denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented path length constraint checkinf for IKEv2

Browse Source
This commit is contained in:
Andreas Steffen
2009-11-04 23:37:15 +01:00
parent fef3b0b7fd
commit 4c68a85a75
25 changed files with 266 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/ca.c
+9 -8
View File
@@ -21,6 +21,7 @@
#include <debug.h>
#include <utils/enumerator.h>
#include <credentials/certificates/x509.h>
#include <freeswan.h>
@@ -52,14 +53,14 @@ bool trusted_ca(identification_t *a, identification_t *b, int *pathlen)
/* no CA b specified -> any CA a is accepted */
if (b == NULL)
{
*pathlen = (a == NULL) ? 0 : MAX_CA_PATH_LEN;
*pathlen = (a == NULL) ? 0 : X509_MAX_PATH_LEN;
return TRUE;
}
/* no CA a specified -> trust cannot be established */
if (a == NULL)
{
*pathlen = MAX_CA_PATH_LEN;
*pathlen = X509_MAX_PATH_LEN;
return FALSE;
}
@@ -74,7 +75,7 @@ bool trusted_ca(identification_t *a, identification_t *b, int *pathlen)
/* CA a might be a subordinate CA of b */
lock_authcert_list("trusted_ca");
while ((*pathlen)++ < MAX_CA_PATH_LEN)
while ((*pathlen)++ < X509_MAX_PATH_LEN)
{
certificate_t *certificate;
identification_t *issuer;
@@ -130,7 +131,7 @@ bool match_requested_ca(linked_list_t *requested_ca, identification_t *our_ca,
return TRUE;
}
*our_pathlen = MAX_CA_PATH_LEN + 1;
*our_pathlen = X509_MAX_PATH_LEN + 1;
enumerator = requested_ca->create_enumerator(requested_ca);
while (enumerator->enumerate(enumerator, &ca))
@@ -144,9 +145,9 @@ bool match_requested_ca(linked_list_t *requested_ca, identification_t *our_ca,
}
enumerator->destroy(enumerator);
if (*our_pathlen > MAX_CA_PATH_LEN)
if (*our_pathlen > X509_MAX_PATH_LEN)
{
*our_pathlen = MAX_CA_PATH_LEN;
*our_pathlen = X509_MAX_PATH_LEN;
return FALSE;
}
else
@@ -374,7 +375,7 @@ bool trust_authcert_candidate(const x509cert_t *cert, const x509cert_t *alt_chai
lock_authcert_list("trust_authcert_candidate");
for (pathlen = 0; pathlen < MAX_CA_PATH_LEN; pathlen++)
for (pathlen = 0; pathlen < X509_MAX_PATH_LEN; pathlen++)
{
certificate_t *certificate = cert->cert;
x509_t *x509 = (x509_t*)certificate;
@@ -443,7 +444,7 @@ bool trust_authcert_candidate(const x509cert_t *cert, const x509cert_t *alt_chai
/* go up one step in the trust chain */
cert = authcert;
}
plog("maximum ca path length of %d levels exceeded", MAX_CA_PATH_LEN);
plog("maximum ca path length of %d levels exceeded", X509_MAX_PATH_LEN);
unlock_authcert_list("trust_authcert_candidate");
return FALSE;
}
src/pluto/ca.h
-2
View File
@@ -21,8 +21,6 @@
#include "x509.h"
#include "whack.h"
#define MAX_CA_PATH_LEN 7
/* CA info structures */
typedef struct ca_info ca_info_t;
src/pluto/connections.c
+5 -5
View File
@@ -3391,8 +3391,8 @@ connection_t *refine_host_connection(const struct state *st,
int prio = (ID_MATCH_PERFECT) * !matching_request +
ID_MATCH_PERFECT - match_level;
prio = (MAX_CA_PATH_LEN + 1) * prio + peer_pathlen;
prio = (MAX_CA_PATH_LEN + 1) * prio + our_pathlen;
prio = (X509_MAX_PATH_LEN + 1) * prio + peer_pathlen;
prio = (X509_MAX_PATH_LEN + 1) * prio + our_pathlen;
DBG(DBG_CONTROLMORE,
DBG_log("%s: %s match (id: %s, auth: %s, trust: %s, request: %s, prio: %4d)"
@@ -3560,7 +3560,7 @@ static bool is_virtual_net_used(const ip_subnet *peer_net,
*/
#define PATH_WEIGHT 1
#define WILD_WEIGHT (MAX_CA_PATH_LEN+1)
#define WILD_WEIGHT (X509_MAX_PATH_LEN+1)
#define PRIO_WEIGHT (ID_MATCH_PERFECT+1) * WILD_WEIGHT
/* fc_try: a helper function for find_client_connection */
@@ -3691,7 +3691,7 @@ static connection_t *fc_try(const connection_t *c, struct host_pair *hp,
*/
prio = PRIO_WEIGHT * routed(sr->routing)
+ WILD_WEIGHT * match_level
+ PATH_WEIGHT * (MAX_CA_PATH_LEN - pathlen)
+ PATH_WEIGHT * (X509_MAX_PATH_LEN - pathlen)
+ 1;
if (prio > best_prio)
{
@@ -3797,7 +3797,7 @@ static connection_t *fc_try_oppo(const connection_t *c,
*/
prio = PRIO_WEIGHT * (d->prio + routed(sr->routing))
+ WILD_WEIGHT * match_level
+ PATH_WEIGHT * (MAX_CA_PATH_LEN - pathlen);
+ PATH_WEIGHT * (X509_MAX_PATH_LEN - pathlen);
if (prio > best_prio)
{
best = d;
src/pluto/ocsp.c
+15 -4
View File
@@ -961,7 +961,7 @@ chunk_t build_ocsp_request(ocsp_location_t *location)
*/
static bool valid_ocsp_response(response_t *res)
{
int pathlen;
int pathlen, pathlen_constraint;
x509cert_t *authcert;
lock_authcert_list("valid_ocsp_response");
@@ -990,7 +990,7 @@ static bool valid_ocsp_response(response_t *res)
)
for (pathlen = 0; pathlen < MAX_CA_PATH_LEN; pathlen++)
for (pathlen = -1; pathlen <= X509_MAX_PATH_LEN; pathlen++)
{
x509cert_t *cert = authcert;
certificate_t *certificate = cert->cert;
@@ -1038,17 +1038,28 @@ static bool valid_ocsp_response(response_t *res)
DBG_log("certificate signature is valid")
)
/* check path length constraint */
pathlen_constraint = x509->get_pathLenConstraint(x509);
if (pathlen_constraint != X509_NO_PATH_LEN_CONSTRAINT &&
pathlen > pathlen_constraint)
{
plog("path length of %d violates constraint of %d",
pathlen, pathlen_constraint);
return FALSE;
}
/* check if cert is self-signed */
if (x509->get_flags(x509) & X509_SELF_SIGNED)
{
DBG(DBG_CONTROL,
DBG_log("reached self-signed root ca")
DBG_log("reached self-signed root ca with a path length of %d",
pathlen)
)
unlock_authcert_list("valid_ocsp_response");
return TRUE;
}
}
plog("maximum ca path length of %d levels exceeded", MAX_CA_PATH_LEN);
plog("maximum path length of %d exceeded", X509_MAX_PATH_LEN);
unlock_authcert_list("valid_ocsp_response");
return FALSE;
}
src/pluto/x509.c
+4 -4
View File
@@ -348,7 +348,7 @@ bool verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
*until = 0;
for (pathlen = -1; pathlen < MAX_CA_PATH_LEN; pathlen++)
for (pathlen = -1; pathlen <= X509_MAX_PATH_LEN; pathlen++)
{
certificate_t *certificate = cert->cert;
identification_t *subject = certificate->get_subject(certificate);
@@ -409,7 +409,7 @@ bool verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
/* check path length constraint */
pathlen_constraint = x509->get_pathLenConstraint(x509);
if (pathlen_constraint != NO_PATH_LEN_CONSTRAINT &&
if (pathlen_constraint != X509_NO_PATH_LEN_CONSTRAINT &&
pathlen > pathlen_constraint)
{
plog("path length of %d violates constraint of %d",
@@ -490,7 +490,7 @@ bool verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
/* go up one step in the trust chain */
cert = issuer_cert;
}
plog("maximum path length of %d exceeded", MAX_CA_PATH_LEN);
plog("maximum path length of %d exceeded", X509_MAX_PATH_LEN);
return FALSE;
}
@@ -603,7 +603,7 @@ void list_x509cert_chain(const char *caption, x509cert_t* cert,
/* list optional pathLenConstraint */
pathlen = x509->get_pathLenConstraint(x509);
if (pathlen != NO_PATH_LEN_CONSTRAINT)
if (pathlen != X509_NO_PATH_LEN_CONSTRAINT)
{
whack_log(RC_COMMENT, " pathlen: %d", pathlen);
}