aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorAndreas Steffen <andreas.steffen@strongswan.org>2011-02-10 15:51:18 +0100
committerAndreas Steffen <andreas.steffen@strongswan.org>2011-02-10 15:51:18 +0100
commitd390b3b9015aac38b186237dfcbf5e3c0a1ea9f9 (patch)
treed805c8aff9a79354e2bbb156a1e198a7f88317b9 /src
parentafddd6a7e854a0b11154d7069219cf3373e0d9fc (diff)
downloadstrongswan-d390b3b9015aac38b186237dfcbf5e3c0a1ea9f9.tar.bz2
strongswan-d390b3b9015aac38b186237dfcbf5e3c0a1ea9f9.tar.xz
[hopefully] fixed pathlen problem on ARM platforms
Diffstat (limited to 'src')
-rw-r--r--src/libcharon/plugins/stroke/stroke_list.c4
-rw-r--r--src/libstrongswan/credentials/cert_validator.h2
-rw-r--r--src/libstrongswan/credentials/certificates/x509.h5
-rw-r--r--src/libstrongswan/plugins/constraints/constraints_validator.c9
-rw-r--r--src/libstrongswan/plugins/openssl/openssl_x509.c10
-rw-r--r--src/libstrongswan/plugins/revocation/revocation_validator.c2
-rw-r--r--src/libstrongswan/plugins/x509/x509_cert.c35
7 files changed, 39 insertions, 28 deletions
diff --git a/src/libcharon/plugins/stroke/stroke_list.c b/src/libcharon/plugins/stroke/stroke_list.c
index 2fa017de1..36311f092 100644
--- a/src/libcharon/plugins/stroke/stroke_list.c
+++ b/src/libcharon/plugins/stroke/stroke_list.c
@@ -754,7 +754,7 @@ static void stroke_list_certs(linked_list_t *list, char *label,
enumerator_t *enumerator;
identification_t *altName;
bool first_altName = TRUE;
- int pathlen;
+ u_int pathlen;
chunk_t serial, authkey;
time_t notBefore, notAfter;
public_key_t *public;
@@ -837,7 +837,7 @@ static void stroke_list_certs(linked_list_t *list, char *label,
pathlen = x509->get_constraint(x509, X509_PATH_LEN);
if (pathlen != X509_NO_CONSTRAINT)
{
- fprintf(out, " pathlen: %d\n", pathlen);
+ fprintf(out, " pathlen: %u\n", pathlen);
}
/* list optional ipAddrBlocks */
diff --git a/src/libstrongswan/credentials/cert_validator.h b/src/libstrongswan/credentials/cert_validator.h
index 3c1ebc9f2..733d9d612 100644
--- a/src/libstrongswan/credentials/cert_validator.h
+++ b/src/libstrongswan/credentials/cert_validator.h
@@ -45,7 +45,7 @@ struct cert_validator_t {
* @param auth container for resulting authentication info
*/
bool (*validate)(cert_validator_t *this, certificate_t *subject,
- certificate_t *issuer, bool online, int pathlen,
+ certificate_t *issuer, bool online, u_int pathlen,
bool anchor, auth_cfg_t *auth);
};
diff --git a/src/libstrongswan/credentials/certificates/x509.h b/src/libstrongswan/credentials/certificates/x509.h
index 9f5865da8..fec02dbad 100644
--- a/src/libstrongswan/credentials/certificates/x509.h
+++ b/src/libstrongswan/credentials/certificates/x509.h
@@ -24,7 +24,8 @@
#include <utils/enumerator.h>
#include <credentials/certificates/certificate.h>
-#define X509_NO_CONSTRAINT -1
+/* constraints are currently restricted to the range 0..127 */
+#define X509_NO_CONSTRAINT 255
typedef struct x509_t x509_t;
typedef struct x509_cert_policy_t x509_cert_policy_t;
@@ -150,7 +151,7 @@ struct x509_t {
* @param type type of constraint to get
* @return constraint, X509_NO_CONSTRAINT if none found
*/
- int (*get_constraint)(x509_t *this, x509_constraint_t type);
+ u_int (*get_constraint)(x509_t *this, x509_constraint_t type);
/**
* Create an enumerator over all subjectAltNames.
diff --git a/src/libstrongswan/plugins/constraints/constraints_validator.c b/src/libstrongswan/plugins/constraints/constraints_validator.c
index 20894507a..b54d813df 100644
--- a/src/libstrongswan/plugins/constraints/constraints_validator.c
+++ b/src/libstrongswan/plugins/constraints/constraints_validator.c
@@ -38,7 +38,7 @@ struct private_constraints_validator_t {
*/
static bool check_pathlen(x509_t *issuer, int pathlen)
{
- int pathlen_constraint;
+ u_int pathlen_constraint;
pathlen_constraint = issuer->get_constraint(issuer, X509_PATH_LEN);
if (pathlen_constraint != X509_NO_CONSTRAINT &&
@@ -439,7 +439,7 @@ static bool has_no_any_policy(linked_list_t *chain, int len)
/**
* Check requireExplicitPolicy and inhibitPolicyMapping constraints
*/
-static bool check_policy_constraints(x509_t *issuer, int pathlen,
+static bool check_policy_constraints(x509_t *issuer, u_int pathlen,
auth_cfg_t *auth)
{
certificate_t *subject;
@@ -455,7 +455,8 @@ static bool check_policy_constraints(x509_t *issuer, int pathlen,
certificate_t *cert;
auth_rule_t rule;
x509_t *x509;
- int len = 0, expl, inh;
+ int len = 0;
+ u_int expl, inh;
/* prepare trustchain to validate */
chain = linked_list_create();
@@ -524,7 +525,7 @@ static bool check_policy_constraints(x509_t *issuer, int pathlen,
METHOD(cert_validator_t, validate, bool,
private_constraints_validator_t *this, certificate_t *subject,
- certificate_t *issuer, bool online, int pathlen, bool anchor,
+ certificate_t *issuer, bool online, u_int pathlen, bool anchor,
auth_cfg_t *auth)
{
if (issuer->get_type(issuer) == CERT_X509 &&
diff --git a/src/libstrongswan/plugins/openssl/openssl_x509.c b/src/libstrongswan/plugins/openssl/openssl_x509.c
index f096b2b5b..f7495b2ae 100644
--- a/src/libstrongswan/plugins/openssl/openssl_x509.c
+++ b/src/libstrongswan/plugins/openssl/openssl_x509.c
@@ -84,7 +84,7 @@ struct private_openssl_x509_t {
/**
* Pathlen constraint
*/
- int pathlen;
+ u_char pathlen;
/**
* certificate subject
@@ -250,7 +250,7 @@ METHOD(x509_t, get_authKeyIdentifier, chunk_t,
return chunk_empty;
}
-METHOD(x509_t, get_constraint, int,
+METHOD(x509_t, get_constraint, u_int,
private_openssl_x509_t *this, x509_constraint_t type)
{
switch (type)
@@ -586,6 +586,7 @@ static bool parse_basicConstraints_ext(private_openssl_x509_t *this,
X509_EXTENSION *ext)
{
BASIC_CONSTRAINTS *constraints;
+ long pathlen;
constraints = (BASIC_CONSTRAINTS*)X509V3_EXT_d2i(ext);
if (constraints)
@@ -596,7 +597,10 @@ static bool parse_basicConstraints_ext(private_openssl_x509_t *this,
}
if (constraints->pathlen)
{
- this->pathlen = ASN1_INTEGER_get(constraints->pathlen);
+
+ pathlen = ASN1_INTEGER_get(constraints->pathlen);
+ this->pathlen = (pathlen >= 0 && pathlen < 128) ?
+ pathlen : X509_NO_CONSTRAINT;
}
BASIC_CONSTRAINTS_free(constraints);
return TRUE;
diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c
index b08e30933..def169275 100644
--- a/src/libstrongswan/plugins/revocation/revocation_validator.c
+++ b/src/libstrongswan/plugins/revocation/revocation_validator.c
@@ -665,7 +665,7 @@ static cert_validation_t check_crl(x509_t *subject, x509_t *issuer,
METHOD(cert_validator_t, validate, bool,
private_revocation_validator_t *this, certificate_t *subject,
- certificate_t *issuer, bool online, int pathlen, bool anchor,
+ certificate_t *issuer, bool online, u_int pathlen, bool anchor,
auth_cfg_t *auth)
{
if (subject->get_type(subject) == CERT_X509 &&
diff --git a/src/libstrongswan/plugins/x509/x509_cert.c b/src/libstrongswan/plugins/x509/x509_cert.c
index c3bb4ea5b..526dbe8c6 100644
--- a/src/libstrongswan/plugins/x509/x509_cert.c
+++ b/src/libstrongswan/plugins/x509/x509_cert.c
@@ -174,22 +174,22 @@ struct private_x509_cert_t {
/**
* Path Length Constraint
*/
- char pathLenConstraint;
+ u_char pathLenConstraint;
/**
* requireExplicitPolicy Constraint
*/
- char require_explicit;
+ u_char require_explicit;
/**
* inhibitPolicyMapping Constraint
*/
- char inhibit_mapping;
+ u_char inhibit_mapping;
/**
* inhibitAnyPolicy Constraint
*/
- char inhibit_any;
+ u_char inhibit_any;
/**
* x509 constraints and other flags
@@ -255,14 +255,14 @@ static void policy_mapping_destroy(x509_policy_mapping_t *mapping)
/**
* Parse a length constraint from an unwrapped integer
*/
-static int parse_constraint(chunk_t object)
+static u_int parse_constraint(chunk_t object)
{
switch (object.len)
{
case 0:
return 0;
case 1:
- return object.ptr[0];
+ return (object.ptr[0] & 0x80) ? X509_NO_CONSTRAINT : object.ptr[0];
default:
return X509_NO_CONSTRAINT;
}
@@ -1723,7 +1723,7 @@ METHOD(x509_t, get_authKeyIdentifier, chunk_t,
return this->authKeyIdentifier;
}
-METHOD(x509_t, get_constraint, int,
+METHOD(x509_t, get_constraint, u_int,
private_x509_cert_t *this, x509_constraint_t type)
{
switch (type)
@@ -2390,6 +2390,7 @@ x509_cert_t *x509_cert_gen(certificate_type_t type, va_list args)
certificate_t *sign_cert = NULL;
private_key_t *sign_key = NULL;
hash_algorithm_t digest_alg = HASH_SHA1;
+ u_int constraint;
cert = create_empty();
while (TRUE)
@@ -2464,11 +2465,9 @@ x509_cert_t *x509_cert_gen(certificate_type_t type, va_list args)
continue;
}
case BUILD_PATHLEN:
- cert->pathLenConstraint = va_arg(args, int);
- if (cert->pathLenConstraint < 0 || cert->pathLenConstraint > 127)
- {
- cert->pathLenConstraint = X509_NO_CONSTRAINT;
- }
+ constraint = va_arg(args, u_int);
+ cert->pathLenConstraint = (constraint < 128) ?
+ constraint : X509_NO_CONSTRAINT;
continue;
case BUILD_PERMITTED_NAME_CONSTRAINTS:
{
@@ -2543,13 +2542,19 @@ x509_cert_t *x509_cert_gen(certificate_type_t type, va_list args)
continue;
}
case BUILD_POLICY_REQUIRE_EXPLICIT:
- cert->require_explicit = va_arg(args, int);
+ constraint = va_arg(args, u_int);
+ cert->require_explicit = (constraint < 128) ?
+ constraint : X509_NO_CONSTRAINT;
continue;
case BUILD_POLICY_INHIBIT_MAPPING:
- cert->inhibit_mapping = va_arg(args, int);
+ constraint = va_arg(args, u_int);
+ cert->inhibit_mapping = (constraint < 128) ?
+ constraint : X509_NO_CONSTRAINT;
continue;
case BUILD_POLICY_INHIBIT_ANY:
- cert->inhibit_any = va_arg(args, int);
+ constraint = va_arg(args, u_int);
+ cert->inhibit_any = (constraint < 128) ?
+ constraint : X509_NO_CONSTRAINT;
continue;
case BUILD_NOT_BEFORE_TIME:
cert->notBefore = va_arg(args, time_t);