denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Moved X509 addrBlock validation to a separate addrblock plugin

Browse Source
This commit is contained in:
Martin Willi
2010-07-13 10:26:07 +02:00
parent 2feb16f5dd
commit 5f9e62c54f
10 changed files with 309 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/cert_validator.h
+2
View File
@@ -23,6 +23,8 @@
typedef struct cert_validator_t cert_validator_t;
#include <library.h>
/**
* Certificate validator interface.
*
src/libstrongswan/credentials/credential_manager.c
-59
View File
@@ -943,60 +943,6 @@ static cert_validation_t check_crl(private_credential_manager_t *this,
return valid;
}
/**
* check a certificate for optional IP address block constraints
*/
static bool check_ip_addr_block_constraints(x509_t *subject, x509_t *issuer)
{
bool subject_constraint = subject->get_flags(subject) & X509_IP_ADDR_BLOCKS;
bool issuer_constraint = issuer->get_flags(issuer) & X509_IP_ADDR_BLOCKS;
bool contained = TRUE;
enumerator_t *subject_enumerator, *issuer_enumerator;
traffic_selector_t *subject_ts, *issuer_ts;
if (!subject_constraint && !issuer_constraint)
{
return TRUE;
}
if (!subject_constraint)
{
DBG1(DBG_CFG, "subject certficate lacks ipAddrBlocks extension");
return FALSE;
}
if (!issuer_constraint)
{
DBG1(DBG_CFG, "issuer certficate lacks ipAddrBlocks extension");
return FALSE;
}
subject_enumerator = subject->create_ipAddrBlock_enumerator(subject);
while (subject_enumerator->enumerate(subject_enumerator, &subject_ts))
{
contained = FALSE;
issuer_enumerator = issuer->create_ipAddrBlock_enumerator(issuer);
while (issuer_enumerator->enumerate(issuer_enumerator, &issuer_ts))
{
if (subject_ts->is_contained_in(subject_ts, issuer_ts))
{
DBG2(DBG_CFG, " subject address block %R is contained in "
"issuer address block %R", subject_ts, issuer_ts);
contained = TRUE;
break;
}
}
issuer_enumerator->destroy(issuer_enumerator);
if (!contained)
{
DBG1(DBG_CFG, "subject address block %R is not contained in any "
"issuer address block", subject_ts);
break;
}
}
subject_enumerator->destroy(subject_enumerator);
return contained;
}
/**
* check a certificate for its lifetime
*/
@@ -1026,11 +972,6 @@ static bool check_certificate(private_credential_manager_t *this,
int pathlen_constraint;
x509_t *x509;
if (!check_ip_addr_block_constraints((x509_t*)subject, (x509_t*)issuer))
{
return FALSE;
}
/* check path length constraint */
x509 = (x509_t*)issuer;
pathlen_constraint = x509->get_pathLenConstraint(x509);