denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- added payload CERT

Browse Source 
- cleaned code of different states
- added additional notify handling
This commit is contained in:
Jan Hutter
2005-12-05 12:21:38 +00:00
parent 3ebebc5e96
commit f6ba78c370
29 changed files with 861 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Source/charon/encoding/payloads/Makefile.payloads
+4
View File
@@ -41,6 +41,10 @@ $(BUILD_DIR)id_payload.o : $(PAYLOADS_DIR)id_payload.c $(PAYLOADS_DIR)id_payl
OBJS+= $(BUILD_DIR)auth_payload.o
$(BUILD_DIR)auth_payload.o : $(PAYLOADS_DIR)auth_payload.c $(PAYLOADS_DIR)auth_payload.h
$(CC) $(CFLAGS) -c -o $@ $<
OBJS+= $(BUILD_DIR)cert_payload.o
$(BUILD_DIR)cert_payload.o : $(PAYLOADS_DIR)cert_payload.c $(PAYLOADS_DIR)cert_payload.h
$(CC) $(CFLAGS) -c -o $@ $<
OBJS+= $(BUILD_DIR)ts_payload.o
$(BUILD_DIR)ts_payload.o : $(PAYLOADS_DIR)ts_payload.c $(PAYLOADS_DIR)ts_payload.h
Source/charon/encoding/payloads/cert_payload.c
+284
View File
@@ -0,0 +1,284 @@
/**
* @file cert_payload.c
*
* @brief Implementation of cert_payload_t.
*
*/
/*
* Copyright (C) 2005 Jan Hutter, Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "cert_payload.h"
#include <utils/allocator.h>
/**
* String mappings for cert_encoding_t.
*/
mapping_t cert_encoding_m[] = {
{PKCS7_WRAPPED_X509_CERTIFICATE, "PKCS7_WRAPPED_X509_CERTIFICATE"},
{PGP_CERTIFICATE, "PGP_CERTIFICATE"},
{DNS_SIGNED_KEY, "DNS_SIGNED_KEY"},
{X509_CERTIFICATE_SIGNATURE, "X509_CERTIFICATE_SIGNATURE"},
{KERBEROS_TOKEN, "KERBEROS_TOKEN"},
{CERTIFICATE_REVOCATION_LIST, "CERTIFICATE_REVOCATION_LIST"},
{AUTHORITY_REVOCATION_LIST, "AUTHORITY_REVOCATION_LIST"},
{SPKI_CERTIFICATE, "SPKI_CERTIFICATE"},
{X509_CERTIFICATE_ATTRIBUTE, "X509_CERTIFICATE_ATTRIBUTE"},
{RAW_SA_KEY, "RAW_SA_KEY"},
{HASH_AND_URL_X509_CERTIFICATE, "HASH_AND_URL_X509_CERTIFICATE"},
{HASH_AND_URL_X509_BUNDLE, "HASH_AND_URL_X509_BUNDLE"},
{MAPPING_END, NULL}
};
typedef struct private_cert_payload_t private_cert_payload_t;
/**
* Private data of an cert_payload_t object.
*
*/
struct private_cert_payload_t {
/**
* Public cert_payload_t interface.
*/
cert_payload_t public;
/**
* Next payload type.
*/
u_int8_t next_payload;
/**
* Critical flag.
*/
bool critical;
/**
* Length of this payload.
*/
u_int16_t payload_length;
/**
* Encoding of the CERT Data.
*/
u_int8_t cert_encoding;
/**
* The contained cert data value.
*/
chunk_t cert_data;
};
/**
* Encoding rules to parse or generate a CERT payload
*
* The defined offsets are the positions in a object of type
* private_cert_payload_t.
*
*/
encoding_rule_t cert_payload_encodings[] = {
/* 1 Byte next payload type, stored in the field next_payload */
{ U_INT_8, offsetof(private_cert_payload_t, next_payload) },
/* the critical bit */
{ FLAG, offsetof(private_cert_payload_t, critical) },
/* 7 Bit reserved bits, nowhere stored */
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
{ RESERVED_BIT, 0 },
/* Length of the whole payload*/
{ PAYLOAD_LENGTH, offsetof(private_cert_payload_t, payload_length)},
/* 1 Byte CERT type*/
{ U_INT_8, offsetof(private_cert_payload_t, cert_encoding) },
/* some cert data bytes, length is defined in PAYLOAD_LENGTH */
{ CERT_DATA, offsetof(private_cert_payload_t, cert_data) }
};
/*
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Next Payload !C! RESERVED ! Payload Length !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
! Cert Encoding ! !
+-+-+-+-+-+-+-+-+ !
~ Certificate Data ~
! !
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
/**
* Implementation of payload_t.verify.
*/
static status_t verify(private_cert_payload_t *this)
{
if (this->critical)
{
/* critical bit is set! */
return FAILED;
}
if ((this->cert_encoding == 0) ||
((this->cert_encoding >= 14) && (this->cert_encoding <= 200)))
{
/* reserved IDs */
return FAILED;
}
return SUCCESS;
}
/**
* Implementation of cert_payload_t.get_encoding_rules.
*/
static void get_encoding_rules(private_cert_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
{
*rules = cert_payload_encodings;
*rule_count = sizeof(cert_payload_encodings) / sizeof(encoding_rule_t);
}
/**
* Implementation of payload_t.get_type.
*/
static payload_type_t get_payload_type(private_cert_payload_t *this)
{
return CERTIFICATE;
}
/**
* Implementation of payload_t.get_next_type.
*/
static payload_type_t get_next_type(private_cert_payload_t *this)
{
return (this->next_payload);
}
/**
* Implementation of payload_t.set_next_type.
*/
static void set_next_type(private_cert_payload_t *this,payload_type_t type)
{
this->next_payload = type;
}
/**
* Implementation of payload_t.get_length.
*/
static size_t get_length(private_cert_payload_t *this)
{
return this->payload_length;
}
/**
* Implementation of cert_payload_t.set_cert_encoding.
*/
static void set_cert_encoding (private_cert_payload_t *this, cert_encoding_t encoding)
{
this->cert_encoding = encoding;
}
/**
* Implementation of cert_payload_t.get_cert_encoding.
*/
static cert_encoding_t get_cert_encoding (private_cert_payload_t *this)
{
return (this->cert_encoding);
}
/**
* Implementation of cert_payload_t.set_data.
*/
static void set_data (private_cert_payload_t *this, chunk_t data)
{
if (this->cert_data.ptr != NULL)
{
allocator_free_chunk(&(this->cert_data));
}
this->cert_data.ptr = allocator_clone_bytes(data.ptr,data.len);
this->cert_data.len = data.len;
this->payload_length = CERT_PAYLOAD_HEADER_LENGTH + this->cert_data.len;
}
/**
* Implementation of cert_payload_t.get_data.
*/
static chunk_t get_data (private_cert_payload_t *this)
{
return (this->cert_data);
}
/**
* Implementation of cert_payload_t.get_data_clone.
*/
static chunk_t get_data_clone (private_cert_payload_t *this)
{
chunk_t cloned_data;
if (this->cert_data.ptr == NULL)
{
return (this->cert_data);
}
cloned_data.ptr = allocator_clone_bytes(this->cert_data.ptr,this->cert_data.len);
cloned_data.len = this->cert_data.len;
return cloned_data;
}
/**
* Implementation of payload_t.destroy and cert_payload_t.destroy.
*/
static void destroy(private_cert_payload_t *this)
{
if (this->cert_data.ptr != NULL)
{
allocator_free_chunk(&(this->cert_data));
}
allocator_free(this);
}
/*
* Described in header
*/
cert_payload_t *cert_payload_create()
{
private_cert_payload_t *this = allocator_alloc_thing(private_cert_payload_t);
/* interface functions */
this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
/* public functions */
this->public.destroy = (void (*) (cert_payload_t *)) destroy;
this->public.set_cert_encoding = (void (*) (cert_payload_t *,cert_encoding_t)) set_cert_encoding;
this->public.get_cert_encoding = (cert_encoding_t (*) (cert_payload_t *)) get_cert_encoding;
this->public.set_data = (void (*) (cert_payload_t *,chunk_t)) set_data;
this->public.get_data_clone = (chunk_t (*) (cert_payload_t *)) get_data_clone;
this->public.get_data = (chunk_t (*) (cert_payload_t *)) get_data;
/* private variables */
this->critical = FALSE;
this->next_payload = NO_PAYLOAD;
this->payload_length =CERT_PAYLOAD_HEADER_LENGTH;
this->cert_data = CHUNK_INITIALIZER;
return (&(this->public));
}
Source/charon/encoding/payloads/cert_payload.h
+143
View File
@@ -0,0 +1,143 @@
/**
* @file cert_payload.h
*
* @brief Interface of cert_payload_t.
*
*/
/*
* Copyright (C) 2005 Jan Hutter, Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#ifndef _CERT_PAYLOAD_H_
#define _CERT_PAYLOAD_H_
#include <types.h>
#include <encoding/payloads/payload.h>
/**
* Length of a cert payload without the cert data in bytes.
*
* @ingroup payloads
*/
#define CERT_PAYLOAD_HEADER_LENGTH 5
typedef enum cert_encoding_t cert_encoding_t;
/**
* Cert Encoding.
*
* @ingroup payloads
*/
enum cert_encoding_t {
PKCS7_WRAPPED_X509_CERTIFICATE = 1,
PGP_CERTIFICATE = 2,
DNS_SIGNED_KEY = 3,
X509_CERTIFICATE_SIGNATURE = 4,
KERBEROS_TOKEN = 6,
CERTIFICATE_REVOCATION_LIST = 7,
AUTHORITY_REVOCATION_LIST = 8,
SPKI_CERTIFICATE = 9,
X509_CERTIFICATE_ATTRIBUTE = 10,
RAW_SA_KEY = 11,
HASH_AND_URL_X509_CERTIFICATE = 12,
HASH_AND_URL_X509_BUNDLE = 13
};
extern mapping_t cert_encoding_m[];
typedef struct cert_payload_t cert_payload_t;
/**
* Object representing an IKEv2 CERT payload.
*
* The CERT payload format is described in draft section 3.6.
*
* @ingroup payloads
*
*/
struct cert_payload_t {
/**
* The payload_t interface.
*/
payload_t payload_interface;
/**
* @brief Set the CERT encoding.
*
*
* @param this calling cert_payload_t object
* @param encoding CERT encoding
*/
void (*set_cert_encoding) (cert_payload_t *this, cert_encoding_t encoding);
/**
* @brief Get the CERT encoding.
*
* @param this calling cert_payload_t object
* @return Encoding of the CERT
*/
cert_encoding_t (*get_cert_encoding) (cert_payload_t *this);
/**
* @brief Set the CERT data.
*
* Data are getting cloned.
*
* @param this calling cert_payload_t object
* @param data CERT data as chunk_t
*/
void (*set_data) (cert_payload_t *this, chunk_t data);
/**
* @brief Get the CERT data.
*
* Returned data are a copy of the internal one.
*
* @param this calling cert_payload_t object
* @return CERT data as chunk_t
*/
chunk_t (*get_data_clone) (cert_payload_t *this);
/**
* @brief Get the CERT data.
*
* Returned data are NOT copied.
*
* @param this calling cert_payload_t object
* @return CERT data as chunk_t
*/
chunk_t (*get_data) (cert_payload_t *this);
/**
* @brief Destroys an cert_payload_t object.
*
* @param this cert_payload_t object to destroy
*/
void (*destroy) (cert_payload_t *this);
};
/**
* @brief Creates an empty cert_payload_t object.
*
* @return created cert_payload_t object
*
* @ingroup payloads
*/
cert_payload_t *cert_payload_create();
#endif //_CERT_PAYLOAD_H_
Source/charon/encoding/payloads/encodings.h
+10
View File
@@ -367,6 +367,16 @@ enum encoding_type_t{
* When parsing (Payload Length - 8) bytes are read and written into the chunk pointing to.
*/
AUTH_DATA,
/**
* Representating a CERT Data field.
*
* When generating the content of the chunkt pointing to
* is written.
*
* When parsing (Payload Length - 5) bytes are read and written into the chunk pointing to.
*/
CERT_DATA,
/**
* Representating an IKE_SPI field in an IKEv2 Header.
Source/charon/encoding/payloads/ike_header.c
-12
View File
@@ -186,18 +186,6 @@ static status_t verify(private_ike_header_t *this)
return FAILED;
}
if ((this->responder_spi == 0) && (!this->flags.initiator))
{
/* must be original initiator*/
return FAILED;
}
if ((this->responder_spi == 0) && (this->flags.response))
{
/* must be request*/
return FAILED;
}
/* verification of version is not done in here */
return SUCCESS;
Source/charon/encoding/payloads/notify_payload.c
+6 -1
View File
@@ -36,7 +36,7 @@ mapping_t notify_message_type_m[] = {
{INVALID_IKE_SPI, "INVALID_IKE_SPI"},
{INVALID_MAJOR_VERSION, "INVALID_MAJOR_VERSION"},
{INVALID_SYNTAX, "INVALID_SYNTAX"},
{INVALID_MESSAGE_ID, "MODP_2048_BIT"},
{INVALID_MESSAGE_ID, "INVALID_MESSAGE_ID"},
{INVALID_SPI, "INVALID_SPI"},
{NO_PROPOSAL_CHOSEN, "NO_PROPOSAL_CHOSEN"},
{INVALID_KE_PAYLOAD, "INVALID_KE_PAYLOAD"},
@@ -47,6 +47,11 @@ mapping_t notify_message_type_m[] = {
{FAILED_CP_REQUIRED, "FAILED_CP_REQUIRED"},
{TS_UACCEPTABLE, "TS_UACCEPTABLE"},
{INVALID_SELECTORS, "INVALID_SELECTORS"},
/* status messages */
{INITIAL_CONTACT, "INITIAL_CONTACT"},
{SET_WINDOW_SIZE, "SET_WINDOW_SIZE"},
{MAPPING_END, NULL}
};
Source/charon/encoding/payloads/notify_payload.h
+4 -1
View File
@@ -68,7 +68,10 @@ enum notify_message_type_t {
INTERNAL_ADDRESS_FAILURE = 36,
FAILED_CP_REQUIRED = 37,
TS_UACCEPTABLE = 38,
INVALID_SELECTORS = 39
INVALID_SELECTORS = 39,
INITIAL_CONTACT = 16384,
SET_WINDOW_SIZE = 16385
};
/**
Source/charon/encoding/payloads/payload.c
+3
View File
@@ -31,6 +31,7 @@
#include <encoding/payloads/ke_payload.h>
#include <encoding/payloads/notify_payload.h>
#include <encoding/payloads/auth_payload.h>
#include <encoding/payloads/cert_payload.h>
#include <encoding/payloads/encryption_payload.h>
#include <encoding/payloads/ts_payload.h>
@@ -88,6 +89,8 @@ payload_t *payload_create(payload_type_t type)
return (payload_t*)id_payload_create(FALSE);
case AUTHENTICATION:
return (payload_t*)auth_payload_create();
case CERTIFICATE:
return (payload_t*)cert_payload_create();
case TRAFFIC_SELECTOR_SUBSTRUCTURE:
return (payload_t*)traffic_selector_substructure_create();
case TRAFFIC_SELECTOR_INITIATOR: