denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- applied patch from andreas, which allows certificate listing via stroke

Browse Source
This commit is contained in:
Martin Willi
2006-05-19 06:44:08 +00:00
parent 3e61d63a3a
commit 86a7937b45
17 changed files with 343 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/crypto/rsa/rsa_public_key.c
+51 -23
View File
@@ -40,39 +40,58 @@
* TODO: We may move them in asn1 sometime...
*/
u_int8_t md2_oid[] = {
0x30,0x20,0x30,0x0c,0x06,0x08,0x2a,0x86,
0x48,0x86,0xf7,0x0d,0x02,0x02,0x05,0x00,
0x04,0x10
const u_int8_t md2_oid[] = {
0x30,0x20,
0x30,0x0c,
0x06,0x08,
0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x02,
0x05,0x00,
0x04,0x10
};
u_int8_t md5_oid[] = {
0x30,0x20,0x30,0x0c,0x06,0x08,0x2a,0x86,
0x48,0x86,0xf7,0x0d,0x02,0x05,0x05,0x00,
0x04,0x10
const u_int8_t md5_oid[] = {
0x30,0x20,
0x30,0x0c,
0x06,0x08,
0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x05,
0x05,0x00,
0x04,0x10
};
u_int8_t sha1_oid[] = {
0x30,0x21,0x30,0x09,0x06,0x05,0x2b,0x0e,
0x03,0x02,0x1a,0x05,0x00,0x04,0x14
const u_int8_t sha1_oid[] = {
0x30,0x21,
0x30,0x09,
0x06,0x05,
0x2b,0x0e,0x03,0x02,0x1a,
0x05,0x00,
0x04,0x14
};
u_int8_t sha256_oid[] = {
0x30,0x31,0x30,0x0d,0x06,0x09,0x60,0x86,
0x48,0x01,0x65,0x03,0x04,0x02,0x01,0x05,
0x00,0x04,0x20
const u_int8_t sha256_oid[] = {
0x30,0x31,
0x30,0x0d,
0x06,0x09,
0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x01,
0x05,0x00,
0x04,0x20
};
u_int8_t sha384_oid[] = {
0x30,0x41,0x30,0x0d,0x06,0x09,0x60,0x86,
0x48,0x01,0x65,0x03,0x04,0x02,0x02,0x05,
0x00,0x04,0x30
const u_int8_t sha384_oid[] = {
0x30,0x41,
0x30,0x0d,
0x06,0x09,
0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x02,
0x05,0x00,
0x04,0x30
};
u_int8_t sha512_oid[] = {
0x30,0x51,0x30,0x0d,0x06,0x09,0x60,0x86,
0x48,0x01,0x65,0x03,0x04,0x02,0x03,0x05,
0x00,0x04,0x40
const u_int8_t sha512_oid[] = {
0x30,0x51,
0x30,0x0d,
0x06,0x09,
0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x03,
0x05,0x00,
0x04,0x40
};
/* ASN.1 definition public key */
@@ -337,6 +356,14 @@ static mpz_t *get_modulus(private_rsa_public_key_t *this)
return &this->n;
}
/**
* Implementation of rsa_public_key.get_keysize.
*/
static size_t get_keysize(private_rsa_public_key_t *this)
{
return this->k;
}
/**
* Implementation of rsa_public_key.clone.
*/
@@ -373,6 +400,7 @@ private_rsa_public_key_t *rsa_public_key_create_empty(void)
this->public.get_key = (status_t (*) (rsa_public_key_t*,chunk_t*))get_key;
this->public.save_key = (status_t (*) (rsa_public_key_t*,char*))save_key;
this->public.get_modulus = (mpz_t *(*) (rsa_public_key_t*))get_modulus;
this->public.get_keysize = (size_t (*) (rsa_public_key_t*))get_keysize;
this->public.clone = (rsa_public_key_t* (*) (rsa_public_key_t*))_clone;
this->public.destroy = (void (*) (rsa_public_key_t*))destroy;
src/libstrongswan/crypto/rsa/rsa_public_key.h
+8
View File
@@ -104,6 +104,14 @@ struct rsa_public_key_t {
*/
mpz_t *(*get_modulus) (rsa_public_key_t *this);
/**
* @brief Get the size of the modulus in bytes.
*
* @param this calling object
* @return size of the modulus (n) in bytes
*/
size_t (*get_keysize) (rsa_public_key_t *this);
/**
* @brief Clone the public key.
*
src/libstrongswan/crypto/x509.c
+96 -32
View File
@@ -34,9 +34,10 @@
#include <utils/linked_list.h>
#define BUF_LEN 512
#define RSA_MIN_OCTETS (512 / 8)
#define RSA_MIN_OCTETS_UGH "RSA modulus too small for security: less than 512 bits"
#define RSA_MAX_OCTETS (8192 / 8)
#define BITS_PER_BYTE 8
#define RSA_MIN_OCTETS (1024 / BITS_PER_BYTE)
#define RSA_MIN_OCTETS_UGH "RSA modulus too small for security: less than 1024 bits"
#define RSA_MAX_OCTETS (8192 / BITS_PER_BYTE)
#define RSA_MAX_OCTETS_UGH "RSA modulus too large: more than 8192 bits"
logger_t *logger;
@@ -81,20 +82,45 @@ struct private_x509_t {
x509_t public;
/**
* Version of the X509 certificate
* Time when certificate was installed
*/
time_t installed;
/**
* X.509 Certificate in DER format
*/
chunk_t certificate;
/**
* Version of the X.509 certificate
*/
u_int version;
/**
* ID representing the certificates subject
* Serial number of the X.509 certificate
*/
identification_t *subject;
chunk_t serialNumber;
/**
* ID representing the certificate issuer
*/
identification_t *issuer;
/**
* Start time of certificate validity
*/
time_t notBefore;
/**
* End time of certificate validity
*/
time_t notAfter;
/**
* ID representing the certificate subject
*/
identification_t *subject;
/**
* List of identification_t's representing subjectAltNames
*/
@@ -109,41 +135,34 @@ struct private_x509_t {
* List of identification_t's representing crlDistributionPoints
*/
linked_list_t *crlDistributionPoints;
/**
* Subjects RSA public key, if subjectPublicKeyAlgorithm == RSA
* Subject RSA public key, if subjectPublicKeyAlgorithm == RSA
*/
rsa_public_key_t *public_key;
/**
* Subject Key Identifier
*/
chunk_t subjectKeyID;
/**
* Authority Key Identifier
*/
chunk_t authKeyID;
/**
* Authority Key Serial Number
*/
chunk_t authKeySerialNumber;
time_t installed;
u_char authority_flags;
chunk_t x509;
chunk_t tbsCertificate;
chunk_t serialNumber;
/* signature */
int sigAlg;
/* validity */
time_t notBefore;
time_t notAfter;
/* subjectPublicKeyInfo */
chunk_t subjectPublicKey;
/* issuerUniqueID */
/* subjectUniqueID */
/* v3 extensions */
/* extension */
/* extension */
/* extnID */
/* critical */
/* extnValue */
bool isCA;
bool isOcspSigner; /* ocsp */
chunk_t subjectKeyID;
chunk_t authKeyID;
chunk_t authKeySerialNumber;
chunk_t accessLocation; /* ocsp */
/* signatureAlgorithm */
int algorithm;
@@ -649,7 +668,7 @@ bool parse_x509cert(chunk_t blob, u_int level0, private_x509_t *cert)
level++;
switch (objectID) {
case X509_OBJ_CERTIFICATE:
cert->x509 = object;
cert->certificate = object;
break;
case X509_OBJ_TBS_CERTIFICATE:
cert->tbsCertificate = object;
@@ -843,9 +862,50 @@ static void destroy(private_x509_t *this)
{
this->public_key->destroy(this->public_key);
}
free(this->certificate.ptr);
free(this);
}
/**
* log certificate
*/
static void log_certificate(private_x509_t *this, logger_t *logger, bool utc)
{
identification_t *subject = this->subject;
identification_t *issuer = this->issuer;
rsa_public_key_t *rsa_key = this->public_key;
char buf[BUF_LEN];
timetoa(buf, BUF_LEN, &this->installed, utc);
logger->log(logger, CONTROL, "%s", buf);
logger->log(logger, CONTROL, " subject: '%s'", subject->get_string(subject));
logger->log(logger, CONTROL, " issuer: '%s'", issuer->get_string(issuer));
chunk_to_hex(buf, BUF_LEN, this->serialNumber);
logger->log(logger, CONTROL, " serial: %s", buf);
timetoa(buf, BUF_LEN, &this->notBefore, utc);
logger->log(logger, CONTROL, " validity: not before %s", buf);
timetoa(buf, BUF_LEN, &this->notAfter, utc);
logger->log(logger, CONTROL, " not after %s", buf);
logger->log(logger, CONTROL, " pubkey: RSA %d bits", BITS_PER_BYTE * rsa_key->get_keysize(rsa_key));
if (this->subjectKeyID.ptr != NULL)
{
chunk_to_hex(buf, BUF_LEN, this->subjectKeyID);
logger->log(logger, CONTROL, " subjkey: %s", buf);
}
if (this->authKeyID.ptr != NULL)
{
chunk_to_hex(buf, BUF_LEN, this->authKeyID);
logger->log(logger, CONTROL, " authkey: %s", buf);
}
if (this->authKeySerialNumber.ptr != NULL)
{
chunk_to_hex(buf, BUF_LEN, this->authKeySerialNumber);
logger->log(logger, CONTROL, " aserial: %s", buf);
}
}
/*
* Described in header.
*/
@@ -859,6 +919,7 @@ x509_t *x509_create_from_chunk(chunk_t chunk)
this->public.get_public_key = (rsa_public_key_t* (*) (x509_t*))get_public_key;
this->public.get_subject = (identification_t* (*) (x509_t*))get_subject;
this->public.get_issuer = (identification_t* (*) (x509_t*))get_issuer;
this->public.log_certificate = (void (*) (x509_t*,logger_t*,bool))log_certificate;
/* initialize */
this->subjectPublicKey = CHUNK_INITIALIZER;
@@ -892,7 +953,7 @@ x509_t *x509_create_from_chunk(chunk_t chunk)
/*
* Described in header.
*/
x509_t *x509_create_from_file(char *filename)
x509_t *x509_create_from_file(const char *filename)
{
bool pgp = FALSE;
chunk_t chunk = CHUNK_INITIALIZER;
@@ -902,6 +963,9 @@ x509_t *x509_create_from_file(char *filename)
return NULL;
cert = x509_create_from_chunk(chunk);
free(chunk.ptr);
if (cert == NULL)
{
free(chunk.ptr);
}
return cert;
}
src/libstrongswan/crypto/x509.h
+12 -2
View File
@@ -28,6 +28,7 @@
#include <crypto/rsa/rsa_public_key.h>
#include <utils/identification.h>
#include <utils/iterator.h>
#include <utils/logger.h>
typedef struct x509_t x509_t;
@@ -103,7 +104,7 @@ struct x509_t {
* @param other second cert for compare
* @return TRUE if signature is equal
*/
bool (*equals) (x509_t *this, x509_t *other);
bool (*equals) (x509_t *this, x509_t *that);
/**
* @brief Destroys the certificate.
@@ -111,6 +112,15 @@ struct x509_t {
* @param this certificate to destroy
*/
void (*destroy) (x509_t *this);
/**
* @brief Log x509 certificate info.
*
* @param this certificate to log
* @param logger logger to be used
* @param utc log dates either in UTC or local time
*/
void (*log_certificate) (x509_t *this, logger_t *logger, bool utc);
};
/**
@@ -131,6 +141,6 @@ x509_t *x509_create_from_chunk(chunk_t chunk);
*
* @ingroup transforms
*/
x509_t *x509_create_from_file(char *filename);
x509_t *x509_create_from_file(const char *filename);
#endif /* X509_H_ */