![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to auth_cfg.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / credentials|
Return to auth_cfg.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / credentials |
1.1 misho 1: /*
2: * Copyright (C) 2008-2017 Tobias Brunner
3: * Copyright (C) 2007-2009 Martin Willi
4: * Copyright (C) 2016 Andreas Steffen
5: * HSR Hochschule fuer Technik Rapperswil
6: *
7: * This program is free software; you can redistribute it and/or modify it
8: * under the terms of the GNU General Public License as published by the
9: * Free Software Foundation; either version 2 of the License, or (at your
10: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11: *
12: * This program is distributed in the hope that it will be useful, but
13: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15: * for more details.
16: */
17:
18: #include "auth_cfg.h"
19:
20: #include <library.h>
21: #include <utils/debug.h>
22: #include <collections/array.h>
23: #include <utils/identification.h>
24: #include <eap/eap.h>
25: #include <credentials/certificates/certificate.h>
26:
27: ENUM(auth_class_names, AUTH_CLASS_ANY, AUTH_CLASS_XAUTH,
28: "any",
29: "public key",
30: "pre-shared key",
31: "EAP",
32: "XAuth",
33: );
34:
35: ENUM(auth_rule_names, AUTH_RULE_IDENTITY, AUTH_HELPER_AC_CERT,
36: "RULE_IDENTITY",
37: "RULE_IDENTITY_LOOSE",
38: "RULE_AUTH_CLASS",
39: "RULE_AAA_IDENTITY",
40: "RULE_EAP_IDENTITY",
41: "RULE_EAP_TYPE",
42: "RULE_EAP_VENDOR",
43: "RULE_XAUTH_BACKEND",
44: "RULE_XAUTH_IDENTITY",
45: "AUTH_RULE_CA_IDENTITY",
46: "RULE_CA_CERT",
47: "RULE_IM_CERT",
48: "RULE_SUBJECT_CERT",
49: "RULE_CRL_VALIDATION",
50: "RULE_OCSP_VALIDATION",
51: "RULE_CERT_VALIDATION_SUSPENDED",
52: "RULE_GROUP",
53: "RULE_RSA_STRENGTH",
54: "RULE_ECDSA_STRENGTH",
55: "RULE_BLISS_STRENGTH",
56: "RULE_SIGNATURE_SCHEME",
57: "RULE_IKE_SIGNATURE_SCHEME",
58: "RULE_CERT_POLICY",
59: "HELPER_IM_CERT",
60: "HELPER_SUBJECT_CERT",
61: "HELPER_IM_HASH_URL",
62: "HELPER_SUBJECT_HASH_URL",
63: "HELPER_REVOCATION_CERT",
64: "HELPER_AC_CERT",
65: );
66:
67: /**
68: * Check if the given rule is a rule for which there may be multiple values.
69: */
70: static inline bool is_multi_value_rule(auth_rule_t type)
71: {
72: switch (type)
73: {
74: case AUTH_RULE_AUTH_CLASS:
75: case AUTH_RULE_EAP_TYPE:
76: case AUTH_RULE_EAP_VENDOR:
77: case AUTH_RULE_IDENTITY:
78: case AUTH_RULE_IDENTITY_LOOSE:
79: case AUTH_RULE_EAP_IDENTITY:
80: case AUTH_RULE_AAA_IDENTITY:
81: case AUTH_RULE_XAUTH_IDENTITY:
82: case AUTH_RULE_XAUTH_BACKEND:
83: case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
84: case AUTH_HELPER_SUBJECT_CERT:
85: case AUTH_HELPER_SUBJECT_HASH_URL:
86: case AUTH_RULE_MAX:
87: return FALSE;
88: case AUTH_RULE_OCSP_VALIDATION:
89: case AUTH_RULE_CRL_VALIDATION:
90: case AUTH_RULE_GROUP:
91: case AUTH_RULE_SUBJECT_CERT:
92: case AUTH_RULE_CA_IDENTITY:
93: case AUTH_RULE_CA_CERT:
94: case AUTH_RULE_IM_CERT:
95: case AUTH_RULE_CERT_POLICY:
96: case AUTH_RULE_RSA_STRENGTH:
97: case AUTH_RULE_ECDSA_STRENGTH:
98: case AUTH_RULE_BLISS_STRENGTH:
99: case AUTH_RULE_SIGNATURE_SCHEME:
100: case AUTH_RULE_IKE_SIGNATURE_SCHEME:
101: case AUTH_HELPER_IM_CERT:
102: case AUTH_HELPER_IM_HASH_URL:
103: case AUTH_HELPER_REVOCATION_CERT:
104: case AUTH_HELPER_AC_CERT:
105: return TRUE;
106: }
107: return FALSE;
108: }
109:
110: typedef struct private_auth_cfg_t private_auth_cfg_t;
111:
112: /**
113: * private data of item_set
114: */
115: struct private_auth_cfg_t {
116:
117: /**
118: * public functions
119: */
120: auth_cfg_t public;
121:
122: /**
123: * Array of entry_t
124: */
125: array_t *entries;
126: };
127:
128: typedef struct entry_t entry_t;
129:
130: struct entry_t {
131: /** rule type */
132: auth_rule_t type;
133: /** associated value */
134: void *value;
135: };
136:
137: /**
138: * enumerator for auth_cfg_t.create_enumerator()
139: */
140: typedef struct {
141: /** implements enumerator_t */
142: enumerator_t public;
143: /** inner enumerator from linked_list_t */
144: enumerator_t *inner;
145: /** current entry */
146: entry_t *current;
147: /** types we have already enumerated */
148: bool enumerated[AUTH_RULE_MAX];
149: } entry_enumerator_t;
150:
151: METHOD(enumerator_t, enumerate, bool,
152: entry_enumerator_t *this, va_list args)
153: {
154: auth_rule_t *type;
155: entry_t *entry;
156: void **value;
157:
158: VA_ARGS_VGET(args, type, value);
159:
160: while (this->inner->enumerate(this->inner, &entry))
161: {
162: if (!is_multi_value_rule(entry->type) && this->enumerated[entry->type])
163: {
164: continue;
165: }
166: this->enumerated[entry->type] = TRUE;
167: this->current = entry;
168: if (type)
169: {
170: *type = entry->type;
171: }
172: if (value)
173: {
174: *value = entry->value;
175: }
176: return TRUE;
177: }
178: return FALSE;
179: }
180:
181: METHOD(enumerator_t, entry_enumerator_destroy, void,
182: entry_enumerator_t *this)
183: {
184: this->inner->destroy(this->inner);
185: free(this);
186: }
187:
188: METHOD(auth_cfg_t, create_enumerator, enumerator_t*,
189: private_auth_cfg_t *this)
190: {
191: entry_enumerator_t *enumerator;
192:
193: INIT(enumerator,
194: .public = {
195: .enumerate = enumerator_enumerate_default,
196: .venumerate = _enumerate,
197: .destroy = _entry_enumerator_destroy,
198: },
199: .inner = array_create_enumerator(this->entries),
200: );
201: return &enumerator->public;
202: }
203:
204: /**
205: * Initialize an entry.
206: */
207: static void init_entry(entry_t *this, auth_rule_t type, va_list args)
208: {
209: this->type = type;
210: switch (type)
211: {
212: case AUTH_RULE_IDENTITY_LOOSE:
213: case AUTH_RULE_AUTH_CLASS:
214: case AUTH_RULE_EAP_TYPE:
215: case AUTH_RULE_EAP_VENDOR:
216: case AUTH_RULE_CRL_VALIDATION:
217: case AUTH_RULE_OCSP_VALIDATION:
218: case AUTH_RULE_RSA_STRENGTH:
219: case AUTH_RULE_ECDSA_STRENGTH:
220: case AUTH_RULE_BLISS_STRENGTH:
221: case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
222: /* integer type */
223: this->value = (void*)(uintptr_t)va_arg(args, u_int);
224: break;
225: case AUTH_RULE_IDENTITY:
226: case AUTH_RULE_EAP_IDENTITY:
227: case AUTH_RULE_AAA_IDENTITY:
228: case AUTH_RULE_XAUTH_BACKEND:
229: case AUTH_RULE_XAUTH_IDENTITY:
230: case AUTH_RULE_GROUP:
231: case AUTH_RULE_CA_IDENTITY:
232: case AUTH_RULE_CA_CERT:
233: case AUTH_RULE_IM_CERT:
234: case AUTH_RULE_SUBJECT_CERT:
235: case AUTH_RULE_CERT_POLICY:
236: case AUTH_RULE_SIGNATURE_SCHEME:
237: case AUTH_RULE_IKE_SIGNATURE_SCHEME:
238: case AUTH_HELPER_IM_CERT:
239: case AUTH_HELPER_SUBJECT_CERT:
240: case AUTH_HELPER_IM_HASH_URL:
241: case AUTH_HELPER_SUBJECT_HASH_URL:
242: case AUTH_HELPER_REVOCATION_CERT:
243: case AUTH_HELPER_AC_CERT:
244: /* pointer type */
245: this->value = va_arg(args, void*);
246: break;
247: case AUTH_RULE_MAX:
248: this->value = NULL;
249: break;
250: }
251: }
252:
253: /**
254: * Compare two entries for equality.
255: */
256: static bool entry_equals(entry_t *e1, entry_t *e2)
257: {
258: if (e1->type != e2->type)
259: {
260: return FALSE;
261: }
262: switch (e1->type)
263: {
264: case AUTH_RULE_IDENTITY_LOOSE:
265: case AUTH_RULE_AUTH_CLASS:
266: case AUTH_RULE_EAP_TYPE:
267: case AUTH_RULE_EAP_VENDOR:
268: case AUTH_RULE_CRL_VALIDATION:
269: case AUTH_RULE_OCSP_VALIDATION:
270: case AUTH_RULE_RSA_STRENGTH:
271: case AUTH_RULE_ECDSA_STRENGTH:
272: case AUTH_RULE_BLISS_STRENGTH:
273: case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
274: {
275: return e1->value == e2->value;
276: }
277: case AUTH_RULE_CA_CERT:
278: case AUTH_RULE_IM_CERT:
279: case AUTH_RULE_SUBJECT_CERT:
280: case AUTH_HELPER_IM_CERT:
281: case AUTH_HELPER_SUBJECT_CERT:
282: case AUTH_HELPER_REVOCATION_CERT:
283: case AUTH_HELPER_AC_CERT:
284: {
285: certificate_t *c1, *c2;
286:
287: c1 = (certificate_t*)e1->value;
288: c2 = (certificate_t*)e2->value;
289:
290: return c1->equals(c1, c2);
291: }
292: case AUTH_RULE_IDENTITY:
293: case AUTH_RULE_CA_IDENTITY:
294: case AUTH_RULE_EAP_IDENTITY:
295: case AUTH_RULE_AAA_IDENTITY:
296: case AUTH_RULE_XAUTH_IDENTITY:
297: case AUTH_RULE_GROUP:
298: {
299: identification_t *id1, *id2;
300:
301: id1 = (identification_t*)e1->value;
302: id2 = (identification_t*)e2->value;
303:
304: return id1->equals(id1, id2);
305: }
306: case AUTH_RULE_SIGNATURE_SCHEME:
307: case AUTH_RULE_IKE_SIGNATURE_SCHEME:
308: {
309: return signature_params_equal(e1->value, e2->value);
310: }
311: case AUTH_RULE_CERT_POLICY:
312: case AUTH_RULE_XAUTH_BACKEND:
313: case AUTH_HELPER_IM_HASH_URL:
314: case AUTH_HELPER_SUBJECT_HASH_URL:
315: {
316: return streq(e1->value, e2->value);
317: }
318: case AUTH_RULE_MAX:
319: break;
320: }
321: return FALSE;
322: }
323:
324: /**
325: * Destroy the value associated with an entry
326: */
327: static void destroy_entry_value(entry_t *entry)
328: {
329: switch (entry->type)
330: {
331: case AUTH_RULE_IDENTITY:
332: case AUTH_RULE_CA_IDENTITY:
333: case AUTH_RULE_EAP_IDENTITY:
334: case AUTH_RULE_AAA_IDENTITY:
335: case AUTH_RULE_GROUP:
336: case AUTH_RULE_XAUTH_IDENTITY:
337: {
338: identification_t *id = (identification_t*)entry->value;
339: id->destroy(id);
340: break;
341: }
342: case AUTH_RULE_CA_CERT:
343: case AUTH_RULE_IM_CERT:
344: case AUTH_RULE_SUBJECT_CERT:
345: case AUTH_HELPER_IM_CERT:
346: case AUTH_HELPER_SUBJECT_CERT:
347: case AUTH_HELPER_REVOCATION_CERT:
348: case AUTH_HELPER_AC_CERT:
349: {
350: certificate_t *cert = (certificate_t*)entry->value;
351: cert->destroy(cert);
352: break;
353: }
354: case AUTH_RULE_CERT_POLICY:
355: case AUTH_RULE_XAUTH_BACKEND:
356: case AUTH_HELPER_IM_HASH_URL:
357: case AUTH_HELPER_SUBJECT_HASH_URL:
358: {
359: free(entry->value);
360: break;
361: }
362: case AUTH_RULE_SIGNATURE_SCHEME:
363: case AUTH_RULE_IKE_SIGNATURE_SCHEME:
364: {
365: signature_params_destroy(entry->value);
366: break;
367: }
368: case AUTH_RULE_IDENTITY_LOOSE:
369: case AUTH_RULE_AUTH_CLASS:
370: case AUTH_RULE_EAP_TYPE:
371: case AUTH_RULE_EAP_VENDOR:
372: case AUTH_RULE_CRL_VALIDATION:
373: case AUTH_RULE_OCSP_VALIDATION:
374: case AUTH_RULE_RSA_STRENGTH:
375: case AUTH_RULE_ECDSA_STRENGTH:
376: case AUTH_RULE_BLISS_STRENGTH:
377: case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
378: case AUTH_RULE_MAX:
379: break;
380: }
381: }
382:
383: /**
384: * Implementation of auth_cfg_t.replace.
385: */
386: static void replace(private_auth_cfg_t *this, entry_enumerator_t *enumerator,
387: auth_rule_t type, ...)
388: {
389: if (enumerator->current)
390: {
391: entry_t *entry;
392: va_list args;
393:
394: va_start(args, type);
395: entry = enumerator->current;
396: destroy_entry_value(entry);
397: entry->type = type;
398: switch (type)
399: {
400: case AUTH_RULE_IDENTITY_LOOSE:
401: case AUTH_RULE_AUTH_CLASS:
402: case AUTH_RULE_EAP_TYPE:
403: case AUTH_RULE_EAP_VENDOR:
404: case AUTH_RULE_CRL_VALIDATION:
405: case AUTH_RULE_OCSP_VALIDATION:
406: case AUTH_RULE_RSA_STRENGTH:
407: case AUTH_RULE_ECDSA_STRENGTH:
408: case AUTH_RULE_BLISS_STRENGTH:
409: case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
410: /* integer type */
411: entry->value = (void*)(uintptr_t)va_arg(args, u_int);
412: break;
413: case AUTH_RULE_IDENTITY:
414: case AUTH_RULE_CA_IDENTITY:
415: case AUTH_RULE_EAP_IDENTITY:
416: case AUTH_RULE_AAA_IDENTITY:
417: case AUTH_RULE_XAUTH_BACKEND:
418: case AUTH_RULE_XAUTH_IDENTITY:
419: case AUTH_RULE_GROUP:
420: case AUTH_RULE_CA_CERT:
421: case AUTH_RULE_IM_CERT:
422: case AUTH_RULE_SUBJECT_CERT:
423: case AUTH_RULE_CERT_POLICY:
424: case AUTH_RULE_SIGNATURE_SCHEME:
425: case AUTH_RULE_IKE_SIGNATURE_SCHEME:
426: case AUTH_HELPER_IM_CERT:
427: case AUTH_HELPER_SUBJECT_CERT:
428: case AUTH_HELPER_IM_HASH_URL:
429: case AUTH_HELPER_SUBJECT_HASH_URL:
430: case AUTH_HELPER_REVOCATION_CERT:
431: case AUTH_HELPER_AC_CERT:
432: /* pointer type */
433: entry->value = va_arg(args, void*);
434: break;
435: case AUTH_RULE_MAX:
436: entry->value = NULL;
437: break;
438: }
439: va_end(args);
440: }
441: }
442:
443: METHOD(auth_cfg_t, get, void*,
444: private_auth_cfg_t *this, auth_rule_t type)
445: {
446: enumerator_t *enumerator;
447: void *current_value, *best_value = NULL;
448: auth_rule_t current_type;
449: bool found = FALSE;
450:
451: enumerator = create_enumerator(this);
452: while (enumerator->enumerate(enumerator, ¤t_type, ¤t_value))
453: {
454: if (type == current_type)
455: {
456: if (type == AUTH_RULE_CRL_VALIDATION ||
457: type == AUTH_RULE_OCSP_VALIDATION)
458: { /* for CRL/OCSP validation, always get() the highest value */
459: if (!found || current_value > best_value)
460: {
461: best_value = current_value;
462: }
463: found = TRUE;
464: continue;
465: }
466: best_value = current_value;
467: found = TRUE;
468: break;
469: }
470: }
471: enumerator->destroy(enumerator);
472: if (found)
473: {
474: return best_value;
475: }
476: switch (type)
477: {
478: /* use some sane defaults if we don't find an entry */
479: case AUTH_RULE_AUTH_CLASS:
480: return (void*)AUTH_CLASS_ANY;
481: case AUTH_RULE_EAP_TYPE:
482: return (void*)EAP_NAK;
483: case AUTH_RULE_EAP_VENDOR:
484: case AUTH_RULE_RSA_STRENGTH:
485: case AUTH_RULE_ECDSA_STRENGTH:
486: case AUTH_RULE_BLISS_STRENGTH:
487: return (void*)0;
488: case AUTH_RULE_CRL_VALIDATION:
489: case AUTH_RULE_OCSP_VALIDATION:
490: return (void*)VALIDATION_FAILED;
491: case AUTH_RULE_IDENTITY_LOOSE:
492: case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
493: return (void*)FALSE;
494: case AUTH_RULE_IDENTITY:
495: case AUTH_RULE_CA_IDENTITY:
496: case AUTH_RULE_EAP_IDENTITY:
497: case AUTH_RULE_AAA_IDENTITY:
498: case AUTH_RULE_XAUTH_BACKEND:
499: case AUTH_RULE_XAUTH_IDENTITY:
500: case AUTH_RULE_GROUP:
501: case AUTH_RULE_CA_CERT:
502: case AUTH_RULE_IM_CERT:
503: case AUTH_RULE_SUBJECT_CERT:
504: case AUTH_RULE_CERT_POLICY:
505: case AUTH_RULE_SIGNATURE_SCHEME:
506: case AUTH_RULE_IKE_SIGNATURE_SCHEME:
507: case AUTH_HELPER_IM_CERT:
508: case AUTH_HELPER_SUBJECT_CERT:
509: case AUTH_HELPER_IM_HASH_URL:
510: case AUTH_HELPER_SUBJECT_HASH_URL:
511: case AUTH_HELPER_REVOCATION_CERT:
512: case AUTH_HELPER_AC_CERT:
513: case AUTH_RULE_MAX:
514: break;
515: }
516: return NULL;
517: }
518:
519: /**
520: * Implementation of auth_cfg_t.add.
521: */
522: static void add(private_auth_cfg_t *this, auth_rule_t type, ...)
523: {
524: entry_t entry;
525: va_list args;
526:
527: va_start(args, type);
528: init_entry(&entry, type, args);
529: va_end(args);
530:
531: if (is_multi_value_rule(type))
532: { /* insert rules that may occur multiple times at the end */
533: array_insert(this->entries, ARRAY_TAIL, &entry);
534: }
535: else
536: { /* insert rules we expect only once at the front (get() will return
537: * the latest value) */
538: array_insert(this->entries, ARRAY_HEAD, &entry);
539: }
540: }
541:
542: /**
543: * Create a constraint for RSA/PSS signatures
544: */
545: static signature_params_t *create_rsa_pss_constraint(char *token)
546: {
547: signature_params_t *params = NULL;
548: hash_algorithm_t hash;
549:
550: if (enum_from_name(hash_algorithm_short_names, token, &hash))
551: {
552: rsa_pss_params_t pss = {
553: .hash = hash,
554: .mgf1_hash = hash,
555: .salt_len = RSA_PSS_SALT_LEN_DEFAULT,
556: };
557: signature_params_t pss_params = {
558: .scheme = SIGN_RSA_EMSA_PSS,
559: .params = &pss,
560: };
561: rsa_pss_params_set_salt_len(&pss, 0);
562: params = signature_params_clone(&pss_params);
563: }
564: return params;
565: }
566:
567: METHOD(auth_cfg_t, add_pubkey_constraints, void,
568: private_auth_cfg_t *this, char* constraints, bool ike)
569: {
570: enumerator_t *enumerator;
571: bool ike_added = FALSE, rsa_pss;
572: key_type_t expected_type = -1;
573: auth_rule_t expected_strength = AUTH_RULE_MAX;
574: signature_params_t *params;
575: int strength;
576: char *token, *key_token = NULL;
577: auth_rule_t type;
578: void *value;
579:
580: rsa_pss = lib->settings->get_bool(lib->settings, "%s.rsa_pss", FALSE,
581: lib->ns);
582:
583: enumerator = enumerator_create_token(constraints, "-", "");
584: while (enumerator->enumerate(enumerator, &token))
585: {
586: bool found = FALSE;
587: int i;
588: struct {
589: char *name;
590: signature_scheme_t scheme;
591: key_type_t key;
592: } schemes[] = {
593: { "md5", SIGN_RSA_EMSA_PKCS1_MD5, KEY_RSA, },
594: { "sha1", SIGN_RSA_EMSA_PKCS1_SHA1, KEY_RSA, },
595: { "sha224", SIGN_RSA_EMSA_PKCS1_SHA2_224, KEY_RSA, },
596: { "sha256", SIGN_RSA_EMSA_PKCS1_SHA2_256, KEY_RSA, },
597: { "sha384", SIGN_RSA_EMSA_PKCS1_SHA2_384, KEY_RSA, },
598: { "sha512", SIGN_RSA_EMSA_PKCS1_SHA2_512, KEY_RSA, },
599: { "sha1", SIGN_ECDSA_WITH_SHA1_DER, KEY_ECDSA, },
600: { "sha256", SIGN_ECDSA_WITH_SHA256_DER, KEY_ECDSA, },
601: { "sha384", SIGN_ECDSA_WITH_SHA384_DER, KEY_ECDSA, },
602: { "sha512", SIGN_ECDSA_WITH_SHA512_DER, KEY_ECDSA, },
603: { "sha256", SIGN_ECDSA_256, KEY_ECDSA, },
604: { "sha384", SIGN_ECDSA_384, KEY_ECDSA, },
605: { "sha512", SIGN_ECDSA_521, KEY_ECDSA, },
606: { "sha256", SIGN_BLISS_WITH_SHA2_256, KEY_BLISS, },
607: { "sha384", SIGN_BLISS_WITH_SHA2_384, KEY_BLISS, },
608: { "sha512", SIGN_BLISS_WITH_SHA2_512, KEY_BLISS, },
609: { "identity", SIGN_ED25519, KEY_ED25519, },
610: { "identity", SIGN_ED448, KEY_ED448, },
611: };
612:
613: if (expected_strength != AUTH_RULE_MAX)
614: { /* expecting a key strength token */
615: strength = atoi(token);
616: if (strength)
617: {
618: add(this, expected_strength, (uintptr_t)strength);
619: }
620: expected_strength = AUTH_RULE_MAX;
621: if (strength)
622: {
623: continue;
624: }
625: }
626: if (streq(token, "rsa") || streq(token, "ike:rsa"))
627: {
628: key_token = token;
629: expected_type = KEY_RSA;
630: expected_strength = AUTH_RULE_RSA_STRENGTH;
631: continue;
632: }
633: if (streq(token, "rsa/pss") || streq(token, "ike:rsa/pss"))
634: {
635: key_token = token;
636: expected_type = KEY_RSA;
637: expected_strength = AUTH_RULE_RSA_STRENGTH;
638: continue;
639: }
640: if (streq(token, "ecdsa") || streq(token, "ike:ecdsa"))
641: {
642: key_token = token;
643: expected_type = KEY_ECDSA;
644: expected_strength = AUTH_RULE_ECDSA_STRENGTH;
645: continue;
646: }
647: if (streq(token, "ed25519") || streq(token, "ike:ed25519"))
648: {
649: key_token = token;
650: expected_type = KEY_ED25519;
651: continue;
652: }
653: if (streq(token, "ed448") || streq(token, "ike:ed448"))
654: {
655: key_token = token;
656: expected_type = KEY_ED448;
657: continue;
658: }
659: if (streq(token, "bliss") || streq(token, "ike:bliss"))
660: {
661: key_token = token;
662: expected_type = KEY_BLISS;
663: expected_strength = AUTH_RULE_BLISS_STRENGTH;
664: continue;
665: }
666: if (streq(token, "pubkey") || streq(token, "ike:pubkey"))
667: {
668: key_token = token;
669: expected_type = KEY_ANY;
670: continue;
671: }
672: if (key_token && strpfx(key_token, "ike:") && !ike)
673: {
674: continue;
675: }
676:
677: if (key_token && streq(key_token + strlen(key_token) - 3, "pss"))
678: {
679: params = create_rsa_pss_constraint(token);
680: if (params)
681: {
682: if (strpfx(key_token, "ike:"))
683: {
684: add(this, AUTH_RULE_IKE_SIGNATURE_SCHEME, params);
685: ike_added = TRUE;
686: }
687: else
688: {
689: add(this, AUTH_RULE_SIGNATURE_SCHEME, params);
690: }
691: found = TRUE;
692: }
693: }
694: else
695: {
696: if (rsa_pss)
697: {
698: if (expected_type == KEY_ANY ||
699: expected_type == KEY_RSA)
700: {
701: params = create_rsa_pss_constraint(token);
702: if (params)
703: {
704: if (strpfx(key_token, "ike:"))
705: {
706: add(this, AUTH_RULE_IKE_SIGNATURE_SCHEME, params);
707: ike_added = TRUE;
708: }
709: else
710: {
711: add(this, AUTH_RULE_SIGNATURE_SCHEME, params);
712: }
713: found = TRUE;
714: }
715: }
716: }
717: for (i = 0; i < countof(schemes); i++)
718: {
719: if (streq(schemes[i].name, token))
720: {
721: if (expected_type == KEY_ANY ||
722: expected_type == schemes[i].key)
723: {
724: INIT(params,
725: .scheme = schemes[i].scheme,
726: );
727: if (strpfx(key_token, "ike:"))
728: {
729: add(this, AUTH_RULE_IKE_SIGNATURE_SCHEME, params);
730: ike_added = TRUE;
731: }
732: else
733: {
734: add(this, AUTH_RULE_SIGNATURE_SCHEME, params);
735: }
736: }
737: found = TRUE;
738: }
739: }
740: }
741: if (!found)
742: {
743: DBG1(DBG_CFG, "ignoring invalid auth token: '%s'", token);
744: }
745: }
746: enumerator->destroy(enumerator);
747:
748: /* if no explicit IKE signature constraints were added we add them for all
749: * configured signature constraints */
750: if (ike && !ike_added &&
751: lib->settings->get_bool(lib->settings,
752: "%s.signature_authentication_constraints", TRUE,
753: lib->ns))
754: {
755: enumerator = create_enumerator(this);
756: while (enumerator->enumerate(enumerator, &type, &value))
757: {
758: if (type == AUTH_RULE_SIGNATURE_SCHEME)
759: {
760: add(this, AUTH_RULE_IKE_SIGNATURE_SCHEME,
761: signature_params_clone(value));
762: }
763: }
764: enumerator->destroy(enumerator);
765: }
766: }
767:
768: /**
769: * Check if signature schemes of a specific type are compliant
770: */
771: static bool complies_scheme(private_auth_cfg_t *this, auth_cfg_t *constraints,
772: auth_rule_t type, bool log_error)
773: {
774: enumerator_t *e1, *e2;
775: auth_rule_t t1, t2;
776: signature_params_t *params, *constraint;
777: bool success = TRUE;
778:
779: e2 = create_enumerator(this);
780: while (e2->enumerate(e2, &t2, ¶ms))
781: {
782: if (t2 == type)
783: {
784: success = FALSE;
785: e1 = constraints->create_enumerator(constraints);
786: while (e1->enumerate(e1, &t1, &constraint))
787: {
788: if (t1 == type &&
789: signature_params_comply(constraint, params))
790: {
791: success = TRUE;
792: break;
793: }
794: }
795: e1->destroy(e1);
796: if (!success)
797: {
798: if (log_error)
799: {
800: DBG1(DBG_CFG, "%s signature scheme %N not acceptable",
801: AUTH_RULE_SIGNATURE_SCHEME == type ? "X.509" : "IKE",
802: signature_scheme_names, params->scheme);
803: }
804: break;
805: }
806: }
807: }
808: e2->destroy(e2);
809: return success;
810: }
811:
812: METHOD(auth_cfg_t, complies, bool,
813: private_auth_cfg_t *this, auth_cfg_t *constraints, bool log_error)
814: {
815: enumerator_t *e1, *e2;
816: bool success = TRUE, group_match = FALSE;
817: bool ca_match = FALSE, cert_match = FALSE;
818: identification_t *require_group = NULL, *require_ca = NULL;
819: certificate_t *require_cert = NULL;
820: signature_params_t *ike_scheme = NULL, *scheme = NULL;
821: u_int strength = 0;
822: auth_rule_t t1, t2;
823: char *key_type;
824: void *value;
825:
826: e1 = constraints->create_enumerator(constraints);
827: while (e1->enumerate(e1, &t1, &value))
828: {
829: switch (t1)
830: {
831: case AUTH_RULE_CA_CERT:
832: case AUTH_RULE_IM_CERT:
833: {
834: certificate_t *cert, *ca;
835:
836: /* for CA certs, a match of a single cert is sufficient */
837: ca = (certificate_t*)value;
838: require_ca = ca->get_subject(ca);
839:
840: e2 = create_enumerator(this);
841: while (e2->enumerate(e2, &t2, &cert))
842: {
843: if ((t2 == AUTH_RULE_CA_CERT || t2 == AUTH_RULE_IM_CERT) &&
844: cert->equals(cert, ca))
845: {
846: ca_match = TRUE;
847: }
848: }
849: e2->destroy(e2);
850: break;
851: }
852: case AUTH_RULE_CA_IDENTITY:
853: {
854: certificate_t *cert;
855:
856: require_ca = (identification_t*)value;
857:
858: e2 = create_enumerator(this);
859: while (e2->enumerate(e2, &t2, &cert))
860: {
861: if ((t2 == AUTH_RULE_CA_CERT || t2 == AUTH_RULE_IM_CERT) &&
862: cert->has_subject(cert, require_ca))
863: {
864: ca_match = TRUE;
865: }
866: }
867: e2->destroy(e2);
868: break;
869: }
870: case AUTH_RULE_SUBJECT_CERT:
871: {
872: certificate_t *cert;
873:
874: /* for certs, a match of a single cert is sufficient */
875: require_cert = (certificate_t*)value;
876:
877: e2 = create_enumerator(this);
878: while (e2->enumerate(e2, &t2, &cert))
879: {
880: if (t2 == AUTH_RULE_SUBJECT_CERT &&
881: cert->equals(cert, require_cert))
882: {
883: cert_match = TRUE;
884: }
885: }
886: e2->destroy(e2);
887: break;
888: }
889: case AUTH_RULE_CRL_VALIDATION:
890: case AUTH_RULE_OCSP_VALIDATION:
891: {
892: uintptr_t validated;
893:
894: if (get(this, AUTH_RULE_CERT_VALIDATION_SUSPENDED))
895: { /* skip validation, may happen later */
896: break;
897: }
898:
899: e2 = create_enumerator(this);
900: while (e2->enumerate(e2, &t2, &validated))
901: {
902: if (t2 == t1)
903: {
904: switch ((uintptr_t)value)
905: {
906: case VALIDATION_FAILED:
907: /* no constraint */
908: break;
909: case VALIDATION_SKIPPED:
910: if (validated == VALIDATION_SKIPPED)
911: {
912: break;
913: }
914: /* FALL */
915: case VALIDATION_GOOD:
916: if (validated == VALIDATION_GOOD)
917: {
918: break;
919: }
920: /* FALL */
921: default:
922: success = FALSE;
923: if (log_error)
924: {
925: DBG1(DBG_CFG, "constraint check failed: "
926: "%N is %N, but requires at least %N",
927: auth_rule_names, t1,
928: cert_validation_names, validated,
929: cert_validation_names, (uintptr_t)value);
930: }
931: break;
932: }
933: }
934: }
935: e2->destroy(e2);
936: break;
937: }
938: case AUTH_RULE_IDENTITY:
939: case AUTH_RULE_EAP_IDENTITY:
940: case AUTH_RULE_AAA_IDENTITY:
941: case AUTH_RULE_XAUTH_IDENTITY:
942: {
943: identification_t *id1, *id2;
944:
945: id1 = (identification_t*)value;
946: id2 = get(this, t1);
947: if (!id2 || !id2->matches(id2, id1))
948: {
949: if (t1 == AUTH_RULE_IDENTITY &&
950: constraints->get(constraints, AUTH_RULE_IDENTITY_LOOSE))
951: { /* also verify identity against subjectAltNames */
952: certificate_t *cert;
953:
954: cert = get(this, AUTH_RULE_SUBJECT_CERT);
955: if (cert && cert->has_subject(cert, id1))
956: {
957: break;
958: }
959: }
960: success = FALSE;
961: if (log_error)
962: {
963: DBG1(DBG_CFG, "constraint check failed: %sidentity '%Y'"
964: " required ", t1 == AUTH_RULE_IDENTITY ? "" :
965: "EAP ", id1);
966: }
967: }
968: break;
969: }
970: case AUTH_RULE_AUTH_CLASS:
971: {
972: if ((uintptr_t)value != AUTH_CLASS_ANY &&
973: (uintptr_t)value != (uintptr_t)get(this, t1))
974: {
975: success = FALSE;
976: if (log_error)
977: {
978: DBG1(DBG_CFG, "constraint requires %N authentication, "
979: "but %N was used", auth_class_names, (uintptr_t)value,
980: auth_class_names, (uintptr_t)get(this, t1));
981: }
982: }
983: break;
984: }
985: case AUTH_RULE_EAP_TYPE:
986: {
987: if ((uintptr_t)value != (uintptr_t)get(this, t1) &&
988: (uintptr_t)value != EAP_DYNAMIC &&
989: (uintptr_t)value != EAP_RADIUS)
990: {
991: success = FALSE;
992: if (log_error)
993: {
994: DBG1(DBG_CFG, "constraint requires %N, "
995: "but %N was used", eap_type_names, (uintptr_t)value,
996: eap_type_names, (uintptr_t)get(this, t1));
997: }
998: }
999: break;
1000: }
1001: case AUTH_RULE_EAP_VENDOR:
1002: {
1003: if ((uintptr_t)value != (uintptr_t)get(this, t1))
1004: {
1005: success = FALSE;
1006: if (log_error)
1007: {
1008: DBG1(DBG_CFG, "constraint requires EAP vendor %d, "
1009: "but %d was used", (uintptr_t)value,
1010: (uintptr_t)get(this, t1));
1011: }
1012: }
1013: break;
1014: }
1015: case AUTH_RULE_GROUP:
1016: {
1017: identification_t *group;
1018:
1019: /* for groups, a match of a single group is sufficient */
1020: require_group = (identification_t*)value;
1021: e2 = create_enumerator(this);
1022: while (e2->enumerate(e2, &t2, &group))
1023: {
1024: if (t2 == AUTH_RULE_GROUP &&
1025: group->matches(group, require_group))
1026: {
1027: group_match = TRUE;
1028: }
1029: }
1030: e2->destroy(e2);
1031: break;
1032: }
1033: case AUTH_RULE_RSA_STRENGTH:
1034: case AUTH_RULE_ECDSA_STRENGTH:
1035: case AUTH_RULE_BLISS_STRENGTH:
1036: {
1037: strength = (uintptr_t)value;
1038: break;
1039: }
1040: case AUTH_RULE_IKE_SIGNATURE_SCHEME:
1041: {
1042: ike_scheme = value;
1043: break;
1044: }
1045: case AUTH_RULE_SIGNATURE_SCHEME:
1046: {
1047: scheme = value;
1048: break;
1049: }
1050: case AUTH_RULE_CERT_POLICY:
1051: {
1052: char *oid1, *oid2;
1053:
1054: oid1 = (char*)value;
1055: success = FALSE;
1056: e2 = create_enumerator(this);
1057: while (e2->enumerate(e2, &t2, &oid2))
1058: {
1059: if (t2 == t1 && streq(oid1, oid2))
1060: {
1061: success = TRUE;
1062: break;
1063: }
1064: }
1065: e2->destroy(e2);
1066: if (!success && log_error)
1067: {
1068: DBG1(DBG_CFG, "constraint requires cert policy %s", oid1);
1069: }
1070: break;
1071: }
1072: case AUTH_RULE_IDENTITY_LOOSE:
1073: /* just an indication when verifying AUTH_RULE_IDENTITY */
1074: case AUTH_RULE_XAUTH_BACKEND:
1075: /* not enforced, just a hint for local authentication */
1076: case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
1077: /* not a constraint */
1078: case AUTH_HELPER_IM_CERT:
1079: case AUTH_HELPER_SUBJECT_CERT:
1080: case AUTH_HELPER_IM_HASH_URL:
1081: case AUTH_HELPER_SUBJECT_HASH_URL:
1082: case AUTH_HELPER_REVOCATION_CERT:
1083: case AUTH_HELPER_AC_CERT:
1084: case AUTH_RULE_MAX:
1085: /* skip helpers */
1086: continue;
1087: }
1088: if (!success)
1089: {
1090: break;
1091: }
1092: }
1093: e1->destroy(e1);
1094:
1095: /* Check if we have a matching constraint (or none at all) for used
1096: * signature schemes. */
1097: if (success && scheme)
1098: {
1099: success = complies_scheme(this, constraints,
1100: AUTH_RULE_SIGNATURE_SCHEME, log_error);
1101: }
1102: if (success && ike_scheme)
1103: {
1104: success = complies_scheme(this, constraints,
1105: AUTH_RULE_IKE_SIGNATURE_SCHEME, log_error);
1106: }
1107:
1108: /* Check if we have a matching constraint (or none at all) for used
1109: * public key strength */
1110: if (success && strength)
1111: {
1112: e2 = create_enumerator(this);
1113: while (e2->enumerate(e2, &t2, &strength))
1114: {
1115: switch (t2)
1116: {
1117: default:
1118: continue;
1119: case AUTH_RULE_RSA_STRENGTH:
1120: key_type = "RSA";
1121: break;
1122: case AUTH_RULE_ECDSA_STRENGTH:
1123: key_type = "ECDSA";
1124: break;
1125: case AUTH_RULE_BLISS_STRENGTH:
1126: key_type = "BLISS";
1127: break;
1128: }
1129: success = FALSE;
1130: e1 = constraints->create_enumerator(constraints);
1131: while (e1->enumerate(e1, &t1, &value))
1132: {
1133: if (t1 == t2 && (uintptr_t)value <= strength)
1134: {
1135: success = TRUE;
1136: break;
1137: }
1138: }
1139: e1->destroy(e1);
1140: if (!success)
1141: {
1142: if (log_error)
1143: {
1144: DBG1(DBG_CFG, "%s-%d signatures not acceptable",
1145: key_type, strength);
1146: }
1147: break;
1148: }
1149: }
1150: e2->destroy(e2);
1151: }
1152:
1153: if (require_group && !group_match)
1154: {
1155: if (log_error)
1156: {
1157: DBG1(DBG_CFG, "constraint check failed: group membership to "
1158: "'%Y' required", require_group);
1159: }
1160: return FALSE;
1161: }
1162: if (require_ca && !ca_match)
1163: {
1164: if (log_error)
1165: {
1166: DBG1(DBG_CFG, "constraint check failed: peer not "
1167: "authenticated by CA '%Y'", require_ca);
1168: }
1169: return FALSE;
1170: }
1171: if (require_cert && !cert_match)
1172: {
1173: if (log_error)
1174: {
1175: DBG1(DBG_CFG, "constraint check failed: peer not "
1176: "authenticated with peer cert '%Y'",
1177: require_cert->get_subject(require_cert));
1178: }
1179: return FALSE;
1180: }
1181: return success;
1182: }
1183:
1184: /**
1185: * Implementation of auth_cfg_t.merge.
1186: */
1187: static void merge(private_auth_cfg_t *this, private_auth_cfg_t *other, bool copy)
1188: {
1189: if (!other)
1190: { /* nothing to merge */
1191: return;
1192: }
1193: if (copy)
1194: {
1195: enumerator_t *enumerator;
1196: auth_rule_t type;
1197: void *value;
1198:
1199: /* this enumerator skips duplicates for rules we expect only once */
1200: enumerator = create_enumerator(other);
1201: while (enumerator->enumerate(enumerator, &type, &value))
1202: {
1203: switch (type)
1204: {
1205: case AUTH_RULE_CA_CERT:
1206: case AUTH_RULE_IM_CERT:
1207: case AUTH_RULE_SUBJECT_CERT:
1208: case AUTH_HELPER_IM_CERT:
1209: case AUTH_HELPER_SUBJECT_CERT:
1210: case AUTH_HELPER_REVOCATION_CERT:
1211: case AUTH_HELPER_AC_CERT:
1212: {
1213: certificate_t *cert = (certificate_t*)value;
1214:
1215: add(this, type, cert->get_ref(cert));
1216: break;
1217: }
1218: case AUTH_RULE_IDENTITY_LOOSE:
1219: case AUTH_RULE_CRL_VALIDATION:
1220: case AUTH_RULE_OCSP_VALIDATION:
1221: case AUTH_RULE_AUTH_CLASS:
1222: case AUTH_RULE_EAP_TYPE:
1223: case AUTH_RULE_EAP_VENDOR:
1224: case AUTH_RULE_RSA_STRENGTH:
1225: case AUTH_RULE_ECDSA_STRENGTH:
1226: case AUTH_RULE_BLISS_STRENGTH:
1227: case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
1228: {
1229: add(this, type, (uintptr_t)value);
1230: break;
1231: }
1232: case AUTH_RULE_IDENTITY:
1233: case AUTH_RULE_CA_IDENTITY:
1234: case AUTH_RULE_EAP_IDENTITY:
1235: case AUTH_RULE_AAA_IDENTITY:
1236: case AUTH_RULE_GROUP:
1237: case AUTH_RULE_XAUTH_IDENTITY:
1238: {
1239: identification_t *id = (identification_t*)value;
1240:
1241: add(this, type, id->clone(id));
1242: break;
1243: }
1244: case AUTH_RULE_SIGNATURE_SCHEME:
1245: case AUTH_RULE_IKE_SIGNATURE_SCHEME:
1246: {
1247: add(this, type, signature_params_clone(value));
1248: break;
1249: }
1250: case AUTH_RULE_XAUTH_BACKEND:
1251: case AUTH_RULE_CERT_POLICY:
1252: case AUTH_HELPER_IM_HASH_URL:
1253: case AUTH_HELPER_SUBJECT_HASH_URL:
1254: {
1255: add(this, type, strdup((char*)value));
1256: break;
1257: }
1258: case AUTH_RULE_MAX:
1259: break;
1260: }
1261: }
1262: enumerator->destroy(enumerator);
1263: }
1264: else
1265: {
1266: entry_t entry;
1267:
1268: while (array_remove(other->entries, ARRAY_TAIL, &entry))
1269: { /* keep order but prefer new values (esp. for single valued ones) */
1270: array_insert(this->entries, ARRAY_HEAD, &entry);
1271: }
1272: array_compress(other->entries);
1273: }
1274: }
1275:
1276: /**
1277: * Compare two auth_cfg_t objects for equality.
1278: */
1279: static bool auth_cfg_equals(private_auth_cfg_t *this, private_auth_cfg_t *other)
1280: {
1281: enumerator_t *e1, *e2;
1282: entry_t *i1, *i2;
1283: bool equal = TRUE, found;
1284:
1285: /* the rule count does not have to be equal for the two, as we only compare
1286: * the first value found for some rules */
1287: e1 = array_create_enumerator(this->entries);
1288: while (e1->enumerate(e1, &i1))
1289: {
1290: found = FALSE;
1291:
1292: e2 = array_create_enumerator(other->entries);
1293: while (e2->enumerate(e2, &i2))
1294: {
1295: if (entry_equals(i1, i2))
1296: {
1297: found = TRUE;
1298: break;
1299: }
1300: else if (i1->type == i2->type && !is_multi_value_rule(i1->type))
1301: { /* we continue our search, only for multi valued rules */
1302: break;
1303: }
1304: }
1305: e2->destroy(e2);
1306: if (!found)
1307: {
1308: equal = FALSE;
1309: break;
1310: }
1311: }
1312: e1->destroy(e1);
1313: return equal;
1314: }
1315:
1316: /**
1317: * Implementation of auth_cfg_t.equals.
1318: */
1319: static bool equals(private_auth_cfg_t *this, private_auth_cfg_t *other)
1320: {
1321: if (auth_cfg_equals(this, other))
1322: {
1323: /* as 'other' might contain entries that 'this' doesn't we also check
1324: * the other way around */
1325: return auth_cfg_equals(other, this);
1326: }
1327: return FALSE;
1328: }
1329:
1330: METHOD(auth_cfg_t, purge, void,
1331: private_auth_cfg_t *this, bool keep_ca)
1332: {
1333: enumerator_t *enumerator;
1334: entry_t *entry;
1335:
1336: enumerator = array_create_enumerator(this->entries);
1337: while (enumerator->enumerate(enumerator, &entry))
1338: {
1339: if (!keep_ca || entry->type != AUTH_RULE_CA_CERT)
1340: {
1341: destroy_entry_value(entry);
1342: array_remove_at(this->entries, enumerator);
1343: }
1344: }
1345: enumerator->destroy(enumerator);
1346:
1347: array_compress(this->entries);
1348: }
1349:
1350: METHOD(auth_cfg_t, clone_, auth_cfg_t*,
1351: private_auth_cfg_t *this)
1352: {
1353: enumerator_t *enumerator;
1354: auth_cfg_t *clone;
1355: auth_rule_t type;
1356: void *value;
1357:
1358: clone = auth_cfg_create();
1359: /* this enumerator skips duplicates for rules we expect only once */
1360: enumerator = create_enumerator(this);
1361: while (enumerator->enumerate(enumerator, &type, &value))
1362: {
1363: switch (type)
1364: {
1365: case AUTH_RULE_IDENTITY:
1366: case AUTH_RULE_CA_IDENTITY:
1367: case AUTH_RULE_EAP_IDENTITY:
1368: case AUTH_RULE_AAA_IDENTITY:
1369: case AUTH_RULE_GROUP:
1370: case AUTH_RULE_XAUTH_IDENTITY:
1371: {
1372: identification_t *id = (identification_t*)value;
1373: clone->add(clone, type, id->clone(id));
1374: break;
1375: }
1376: case AUTH_RULE_CA_CERT:
1377: case AUTH_RULE_IM_CERT:
1378: case AUTH_RULE_SUBJECT_CERT:
1379: case AUTH_HELPER_IM_CERT:
1380: case AUTH_HELPER_SUBJECT_CERT:
1381: case AUTH_HELPER_REVOCATION_CERT:
1382: case AUTH_HELPER_AC_CERT:
1383: {
1384: certificate_t *cert = (certificate_t*)value;
1385: clone->add(clone, type, cert->get_ref(cert));
1386: break;
1387: }
1388: case AUTH_RULE_XAUTH_BACKEND:
1389: case AUTH_RULE_CERT_POLICY:
1390: case AUTH_HELPER_IM_HASH_URL:
1391: case AUTH_HELPER_SUBJECT_HASH_URL:
1392: {
1393: clone->add(clone, type, strdup(value));
1394: break;
1395: }
1396: case AUTH_RULE_IDENTITY_LOOSE:
1397: case AUTH_RULE_AUTH_CLASS:
1398: case AUTH_RULE_EAP_TYPE:
1399: case AUTH_RULE_EAP_VENDOR:
1400: case AUTH_RULE_CRL_VALIDATION:
1401: case AUTH_RULE_OCSP_VALIDATION:
1402: case AUTH_RULE_RSA_STRENGTH:
1403: case AUTH_RULE_ECDSA_STRENGTH:
1404: case AUTH_RULE_BLISS_STRENGTH:
1405: case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
1406: clone->add(clone, type, (uintptr_t)value);
1407: break;
1408: case AUTH_RULE_SIGNATURE_SCHEME:
1409: case AUTH_RULE_IKE_SIGNATURE_SCHEME:
1410: {
1411: clone->add(clone, type, signature_params_clone(value));
1412: break;
1413: }
1414: case AUTH_RULE_MAX:
1415: break;
1416: }
1417: }
1418: enumerator->destroy(enumerator);
1419: return clone;
1420: }
1421:
1422: METHOD(auth_cfg_t, destroy, void,
1423: private_auth_cfg_t *this)
1424: {
1425: purge(this, FALSE);
1426: array_destroy(this->entries);
1427: free(this);
1428: }
1429:
1430: /*
1431: * see header file
1432: */
1433: auth_cfg_t *auth_cfg_create()
1434: {
1435: private_auth_cfg_t *this;
1436:
1437: INIT(this,
1438: .public = {
1439: .add = (void(*)(auth_cfg_t*, auth_rule_t type, ...))add,
1440: .add_pubkey_constraints = _add_pubkey_constraints,
1441: .get = _get,
1442: .create_enumerator = _create_enumerator,
1443: .replace = (void(*)(auth_cfg_t*,enumerator_t*,auth_rule_t,...))replace,
1444: .complies = _complies,
1445: .merge = (void(*)(auth_cfg_t*,auth_cfg_t*,bool))merge,
1446: .purge = _purge,
1447: .equals = (bool(*)(auth_cfg_t*,auth_cfg_t*))equals,
1448: .clone = _clone_,
1449: .destroy = _destroy,
1450: },
1451: .entries = array_create(sizeof(entry_t), 0),
1452: );
1453:
1454: return &this->public;
1455: }