, int digest_alg
, const RSA_private_key_t *private_key);
extern bool scep_http_request(const char *url, chunk_t pkcs7, scep_op_t op
, fetch_request_t request_type, chunk_t *response);
, fetch_request_t request_type, chunk_t *response);
extern err_t scep_parse_response(chunk_t response, chunk_t transID
, contentInfo_t *data, scep_attributes_t *attrs, x509cert_t *signer_cert);
, contentInfo_t *data, scep_attributes_t *attrs, x509cert_t *signer_cert);
#endif /* _SCEP_H */
src/scepclient/scepclient.c
+867 -867
View File
File diff suppressed because it is too large Load Diff