Annotation of embedaddon/strongswan/src/libstrongswan/utils/identification.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (C) 2016 Andreas Steffen
! 3: * Copyright (C) 2009-2019 Tobias Brunner
! 4: * Copyright (C) 2005-2009 Martin Willi
! 5: * Copyright (C) 2005 Jan Hutter
! 6: * HSR Hochschule fuer Technik Rapperswil
! 7: *
! 8: * This program is free software; you can redistribute it and/or modify it
! 9: * under the terms of the GNU General Public License as published by the
! 10: * Free Software Foundation; either version 2 of the License, or (at your
! 11: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
! 12: *
! 13: * This program is distributed in the hope that it will be useful, but
! 14: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
! 15: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
! 16: * for more details.
! 17: */
! 18:
! 19: #include <string.h>
! 20: #include <stdio.h>
! 21: #include <errno.h>
! 22:
! 23: #include "identification.h"
! 24:
! 25: #include <utils/utils.h>
! 26: #include <asn1/oid.h>
! 27: #include <asn1/asn1.h>
! 28: #include <crypto/hashers/hasher.h>
! 29: #include <collections/array.h>
! 30:
! 31: ENUM_BEGIN(id_match_names, ID_MATCH_NONE, ID_MATCH_MAX_WILDCARDS,
! 32: "MATCH_NONE",
! 33: "MATCH_ANY",
! 34: "MATCH_MAX_WILDCARDS");
! 35: ENUM_NEXT(id_match_names, ID_MATCH_PERFECT, ID_MATCH_PERFECT, ID_MATCH_MAX_WILDCARDS,
! 36: "MATCH_PERFECT");
! 37: ENUM_END(id_match_names, ID_MATCH_PERFECT);
! 38:
! 39: ENUM_BEGIN(id_type_names, ID_ANY, ID_KEY_ID,
! 40: "ID_ANY",
! 41: "ID_IPV4_ADDR",
! 42: "ID_FQDN",
! 43: "ID_RFC822_ADDR",
! 44: "ID_IPV4_ADDR_SUBNET",
! 45: "ID_IPV6_ADDR",
! 46: "ID_IPV6_ADDR_SUBNET",
! 47: "ID_IPV4_ADDR_RANGE",
! 48: "ID_IPV6_ADDR_RANGE",
! 49: "ID_DER_ASN1_DN",
! 50: "ID_DER_ASN1_GN",
! 51: "ID_KEY_ID");
! 52: ENUM_NEXT(id_type_names, ID_DER_ASN1_GN_URI, ID_DER_ASN1_GN_URI, ID_KEY_ID,
! 53: "ID_DER_ASN1_GN_URI");
! 54: ENUM_END(id_type_names, ID_DER_ASN1_GN_URI);
! 55:
! 56: /**
! 57: * coding of X.501 distinguished name
! 58: */
! 59: typedef struct {
! 60: const u_char *name;
! 61: int oid;
! 62: u_char type;
! 63: } x501rdn_t;
! 64:
! 65: static const x501rdn_t x501rdns[] = {
! 66: {"ND", OID_NAME_DISTINGUISHER, ASN1_PRINTABLESTRING},
! 67: {"UID", OID_PILOT_USERID, ASN1_PRINTABLESTRING},
! 68: {"DC", OID_PILOT_DOMAIN_COMPONENT, ASN1_PRINTABLESTRING},
! 69: {"CN", OID_COMMON_NAME, ASN1_PRINTABLESTRING},
! 70: {"S", OID_SURNAME, ASN1_PRINTABLESTRING},
! 71: {"SN", OID_SERIAL_NUMBER, ASN1_PRINTABLESTRING},
! 72: {"serialNumber", OID_SERIAL_NUMBER, ASN1_PRINTABLESTRING},
! 73: {"C", OID_COUNTRY, ASN1_PRINTABLESTRING},
! 74: {"L", OID_LOCALITY, ASN1_PRINTABLESTRING},
! 75: {"ST", OID_STATE_OR_PROVINCE, ASN1_PRINTABLESTRING},
! 76: {"STREET", OID_STREET_ADDRESS, ASN1_PRINTABLESTRING},
! 77: {"O", OID_ORGANIZATION, ASN1_PRINTABLESTRING},
! 78: {"OU", OID_ORGANIZATION_UNIT, ASN1_PRINTABLESTRING},
! 79: {"T", OID_TITLE, ASN1_PRINTABLESTRING},
! 80: {"D", OID_DESCRIPTION, ASN1_PRINTABLESTRING},
! 81: {"postalAddress", OID_POSTAL_ADDRESS, ASN1_PRINTABLESTRING},
! 82: {"postalCode", OID_POSTAL_CODE, ASN1_PRINTABLESTRING},
! 83: {"N", OID_NAME, ASN1_PRINTABLESTRING},
! 84: {"G", OID_GIVEN_NAME, ASN1_PRINTABLESTRING},
! 85: {"I", OID_INITIALS, ASN1_PRINTABLESTRING},
! 86: {"dnQualifier", OID_DN_QUALIFIER, ASN1_PRINTABLESTRING},
! 87: {"dmdName", OID_DMD_NAME, ASN1_PRINTABLESTRING},
! 88: {"pseudonym", OID_PSEUDONYM, ASN1_PRINTABLESTRING},
! 89: {"ID", OID_UNIQUE_IDENTIFIER, ASN1_PRINTABLESTRING},
! 90: {"EN", OID_EMPLOYEE_NUMBER, ASN1_PRINTABLESTRING},
! 91: {"employeeNumber", OID_EMPLOYEE_NUMBER, ASN1_PRINTABLESTRING},
! 92: {"E", OID_EMAIL_ADDRESS, ASN1_IA5STRING},
! 93: {"Email", OID_EMAIL_ADDRESS, ASN1_IA5STRING},
! 94: {"emailAddress", OID_EMAIL_ADDRESS, ASN1_IA5STRING},
! 95: {"UN", OID_UNSTRUCTURED_NAME, ASN1_IA5STRING},
! 96: {"unstructuredName", OID_UNSTRUCTURED_NAME, ASN1_IA5STRING},
! 97: {"UA", OID_UNSTRUCTURED_ADDRESS, ASN1_PRINTABLESTRING},
! 98: {"unstructuredAddress", OID_UNSTRUCTURED_ADDRESS, ASN1_PRINTABLESTRING},
! 99: {"TCGID", OID_TCGID, ASN1_PRINTABLESTRING}
! 100: };
! 101:
! 102: /**
! 103: * maximum number of RDNs in atodn()
! 104: */
! 105: #define RDN_MAX 20
! 106:
! 107:
! 108: typedef struct private_identification_t private_identification_t;
! 109:
! 110: /**
! 111: * Private data of an identification_t object.
! 112: */
! 113: struct private_identification_t {
! 114: /**
! 115: * Public interface.
! 116: */
! 117: identification_t public;
! 118:
! 119: /**
! 120: * Encoded representation of this ID.
! 121: */
! 122: chunk_t encoded;
! 123:
! 124: /**
! 125: * Type of this ID.
! 126: */
! 127: id_type_t type;
! 128: };
! 129:
! 130: /**
! 131: * Enumerator over RDNs
! 132: */
! 133: typedef struct {
! 134: /* implements enumerator interface */
! 135: enumerator_t public;
! 136: /* next set to parse, if any */
! 137: chunk_t sets;
! 138: /* next sequence in set, if any */
! 139: chunk_t seqs;
! 140: } rdn_enumerator_t;
! 141:
! 142: METHOD(enumerator_t, rdn_enumerate, bool,
! 143: rdn_enumerator_t *this, va_list args)
! 144: {
! 145: chunk_t rdn, *oid, *data;
! 146: u_char *type;
! 147:
! 148: VA_ARGS_VGET(args, oid, type, data);
! 149:
! 150: /* a DN contains one or more SET, each containing one or more SEQUENCES,
! 151: * each containing a OID/value RDN */
! 152: if (!this->seqs.len)
! 153: {
! 154: /* no SEQUENCEs in current SET, parse next SET */
! 155: if (asn1_unwrap(&this->sets, &this->seqs) != ASN1_SET)
! 156: {
! 157: return FALSE;
! 158: }
! 159: }
! 160: if (asn1_unwrap(&this->seqs, &rdn) == ASN1_SEQUENCE &&
! 161: asn1_unwrap(&rdn, oid) == ASN1_OID)
! 162: {
! 163: int t = asn1_unwrap(&rdn, data);
! 164:
! 165: if (t != ASN1_INVALID)
! 166: {
! 167: *type = t;
! 168: return TRUE;
! 169: }
! 170: }
! 171: return FALSE;
! 172: }
! 173:
! 174: /**
! 175: * Create an enumerator over all RDNs (oid, string type, data) of a DN
! 176: */
! 177: static enumerator_t* create_rdn_enumerator(chunk_t dn)
! 178: {
! 179: rdn_enumerator_t *e;
! 180:
! 181: INIT(e,
! 182: .public = {
! 183: .enumerate = enumerator_enumerate_default,
! 184: .venumerate = _rdn_enumerate,
! 185: .destroy = (void*)free,
! 186: },
! 187: );
! 188:
! 189: /* a DN is a SEQUENCE, get the first SET of it */
! 190: if (asn1_unwrap(&dn, &e->sets) == ASN1_SEQUENCE)
! 191: {
! 192: e->seqs = chunk_empty;
! 193: return &e->public;
! 194: }
! 195: free(e);
! 196: return enumerator_create_empty();
! 197: }
! 198:
! 199: /**
! 200: * Part enumerator over RDNs
! 201: */
! 202: typedef struct {
! 203: /* implements enumerator interface */
! 204: enumerator_t public;
! 205: /* inner RDN enumerator */
! 206: enumerator_t *inner;
! 207: } rdn_part_enumerator_t;
! 208:
! 209: METHOD(enumerator_t, rdn_part_enumerate, bool,
! 210: rdn_part_enumerator_t *this, va_list args)
! 211: {
! 212: int i, known_oid, strtype;
! 213: chunk_t oid, inner_data, *data;
! 214: id_part_t *type;
! 215: static const struct {
! 216: int oid;
! 217: id_part_t type;
! 218: } oid2part[] = {
! 219: {OID_COMMON_NAME, ID_PART_RDN_CN},
! 220: {OID_SURNAME, ID_PART_RDN_S},
! 221: {OID_SERIAL_NUMBER, ID_PART_RDN_SN},
! 222: {OID_COUNTRY, ID_PART_RDN_C},
! 223: {OID_LOCALITY, ID_PART_RDN_L},
! 224: {OID_STATE_OR_PROVINCE, ID_PART_RDN_ST},
! 225: {OID_ORGANIZATION, ID_PART_RDN_O},
! 226: {OID_ORGANIZATION_UNIT, ID_PART_RDN_OU},
! 227: {OID_TITLE, ID_PART_RDN_T},
! 228: {OID_DESCRIPTION, ID_PART_RDN_D},
! 229: {OID_NAME, ID_PART_RDN_N},
! 230: {OID_GIVEN_NAME, ID_PART_RDN_G},
! 231: {OID_INITIALS, ID_PART_RDN_I},
! 232: {OID_DN_QUALIFIER, ID_PART_RDN_DNQ},
! 233: {OID_DMD_NAME, ID_PART_RDN_DMDN},
! 234: {OID_PSEUDONYM, ID_PART_RDN_PN},
! 235: {OID_UNIQUE_IDENTIFIER, ID_PART_RDN_ID},
! 236: {OID_EMAIL_ADDRESS, ID_PART_RDN_E},
! 237: {OID_EMPLOYEE_NUMBER, ID_PART_RDN_EN},
! 238: };
! 239:
! 240: VA_ARGS_VGET(args, type, data);
! 241:
! 242: while (this->inner->enumerate(this->inner, &oid, &strtype, &inner_data))
! 243: {
! 244: known_oid = asn1_known_oid(oid);
! 245: for (i = 0; i < countof(oid2part); i++)
! 246: {
! 247: if (oid2part[i].oid == known_oid)
! 248: {
! 249: *type = oid2part[i].type;
! 250: *data = inner_data;
! 251: return TRUE;
! 252: }
! 253: }
! 254: }
! 255: return FALSE;
! 256: }
! 257:
! 258: METHOD(enumerator_t, rdn_part_enumerator_destroy, void,
! 259: rdn_part_enumerator_t *this)
! 260: {
! 261: this->inner->destroy(this->inner);
! 262: free(this);
! 263: }
! 264:
! 265: METHOD(identification_t, create_part_enumerator, enumerator_t*,
! 266: private_identification_t *this)
! 267: {
! 268: switch (this->type)
! 269: {
! 270: case ID_DER_ASN1_DN:
! 271: {
! 272: rdn_part_enumerator_t *e;
! 273:
! 274: INIT(e,
! 275: .inner = create_rdn_enumerator(this->encoded),
! 276: .public = {
! 277: .enumerate = enumerator_enumerate_default,
! 278: .venumerate = _rdn_part_enumerate,
! 279: .destroy = _rdn_part_enumerator_destroy,
! 280: },
! 281: );
! 282: return &e->public;
! 283: }
! 284: case ID_RFC822_ADDR:
! 285: /* TODO */
! 286: case ID_FQDN:
! 287: /* TODO */
! 288: default:
! 289: return enumerator_create_empty();
! 290: }
! 291: }
! 292:
! 293: /**
! 294: * Print a separator between two RDNs
! 295: */
! 296: static inline bool print_separator(char **buf, size_t *len)
! 297: {
! 298: int written;
! 299:
! 300: written = snprintf(*buf, *len, ", ");
! 301: if (written < 0 || written >= *len)
! 302: {
! 303: return FALSE;
! 304: }
! 305: *buf += written;
! 306: *len -= written;
! 307: return TRUE;
! 308: }
! 309:
! 310: /**
! 311: * Print a DN with all its RDN in a buffer to present it to the user
! 312: */
! 313: static void dntoa(chunk_t dn, char *buf, size_t len)
! 314: {
! 315: enumerator_t *e;
! 316: chunk_t oid_data, data, printable;
! 317: u_char type;
! 318: int oid, written;
! 319: bool finished = FALSE, empty = TRUE;
! 320:
! 321: e = create_rdn_enumerator(dn);
! 322: while (e->enumerate(e, &oid_data, &type, &data))
! 323: {
! 324: empty = FALSE;
! 325:
! 326: /* previous RDN was empty but it wasn't the last one */
! 327: if (finished && !print_separator(&buf, &len))
! 328: {
! 329: break;
! 330: }
! 331: finished = FALSE;
! 332:
! 333: oid = asn1_known_oid(oid_data);
! 334: if (oid == OID_UNKNOWN)
! 335: {
! 336: written = snprintf(buf, len, "%#B=", &oid_data);
! 337: }
! 338: else
! 339: {
! 340: written = snprintf(buf, len,"%s=", oid_names[oid].name);
! 341: }
! 342: if (written < 0 || written >= len)
! 343: {
! 344: break;
! 345: }
! 346: buf += written;
! 347: len -= written;
! 348:
! 349: written = 0;
! 350: chunk_printable(data, &printable, '?');
! 351: if (printable.ptr)
! 352: {
! 353: written = snprintf(buf, len, "%.*s", (int)printable.len,
! 354: printable.ptr);
! 355: }
! 356: chunk_free(&printable);
! 357: if (written < 0 || written >= len)
! 358: {
! 359: break;
! 360: }
! 361: buf += written;
! 362: len -= written;
! 363:
! 364: if (!data.ptr)
! 365: { /* we can't calculate if we're finished, assume we are */
! 366: finished = TRUE;
! 367: }
! 368: else if (data.ptr + data.len == dn.ptr + dn.len)
! 369: {
! 370: finished = TRUE;
! 371: break;
! 372: }
! 373: else if (!print_separator(&buf, &len))
! 374: {
! 375: break;
! 376: }
! 377: }
! 378: if (empty)
! 379: {
! 380: snprintf(buf, len, "");
! 381: }
! 382: else if (!finished)
! 383: {
! 384: snprintf(buf, len, "(invalid ID_DER_ASN1_DN)");
! 385: }
! 386: e->destroy(e);
! 387: }
! 388:
! 389: /**
! 390: * Converts an LDAP-style human-readable ASCII-encoded
! 391: * ASN.1 distinguished name into binary DER-encoded format
! 392: */
! 393: static status_t atodn(char *src, chunk_t *dn)
! 394: {
! 395: /* finite state machine for atodn */
! 396: typedef enum {
! 397: SEARCH_OID = 0,
! 398: READ_OID = 1,
! 399: SEARCH_NAME = 2,
! 400: READ_NAME = 3,
! 401: UNKNOWN_OID = 4
! 402: } state_t;
! 403:
! 404: chunk_t oid = chunk_empty;
! 405: chunk_t name = chunk_empty;
! 406: chunk_t rdns[RDN_MAX];
! 407: int rdn_count = 0;
! 408: int dn_len = 0;
! 409: int whitespace = 0;
! 410: int i = 0;
! 411: asn1_t rdn_type;
! 412: state_t state = SEARCH_OID;
! 413: status_t status = SUCCESS;
! 414: char sep = '\0';
! 415:
! 416: do
! 417: {
! 418: switch (state)
! 419: {
! 420: case SEARCH_OID:
! 421: if (!sep && *src == '/')
! 422: { /* use / as separator if the string starts with a slash */
! 423: sep = '/';
! 424: break;
! 425: }
! 426: if (*src != ' ' && *src != '\0')
! 427: {
! 428: if (!sep)
! 429: { /* use , as separator by default */
! 430: sep = ',';
! 431: }
! 432: oid.ptr = src;
! 433: oid.len = 1;
! 434: state = READ_OID;
! 435: }
! 436: break;
! 437: case READ_OID:
! 438: if (*src != ' ' && *src != '=')
! 439: {
! 440: oid.len++;
! 441: }
! 442: else
! 443: {
! 444: bool found = FALSE;
! 445:
! 446: for (i = 0; i < countof(x501rdns); i++)
! 447: {
! 448: if (strlen(x501rdns[i].name) == oid.len &&
! 449: strncasecmp(x501rdns[i].name, oid.ptr, oid.len) == 0)
! 450: {
! 451: found = TRUE;
! 452: break;
! 453: }
! 454: }
! 455: if (!found)
! 456: {
! 457: status = NOT_SUPPORTED;
! 458: state = UNKNOWN_OID;
! 459: break;
! 460: }
! 461: /* reset oid and change state */
! 462: oid = chunk_empty;
! 463: state = SEARCH_NAME;
! 464: }
! 465: break;
! 466: case SEARCH_NAME:
! 467: if (*src == ' ' || *src == '=')
! 468: {
! 469: break;
! 470: }
! 471: else if (*src != sep && *src != '\0')
! 472: {
! 473: name.ptr = src;
! 474: name.len = 1;
! 475: whitespace = 0;
! 476: state = READ_NAME;
! 477: break;
! 478: }
! 479: name = chunk_empty;
! 480: whitespace = 0;
! 481: state = READ_NAME;
! 482: /* fall-through */
! 483: case READ_NAME:
! 484: if (*src != sep && *src != '\0')
! 485: {
! 486: name.len++;
! 487: if (*src == ' ')
! 488: whitespace++;
! 489: else
! 490: whitespace = 0;
! 491: }
! 492: else
! 493: {
! 494: name.len -= whitespace;
! 495: rdn_type = (x501rdns[i].type == ASN1_PRINTABLESTRING
! 496: && !asn1_is_printablestring(name))
! 497: ? ASN1_UTF8STRING : x501rdns[i].type;
! 498:
! 499: if (rdn_count < RDN_MAX)
! 500: {
! 501: chunk_t rdn_oid;
! 502:
! 503: rdn_oid = asn1_build_known_oid(x501rdns[i].oid);
! 504: if (rdn_oid.len)
! 505: {
! 506: rdns[rdn_count] =
! 507: asn1_wrap(ASN1_SET, "m",
! 508: asn1_wrap(ASN1_SEQUENCE, "mm",
! 509: rdn_oid,
! 510: asn1_wrap(rdn_type, "c", name)
! 511: )
! 512: );
! 513: dn_len += rdns[rdn_count++].len;
! 514: }
! 515: else
! 516: {
! 517: status = INVALID_ARG;
! 518: }
! 519: }
! 520: else
! 521: {
! 522: status = OUT_OF_RES;
! 523: }
! 524: /* reset name and change state */
! 525: name = chunk_empty;
! 526: state = SEARCH_OID;
! 527: }
! 528: break;
! 529: case UNKNOWN_OID:
! 530: break;
! 531: }
! 532: } while (*src++ != '\0');
! 533:
! 534: if (state == READ_OID)
! 535: { /* unterminated OID */
! 536: status = INVALID_ARG;
! 537: }
! 538:
! 539: /* build the distinguished name sequence */
! 540: {
! 541: int i;
! 542: u_char *pos = asn1_build_object(dn, ASN1_SEQUENCE, dn_len);
! 543:
! 544: for (i = 0; i < rdn_count; i++)
! 545: {
! 546: memcpy(pos, rdns[i].ptr, rdns[i].len);
! 547: pos += rdns[i].len;
! 548: free(rdns[i].ptr);
! 549: }
! 550: }
! 551: if (status != SUCCESS)
! 552: {
! 553: free(dn->ptr);
! 554: *dn = chunk_empty;
! 555: }
! 556: return status;
! 557: }
! 558:
! 559: METHOD(identification_t, get_encoding, chunk_t,
! 560: private_identification_t *this)
! 561: {
! 562: return this->encoded;
! 563: }
! 564:
! 565: METHOD(identification_t, get_type, id_type_t,
! 566: private_identification_t *this)
! 567: {
! 568: return this->type;
! 569: }
! 570:
! 571: /**
! 572: * Check if this is a wildcard value
! 573: */
! 574: static inline bool is_wildcard(chunk_t data)
! 575: {
! 576: return data.len == 1 && data.ptr[0] == '*';
! 577: }
! 578:
! 579: METHOD(identification_t, contains_wildcards_dn, bool,
! 580: private_identification_t *this)
! 581: {
! 582: enumerator_t *enumerator;
! 583: bool contains = FALSE;
! 584: id_part_t type;
! 585: chunk_t data;
! 586:
! 587: enumerator = create_part_enumerator(this);
! 588: while (enumerator->enumerate(enumerator, &type, &data))
! 589: {
! 590: if (is_wildcard(data))
! 591: {
! 592: contains = TRUE;
! 593: break;
! 594: }
! 595: }
! 596: enumerator->destroy(enumerator);
! 597: return contains;
! 598: }
! 599:
! 600: METHOD(identification_t, contains_wildcards_memchr, bool,
! 601: private_identification_t *this)
! 602: {
! 603: return memchr(this->encoded.ptr, '*', this->encoded.len) != NULL;
! 604: }
! 605:
! 606: METHOD(identification_t, hash_binary, u_int,
! 607: private_identification_t *this, u_int inc)
! 608: {
! 609: u_int hash;
! 610:
! 611: hash = chunk_hash_inc(chunk_from_thing(this->type), inc);
! 612: if (this->type != ID_ANY)
! 613: {
! 614: hash = chunk_hash_inc(this->encoded, hash);
! 615: }
! 616: return hash;
! 617: }
! 618:
! 619: METHOD(identification_t, equals_binary, bool,
! 620: private_identification_t *this, identification_t *other)
! 621: {
! 622: if (this->type == other->get_type(other))
! 623: {
! 624: if (this->type == ID_ANY)
! 625: {
! 626: return TRUE;
! 627: }
! 628: return chunk_equals(this->encoded, other->get_encoding(other));
! 629: }
! 630: return FALSE;
! 631: }
! 632:
! 633: /**
! 634: * Compare two RDNs for equality, comparing some string types case insensitive
! 635: */
! 636: static bool rdn_equals(chunk_t oid, u_char a_type, chunk_t a, u_char b_type,
! 637: chunk_t b)
! 638: {
! 639: if (a_type == b_type &&
! 640: (a_type == ASN1_PRINTABLESTRING ||
! 641: (a_type == ASN1_IA5STRING &&
! 642: asn1_known_oid(oid) == OID_EMAIL_ADDRESS)))
! 643: { /* ignore case for printableStrings and email RDNs */
! 644: return strncaseeq(a.ptr, b.ptr, a.len);
! 645: }
! 646: else
! 647: { /* respect case and length for everything else */
! 648: return memeq(a.ptr, b.ptr, a.len);
! 649: }
! 650: }
! 651:
! 652: /**
! 653: * RDNs when matching DNs
! 654: */
! 655: typedef struct {
! 656: chunk_t oid;
! 657: u_char type;
! 658: chunk_t data;
! 659: bool matched;
! 660: } rdn_t;
! 661:
! 662: /**
! 663: * Match DNs (o_dn may contain wildcards and RDNs in a different order, if
! 664: * allow_unmatched is TRUE, t_dn may contain unmatched RDNs)
! 665: */
! 666: static bool match_dn(chunk_t t_dn, chunk_t o_dn, int *wc, bool allow_unmatched)
! 667: {
! 668: enumerator_t *enumerator;
! 669: array_t *rdns;
! 670: rdn_t *rdn, *found;
! 671: chunk_t oid, data;
! 672: u_char type;
! 673: bool finished = FALSE;
! 674: int i, regular = 0;
! 675:
! 676: *wc = 0;
! 677:
! 678: /* try a binary compare */
! 679: if (chunk_equals(t_dn, o_dn))
! 680: {
! 681: return TRUE;
! 682: }
! 683:
! 684: rdns = array_create(0, 8);
! 685:
! 686: enumerator = create_rdn_enumerator(o_dn);
! 687: while (TRUE)
! 688: {
! 689: if (!enumerator->enumerate(enumerator, &oid, &type, &data))
! 690: {
! 691: break;
! 692: }
! 693: INIT(rdn,
! 694: .oid = oid,
! 695: .type = type,
! 696: .data = data,
! 697: );
! 698: if (is_wildcard(data))
! 699: {
! 700: /* insert wildcards at the end, to perform exact matches first */
! 701: array_insert(rdns, ARRAY_TAIL, rdn);
! 702: }
! 703: else
! 704: {
! 705: array_insert(rdns, regular++, rdn);
! 706: }
! 707: /* the enumerator returns FALSE on parse error, we are finished
! 708: * if we have reached the end of the DN only */
! 709: if ((data.ptr + data.len == o_dn.ptr + o_dn.len))
! 710: {
! 711: finished = TRUE;
! 712: }
! 713: }
! 714: enumerator->destroy(enumerator);
! 715:
! 716: if (!finished)
! 717: { /* invalid DN */
! 718: array_destroy_function(rdns, (void*)free, NULL);
! 719: return FALSE;
! 720: }
! 721: finished = FALSE;
! 722:
! 723: enumerator = create_rdn_enumerator(t_dn);
! 724: while (TRUE)
! 725: {
! 726: if (!enumerator->enumerate(enumerator, &oid, &type, &data))
! 727: {
! 728: break;
! 729: }
! 730: for (i = 0, found = NULL; i < array_count(rdns); i++)
! 731: {
! 732: array_get(rdns, i, &rdn);
! 733: if (!rdn->matched && chunk_equals(rdn->oid, oid))
! 734: {
! 735: if (is_wildcard(rdn->data))
! 736: {
! 737: (*wc)++;
! 738: }
! 739: else if (data.len != rdn->data.len ||
! 740: !rdn_equals(oid, type, data, rdn->type, rdn->data))
! 741: {
! 742: continue;
! 743: }
! 744: rdn->matched = TRUE;
! 745: found = rdn;
! 746: break;
! 747: }
! 748: }
! 749: if (!found)
! 750: {
! 751: /* treat unmatched RDNs like wildcards if allowed */
! 752: if (!allow_unmatched)
! 753: {
! 754: break;
! 755: }
! 756: (*wc)++;
! 757: }
! 758: /* the enumerator returns FALSE on parse error, we are finished
! 759: * if we have reached the end of the DN only */
! 760: if ((data.ptr + data.len == t_dn.ptr + t_dn.len))
! 761: {
! 762: finished = TRUE;
! 763: }
! 764: }
! 765: enumerator->destroy(enumerator);
! 766:
! 767: if (finished)
! 768: {
! 769: for (i = 0; i < array_count(rdns); i++)
! 770: {
! 771: array_get(rdns, i, &rdn);
! 772: if (!rdn->matched)
! 773: {
! 774: finished = FALSE;
! 775: }
! 776: }
! 777: }
! 778: array_destroy_function(rdns, (void*)free, NULL);
! 779: return finished;
! 780: }
! 781:
! 782: /**
! 783: * Reordered RDNs are fine, but match all
! 784: */
! 785: static bool match_dn_reordered(chunk_t t_dn, chunk_t o_dn, int *wc)
! 786: {
! 787: return match_dn(t_dn, o_dn, wc, FALSE);
! 788: }
! 789:
! 790: /**
! 791: * t_dn may contain more RDNs than o_dn
! 792: */
! 793: static bool match_dn_relaxed(chunk_t t_dn, chunk_t o_dn, int *wc)
! 794: {
! 795: return match_dn(t_dn, o_dn, wc, TRUE);
! 796: }
! 797:
! 798: /**
! 799: * Compare two DNs, for equality if wc == NULL, with wildcard matching otherwise
! 800: */
! 801: static bool compare_dn(chunk_t t_dn, chunk_t o_dn, int *wc)
! 802: {
! 803: enumerator_t *t, *o;
! 804: chunk_t t_oid, o_oid, t_data, o_data;
! 805: u_char t_type, o_type;
! 806: bool t_next, o_next, finished = FALSE;
! 807:
! 808: if (wc)
! 809: {
! 810: *wc = 0;
! 811: }
! 812: else if (t_dn.len != o_dn.len)
! 813: {
! 814: return FALSE;
! 815: }
! 816:
! 817: if (chunk_equals(t_dn, o_dn))
! 818: {
! 819: return TRUE;
! 820: }
! 821:
! 822: t = create_rdn_enumerator(t_dn);
! 823: o = create_rdn_enumerator(o_dn);
! 824: while (TRUE)
! 825: {
! 826: t_next = t->enumerate(t, &t_oid, &t_type, &t_data);
! 827: o_next = o->enumerate(o, &o_oid, &o_type, &o_data);
! 828:
! 829: if (!o_next && !t_next)
! 830: {
! 831: break;
! 832: }
! 833: finished = FALSE;
! 834: if (o_next != t_next)
! 835: {
! 836: break;
! 837: }
! 838: if (!chunk_equals(t_oid, o_oid))
! 839: {
! 840: break;
! 841: }
! 842: if (wc && is_wildcard(o_data))
! 843: {
! 844: (*wc)++;
! 845: }
! 846: else
! 847: {
! 848: if (t_data.len != o_data.len)
! 849: {
! 850: break;
! 851: }
! 852: if (!rdn_equals(t_oid, t_type, t_data, o_type, o_data))
! 853: {
! 854: break;
! 855: }
! 856: }
! 857: /* the enumerator returns FALSE on parse error, we are finished
! 858: * if we have reached the end of the DN only */
! 859: if ((t_data.ptr + t_data.len == t_dn.ptr + t_dn.len) &&
! 860: (o_data.ptr + o_data.len == o_dn.ptr + o_dn.len))
! 861: {
! 862: finished = TRUE;
! 863: }
! 864: }
! 865: t->destroy(t);
! 866: o->destroy(o);
! 867: return finished;
! 868: }
! 869:
! 870: METHOD(identification_t, equals_dn, bool,
! 871: private_identification_t *this, identification_t *other)
! 872: {
! 873: return compare_dn(this->encoded, other->get_encoding(other), NULL);
! 874: }
! 875:
! 876: METHOD(identification_t, hash_dn, u_int,
! 877: private_identification_t *this, u_int inc)
! 878: {
! 879: enumerator_t *rdns;
! 880: chunk_t oid, data;
! 881: u_char type;
! 882: u_int hash;
! 883:
! 884: hash = chunk_hash_inc(chunk_from_thing(this->type), inc);
! 885: rdns = create_rdn_enumerator(this->encoded);
! 886: while (rdns->enumerate(rdns, &oid, &type, &data))
! 887: {
! 888: hash = chunk_hash_inc(data, chunk_hash_inc(oid, hash));
! 889: }
! 890: rdns->destroy(rdns);
! 891: return hash;
! 892: }
! 893:
! 894: METHOD(identification_t, equals_strcasecmp, bool,
! 895: private_identification_t *this, identification_t *other)
! 896: {
! 897: chunk_t encoded = other->get_encoding(other);
! 898:
! 899: /* we do some extra sanity checks to check for invalid IDs with a
! 900: * terminating null in it. */
! 901: if (this->type == other->get_type(other) &&
! 902: this->encoded.len == encoded.len &&
! 903: memchr(this->encoded.ptr, 0, this->encoded.len) == NULL &&
! 904: memchr(encoded.ptr, 0, encoded.len) == NULL &&
! 905: strncasecmp(this->encoded.ptr, encoded.ptr, this->encoded.len) == 0)
! 906: {
! 907: return TRUE;
! 908: }
! 909: return FALSE;
! 910: }
! 911:
! 912: METHOD(identification_t, matches_binary, id_match_t,
! 913: private_identification_t *this, identification_t *other)
! 914: {
! 915: if (other->get_type(other) == ID_ANY)
! 916: {
! 917: return ID_MATCH_ANY;
! 918: }
! 919: if (this->type == other->get_type(other) &&
! 920: chunk_equals(this->encoded, other->get_encoding(other)))
! 921: {
! 922: return ID_MATCH_PERFECT;
! 923: }
! 924: return ID_MATCH_NONE;
! 925: }
! 926:
! 927: METHOD(identification_t, matches_string, id_match_t,
! 928: private_identification_t *this, identification_t *other)
! 929: {
! 930: chunk_t encoded = other->get_encoding(other);
! 931: u_int len = encoded.len;
! 932:
! 933: if (other->get_type(other) == ID_ANY)
! 934: {
! 935: return ID_MATCH_ANY;
! 936: }
! 937: if (this->type != other->get_type(other))
! 938: {
! 939: return ID_MATCH_NONE;
! 940: }
! 941: /* try a equals check first */
! 942: if (equals_strcasecmp(this, other))
! 943: {
! 944: return ID_MATCH_PERFECT;
! 945: }
! 946: if (len == 0 || this->encoded.len < len)
! 947: {
! 948: return ID_MATCH_NONE;
! 949: }
! 950:
! 951: /* check for single wildcard at the head of the string */
! 952: if (*encoded.ptr == '*')
! 953: {
! 954: /* single asterisk matches any string */
! 955: if (len-- == 1)
! 956: { /* not better than ID_ANY */
! 957: return ID_MATCH_ANY;
! 958: }
! 959: if (strncasecmp(this->encoded.ptr + this->encoded.len - len,
! 960: encoded.ptr + 1, len) == 0)
! 961: {
! 962: return ID_MATCH_ONE_WILDCARD;
! 963: }
! 964: }
! 965: return ID_MATCH_NONE;
! 966: }
! 967:
! 968: METHOD(identification_t, matches_any, id_match_t,
! 969: private_identification_t *this, identification_t *other)
! 970: {
! 971: if (other->get_type(other) == ID_ANY)
! 972: {
! 973: return ID_MATCH_ANY;
! 974: }
! 975: return ID_MATCH_NONE;
! 976: }
! 977:
! 978: /**
! 979: * Match DNs given the matching function
! 980: */
! 981: static id_match_t matches_dn_internal(private_identification_t *this,
! 982: identification_t *other,
! 983: bool (*match)(chunk_t,chunk_t,int*))
! 984: {
! 985: int wc;
! 986:
! 987: if (other->get_type(other) == ID_ANY)
! 988: {
! 989: return ID_MATCH_ANY;
! 990: }
! 991:
! 992: if (this->type == other->get_type(other))
! 993: {
! 994: if (match(this->encoded, other->get_encoding(other), &wc))
! 995: {
! 996: wc = min(wc, ID_MATCH_ONE_WILDCARD - ID_MATCH_MAX_WILDCARDS);
! 997: return ID_MATCH_PERFECT - wc;
! 998: }
! 999: }
! 1000: return ID_MATCH_NONE;
! 1001: }
! 1002:
! 1003: METHOD(identification_t, matches_dn, id_match_t,
! 1004: private_identification_t *this, identification_t *other)
! 1005: {
! 1006: return matches_dn_internal(this, other, compare_dn);
! 1007: }
! 1008:
! 1009: METHOD(identification_t, matches_dn_reordered, id_match_t,
! 1010: private_identification_t *this, identification_t *other)
! 1011: {
! 1012: return matches_dn_internal(this, other, match_dn_reordered);
! 1013: }
! 1014:
! 1015: METHOD(identification_t, matches_dn_relaxed, id_match_t,
! 1016: private_identification_t *this, identification_t *other)
! 1017: {
! 1018: return matches_dn_internal(this, other, match_dn_relaxed);
! 1019: }
! 1020:
! 1021: /**
! 1022: * Transform netmask to CIDR bits
! 1023: */
! 1024: static int netmask_to_cidr(char *netmask, size_t address_size)
! 1025: {
! 1026: uint8_t byte;
! 1027: int i, netbits = 0;
! 1028:
! 1029: for (i = 0; i < address_size; i++)
! 1030: {
! 1031: byte = netmask[i];
! 1032:
! 1033: if (byte == 0x00)
! 1034: {
! 1035: break;
! 1036: }
! 1037: if (byte == 0xff)
! 1038: {
! 1039: netbits += 8;
! 1040: }
! 1041: else
! 1042: {
! 1043: while (byte & 0x80)
! 1044: {
! 1045: netbits++;
! 1046: byte <<= 1;
! 1047: }
! 1048: }
! 1049: }
! 1050: return netbits;
! 1051: }
! 1052:
! 1053: METHOD(identification_t, matches_range, id_match_t,
! 1054: private_identification_t *this, identification_t *other)
! 1055: {
! 1056: chunk_t other_encoding;
! 1057: uint8_t *address, *from, *to, *network, *netmask;
! 1058: size_t address_size = 0;
! 1059: int netbits, range_sign, i;
! 1060:
! 1061: if (other->get_type(other) == ID_ANY)
! 1062: {
! 1063: return ID_MATCH_ANY;
! 1064: }
! 1065: if (this->type == other->get_type(other) &&
! 1066: chunk_equals(this->encoded, other->get_encoding(other)))
! 1067: {
! 1068: return ID_MATCH_PERFECT;
! 1069: }
! 1070: if ((this->type == ID_IPV4_ADDR &&
! 1071: other->get_type(other) == ID_IPV4_ADDR_SUBNET))
! 1072: {
! 1073: address_size = sizeof(struct in_addr);
! 1074: }
! 1075: else if ((this->type == ID_IPV6_ADDR &&
! 1076: other->get_type(other) == ID_IPV6_ADDR_SUBNET))
! 1077: {
! 1078: address_size = sizeof(struct in6_addr);
! 1079: }
! 1080: if (address_size)
! 1081: {
! 1082: other_encoding = other->get_encoding(other);
! 1083: if (this->encoded.len != address_size ||
! 1084: other_encoding.len != 2 * address_size)
! 1085: {
! 1086: return ID_MATCH_NONE;
! 1087: }
! 1088: address = this->encoded.ptr;
! 1089: network = other_encoding.ptr;
! 1090: netmask = other_encoding.ptr + address_size;
! 1091: netbits = netmask_to_cidr(netmask, address_size);
! 1092:
! 1093: if (netbits == 0)
! 1094: {
! 1095: return ID_MATCH_MAX_WILDCARDS;
! 1096: }
! 1097: if (netbits == 8 * address_size)
! 1098: {
! 1099: return memeq(address, network, address_size) ?
! 1100: ID_MATCH_PERFECT : ID_MATCH_NONE;
! 1101: }
! 1102: for (i = 0; i < (netbits + 7)/8; i++)
! 1103: {
! 1104: if ((address[i] ^ network[i]) & netmask[i])
! 1105: {
! 1106: return ID_MATCH_NONE;
! 1107: }
! 1108: }
! 1109: return ID_MATCH_ONE_WILDCARD;
! 1110: }
! 1111: if ((this->type == ID_IPV4_ADDR &&
! 1112: other->get_type(other) == ID_IPV4_ADDR_RANGE))
! 1113: {
! 1114: address_size = sizeof(struct in_addr);
! 1115: }
! 1116: else if ((this->type == ID_IPV6_ADDR &&
! 1117: other->get_type(other) == ID_IPV6_ADDR_RANGE))
! 1118: {
! 1119: address_size = sizeof(struct in6_addr);
! 1120: }
! 1121: if (address_size)
! 1122: {
! 1123: other_encoding = other->get_encoding(other);
! 1124: if (this->encoded.len != address_size ||
! 1125: other_encoding.len != 2 * address_size)
! 1126: {
! 1127: return ID_MATCH_NONE;
! 1128: }
! 1129: address = this->encoded.ptr;
! 1130: from = other_encoding.ptr;
! 1131: to = other_encoding.ptr + address_size;
! 1132:
! 1133: range_sign = memcmp(to, from, address_size);
! 1134: if (range_sign < 0)
! 1135: { /* to is smaller than from */
! 1136: return ID_MATCH_NONE;
! 1137: }
! 1138:
! 1139: /* check lower bound */
! 1140: for (i = 0; i < address_size; i++)
! 1141: {
! 1142: if (address[i] != from[i])
! 1143: {
! 1144: if (address[i] < from[i])
! 1145: {
! 1146: return ID_MATCH_NONE;
! 1147: }
! 1148: break;
! 1149: }
! 1150: }
! 1151:
! 1152: /* check upper bound */
! 1153: for (i = 0; i < address_size; i++)
! 1154: {
! 1155: if (address[i] != to[i])
! 1156: {
! 1157: if (address[i] > to[i])
! 1158: {
! 1159: return ID_MATCH_NONE;
! 1160: }
! 1161: break;
! 1162: }
! 1163: }
! 1164: return range_sign ? ID_MATCH_ONE_WILDCARD : ID_MATCH_PERFECT;
! 1165: }
! 1166: return ID_MATCH_NONE;
! 1167: }
! 1168:
! 1169: /**
! 1170: * Described in header.
! 1171: */
! 1172: int identification_printf_hook(printf_hook_data_t *data,
! 1173: printf_hook_spec_t *spec, const void *const *args)
! 1174: {
! 1175: private_identification_t *this = *((private_identification_t**)(args[0]));
! 1176: chunk_t proper;
! 1177: char buf[BUF_LEN], *pos;
! 1178: size_t len, address_size;
! 1179: int written;
! 1180:
! 1181: if (this == NULL)
! 1182: {
! 1183: return print_in_hook(data, "%*s", spec->width, "(null)");
! 1184: }
! 1185:
! 1186: switch (this->type)
! 1187: {
! 1188: case ID_ANY:
! 1189: snprintf(buf, BUF_LEN, "%%any");
! 1190: break;
! 1191: case ID_IPV4_ADDR:
! 1192: if (this->encoded.len < sizeof(struct in_addr) ||
! 1193: inet_ntop(AF_INET, this->encoded.ptr, buf, BUF_LEN) == NULL)
! 1194: {
! 1195: snprintf(buf, BUF_LEN, "(invalid ID_IPV4_ADDR)");
! 1196: }
! 1197: break;
! 1198: case ID_IPV4_ADDR_SUBNET:
! 1199: address_size = sizeof(struct in_addr);
! 1200: if (this->encoded.len < 2 * address_size ||
! 1201: inet_ntop(AF_INET, this->encoded.ptr, buf, BUF_LEN) == NULL)
! 1202: {
! 1203: snprintf(buf, BUF_LEN, "(invalid ID_IPV4_ADDR_SUBNET)");
! 1204: break;
! 1205: }
! 1206: written = strlen(buf);
! 1207: snprintf(buf + written, BUF_LEN - written, "/%d",
! 1208: netmask_to_cidr(this->encoded.ptr + address_size,
! 1209: address_size));
! 1210: break;
! 1211: case ID_IPV4_ADDR_RANGE:
! 1212: address_size = sizeof(struct in_addr);
! 1213: if (this->encoded.len < 2 * address_size ||
! 1214: inet_ntop(AF_INET, this->encoded.ptr, buf, BUF_LEN) == NULL)
! 1215: {
! 1216: snprintf(buf, BUF_LEN, "(invalid ID_IPV4_ADDR_RANGE)");
! 1217: break;
! 1218: }
! 1219: written = strlen(buf);
! 1220: pos = buf + written;
! 1221: len = BUF_LEN - written;
! 1222: written = snprintf(pos, len, "-");
! 1223: if (written < 0 || written >= len ||
! 1224: inet_ntop(AF_INET, this->encoded.ptr + address_size,
! 1225: pos + written, len - written) == NULL)
! 1226: {
! 1227: snprintf(buf, BUF_LEN, "(invalid ID_IPV4_ADDR_RANGE)");
! 1228: }
! 1229: break;
! 1230: case ID_IPV6_ADDR:
! 1231: if (this->encoded.len < sizeof(struct in6_addr) ||
! 1232: inet_ntop(AF_INET6, this->encoded.ptr, buf, BUF_LEN) == NULL)
! 1233: {
! 1234: snprintf(buf, BUF_LEN, "(invalid ID_IPV6_ADDR)");
! 1235: }
! 1236: break;
! 1237: case ID_IPV6_ADDR_SUBNET:
! 1238: address_size = sizeof(struct in6_addr);
! 1239: if (this->encoded.len < 2 * address_size ||
! 1240: inet_ntop(AF_INET6, this->encoded.ptr, buf, BUF_LEN) == NULL)
! 1241: {
! 1242: snprintf(buf, BUF_LEN, "(invalid ID_IPV6_ADDR_SUBNET)");
! 1243: }
! 1244: else
! 1245: {
! 1246: written = strlen(buf);
! 1247: snprintf(buf + written, BUF_LEN - written, "/%d",
! 1248: netmask_to_cidr(this->encoded.ptr + address_size,
! 1249: address_size));
! 1250: }
! 1251: break;
! 1252: case ID_IPV6_ADDR_RANGE:
! 1253: address_size = sizeof(struct in6_addr);
! 1254: if (this->encoded.len < 2 * address_size ||
! 1255: inet_ntop(AF_INET6, this->encoded.ptr, buf, BUF_LEN) == NULL)
! 1256: {
! 1257: snprintf(buf, BUF_LEN, "(invalid ID_IPV6_ADDR_RANGE)");
! 1258: break;
! 1259: }
! 1260: written = strlen(buf);
! 1261: pos = buf + written;
! 1262: len = BUF_LEN - written;
! 1263: written = snprintf(pos, len, "-");
! 1264: if (written < 0 || written >= len ||
! 1265: inet_ntop(AF_INET6, this->encoded.ptr + address_size,
! 1266: pos + written, len - written) == NULL)
! 1267: {
! 1268: snprintf(buf, BUF_LEN, "(invalid ID_IPV6_ADDR_RANGE)");
! 1269: }
! 1270: break;
! 1271: case ID_FQDN:
! 1272: case ID_RFC822_ADDR:
! 1273: case ID_DER_ASN1_GN_URI:
! 1274: chunk_printable(this->encoded, &proper, '?');
! 1275: snprintf(buf, BUF_LEN, "%.*s", (int)proper.len, proper.ptr);
! 1276: chunk_free(&proper);
! 1277: break;
! 1278: case ID_DER_ASN1_DN:
! 1279: dntoa(this->encoded, buf, BUF_LEN);
! 1280: break;
! 1281: case ID_DER_ASN1_GN:
! 1282: snprintf(buf, BUF_LEN, "(ASN.1 general name)");
! 1283: break;
! 1284: case ID_KEY_ID:
! 1285: if (chunk_printable(this->encoded, NULL, '?') &&
! 1286: this->encoded.len != HASH_SIZE_SHA1)
! 1287: { /* fully printable, use ascii version */
! 1288: snprintf(buf, BUF_LEN, "%.*s", (int)this->encoded.len,
! 1289: this->encoded.ptr);
! 1290: }
! 1291: else
! 1292: { /* not printable, hex dump */
! 1293: snprintf(buf, BUF_LEN, "%#B", &this->encoded);
! 1294: }
! 1295: break;
! 1296: default:
! 1297: snprintf(buf, BUF_LEN, "(unknown ID type: %d)", this->type);
! 1298: break;
! 1299: }
! 1300: if (spec->minus)
! 1301: {
! 1302: return print_in_hook(data, "%-*s", spec->width, buf);
! 1303: }
! 1304: return print_in_hook(data, "%*s", spec->width, buf);
! 1305: }
! 1306:
! 1307: METHOD(identification_t, clone_, identification_t*,
! 1308: private_identification_t *this)
! 1309: {
! 1310: private_identification_t *clone = malloc_thing(private_identification_t);
! 1311:
! 1312: memcpy(clone, this, sizeof(private_identification_t));
! 1313: if (this->encoded.len)
! 1314: {
! 1315: clone->encoded = chunk_clone(this->encoded);
! 1316: }
! 1317: return &clone->public;
! 1318: }
! 1319:
! 1320: METHOD(identification_t, destroy, void,
! 1321: private_identification_t *this)
! 1322: {
! 1323: chunk_free(&this->encoded);
! 1324: free(this);
! 1325: }
! 1326:
! 1327: /**
! 1328: * Generic constructor used for the other constructors.
! 1329: */
! 1330: static private_identification_t *identification_create(id_type_t type)
! 1331: {
! 1332: private_identification_t *this;
! 1333: char *rdn_matching;
! 1334:
! 1335: INIT(this,
! 1336: .public = {
! 1337: .get_encoding = _get_encoding,
! 1338: .get_type = _get_type,
! 1339: .create_part_enumerator = _create_part_enumerator,
! 1340: .clone = _clone_,
! 1341: .destroy = _destroy,
! 1342: },
! 1343: .type = type,
! 1344: );
! 1345:
! 1346: switch (type)
! 1347: {
! 1348: case ID_ANY:
! 1349: this->public.hash = _hash_binary;
! 1350: this->public.equals = _equals_binary;
! 1351: this->public.matches = _matches_any;
! 1352: this->public.contains_wildcards = return_true;
! 1353: break;
! 1354: case ID_FQDN:
! 1355: case ID_RFC822_ADDR:
! 1356: this->public.hash = _hash_binary;
! 1357: this->public.equals = _equals_strcasecmp;
! 1358: this->public.matches = _matches_string;
! 1359: this->public.contains_wildcards = _contains_wildcards_memchr;
! 1360: break;
! 1361: case ID_DER_ASN1_DN:
! 1362: this->public.hash = _hash_dn;
! 1363: this->public.equals = _equals_dn;
! 1364: this->public.matches = _matches_dn;
! 1365: this->public.contains_wildcards = _contains_wildcards_dn;
! 1366: /* check for more relaxed matching config */
! 1367: rdn_matching = lib->settings->get_str(lib->settings,
! 1368: "%s.rdn_matching", NULL, lib->ns);
! 1369: if (streq("reordered", rdn_matching))
! 1370: {
! 1371: this->public.matches = _matches_dn_reordered;
! 1372: }
! 1373: else if (streq("relaxed", rdn_matching))
! 1374: {
! 1375: this->public.matches = _matches_dn_relaxed;
! 1376: }
! 1377: break;
! 1378: case ID_IPV4_ADDR:
! 1379: case ID_IPV6_ADDR:
! 1380: this->public.hash = _hash_binary;
! 1381: this->public.equals = _equals_binary;
! 1382: this->public.matches = _matches_range;
! 1383: this->public.contains_wildcards = return_false;
! 1384: break;
! 1385: default:
! 1386: this->public.hash = _hash_binary;
! 1387: this->public.equals = _equals_binary;
! 1388: this->public.matches = _matches_binary;
! 1389: this->public.contains_wildcards = return_false;
! 1390: break;
! 1391: }
! 1392: return this;
! 1393: }
! 1394:
! 1395: /**
! 1396: * Create an identity for a specific type, determined by prefix
! 1397: */
! 1398: static private_identification_t* create_from_string_with_prefix_type(char *str)
! 1399: {
! 1400: struct {
! 1401: const char *str;
! 1402: id_type_t type;
! 1403: } prefixes[] = {
! 1404: { "ipv4:", ID_IPV4_ADDR },
! 1405: { "ipv6:", ID_IPV6_ADDR },
! 1406: { "ipv4net:", ID_IPV4_ADDR_SUBNET },
! 1407: { "ipv6net:", ID_IPV6_ADDR_SUBNET },
! 1408: { "ipv4range:", ID_IPV4_ADDR_RANGE },
! 1409: { "ipv6range:", ID_IPV6_ADDR_RANGE },
! 1410: { "rfc822:", ID_RFC822_ADDR },
! 1411: { "email:", ID_RFC822_ADDR },
! 1412: { "userfqdn:", ID_USER_FQDN },
! 1413: { "fqdn:", ID_FQDN },
! 1414: { "dns:", ID_FQDN },
! 1415: { "asn1dn:", ID_DER_ASN1_DN },
! 1416: { "asn1gn:", ID_DER_ASN1_GN },
! 1417: { "xmppaddr:", ID_DER_ASN1_GN },
! 1418: { "keyid:", ID_KEY_ID },
! 1419: };
! 1420: private_identification_t *this;
! 1421: int i;
! 1422:
! 1423: for (i = 0; i < countof(prefixes); i++)
! 1424: {
! 1425: if (strcasepfx(str, prefixes[i].str))
! 1426: {
! 1427: this = identification_create(prefixes[i].type);
! 1428: str += strlen(prefixes[i].str);
! 1429:
! 1430: if (*str == '#')
! 1431: {
! 1432: this->encoded = chunk_from_hex(chunk_from_str(str + 1), NULL);
! 1433: }
! 1434: else
! 1435: {
! 1436: this->encoded = chunk_clone(chunk_from_str(str));
! 1437: }
! 1438:
! 1439: if (prefixes[i].type == ID_DER_ASN1_GN &&
! 1440: strcasepfx(prefixes[i].str, "xmppaddr:"))
! 1441: {
! 1442: this->encoded = asn1_wrap(ASN1_CONTEXT_C_0, "mm",
! 1443: asn1_build_known_oid(OID_XMPP_ADDR),
! 1444: asn1_wrap(ASN1_CONTEXT_C_0, "m",
! 1445: asn1_wrap(ASN1_UTF8STRING, "m",
! 1446: this->encoded)));
! 1447: }
! 1448:
! 1449: return this;
! 1450: }
! 1451: }
! 1452: return NULL;
! 1453: }
! 1454:
! 1455: /**
! 1456: * Create an identity for a specific type, determined by a numerical prefix
! 1457: *
! 1458: * The prefix is of the form "{x}:", where x denotes the numerical identity
! 1459: * type.
! 1460: */
! 1461: static private_identification_t* create_from_string_with_num_type(char *str)
! 1462: {
! 1463: private_identification_t *this;
! 1464: u_long type;
! 1465:
! 1466: if (*str++ != '{')
! 1467: {
! 1468: return NULL;
! 1469: }
! 1470: errno = 0;
! 1471: type = strtoul(str, &str, 0);
! 1472: if (errno || *str++ != '}' || *str++ != ':')
! 1473: {
! 1474: return NULL;
! 1475: }
! 1476: this = identification_create(type);
! 1477: if (*str == '#')
! 1478: {
! 1479: this->encoded = chunk_from_hex(chunk_from_str(str + 1), NULL);
! 1480: }
! 1481: else
! 1482: {
! 1483: this->encoded = chunk_clone(chunk_from_str(str));
! 1484: }
! 1485: return this;
! 1486: }
! 1487:
! 1488: /**
! 1489: * Convert to an IPv4/IPv6 host address, subnet or address range
! 1490: */
! 1491: static private_identification_t* create_ip_address_from_string(char *string,
! 1492: bool is_ipv4)
! 1493: {
! 1494: private_identification_t *this;
! 1495: uint8_t encoding[32];
! 1496: uint8_t *str, *pos, *address, *to_address, *netmask;
! 1497: size_t address_size;
! 1498: int bits, bytes, i;
! 1499: bool has_subnet = FALSE, has_range = FALSE;
! 1500:
! 1501: address = encoding;
! 1502: address_size = is_ipv4 ? sizeof(struct in_addr) : sizeof(struct in6_addr);
! 1503:
! 1504: str = strdup(string);
! 1505: pos = strchr(str, '/');
! 1506: if (pos)
! 1507: { /* separate IP address from optional netmask */
! 1508:
! 1509: *pos = '\0';
! 1510: has_subnet = TRUE;
! 1511: }
! 1512: else
! 1513: {
! 1514: pos = strchr(str, '-');
! 1515: if (pos)
! 1516: { /* separate lower address from upper address of IP range */
! 1517: *pos = '\0';
! 1518: has_range = TRUE;
! 1519: }
! 1520: }
! 1521:
! 1522: if (inet_pton(is_ipv4 ? AF_INET : AF_INET6, str, address) != 1)
! 1523: {
! 1524: free(str);
! 1525: return NULL;
! 1526: }
! 1527:
! 1528: if (has_subnet)
! 1529: { /* is IP subnet */
! 1530: bits = atoi(pos + 1);
! 1531: if (bits > 8 * address_size)
! 1532: {
! 1533: free(str);
! 1534: return NULL;
! 1535: }
! 1536: bytes = bits / 8;
! 1537: bits -= 8 * bytes;
! 1538: netmask = encoding + address_size;
! 1539:
! 1540: for (i = 0; i < address_size; i++)
! 1541: {
! 1542: if (bytes)
! 1543: {
! 1544: *netmask = 0xff;
! 1545: bytes--;
! 1546: }
! 1547: else if (bits)
! 1548: {
! 1549: *netmask = 0xff << (8 - bits);
! 1550: bits = 0;
! 1551: }
! 1552: else
! 1553: {
! 1554: *netmask = 0x00;
! 1555: }
! 1556: *address++ &= *netmask++;
! 1557: }
! 1558: this = identification_create(is_ipv4 ? ID_IPV4_ADDR_SUBNET :
! 1559: ID_IPV6_ADDR_SUBNET);
! 1560: this->encoded = chunk_clone(chunk_create(encoding, 2 * address_size));
! 1561: }
! 1562: else if (has_range)
! 1563: { /* is IP range */
! 1564: to_address = encoding + address_size;
! 1565:
! 1566: if (inet_pton(is_ipv4 ? AF_INET : AF_INET6, pos + 1, to_address) != 1)
! 1567: {
! 1568: free(str);
! 1569: return NULL;
! 1570: }
! 1571: for (i = 0; i < address_size; i++)
! 1572: {
! 1573: if (address[i] != to_address[i])
! 1574: {
! 1575: if (address[i] > to_address[i])
! 1576: {
! 1577: free(str);
! 1578: return NULL;
! 1579: }
! 1580: break;
! 1581: }
! 1582: }
! 1583: this = identification_create(is_ipv4 ? ID_IPV4_ADDR_RANGE :
! 1584: ID_IPV6_ADDR_RANGE);
! 1585: this->encoded = chunk_clone(chunk_create(encoding, 2 * address_size));
! 1586: }
! 1587: else
! 1588: { /* is IP host address */
! 1589: this = identification_create(is_ipv4 ? ID_IPV4_ADDR : ID_IPV6_ADDR);
! 1590: this->encoded = chunk_clone(chunk_create(encoding, address_size));
! 1591: }
! 1592: free(str);
! 1593:
! 1594: return this;
! 1595: }
! 1596:
! 1597: /*
! 1598: * Described in header.
! 1599: */
! 1600: identification_t *identification_create_from_string(char *string)
! 1601: {
! 1602: private_identification_t *this;
! 1603: chunk_t encoded;
! 1604:
! 1605: if (string == NULL)
! 1606: {
! 1607: string = "%any";
! 1608: }
! 1609: this = create_from_string_with_prefix_type(string);
! 1610: if (this)
! 1611: {
! 1612: return &this->public;
! 1613: }
! 1614: this = create_from_string_with_num_type(string);
! 1615: if (this)
! 1616: {
! 1617: return &this->public;
! 1618: }
! 1619: if (strchr(string, '=') != NULL)
! 1620: {
! 1621: /* we interpret this as an ASCII X.501 ID_DER_ASN1_DN.
! 1622: * convert from LDAP style or openssl x509 -subject style to ASN.1 DN
! 1623: */
! 1624: if (atodn(string, &encoded) == SUCCESS)
! 1625: {
! 1626: this = identification_create(ID_DER_ASN1_DN);
! 1627: this->encoded = encoded;
! 1628: }
! 1629: else
! 1630: {
! 1631: this = identification_create(ID_KEY_ID);
! 1632: this->encoded = chunk_from_str(strdup(string));
! 1633: }
! 1634: return &this->public;
! 1635: }
! 1636: else if (strchr(string, '@') == NULL)
! 1637: {
! 1638: if (streq(string, "")
! 1639: || streq(string, "%any")
! 1640: || streq(string, "%any6")
! 1641: || streq(string, "0.0.0.0")
! 1642: || streq(string, "*")
! 1643: || streq(string, "::")
! 1644: || streq(string, "0::0"))
! 1645: {
! 1646: /* any ID will be accepted */
! 1647: this = identification_create(ID_ANY);
! 1648: return &this->public;
! 1649: }
! 1650: else
! 1651: {
! 1652: if (strchr(string, ':') == NULL)
! 1653: {
! 1654: /* IPv4 address or subnet */
! 1655: this = create_ip_address_from_string(string, TRUE);
! 1656: if (!this)
! 1657: { /* not IPv4, mostly FQDN */
! 1658: this = identification_create(ID_FQDN);
! 1659: this->encoded = chunk_from_str(strdup(string));
! 1660: }
! 1661: return &this->public;
! 1662: }
! 1663: else
! 1664: {
! 1665: /* IPv6 address or subnet */
! 1666: this = create_ip_address_from_string(string, FALSE);
! 1667: if (!this)
! 1668: { /* not IPv4/6 fallback to KEY_ID */
! 1669: this = identification_create(ID_KEY_ID);
! 1670: this->encoded = chunk_from_str(strdup(string));
! 1671: }
! 1672: return &this->public;
! 1673: }
! 1674: }
! 1675: }
! 1676: else
! 1677: {
! 1678: if (*string == '@')
! 1679: {
! 1680: string++;
! 1681: if (*string == '#')
! 1682: {
! 1683: this = identification_create(ID_KEY_ID);
! 1684: this->encoded = chunk_from_hex(chunk_from_str(string + 1), NULL);
! 1685: return &this->public;
! 1686: }
! 1687: else if (*string == '@')
! 1688: {
! 1689: this = identification_create(ID_USER_FQDN);
! 1690: this->encoded = chunk_clone(chunk_from_str(string + 1));
! 1691: return &this->public;
! 1692: }
! 1693: else
! 1694: {
! 1695: this = identification_create(ID_FQDN);
! 1696: this->encoded = chunk_clone(chunk_from_str(string));
! 1697: return &this->public;
! 1698: }
! 1699: }
! 1700: else
! 1701: {
! 1702: this = identification_create(ID_RFC822_ADDR);
! 1703: this->encoded = chunk_from_str(strdup(string));
! 1704: return &this->public;
! 1705: }
! 1706: }
! 1707: }
! 1708:
! 1709: /*
! 1710: * Described in header.
! 1711: */
! 1712: identification_t * identification_create_from_data(chunk_t data)
! 1713: {
! 1714: char buf[data.len + 1];
! 1715:
! 1716: if (is_asn1(data))
! 1717: {
! 1718: return identification_create_from_encoding(ID_DER_ASN1_DN, data);
! 1719: }
! 1720: else
! 1721: {
! 1722: /* use string constructor */
! 1723: snprintf(buf, sizeof(buf), "%.*s", (int)data.len, data.ptr);
! 1724: return identification_create_from_string(buf);
! 1725: }
! 1726: }
! 1727:
! 1728: /*
! 1729: * Described in header.
! 1730: */
! 1731: identification_t *identification_create_from_encoding(id_type_t type,
! 1732: chunk_t encoded)
! 1733: {
! 1734: private_identification_t *this = identification_create(type);
! 1735:
! 1736: /* apply encoded chunk */
! 1737: if (type != ID_ANY)
! 1738: {
! 1739: this->encoded = chunk_clone(encoded);
! 1740: }
! 1741: return &(this->public);
! 1742: }
! 1743:
! 1744: /*
! 1745: * Described in header.
! 1746: */
! 1747: identification_t *identification_create_from_sockaddr(sockaddr_t *sockaddr)
! 1748: {
! 1749: switch (sockaddr->sa_family)
! 1750: {
! 1751: case AF_INET:
! 1752: {
! 1753: struct in_addr *addr = &(((struct sockaddr_in*)sockaddr)->sin_addr);
! 1754:
! 1755: return identification_create_from_encoding(ID_IPV4_ADDR,
! 1756: chunk_create((u_char*)addr, sizeof(struct in_addr)));
! 1757: }
! 1758: case AF_INET6:
! 1759: {
! 1760: struct in6_addr *addr = &(((struct sockaddr_in6*)sockaddr)->sin6_addr);
! 1761:
! 1762: return identification_create_from_encoding(ID_IPV6_ADDR,
! 1763: chunk_create((u_char*)addr, sizeof(struct in6_addr)));
! 1764: }
! 1765: default:
! 1766: {
! 1767: private_identification_t *this = identification_create(ID_ANY);
! 1768:
! 1769: return &(this->public);
! 1770: }
! 1771: }
! 1772: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to identification.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / utils