aboutsummaryrefslogtreecommitdiffstats
path: root/Source/lib/utils
diff options
context:
space:
mode:
Diffstat (limited to 'Source/lib/utils')
-rw-r--r--Source/lib/utils/identification.c1005
-rw-r--r--Source/lib/utils/identification.h67
-rw-r--r--Source/lib/utils/logger.c1
-rw-r--r--Source/lib/utils/logger.h1
4 files changed, 972 insertions, 102 deletions
diff --git a/Source/lib/utils/identification.c b/Source/lib/utils/identification.c
index 05d9d76f9..d99d0e453 100644
--- a/Source/lib/utils/identification.c
+++ b/Source/lib/utils/identification.c
@@ -20,13 +20,18 @@
* for more details.
*/
+#define _GNU_SOURCE
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
+#include <stdio.h>
+#include <ctype.h>
#include "identification.h"
+#include <asn1/asn1.h>
+
/**
* String mappings for id_type_t.
*/
@@ -38,10 +43,184 @@ mapping_t id_type_m[] = {
{ID_DER_ASN1_DN, "ID_DER_ASN1_DN"},
{ID_DER_ASN1_GN, "ID_DER_ASN1_GN"},
{ID_KEY_ID, "ID_KEY_ID"},
+ {ID_ANY, "ID_ANY"},
{MAPPING_END, NULL}
};
+/**
+ * X.501 acronyms for well known object identifiers (OIDs)
+ */
+static u_char oid_ND[] = {
+ 0x02, 0x82, 0x06, 0x01,
+ 0x0A, 0x07, 0x14
+};
+static u_char oid_UID[] = {
+ 0x09, 0x92, 0x26, 0x89, 0x93,
+ 0xF2, 0x2C, 0x64, 0x01, 0x01
+};
+static u_char oid_DC[] = {
+ 0x09, 0x92, 0x26, 0x89, 0x93,
+ 0xF2, 0x2C, 0x64, 0x01, 0x19
+};
+static u_char oid_CN[] = {
+ 0x55, 0x04, 0x03
+};
+static u_char oid_S[] = {
+ 0x55, 0x04, 0x04
+};
+static u_char oid_SN[] = {
+ 0x55, 0x04, 0x05
+};
+static u_char oid_C[] = {
+ 0x55, 0x04, 0x06
+};
+static u_char oid_L[] = {
+ 0x55, 0x04, 0x07
+};
+static u_char oid_ST[] = {
+ 0x55, 0x04, 0x08
+};
+static u_char oid_O[] = {
+ 0x55, 0x04, 0x0A
+};
+static u_char oid_OU[] = {
+ 0x55, 0x04, 0x0B
+};
+static u_char oid_T[] = {
+ 0x55, 0x04, 0x0C
+};
+static u_char oid_D[] = {
+ 0x55, 0x04, 0x0D
+};
+static u_char oid_N[] = {
+ 0x55, 0x04, 0x29
+};
+static u_char oid_G[] = {
+ 0x55, 0x04, 0x2A
+};
+static u_char oid_I[] = {
+ 0x55, 0x04, 0x2B
+};
+static u_char oid_ID[] = {
+ 0x55, 0x04, 0x2D
+};
+static u_char oid_EN[] = {
+ 0x60, 0x86, 0x48, 0x01, 0x86,
+ 0xF8, 0x42, 0x03, 0x01, 0x03
+};
+static u_char oid_E[] = {
+ 0x2A, 0x86, 0x48, 0x86, 0xF7,
+ 0x0D, 0x01, 0x09, 0x01
+};
+static u_char oid_UN[] = {
+ 0x2A, 0x86, 0x48, 0x86, 0xF7,
+ 0x0D, 0x01, 0x09, 0x02
+};
+static u_char oid_TCGID[] = {
+ 0x2B, 0x06, 0x01, 0x04, 0x01, 0x89,
+ 0x31, 0x01, 0x01, 0x02, 0x02, 0x4B
+};
+
+/**
+ * coding of X.501 distinguished name
+ */
+typedef struct {
+ const u_char *name;
+ chunk_t oid;
+ u_char type;
+} x501rdn_t;
+
+static const x501rdn_t x501rdns[] = {
+ {"ND", {oid_ND, 7}, ASN1_PRINTABLESTRING},
+ {"UID", {oid_UID, 10}, ASN1_PRINTABLESTRING},
+ {"DC", {oid_DC, 10}, ASN1_PRINTABLESTRING},
+ {"CN", {oid_CN, 3}, ASN1_PRINTABLESTRING},
+ {"S", {oid_S, 3}, ASN1_PRINTABLESTRING},
+ {"SN", {oid_SN, 3}, ASN1_PRINTABLESTRING},
+ {"serialNumber", {oid_SN, 3}, ASN1_PRINTABLESTRING},
+ {"C", {oid_C, 3}, ASN1_PRINTABLESTRING},
+ {"L", {oid_L, 3}, ASN1_PRINTABLESTRING},
+ {"ST", {oid_ST, 3}, ASN1_PRINTABLESTRING},
+ {"O", {oid_O, 3}, ASN1_PRINTABLESTRING},
+ {"OU", {oid_OU, 3}, ASN1_PRINTABLESTRING},
+ {"T", {oid_T, 3}, ASN1_PRINTABLESTRING},
+ {"D", {oid_D, 3}, ASN1_PRINTABLESTRING},
+ {"N", {oid_N, 3}, ASN1_PRINTABLESTRING},
+ {"G", {oid_G, 3}, ASN1_PRINTABLESTRING},
+ {"I", {oid_I, 3}, ASN1_PRINTABLESTRING},
+ {"ID", {oid_ID, 3}, ASN1_PRINTABLESTRING},
+ {"EN", {oid_EN, 10}, ASN1_PRINTABLESTRING},
+ {"employeeNumber", {oid_EN, 10}, ASN1_PRINTABLESTRING},
+ {"E", {oid_E, 9}, ASN1_IA5STRING},
+ {"Email", {oid_E, 9}, ASN1_IA5STRING},
+ {"emailAddress", {oid_E, 9}, ASN1_IA5STRING},
+ {"UN", {oid_UN, 9}, ASN1_IA5STRING},
+ {"unstructuredName",{oid_UN, 9}, ASN1_IA5STRING},
+ {"TCGID", {oid_TCGID, 12}, ASN1_PRINTABLESTRING}
+};
+#define X501_RDN_ROOF 26
+
+/**
+ * Different kinds of generalNames
+ */
+enum generalNames_t {
+ GN_OTHER_NAME = 0,
+ GN_RFC822_NAME = 1,
+ GN_DNS_NAME = 2,
+ GN_X400_ADDRESS = 3,
+ GN_DIRECTORY_NAME = 4,
+ GN_EDI_PARTY_NAME = 5,
+ GN_URI = 6,
+ GN_IP_ADDRESS = 7,
+ GN_REGISTERED_ID = 8,
+};
+
+/**
+ * ASN.1 definition of generalName
+ */
+static const asn1Object_t generalNameObjects[] = {
+ { 0, "otherName", ASN1_CONTEXT_C_0, ASN1_OPT|ASN1_BODY }, /* 0 */
+ { 0, "end choice", ASN1_EOC, ASN1_END }, /* 1 */
+ { 0, "rfc822Name", ASN1_CONTEXT_S_1, ASN1_OPT|ASN1_BODY }, /* 2 */
+ { 0, "end choice", ASN1_EOC, ASN1_END }, /* 3 */
+ { 0, "dnsName", ASN1_CONTEXT_S_2, ASN1_OPT|ASN1_BODY }, /* 4 */
+ { 0, "end choice", ASN1_EOC, ASN1_END }, /* 5 */
+ { 0, "x400Address", ASN1_CONTEXT_S_3, ASN1_OPT|ASN1_BODY }, /* 6 */
+ { 0, "end choice", ASN1_EOC, ASN1_END }, /* 7 */
+ { 0, "directoryName", ASN1_CONTEXT_C_4, ASN1_OPT|ASN1_BODY }, /* 8 */
+ { 0, "end choice", ASN1_EOC, ASN1_END }, /* 9 */
+ { 0, "ediPartyName", ASN1_CONTEXT_C_5, ASN1_OPT|ASN1_BODY }, /* 10 */
+ { 0, "end choice", ASN1_EOC, ASN1_END }, /* 11 */
+ { 0, "URI", ASN1_CONTEXT_S_6, ASN1_OPT|ASN1_BODY }, /* 12 */
+ { 0, "end choice", ASN1_EOC, ASN1_END }, /* 13 */
+ { 0, "ipAddress", ASN1_CONTEXT_S_7, ASN1_OPT|ASN1_BODY }, /* 14 */
+ { 0, "end choice", ASN1_EOC, ASN1_END }, /* 15 */
+ { 0, "registeredID", ASN1_CONTEXT_S_8, ASN1_OPT|ASN1_BODY }, /* 16 */
+ { 0, "end choice", ASN1_EOC, ASN1_END } /* 17 */
+};
+#define GN_OBJ_OTHER_NAME 0
+#define GN_OBJ_RFC822_NAME 2
+#define GN_OBJ_DNS_NAME 4
+#define GN_OBJ_X400_ADDRESS 6
+#define GN_OBJ_DIRECTORY_NAME 8
+#define GN_OBJ_EDI_PARTY_NAME 10
+#define GN_OBJ_URI 12
+#define GN_OBJ_IP_ADDRESS 14
+#define GN_OBJ_REGISTERED_ID 16
+#define GN_OBJ_ROOF 18
+
+/**
+ * ASN.1 definition of otherName
+ */
+static const asn1Object_t otherNameObjects[] = {
+ {0, "type-id", ASN1_OID, ASN1_BODY }, /* 0 */
+ {0, "value", ASN1_CONTEXT_C_0, ASN1_BODY } /* 1 */
+};
+#define ON_OBJ_ID_TYPE 0
+#define ON_OBJ_VALUE 1
+#define ON_OBJ_ROOF 2
+
typedef struct private_identification_t private_identification_t;
/**
@@ -71,6 +250,539 @@ struct private_identification_t {
static private_identification_t *identification_create();
+
+/**
+ * updates a chunk (!????)
+ * TODO: We should reconsider this stuff, its not really clear
+ */
+static void update_chunk(chunk_t *ch, int n)
+{
+ n = (n > -1 && n < (int)ch->len)? n : (int)ch->len-1;
+ ch->ptr += n; ch->len -= n;
+}
+
+/**
+ * Prints a binary string in hexadecimal form
+ */
+void hex_str(chunk_t bin, chunk_t *str)
+{
+ u_int i;
+ update_chunk(str, snprintf(str->ptr,str->len,"0x"));
+ for (i=0; i < bin.len; i++)
+ {
+ update_chunk(str, snprintf(str->ptr,str->len,"%02X",*bin.ptr++));
+ }
+}
+
+/**
+ * Pointer is set to the first RDN in a DN
+ */
+static status_t init_rdn(chunk_t dn, chunk_t *rdn, chunk_t *attribute, bool *next)
+{
+ *rdn = CHUNK_INITIALIZER;
+ *attribute = CHUNK_INITIALIZER;
+
+ /* a DN is a SEQUENCE OF RDNs */
+ if (*dn.ptr != ASN1_SEQUENCE)
+ {
+ /* DN is not a SEQUENCE */
+ return FAILED;
+ }
+
+ rdn->len = asn1_length(&dn);
+
+ if (rdn->len == ASN1_INVALID_LENGTH)
+ {
+ /* Invalid RDN length */
+ return FAILED;
+ }
+
+ rdn->ptr = dn.ptr;
+
+ /* are there any RDNs ? */
+ *next = rdn->len > 0;
+
+ return SUCCESS;
+}
+
+/**
+ * Fetches the next RDN in a DN
+ */
+static status_t get_next_rdn(chunk_t *rdn, chunk_t * attribute, chunk_t *oid, chunk_t *value, asn1_t *type, bool *next)
+{
+ chunk_t body;
+
+ /* initialize return values */
+ *oid = CHUNK_INITIALIZER;
+ *value = CHUNK_INITIALIZER;
+
+ /* if all attributes have been parsed, get next rdn */
+ if (attribute->len <= 0)
+ {
+ /* an RDN is a SET OF attributeTypeAndValue */
+ if (*rdn->ptr != ASN1_SET)
+ {
+ /* RDN is not a SET */
+ return FAILED;
+ }
+ attribute->len = asn1_length(rdn);
+ if (attribute->len == ASN1_INVALID_LENGTH)
+ {
+ /* Invalid attribute length */
+ return FAILED;
+ }
+ attribute->ptr = rdn->ptr;
+ /* advance to start of next RDN */
+ rdn->ptr += attribute->len;
+ rdn->len -= attribute->len;
+ }
+
+ /* an attributeTypeAndValue is a SEQUENCE */
+ if (*attribute->ptr != ASN1_SEQUENCE)
+ {
+ /* attributeTypeAndValue is not a SEQUENCE */
+ return FAILED;
+ }
+
+ /* extract the attribute body */
+ body.len = asn1_length(attribute);
+
+ if (body.len == ASN1_INVALID_LENGTH)
+ {
+ /* Invalid attribute body length */
+ return FAILED;
+ }
+
+ body.ptr = attribute->ptr;
+
+ /* advance to start of next attribute */
+ attribute->ptr += body.len;
+ attribute->len -= body.len;
+
+ /* attribute type is an OID */
+ if (*body.ptr != ASN1_OID)
+ {
+ /* attributeType is not an OID */
+ return FAILED;
+ }
+ /* extract OID */
+ oid->len = asn1_length(&body);
+
+ if (oid->len == ASN1_INVALID_LENGTH)
+ {
+ /* Invalid attribute OID length */
+ return FAILED;
+ }
+ oid->ptr = body.ptr;
+
+ /* advance to the attribute value */
+ body.ptr += oid->len;
+ body.len -= oid->len;
+
+ /* extract string type */
+ *type = *body.ptr;
+
+ /* extract string value */
+ value->len = asn1_length(&body);
+
+ if (value->len == ASN1_INVALID_LENGTH)
+ {
+ /* Invalid attribute string length */
+ return FAILED;
+ }
+ value->ptr = body.ptr;
+
+ /* are there any RDNs left? */
+ *next = rdn->len > 0 || attribute->len > 0;
+ return SUCCESS;
+}
+
+/**
+ * Parses an ASN.1 distinguished name int its OID/value pairs
+ */
+static status_t dntoa(chunk_t dn, chunk_t *str)
+{
+ chunk_t rdn, oid, attribute, value;
+ asn1_t type;
+ int oid_code;
+ bool next;
+ bool first = TRUE;
+
+ status_t status = init_rdn(dn, &rdn, &attribute, &next);
+
+ if (status != SUCCESS)
+ {/* a parsing error has occured */
+ return status;
+ }
+
+ while (next)
+ {
+ status = get_next_rdn(&rdn, &attribute, &oid, &value, &type, &next);
+
+ if (status != SUCCESS)
+ {/* a parsing error has occured */
+ return status;
+ }
+
+ if (first)
+ { /* first OID/value pair */
+ first = FALSE;
+ }
+ else
+ { /* separate OID/value pair by a comma */
+ update_chunk(str, snprintf(str->ptr,str->len,", "));
+ }
+
+ /* print OID */
+ oid_code = known_oid(oid);
+ if (oid_code == OID_UNKNOWN)
+ { /* OID not found in list */
+ hex_str(oid, str);
+ }
+ else
+ {
+ update_chunk(str, snprintf(str->ptr,str->len,"%s", oid_names[oid_code].name));
+ }
+ /* print value */
+ update_chunk(str, snprintf(str->ptr,str->len,"=%.*s", (int)value.len,value.ptr));
+ }
+ return SUCCESS;
+}
+
+/**
+ * compare two distinguished names by
+ * comparing the individual RDNs
+ */
+static bool same_dn(chunk_t a, chunk_t b)
+{
+ chunk_t rdn_a, rdn_b, attribute_a, attribute_b;
+ chunk_t oid_a, oid_b, value_a, value_b;
+ asn1_t type_a, type_b;
+ bool next_a, next_b;
+
+ /* same lengths for the DNs */
+ if (a.len != b.len)
+ {
+ return FALSE;
+ }
+ /* try a binary comparison first */
+ if (memcmp(a.ptr, b.ptr, b.len) == 0)
+ {
+ return TRUE;
+ }
+
+ /* initialize DN parsing */
+ if (init_rdn(a, &rdn_a, &attribute_a, &next_a) != SUCCESS ||
+ init_rdn(b, &rdn_b, &attribute_b, &next_b) != SUCCESS)
+ {
+ return FALSE;
+ }
+
+ /* fetch next RDN pair */
+ while (next_a && next_b)
+ {
+ /* parse next RDNs and check for errors */
+ if (get_next_rdn(&rdn_a, &attribute_a, &oid_a, &value_a, &type_a, &next_a) != SUCCESS ||
+ get_next_rdn(&rdn_b, &attribute_b, &oid_b, &value_b, &type_b, &next_b) != SUCCESS)
+ {
+ return FALSE;
+ }
+ /* OIDs must agree */
+ if (oid_a.len != oid_b.len || memcmp(oid_a.ptr, oid_b.ptr, oid_b.len) != 0)
+ {
+ return FALSE;
+ }
+ /* same lengths for values */
+ if (value_a.len != value_b.len)
+ {
+ return FALSE;
+ }
+ /* printableStrings and email RDNs require uppercase comparison */
+ if (type_a == type_b && (type_a == ASN1_PRINTABLESTRING ||
+ (type_a == ASN1_IA5STRING && known_oid(oid_a) == OID_PKCS9_EMAIL)))
+ {
+ if (strncasecmp(value_a.ptr, value_b.ptr, value_b.len) != 0)
+ {
+ return FALSE;
+ }
+ }
+ else
+ {
+ if (strncmp(value_a.ptr, value_b.ptr, value_b.len) != 0)
+ {
+ return FALSE;
+ }
+ }
+ }
+ /* both DNs must have same number of RDNs */
+ if (next_a || next_b)
+ return FALSE;
+
+ /* the two DNs are equal! */
+ return TRUE;
+}
+
+
+/**
+ * compare two distinguished names by comparing the individual RDNs.
+ * A single'*' character designates a wildcard RDN in DN b.
+ * TODO: Add support for different RDN order in DN !!
+ */
+bool match_dn(chunk_t a, chunk_t b, int *wildcards)
+{
+ chunk_t rdn_a, rdn_b, attribute_a, attribute_b;
+ chunk_t oid_a, oid_b, value_a, value_b;
+ asn1_t type_a, type_b;
+ bool next_a, next_b;
+
+ /* initialize wildcard counter */
+ *wildcards = 0;
+
+ /* initialize DN parsing */
+ if (init_rdn(a, &rdn_a, &attribute_a, &next_a) != SUCCESS ||
+ init_rdn(b, &rdn_b, &attribute_b, &next_b) != SUCCESS)
+ {
+ return FALSE;
+ }
+ /* fetch next RDN pair */
+ while (next_a && next_b)
+ {
+ /* parse next RDNs and check for errors */
+ if (get_next_rdn(&rdn_a, &attribute_a, &oid_a, &value_a, &type_a, &next_a) != SUCCESS ||
+ get_next_rdn(&rdn_b, &attribute_b, &oid_b, &value_b, &type_b, &next_b) != SUCCESS)
+ {
+ return FALSE;
+ }
+ /* OIDs must agree */
+ if (oid_a.len != oid_b.len || memcmp(oid_a.ptr, oid_b.ptr, oid_b.len) != 0)
+ {
+ return FALSE;
+ }
+ /* does rdn_b contain a wildcard? */
+ if (value_b.len == 1 && *value_b.ptr == '*')
+ {
+ (*wildcards)++;
+ continue;
+ }
+ /* same lengths for values */
+ if (value_a.len != value_b.len)
+ {
+ return FALSE;
+ }
+ /* printableStrings and email RDNs require uppercase comparison */
+ if (type_a == type_b && (type_a == ASN1_PRINTABLESTRING ||
+ (type_a == ASN1_IA5STRING && known_oid(oid_a) == OID_PKCS9_EMAIL)))
+ {
+ if (strncasecmp(value_a.ptr, value_b.ptr, value_b.len) != 0)
+ {
+ return FALSE;
+ }
+ }
+ else
+ {
+ if (strncmp(value_a.ptr, value_b.ptr, value_b.len) != 0)
+ {
+ return FALSE;
+ }
+ }
+ }
+ /* both DNs must have same number of RDNs */
+ if (next_a || next_b)
+ {
+ return FALSE;
+ }
+ /* the two DNs match! */
+ return TRUE;
+}
+
+/**
+ * get string representation of a general name
+ * TODO: Add support for gn types
+ */
+static char *gntoa(chunk_t blob)
+{
+ asn1_ctx_t ctx;
+ chunk_t object;
+ int objectID = 0;
+ u_int level;
+ char buf[128];
+
+ asn1_init(&ctx, blob, 0, FALSE);
+
+ while (objectID < GN_OBJ_ROOF)
+ {
+ if (!extract_object(generalNameObjects, &objectID, &object, &level, &ctx))
+ {
+ return NULL;
+ }
+ switch (objectID)
+ {
+ case GN_OBJ_RFC822_NAME:
+ case GN_OBJ_DNS_NAME:
+ case GN_OBJ_URI:
+ snprintf(buf, sizeof(buf), "%.*s", object.len, object.ptr);
+ return strdup(buf);
+ case GN_OBJ_IP_ADDRESS:
+ if (object.len == 4 &&
+ inet_ntop(AF_INET, object.ptr, buf, sizeof(buf)))
+ {
+ return strdup(buf);
+ }
+ return NULL;
+ break;
+ case GN_OBJ_OTHER_NAME:
+ return strdup("(other name)");
+ case GN_OBJ_X400_ADDRESS:
+ return strdup("(X400 Address)");
+ case GN_OBJ_EDI_PARTY_NAME:
+ return strdup("(EDI party name)");
+ case GN_OBJ_REGISTERED_ID:
+ return strdup("(registered ID)");
+ case GN_OBJ_DIRECTORY_NAME:
+ return strdup("(directory name)");
+ default:
+ break;
+ }
+ objectID++;
+ }
+ return NULL;
+}
+
+/**
+ * Converts an LDAP-style human-readable ASCII-encoded
+ * ASN.1 distinguished name into binary DER-encoded format
+ */
+static status_t atodn(char *src, chunk_t *dn)
+{
+ /* finite state machine for atodn */
+ typedef enum {
+ SEARCH_OID = 0,
+ READ_OID = 1,
+ SEARCH_NAME = 2,
+ READ_NAME = 3,
+ UNKNOWN_OID = 4
+ } state_t;
+
+ char *wrap_mode;
+ chunk_t oid = CHUNK_INITIALIZER;
+ chunk_t name = CHUNK_INITIALIZER;
+ chunk_t names[25]; /* max to 25 rdns */
+ int name_count = 0;
+ int whitespace = 0;
+ int pos = 0;
+ asn1_t rdn_type;
+ state_t state = SEARCH_OID;
+ status_t status = SUCCESS;
+
+ do
+ {
+ switch (state)
+ {
+ case SEARCH_OID:
+ if (*src != ' ' && *src != '/' && *src != ',')
+ {
+ oid.ptr = src;
+ oid.len = 1;
+ state = READ_OID;
+ }
+ break;
+ case READ_OID:
+ if (*src != ' ' && *src != '=')
+ {
+ oid.len++;
+ }
+ else
+ {
+ for (pos = 0; pos < X501_RDN_ROOF; pos++)
+ {
+ if (strlen(x501rdns[pos].name) == oid.len &&
+ strncasecmp(x501rdns[pos].name, oid.ptr, oid.len) == 0)
+ {
+ break; /* found a valid OID */
+ }
+ }
+ if (pos == X501_RDN_ROOF)
+ {
+ status = NOT_SUPPORTED;
+ state = UNKNOWN_OID;
+ break;
+ }
+ /* reset oid and change state */
+ oid = CHUNK_INITIALIZER;
+ state = SEARCH_NAME;
+ }
+ break;
+ case SEARCH_NAME:
+ if (*src != ' ' && *src != '=')
+ {
+ name.ptr = src;
+ name.len = 1;
+ whitespace = 0;
+ state = READ_NAME;
+ }
+ break;
+ case READ_NAME:
+ if (*src != ',' && *src != '/' && *src != '\0')
+ {
+ name.len++;
+ if (*src == ' ')
+ {
+ whitespace++;
+ }
+ else
+ {
+ whitespace = 0;
+ }
+ }
+ else
+ {
+ name.len -= whitespace;
+ rdn_type = (x501rdns[pos].type == ASN1_PRINTABLESTRING
+ && !is_printablestring(name))? ASN1_T61STRING : x501rdns[pos].type;
+
+ if (name_count < 25)
+ {
+ names[name_count++] =
+ asn1_wrap(ASN1_SET, "m",
+ asn1_wrap(ASN1_SEQUENCE, "mm",
+ asn1_wrap(ASN1_OID, "c", x501rdns[pos].oid),
+ asn1_wrap(rdn_type, "c", name)
+ )
+ );
+ }
+ else
+ {
+ status = OUT_OF_RES;
+ }
+ /* reset name and change state */
+ name = CHUNK_INITIALIZER;
+ state = SEARCH_OID;
+ }
+ break;
+ case UNKNOWN_OID:
+ break;
+ }
+ } while (*src++ != '\0');
+
+
+ /* build the distinguished name sequence */
+ wrap_mode = alloca(26);
+ memset(wrap_mode, 0, 26);
+ memset(wrap_mode, 'm', name_count);
+ *dn = asn1_wrap(ASN1_SEQUENCE, wrap_mode,
+ names[0], names[1], names[2], names[3], names[4],
+ names[5], names[6], names[7], names[8], names[9],
+ names[10], names[11], names[12], names[13], names[14],
+ names[15], names[16], names[17], names[18], names[19],
+ names[20], names[21], names[22], names[23], names[24]);
+ if (status != SUCCESS)
+ {
+ free(dn->ptr);
+ *dn = CHUNK_INITIALIZER;
+ }
+ return status;
+}
+
/**
* Implementation of identification_t.get_encoding.
*/
@@ -96,17 +808,15 @@ static char *get_string(private_identification_t *this)
}
/**
- * Implementation of identification_t.equals.
+ * Default implementation of identification_t.equals and identification_t.belongs_to.
+ * compares encoded chunk for equality.
*/
-static bool equals (private_identification_t *this,private_identification_t *other)
+static bool equals_binary(private_identification_t *this,private_identification_t *other)
{
if (this->type == other->type)
{
- if (this->encoded.len != other->encoded.len)
- {
- return FALSE;
- }
- if (memcmp(this->encoded.ptr,other->encoded.ptr,this->encoded.len) == 0)
+ if (this->encoded.len == other->encoded.len &&
+ memcmp(this->encoded.ptr, other->encoded.ptr, this->encoded.len) == 0)
{
return TRUE;
}
@@ -115,23 +825,74 @@ static bool equals (private_identification_t *this,private_identification_t *oth
}
/**
- * Implementation of identification_t.belongs_to.
+ * Special implementation of identification_t.equals for ID_DER_ASN1_DN
*/
-static bool belongs_to(private_identification_t *this, private_identification_t *other)
+static bool equals_dn(private_identification_t *this, private_identification_t *other)
{
- if (this->public.equals(&this->public, &other->public))
+ return same_dn(this->encoded, other->encoded);
+}
+
+/**
+ * Special implementation of identification_t.belongs_to for ID_RFC822_ADDR/ID_FQDN.
+ * checks for a wildcard in other-string, and compares it against this-string.
+ */
+static bool belongs_to_wc_string(private_identification_t *this, private_identification_t *other)
+{
+ char *this_str, *other_str, *pos;
+
+ if (this->type == other->type)
{
- return TRUE;
+ /* try a binary comparison first */
+ if (equals_binary(this, other))
+ {
+ return TRUE;
+ }
}
-
- if (this->type == other->type && this->type == ID_IPV4_ADDR)
+ if (other->encoded.len > 0 &&
+ *(other->encoded.ptr) == '*')
{
- /* is this %any (0.0.0.0)?*/
- if (*((u_int32_t*)this->encoded.ptr) == 0)
+ if (other->encoded.len == 1)
{
+ /* other contains just a wildcard, and therefore matches anything */
return TRUE;
}
- /* TODO: Do we need subnet support? */
+ /* We strdup chunks, since they are NOT null-terminated */
+ this_str = strndupa(this->encoded.ptr, this->encoded.len);
+ other_str = strndupa(other->encoded.ptr + 1, other->encoded.len - 1);
+ pos = strstr(this_str, other_str);
+ if (pos != NULL)
+ {
+ /* ok, other is contained in this, but there may be more characters, so check it */
+ if (strlen(pos) == strlen(other_str))
+ {
+ return TRUE;
+ }
+ }
+ }
+
+ return FALSE;
+}
+
+/**
+ * Special implementation of identification_t.belongs_to for ID_ANY.
+ * ANY matches any, even ANY, thats why its there...
+ */
+static bool belongs_to_any(private_identification_t *this, private_identification_t *other)
+{
+ return TRUE;
+}
+
+/**
+ * Special implementation of identification_t.belongs_to for ID_DER_ASN1_DN.
+ * ANY matches any, even ANY, thats why its there...
+ */
+static bool belongs_to_dn(private_identification_t *this, private_identification_t *other)
+{
+ int wildcards;
+
+ if (this->type == other->type)
+ {
+ return match_dn(this->encoded, other->encoded, &wildcards);
}
return FALSE;
}
@@ -161,22 +922,21 @@ static void destroy(private_identification_t *this)
free(this);
}
-/*
+/**
* Generic constructor used for the other constructors.
- *
- * @return private_identification_t object
*/
static private_identification_t *identification_create()
{
private_identification_t *this = malloc_thing(private_identification_t);
- this->public.equals = (bool (*) (identification_t*,identification_t*))equals;
- this->public.belongs_to = (bool (*) (identification_t*,identification_t*))belongs_to;
this->public.get_encoding = (chunk_t (*) (identification_t*))get_encoding;
this->public.get_type = (id_type_t (*) (identification_t*))get_type;
this->public.get_string = (char* (*) (identification_t*))get_string;
this->public.clone = (identification_t* (*) (identification_t*))clone;
this->public.destroy = (void (*) (identification_t*))destroy;
+ /* we use these as defaults, the may be overloaded for special ID types */
+ this->public.equals = (bool (*) (identification_t*,identification_t*))equals_binary;
+ this->public.belongs_to = (bool (*) (identification_t*,identification_t*))equals_binary;
this->string = NULL;
this->encoded = CHUNK_INITIALIZER;
@@ -184,44 +944,110 @@ static private_identification_t *identification_create()
return this;
}
-
/*
* Described in header.
*/
-identification_t *identification_create_from_string(id_type_t type, char *string)
+identification_t *identification_create_from_string(char *string)
{
private_identification_t *this = identification_create();
- this->type = type;
- switch (type)
+ if (strchr(string, '=') != NULL)
{
- case ID_IPV4_ADDR:
+ /* we interpret this as an ASCII X.501 ID_DER_ASN1_DN.
+ * convert from LDAP style or openssl x509 -subject style to ASN.1 DN
+ * discard optional @ character in front of DN
+ */
+ if (atodn((*string == '@') ? string + 1 : string, &this->encoded) != SUCCESS)
{
- /* convert string */
- this->encoded.len = 4;
- this->encoded.ptr = malloc(this->encoded.len);
- if (inet_aton(string, ((struct in_addr*)(this->encoded.ptr))) == 0)
+ free(this);
+ return NULL;
+ }
+ this->string = strdup(string);
+ this->type = ID_DER_ASN1_DN;
+ this->public.equals = (bool (*) (identification_t*,identification_t*))equals_dn;
+ this->public.belongs_to = (bool (*) (identification_t*,identification_t*))belongs_to_dn;
+ return &this->public;
+ }
+ else if (strchr(string, '@') == NULL)
+ {
+ if (strcmp(string, "%any") == 0 ||
+ strcmp(string, "0.0.0.0") == 0 ||
+ strcmp(string, "*") == 0 ||
+ strcmp(string, "::") == 0||
+ strcmp(string, "0::0") == 0)
+ {
+ /* any ID will be accepted */
+ this->type = ID_ANY;
+ this->string = strdup("%any");
+ this->public.belongs_to = (bool (*) (identification_t*,identification_t*))belongs_to_any;
+ return &this->public;
+ }
+ else
+ {
+ /* TODO: Pluto resolve domainnames without '@' to IPv4/6 address. Is this really needed? */
+
+ if (strchr(string, ':') == NULL)
+ {
+ /* try IPv4 */
+ struct in_addr address;
+ chunk_t chunk = {(void*)&address, sizeof(address)};
+
+ if (inet_pton(AF_INET, string, &address) <= 0)
+ {
+ free(this);
+ return NULL;
+ }
+ this->encoded = chunk_clone(chunk);
+ this->string = strdup(string);
+ this->type = ID_IPV4_ADDR;
+ return &(this->public);
+ }
+ else
+ {
+ /* try IPv6 */
+ struct in6_addr address;
+ chunk_t chunk = {(void*)&address, sizeof(address)};
+
+ if (inet_pton(AF_INET6, string, &address) <= 0)
+ {
+ free(this);
+ return NULL;
+ }
+ this->encoded = chunk_clone(chunk);
+ this->string = strdup(string);
+ this->type = ID_IPV6_ADDR;
+ return &(this->public);
+ }
+ }
+ }
+ else
+ {
+ if (*string == '@')
+ {
+ if (*(string + 1) == '#')
{
- free(this->encoded.ptr);
+ /* TODO: Pluto handles '#' as hex encoded ASN1/KEY ID. Do we need this, too? */
free(this);
return NULL;
}
- /* clone string */
- this->string = malloc(strlen(string)+1);
- strcpy(this->string, string);
- return &(this->public);
+ else
+ {
+ this->type = ID_FQDN;
+ this->string = strdup(string + 1); /* discard @ */
+ this->encoded.ptr = strdup(string + 1);
+ this->encoded.len = strlen(string + 1);
+ this->public.belongs_to = (bool (*) (identification_t*,identification_t*))belongs_to_wc_string;
+ return &(this->public);
+ }
}
- case ID_IPV6_ADDR:
- case ID_FQDN:
- case ID_RFC822_ADDR:
- case ID_DER_ASN1_DN:
- case ID_DER_ASN1_GN:
- case ID_KEY_ID:
- default:
+ else
{
- /* not supported */
- free(this);
- return NULL;
+ this->type = ID_RFC822_ADDR;
+ this->string = strdup(string);
+ this->encoded.ptr = strdup(string);
+ this->encoded.len = strlen(string);
+ this->public.belongs_to = (bool (*) (identification_t*,identification_t*))belongs_to_wc_string;
+ return &(this->public);
}
}
}
@@ -231,60 +1057,83 @@ identification_t *identification_create_from_string(id_type_t type, char *string
*/
identification_t *identification_create_from_encoding(id_type_t type, chunk_t encoded)
{
- char *string;
private_identification_t *this = identification_create();
-
- this->encoded = chunk_clone(encoded);
+ char buf[256];
+ chunk_t buf_chunk = chunk_from_buf(buf);
+ char *pos;
this->type = type;
switch (type)
{
+ case ID_ANY:
+ this->string = strdup("%any");
+ this->public.belongs_to = (bool (*) (identification_t*,identification_t*))belongs_to_any;
+ break;
case ID_IPV4_ADDR:
- {
- string = inet_ntoa(*((struct in_addr*)(encoded.ptr)));
+ if (encoded.len < sizeof(struct in_addr) ||
+ inet_ntop(AF_INET, encoded.ptr, buf, sizeof(buf)) == NULL)
+ {
+ this->string = strdup("(invalid ID_IPV4_ADDR)");
+ }
+ else
+ {
+ this->string = strdup(buf);
+ }
break;
- }
case ID_IPV6_ADDR:
- {
- string = "[ID_IPV6_ADDR]";
+ if (encoded.len < sizeof(struct in6_addr) ||
+ inet_ntop(AF_INET6, encoded.ptr, buf, INET6_ADDRSTRLEN) == NULL)
+ {
+ this->string = strdup("(invalid ID_IPV6_ADDR)");
+ }
+ else
+ {
+ this->string = strdup(buf);
+ }
break;
- }
case ID_FQDN:
- {
- string = "[ID_FQDN]";
+ snprintf(buf, sizeof(buf), "@%.*s", encoded.len, encoded.ptr);
+ this->string = strdup(buf);
+ this->public.belongs_to = (bool (*) (identification_t*,identification_t*))belongs_to_wc_string;
break;
- }
case ID_RFC822_ADDR:
- {
- string = "[ID_RFC822_ADDR]";
+ snprintf(buf, sizeof(buf), "%.*s", encoded.len, encoded.ptr);
+ this->string = strdup(buf);
+ this->public.belongs_to = (bool (*) (identification_t*,identification_t*))belongs_to_wc_string;
break;
- }
case ID_DER_ASN1_DN:
- {
- string = "[ID_DER_ASN1_DN]";
+ snprintf(buf, sizeof(buf), "%.*s", encoded.len, encoded.ptr);
+ /* TODO: whats returned on failure */
+ dntoa(encoded, &buf_chunk);
+ this->string = strdup(buf);
+ this->public.equals = (bool (*) (identification_t*,identification_t*))equals_dn;
+ this->public.belongs_to = (bool (*) (identification_t*,identification_t*))belongs_to_dn;
break;
- }
case ID_DER_ASN1_GN:
- {
- string = "[ID_DER_ASN1_GN]";
+ this->string = gntoa(encoded);
break;
- }
case ID_KEY_ID:
- {
- string = "[ID_KEY_ID]";
+ this->string = strdup("(unparsed KEY_ID)");
break;
- }
default:
- {
- string = "[unknown id_type_t]";
- }
- }
+ snprintf(buf, sizeof(buf), "(invalid ID type: %d)", type);
+ this->string = strdup(buf);
+ break;
+ }
- /* build string, must be cloned since
- * inet_ntoa points to a subsequently
- * overwritten buffer */
- this->string = malloc(strlen(string)+1);
- strcpy(this->string, string);
+ /* apply encoded chunk */
+ if (type != ID_ANY)
+ {
+ this->encoded = chunk_clone(encoded);
+ }
+ /* remove unprintable chars in string */
+ for (pos = this->string; *pos != '\0'; pos++)
+ {
+ if (!isprint(*pos))
+ {
+ *pos = '?';
+ }
+ }
return &(this->public);
}
diff --git a/Source/lib/utils/identification.h b/Source/lib/utils/identification.h
index 87ac2a8b2..4df665c09 100644
--- a/Source/lib/utils/identification.h
+++ b/Source/lib/utils/identification.h
@@ -31,11 +31,7 @@ typedef enum id_type_t id_type_t;
/**
* @brief ID Types in a ID payload.
- *
- * @see
- * - identification_t
- * - id_payload_t
- *
+ *
* @ingroup utils
*/
enum id_type_t {
@@ -81,7 +77,12 @@ enum id_type_t {
* specific information necessary to do certain proprietary
* types of identification.
*/
- ID_KEY_ID = 11
+ ID_KEY_ID = 11,
+
+ /**
+ * Special type of PRIVATE USE which matches to any other id.
+ */
+ ID_ANY = 201,
};
/**
@@ -95,20 +96,20 @@ typedef struct identification_t identification_t;
* @brief Generic identification, such as used in ID payload.
*
* The following types are possible:
- * - ID_IPV4_ADDR
- * - ID_FQDN*
- * - ID_RFC822_ADDR*
- * - ID_IPV6_ADDR*
- * - ID_DER_ASN1_DN*
- * - ID_DER_ASN1_GN*
- * - ID_KEY_ID*
- * (* = string conversion not supported)
+ * - ID_IPV4_ADDR
+ * - ID_FQDN
+ * - ID_RFC822_ADDR
+ * - ID_IPV6_ADDR
+ * - ID_DER_ASN1_DN
+ * - ID_DER_ASN1_GN
+ * - ID_KEY_ID
*
* @b Constructors:
* - identification_create_from_string()
* - identification_create_from_encoding()
*
- * @todo Support for other ID types then ID_IPV4_ADDR.
+ * @todo Support for ID_DER_ASN1_GN is minimal right now. Comparison
+ * between them and ID_IPV4_ADDR/RFC822_ADDR would be nice.
*
* @ingroup utils
*/
@@ -158,10 +159,13 @@ struct identification_t {
* An identification_t may contain wildcards, such as
* *@strongswan.org. This call checks if a given ID
* (e.g. tester@strongswan.org) belongs to a such wildcard
- * ID. Returns TRUE if IDs are identical.
+ * ID. Returns TRUE if
+ * - IDs are identical
+ * - other is of type ID_ANY
+ * - other contains a wildcard and matches this
*
- * @param this the ID containing a wildcard
- * @param other the ID without wildcard
+ * @param this the ID without wildcard
+ * @param other the ID containing a wildcard
* @return TRUE if other belongs to this
*/
bool (*belongs_to) (identification_t *this, identification_t *other);
@@ -185,15 +189,31 @@ struct identification_t {
/**
* @brief Creates an identification_t object from a string.
*
- * @param type type of this id, such as ID_IPV4_ADDR
* @param string input string, which will be converted
* @return
* - created identification_t object, or
- * - NULL if type not supported.
+ * - NULL if unsupported string supplied.
+ *
+ * The input string may be e.g. one of the following:
+ * - ID_IPV4_ADDR: 192.168.0.1
+ * - ID_IPV6_ADDR: 2001:0db8:85a3:08d3:1319:8a2e:0370:7345
+ * - ID_FQDN: @www.strongswan.org (@indicates FQDN)
+ * - ID_RFC822_ADDR: alice@wonderland.org
+ * - ID_DER_ASN1_DN: C=CH, O=Linux strongSwan, CN=bob
+ *
+ * In favour of pluto, domainnames are prepended with an @, since
+ * pluto resolves domainnames without an @ to IPv4 addresses. Since
+ * we use a seperate host_t class for addresses, this doesn't
+ * make sense for us.
*
+ * A distinguished name may contain one or more of the following RDNs:
+ * ND, UID, DC, CN, S, SN, serialNumber, C, L, ST, O, OU, T, D,
+ * N, G, I, ID, EN, EmployeeNumber, E, Email, emailAddress, UN,
+ * unstructuredName, TCGID.
+ *
* @ingroup utils
*/
-identification_t * identification_create_from_string(id_type_t type, char *string);
+identification_t * identification_create_from_string(char *string);
/**
* @brief Creates an identification_t object from an encoded chunk.
@@ -201,7 +221,10 @@ identification_t * identification_create_from_string(id_type_t type, char *strin
* @param type type of this id, such as ID_IPV4_ADDR
* @param encoded encoded bytes, such as from identification_t.get_encoding
* @return identification_t object
- *
+ *
+ * In contrast to identification_create_from_string(), this constructor never
+ * returns NULL, even when the conversion to a sring representation fails.
+ *
* @ingroup utils
*/
identification_t * identification_create_from_encoding(id_type_t type, chunk_t encoded);
diff --git a/Source/lib/utils/logger.c b/Source/lib/utils/logger.c
index 4e6832243..663ccaec5 100644
--- a/Source/lib/utils/logger.c
+++ b/Source/lib/utils/logger.c
@@ -29,7 +29,6 @@
#include "logger.h"
-#include <daemon.h>
/**
* Maximum length of a log entry (only used for logger_s.log).
diff --git a/Source/lib/utils/logger.h b/Source/lib/utils/logger.h
index 9f9a37cba..322bb3264 100644
--- a/Source/lib/utils/logger.h
+++ b/Source/lib/utils/logger.h
@@ -27,7 +27,6 @@
#include <types.h>
-
typedef enum log_level_t log_level_t;
/**
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-19 23:26:59 +0000