denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- identification_t supports now almost all id types

Browse Source 
- x509 certificates work with identification_t now
- fixes here, fixes there
This commit is contained in:
Martin Willi
2006-04-24 10:40:10 +00:00
parent fcfeb3220f
commit a8c09d8cc0
26 changed files with 1382 additions and 1020 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Source/lib/asn1/asn1.c
-1
View File
@@ -18,7 +18,6 @@
#include <time.h>
#include "asn1.h"
#include "oid.h"
#include <utils/logger_manager.h>
Source/lib/asn1/asn1.h
+1
View File
@@ -20,6 +20,7 @@
#include <gmp.h>
#include <types.h>
#include <asn1/oid.h>
/* Defines some primitive ASN1 types */
Source/lib/asn1/oid.c
+16 -13
View File
@@ -172,23 +172,26 @@ const oid_t oid_names[] = {
{ 0x03, 0, 0, "id-SHA-512" }, /* 159 */
{ 0x86, 0, 1, "" }, /* 160 */
{ 0xf8, 0, 1, "" }, /* 161 */
{ 0x42, 171, 1, "netscape" }, /* 162 */
{ 0x42, 174, 1, "netscape" }, /* 162 */
{ 0x01, 169, 1, "" }, /* 163 */
{ 0x01, 165, 0, "nsCertType" }, /* 164 */
{ 0x03, 166, 0, "nsRevocationUrl" }, /* 165 */
{ 0x04, 167, 0, "nsCaRevocationUrl" }, /* 166 */
{ 0x08, 168, 0, "nsCaPolicyUrl" }, /* 167 */
{ 0x0d, 0, 0, "nsComment" }, /* 168 */
{ 0x04, 0, 1, "policy" }, /* 169 */
{ 0x01, 0, 0, "nsSGC" }, /* 170 */
{ 0x45, 0, 1, "verisign" }, /* 171 */
{ 0x01, 0, 1, "pki" }, /* 172 */
{ 0x09, 0, 1, "attributes" }, /* 173 */
{ 0x02, 175, 0, "messageType" }, /* 174 */
{ 0x03, 176, 0, "pkiStatus" }, /* 175 */
{ 0x04, 177, 0, "failInfo" }, /* 176 */
{ 0x05, 178, 0, "senderNonce" }, /* 177 */
{ 0x06, 179, 0, "recipientNonce" }, /* 178 */
{ 0x07, 180, 0, "transID" }, /* 179 */
{ 0x08, 0, 0, "extensionReq" } /* 180 */
{ 0x03, 172, 1, "directory" }, /* 169 */
{ 0x01, 0, 1, "" }, /* 170 */
{ 0x03, 0, 0, "employeeNumber" }, /* 171 */
{ 0x04, 0, 1, "policy" }, /* 172 */
{ 0x01, 0, 0, "nsSGC" }, /* 173 */
{ 0x45, 0, 1, "verisign" }, /* 174 */
{ 0x01, 0, 1, "pki" }, /* 175 */
{ 0x09, 0, 1, "attributes" }, /* 176 */
{ 0x02, 178, 0, "messageType" }, /* 177 */
{ 0x03, 179, 0, "pkiStatus" }, /* 178 */
{ 0x04, 180, 0, "failInfo" }, /* 179 */
{ 0x05, 181, 0, "senderNonce" }, /* 180 */
{ 0x06, 182, 0, "recipientNonce" }, /* 181 */
{ 0x07, 183, 0, "transID" }, /* 182 */
{ 0x08, 0, 0, "extensionReq" } /* 183 */
};
Source/lib/asn1/oid.h
+11 -6
View File
@@ -5,6 +5,9 @@
* Do not edit manually!
*/
#ifndef OID_H_
#define OID_H_
typedef struct {
u_char octet;
u_int next;
@@ -67,9 +70,11 @@ extern const oid_t oid_names[];
#define OID_NS_CA_REVOCATION_URL 166
#define OID_NS_CA_POLICY_URL 167
#define OID_NS_COMMENT 168
#define OID_PKI_MESSAGE_TYPE 174
#define OID_PKI_STATUS 175
#define OID_PKI_FAIL_INFO 176
#define OID_PKI_SENDER_NONCE 177
#define OID_PKI_RECIPIENT_NONCE 178
#define OID_PKI_TRANS_ID 179
#define OID_PKI_MESSAGE_TYPE 177
#define OID_PKI_STATUS 178
#define OID_PKI_FAIL_INFO 179
#define OID_PKI_SENDER_NONCE 180
#define OID_PKI_RECIPIENT_NONCE 181
#define OID_PKI_TRANS_ID 182
#endif /* OID_H_ */
Source/lib/asn1/oid.pl
+4
View File
@@ -30,6 +30,8 @@ print OID_H "/* Object identifiers (OIDs) used by FreeS/WAN\n",
" * ", $automatic, "\n",
" * ", $warning, "\n",
" */\n\n",
"#ifndef OID_H_\n",
"#define OID_H_\n\n",
"typedef struct {\n",
" u_char octet;\n",
" u_int next;\n",
@@ -73,6 +75,8 @@ while ($line = <SRC>)
$counter++;
}
print OID_H "\n#endif /* OID_H_ */\n";
close SRC;
close OID_H;
Source/lib/asn1/oid.txt
+3
View File
@@ -167,6 +167,9 @@
0x04 "nsCaRevocationUrl" OID_NS_CA_REVOCATION_URL
0x08 "nsCaPolicyUrl" OID_NS_CA_POLICY_URL
0x0d "nsComment" OID_NS_COMMENT
0x03 "directory"
0x01 ""
0x03 "employeeNumber"
0x04 "policy"
0x01 "nsSGC"
0x45 "verisign"
Source/lib/crypto/x509.c
+112 -869
View File
File diff suppressed because it is too large Load Diff
Source/lib/crypto/x509.h
+10 -2
View File
@@ -58,14 +58,22 @@ struct x509_t {
/**
* @brief Get the certificate issuers ID.
*
* @todo implement!
* The resulting ID is always a identification_t
* of type ID_DER_ASN1_DN.
*
* @param this calling object
* @return issuers ID
*/
identification_t *(*get_issuer) (x509_t *this);
/**
* @brief Get the subjects ID.
*
* @todo implement!
* The resulting ID is always a identification_t
* of type ID_DER_ASN1_DN.
*
* @param this calling object
* @return subjects ID
*/
identification_t *(*get_subject) (x509_t *this);
Source/lib/types.h
-1
View File
@@ -30,7 +30,6 @@
#include <definitions.h>
/**
* General purpose boolean type.
*/
Source/lib/utils/identification.c
+928 -79
View File
File diff suppressed because it is too large Load Diff
Source/lib/utils/identification.h
+45 -22
View File
@@ -31,11 +31,7 @@ typedef enum id_type_t id_type_t;
/**
* @brief ID Types in a ID payload.
*
* @see
* - identification_t
* - id_payload_t
*
*
* @ingroup utils
*/
enum id_type_t {
@@ -81,7 +77,12 @@ enum id_type_t {
* specific information necessary to do certain proprietary
* types of identification.
*/
ID_KEY_ID = 11
ID_KEY_ID = 11,
/**
* Special type of PRIVATE USE which matches to any other id.
*/
ID_ANY = 201,
};
/**
@@ -95,20 +96,20 @@ typedef struct identification_t identification_t;
* @brief Generic identification, such as used in ID payload.
*
* The following types are possible:
* - ID_IPV4_ADDR
* - ID_FQDN*
* - ID_RFC822_ADDR*
* - ID_IPV6_ADDR*
* - ID_DER_ASN1_DN*
* - ID_DER_ASN1_GN*
* - ID_KEY_ID*
* (* = string conversion not supported)
* - ID_IPV4_ADDR
* - ID_FQDN
* - ID_RFC822_ADDR
* - ID_IPV6_ADDR
* - ID_DER_ASN1_DN
* - ID_DER_ASN1_GN
* - ID_KEY_ID
*
* @b Constructors:
* - identification_create_from_string()
* - identification_create_from_encoding()
*
* @todo Support for other ID types then ID_IPV4_ADDR.
* @todo Support for ID_DER_ASN1_GN is minimal right now. Comparison
* between them and ID_IPV4_ADDR/RFC822_ADDR would be nice.
*
* @ingroup utils
*/
@@ -158,10 +159,13 @@ struct identification_t {
* An identification_t may contain wildcards, such as
* *@strongswan.org. This call checks if a given ID
* (e.g. [email protected]) belongs to a such wildcard
* ID. Returns TRUE if IDs are identical.
* ID. Returns TRUE if
* - IDs are identical
* - other is of type ID_ANY
* - other contains a wildcard and matches this
*
* @param this the ID containing a wildcard
* @param other the ID without wildcard
* @param this the ID without wildcard
* @param other the ID containing a wildcard
* @return TRUE if other belongs to this
*/
bool (*belongs_to) (identification_t *this, identification_t *other);
@@ -185,15 +189,31 @@ struct identification_t {
/**
* @brief Creates an identification_t object from a string.
*
* @param type type of this id, such as ID_IPV4_ADDR
* @param string input string, which will be converted
* @return
* - created identification_t object, or
* - NULL if type not supported.
* - NULL if unsupported string supplied.
*
* The input string may be e.g. one of the following:
* - ID_IPV4_ADDR: 192.168.0.1
* - ID_IPV6_ADDR: 2001:0db8:85a3:08d3:1319:8a2e:0370:7345
* - ID_FQDN: @www.strongswan.org (@indicates FQDN)
* - ID_RFC822_ADDR: [email protected]
* - ID_DER_ASN1_DN: C=CH, O=Linux strongSwan, CN=bob
*
* In favour of pluto, domainnames are prepended with an @, since
* pluto resolves domainnames without an @ to IPv4 addresses. Since
* we use a seperate host_t class for addresses, this doesn't
* make sense for us.
*
* A distinguished name may contain one or more of the following RDNs:
* ND, UID, DC, CN, S, SN, serialNumber, C, L, ST, O, OU, T, D,
* N, G, I, ID, EN, EmployeeNumber, E, Email, emailAddress, UN,
* unstructuredName, TCGID.
*
* @ingroup utils
*/
identification_t * identification_create_from_string(id_type_t type, char *string);
identification_t * identification_create_from_string(char *string);
/**
* @brief Creates an identification_t object from an encoded chunk.
@@ -201,7 +221,10 @@ identification_t * identification_create_from_string(id_type_t type, char *strin
* @param type type of this id, such as ID_IPV4_ADDR
* @param encoded encoded bytes, such as from identification_t.get_encoding
* @return identification_t object
*
*
* In contrast to identification_create_from_string(), this constructor never
* returns NULL, even when the conversion to a sring representation fails.
*
* @ingroup utils
*/
identification_t * identification_create_from_encoding(id_type_t type, chunk_t encoded);
Source/lib/utils/logger.c
-1
View File
@@ -29,7 +29,6 @@
#include "logger.h"
#include <daemon.h>
/**
* Maximum length of a log entry (only used for logger_s.log).
Source/lib/utils/logger.h
-1
View File
@@ -27,7 +27,6 @@
#include <types.h>
typedef enum log_level_t log_level_t;
/**