src/charon/encoding/payloads/certreq_payload.c

   1 /**
   2  * @file certreq_payload.c
   3  *
   4  * @brief Implementation of certreq_payload_t.
   5  *
   6  */
   7
   8 /*
   9  * Copyright (C) 2005-2006 Martin Willi
  10  * Copyright (C) 2005 Jan Hutter
  11  * Hochschule fuer Technik Rapperswil
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms of the GNU General Public License as published by the
  15  * Free Software Foundation; either version 2 of the License, or (at your
  16  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  17  *
  18  * This program is distributed in the hope that it will be useful, but
  19  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  20  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  21  * for more details.
  22  */
  23
  24 #include <stddef.h>
  25 #include <string.h>
  26
  27 #include <daemon.h>
  28 #include <crypto/hashers/hasher.h>
  29
  30 #include "certreq_payload.h"
  31
  32
  33 typedef struct private_certreq_payload_t private_certreq_payload_t;
  34
  35 /**
  36  * Private data of an certreq_payload_t object.
  37  *
  38  */
  39 struct private_certreq_payload_t {
  40         /**
  41          * Public certreq_payload_t interface.
  42          */
  43         certreq_payload_t public;
  44
  45         /**
  46          * Next payload type.
  47          */
  48         u_int8_t  next_payload;
  49
  50         /**
  51          * Critical flag.
  52          */
  53         bool critical;
  54
  55         /**
  56          * Length of this payload.
  57          */
  58         u_int16_t payload_length;
  59
  60         /**
  61          * Encoding of the CERT Data.
  62          */
  63         u_int8_t cert_encoding;
  64
  65         /**
  66          * The contained certreq data value.
  67          */
  68         chunk_t certreq_data;
  69 };
  70
  71 /**
  72  * Encoding rules to parse or generate a CERTREQ payload
  73  *
  74  * The defined offsets are the positions in a object of type
  75  * private_certreq_payload_t.
  76  *
  77  */
  78 encoding_rule_t certreq_payload_encodings[] = {
  79         /* 1 Byte next payload type, stored in the field next_payload */
  80         { U_INT_8,                      offsetof(private_certreq_payload_t, next_payload)       },
  81         /* the critical bit */
  82         { FLAG,                         offsetof(private_certreq_payload_t, critical)           },
  83         /* 7 Bit reserved bits, nowhere stored */
  84         { RESERVED_BIT, 0                                                                                                               },
  85         { RESERVED_BIT, 0                                                                                                               },
  86         { RESERVED_BIT, 0                                                                                                               },
  87         { RESERVED_BIT, 0                                                                                                               },
  88         { RESERVED_BIT, 0                                                                                                               },
  89         { RESERVED_BIT, 0                                                                                                               },
  90         { RESERVED_BIT, 0                                                                                                               },
  91         /* Length of the whole payload*/
  92         { PAYLOAD_LENGTH,       offsetof(private_certreq_payload_t, payload_length)},
  93         /* 1 Byte CERTREQ type*/
  94         { U_INT_8,                      offsetof(private_certreq_payload_t, cert_encoding)},
  95         /* some certreq data bytes, length is defined in PAYLOAD_LENGTH */
  96         { CERTREQ_DATA,                 offsetof(private_certreq_payload_t, certreq_data)}
  97 };
  98
  99 /*
 100                            1                   2                   3
 101        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 102       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 103       ! Next Payload  !C!  RESERVED   !         Payload Length        !
 104       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 105       ! Cert Encoding !                                               !
 106       +-+-+-+-+-+-+-+-+                                               !
 107       ~                    Certification Authority                    ~
 108       !                                                               !
 109       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 110 */
 111
 112 /**
 113  * Implementation of payload_t.verify.
 114  */
 115 static status_t verify(private_certreq_payload_t *this)
 116 {
 117         if ((this->cert_encoding == 0) ||
 118                 ((this->cert_encoding >= 14) && (this->cert_encoding <= 200)))
 119         {
 120                 /* reserved IDs */
 121                 return FAILED;
 122         }
 123         return SUCCESS;
 124 }
 125
 126 /**
 127  * Implementation of certreq_payload_t.get_encoding_rules.
 128  */
 129 static void get_encoding_rules(private_certreq_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 130 {
 131         *rules = certreq_payload_encodings;
 132         *rule_count = sizeof(certreq_payload_encodings) / sizeof(encoding_rule_t);
 133 }
 134
 135 /**
 136  * Implementation of payload_t.get_type.
 137  */
 138 static payload_type_t get_payload_type(private_certreq_payload_t *this)
 139 {
 140         return CERTIFICATE_REQUEST;
 141 }
 142
 143 /**
 144  * Implementation of payload_t.get_next_type.
 145  */
 146 static payload_type_t get_next_type(private_certreq_payload_t *this)
 147 {
 148         return (this->next_payload);
 149 }
 150
 151 /**
 152  * Implementation of payload_t.set_next_type.
 153  */
 154 static void set_next_type(private_certreq_payload_t *this,payload_type_t type)
 155 {
 156         this->next_payload = type;
 157 }
 158
 159 /**
 160  * Implementation of payload_t.get_length.
 161  */
 162 static size_t get_length(private_certreq_payload_t *this)
 163 {
 164         return this->payload_length;
 165 }
 166
 167 /**
 168  * Implementation of certreq_payload_t.set_cert_encoding.
 169  */
 170 static void set_cert_encoding (private_certreq_payload_t *this, cert_encoding_t encoding)
 171 {
 172         this->cert_encoding = encoding;
 173 }
 174
 175 /**
 176  * Implementation of certreq_payload_t.get_cert_encoding.
 177  */
 178 static cert_encoding_t get_cert_encoding (private_certreq_payload_t *this)
 179 {
 180         return (this->cert_encoding);
 181 }
 182
 183 /**
 184  * Implementation of certreq_payload_t.set_data.
 185  */
 186 static void set_data (private_certreq_payload_t *this, chunk_t data)
 187 {
 188         if (this->certreq_data.ptr != NULL)
 189         {
 190                 chunk_free(&(this->certreq_data));
 191         }
 192         this->certreq_data.ptr = clalloc(data.ptr,data.len);
 193         this->certreq_data.len = data.len;
 194         this->payload_length = CERTREQ_PAYLOAD_HEADER_LENGTH + this->certreq_data.len;
 195 }
 196
 197 /**
 198  * Implementation of certreq_payload_t.get_data.
 199  */
 200 static chunk_t get_data (private_certreq_payload_t *this)
 201 {
 202         return (this->certreq_data);
 203 }
 204
 205 /**
 206  * Implementation of certreq_payload_t.get_data_clone.
 207  */
 208 static chunk_t get_data_clone (private_certreq_payload_t *this)
 209 {
 210         chunk_t cloned_data;
 211         if (this->certreq_data.ptr == NULL)
 212         {
 213                 return (this->certreq_data);
 214         }
 215         cloned_data.ptr = clalloc(this->certreq_data.ptr,this->certreq_data.len);
 216         cloned_data.len = this->certreq_data.len;
 217         return cloned_data;
 218 }
 219
 220 /**
 221  * Implementation of payload_t.destroy and certreq_payload_t.destroy.
 222  */
 223 static void destroy(private_certreq_payload_t *this)
 224 {
 225         if (this->certreq_data.ptr != NULL)
 226         {
 227                 chunk_free(&(this->certreq_data));
 228         }
 229
 230         free(this);
 231 }
 232
 233 /*
 234  * Described in header
 235  */
 236 certreq_payload_t *certreq_payload_create()
 237 {
 238         private_certreq_payload_t *this = malloc_thing(private_certreq_payload_t);
 239
 240         /* interface functions */
 241         this->public.payload_interface.verify = (status_t (*) (payload_t*))verify;
 242         this->public.payload_interface.get_encoding_rules = (void (*) (payload_t*,encoding_rule_t**,size_t*))get_encoding_rules;
 243         this->public.payload_interface.get_length = (size_t (*) (payload_t*))get_length;
 244         this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t*))get_next_type;
 245         this->public.payload_interface.set_next_type = (void (*) (payload_t*,payload_type_t))set_next_type;
 246         this->public.payload_interface.get_type = (payload_type_t (*) (payload_t*))get_payload_type;
 247         this->public.payload_interface.destroy = (void (*) (payload_t*))destroy;
 248
 249         /* public functions */
 250         this->public.destroy = (void (*) (certreq_payload_t*)) destroy;
 251         this->public.set_cert_encoding = (void (*) (certreq_payload_t*,cert_encoding_t))set_cert_encoding;
 252         this->public.get_cert_encoding = (cert_encoding_t (*) (certreq_payload_t*))get_cert_encoding;
 253         this->public.set_data = (void (*) (certreq_payload_t*,chunk_t))set_data;
 254         this->public.get_data_clone = (chunk_t (*) (certreq_payload_t*))get_data_clone;
 255         this->public.get_data = (chunk_t (*) (certreq_payload_t*))get_data;
 256
 257         /* private variables */
 258         this->critical = FALSE;
 259         this->next_payload = NO_PAYLOAD;
 260         this->payload_length =CERTREQ_PAYLOAD_HEADER_LENGTH;
 261         this->certreq_data = CHUNK_INITIALIZER;
 262
 263         return (&(this->public));
 264 }
 265
 266 /*
 267  * Described in header
 268  */
 269 certreq_payload_t *certreq_payload_create_from_cacert(identification_t *id)
 270 {
 271         x509_t *cacert = charon->credentials->get_ca_certificate(charon->credentials, id);
 272         rsa_public_key_t *pubkey = cacert->get_public_key(cacert);
 273         chunk_t keyid = pubkey->get_keyid(pubkey);
 274
 275         certreq_payload_t *this = certreq_payload_create();
 276
 277         DBG1(DBG_IKE, "request certificate issued by '%D'", id);
 278         DBG2(DBG_IKE, "  with keyid %#B", &keyid);
 279
 280         this->set_cert_encoding(this, CERT_X509_SIGNATURE);
 281         this->set_data(this, keyid);
 282         return this;
 283 }
 284
 285 /*
 286  * Described in header
 287  */
 288 certreq_payload_t *certreq_payload_create_from_cacerts(void)
 289 {
 290         certreq_payload_t *this;
 291         chunk_t keyids;
 292         u_char *pos;
 293         x509_t *cacert;
 294
 295         iterator_t *iterator = charon->credentials->create_cacert_iterator(charon->credentials);
 296         int count = iterator->get_count(iterator);
 297
 298         if (count == 0)
 299                 return NULL;
 300
 301         this = certreq_payload_create();
 302         keyids = chunk_alloc(count * HASH_SIZE_SHA1);
 303         pos = keyids.ptr;
 304
 305         while (iterator->iterate(iterator, (void**)&cacert))
 306         {
 307                 rsa_public_key_t *pubkey = cacert->get_public_key(cacert);
 308                 chunk_t keyid = pubkey->get_keyid(pubkey);
 309
 310                 DBG1(DBG_IKE, "request certificate issued by '%D'", cacert->get_subject(cacert));
 311                 DBG2(DBG_IKE, "  with keyid %#B", &keyid);
 312                 memcpy(pos, keyid.ptr, keyid.len);
 313                 pos += HASH_SIZE_SHA1;
 314         }
 315         iterator->destroy(iterator);
 316
 317         this->set_cert_encoding(this, CERT_X509_SIGNATURE);
 318         this->set_data(this, keyids);
 319         free(keyids.ptr);
 320         return this;
 321 }