From 8dfb0a31b594ea2cee40754559e5e122da940438 Mon Sep 17 00:00:00 2001
From: Andreas Steffen <andreas.steffen@strongswan.org>
Date: Wed, 7 Mar 2007 22:57:50 +0000
Subject: [PATCH] added parsing level to x509_create_from_chunk() and added
 is_ocsp_signer() method

---
 src/libstrongswan/crypto/x509.c | 32 ++++++++++++++++++++++++++------
 src/libstrongswan/crypto/x509.h | 17 ++++++++++++++++-
 2 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/src/libstrongswan/crypto/x509.c b/src/libstrongswan/crypto/x509.c
index 4340a6c7b..fe00e0738 100755
--- a/src/libstrongswan/crypto/x509.c
+++ b/src/libstrongswan/crypto/x509.c
@@ -81,6 +81,11 @@ struct private_x509_t {
 	 */
 	cert_status_t status;
 
+	/**
+	 * Authority flags
+	 */
+	 u_char authority_flags;
+
 	/**
 	 * X.509 Certificate in DER format
 	 */
@@ -141,6 +146,11 @@ struct private_x509_t {
 	 */
 	linked_list_t *ocspAccessLocations;
 
+	/**
+	 * Subject public key
+	 */
+	chunk_t subjectPublicKey;
+
 	/**
 	 * Subject RSA public key, if subjectPublicKeyAlgorithm == RSA
 	 */
@@ -166,6 +176,11 @@ struct private_x509_t {
 	 */
 	bool isCA;
 
+	/**
+	 * OCSPSigner extended key usage flag
+	 */
+	bool isOcspSigner;
+
 	/**
 	 * Signature algorithm (must be identical to sigAlg)
 	 */
@@ -176,9 +191,6 @@ struct private_x509_t {
 	 */
 	chunk_t signature;
 
-	u_char authority_flags;
-	chunk_t subjectPublicKey;
-	bool isOcspSigner; /* ocsp */
 };
 
 /**
@@ -916,6 +928,14 @@ static bool is_ca(const private_x509_t *this)
 	return this->isCA;
 }
 
+/**
+ * Implements x509_t.is_ocsp_signer
+ */
+static bool is_ocsp_signer(const private_x509_t *this)
+{
+	return this->isOcspSigner;
+}
+
 /**
  * Implements x509_t.is_self_signed
  */
@@ -1214,7 +1234,7 @@ static void destroy(private_x509_t *this)
 /*
  * Described in header.
  */
-x509_t *x509_create_from_chunk(chunk_t chunk)
+x509_t *x509_create_from_chunk(chunk_t chunk, u_int level)
 {
 	private_x509_t *this = malloc_thing(private_x509_t);
 	
@@ -1253,7 +1273,7 @@ x509_t *x509_create_from_chunk(chunk_t chunk)
 	this->public.verify = (bool (*) (const x509_t*,const rsa_public_key_t*))verify;
 	this->public.destroy = (void (*) (x509_t*))destroy;
 	
-	if (!parse_x509cert(chunk, 0, this))
+	if (!parse_x509cert(chunk, level, this))
 	{
 		destroy(this);
 		return NULL;
@@ -1284,7 +1304,7 @@ x509_t *x509_create_from_file(const char *filename, const char *label)
 	if (!pem_asn1_load_file(filename, NULL, label, &chunk, &pgp))
 		return NULL;
 
-	cert = x509_create_from_chunk(chunk);
+	cert = x509_create_from_chunk(chunk, 0);
 
 	if (cert == NULL)
 		free(chunk.ptr);
diff --git a/src/libstrongswan/crypto/x509.h b/src/libstrongswan/crypto/x509.h
index 992ce1ffa..9066fd94c 100755
--- a/src/libstrongswan/crypto/x509.h
+++ b/src/libstrongswan/crypto/x509.h
@@ -31,6 +31,13 @@ typedef struct x509_t x509_t;
 #include <utils/identification.h>
 #include <utils/iterator.h>
 
+/* authority flags */
+
+#define AUTH_NONE	0x00	/* no authorities */
+#define AUTH_CA		0x01	/* certification authority */
+#define AUTH_AA		0x02	/* authorization authority */
+#define AUTH_OCSP	0x04	/* ocsp signing authority */
+
 /**
  * @brief X.509 certificate.
  * 
@@ -210,6 +217,14 @@ struct x509_t {
 	 */
 	bool (*is_ca) (const x509_t *this);
 
+	/**
+	 * @brief Returns the OCSPSigner extended key usage flag
+	 * 
+	 * @param this			certificate being examined
+	 * @return				TRUE if the OCSPSigner flag is set
+	 */
+	bool (*is_ocsp_signer) (const x509_t *this);
+
 	/**
 	 * @brief Checks if the certificate is self-signed (subject equals issuer)
 	 * 
@@ -234,7 +249,7 @@ struct x509_t {
  * 
  * @ingroup transforms
  */
-x509_t *x509_create_from_chunk(chunk_t chunk);
+x509_t *x509_create_from_chunk(chunk_t chunk, u_int level);
 
 /**
  * @brief Read a x509 certificate from a DER encoded file.