support of certreq payload in IKE_AUTH messages
[strongswan.git] / src / charon / encoding / payloads / certreq_payload.c
1 /**
2 * @file certreq_payload.c
3 *
4 * @brief Implementation of certreq_payload_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005-2006 Martin Willi
10 * Copyright (C) 2005 Jan Hutter
11 * Hochschule fuer Technik Rapperswil
12 *
13 * This program is free software; you can redistribute it and/or modify it
14 * under the terms of the GNU General Public License as published by the
15 * Free Software Foundation; either version 2 of the License, or (at your
16 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
17 *
18 * This program is distributed in the hope that it will be useful, but
19 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
20 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
21 * for more details.
22 */
23
24 #include <stddef.h>
25 #include <string.h>
26
27 #include <daemon.h>
28 #include <crypto/hashers/hasher.h>
29
30 #include "certreq_payload.h"
31
32
33 typedef struct private_certreq_payload_t private_certreq_payload_t;
34
35 /**
36 * Private data of an certreq_payload_t object.
37 *
38 */
39 struct private_certreq_payload_t {
40 /**
41 * Public certreq_payload_t interface.
42 */
43 certreq_payload_t public;
44
45 /**
46 * Next payload type.
47 */
48 u_int8_t next_payload;
49
50 /**
51 * Critical flag.
52 */
53 bool critical;
54
55 /**
56 * Length of this payload.
57 */
58 u_int16_t payload_length;
59
60 /**
61 * Encoding of the CERT Data.
62 */
63 u_int8_t cert_encoding;
64
65 /**
66 * The contained certreq data value.
67 */
68 chunk_t certreq_data;
69 };
70
71 /**
72 * Encoding rules to parse or generate a CERTREQ payload
73 *
74 * The defined offsets are the positions in a object of type
75 * private_certreq_payload_t.
76 *
77 */
78 encoding_rule_t certreq_payload_encodings[] = {
79 /* 1 Byte next payload type, stored in the field next_payload */
80 { U_INT_8, offsetof(private_certreq_payload_t, next_payload) },
81 /* the critical bit */
82 { FLAG, offsetof(private_certreq_payload_t, critical) },
83 /* 7 Bit reserved bits, nowhere stored */
84 { RESERVED_BIT, 0 },
85 { RESERVED_BIT, 0 },
86 { RESERVED_BIT, 0 },
87 { RESERVED_BIT, 0 },
88 { RESERVED_BIT, 0 },
89 { RESERVED_BIT, 0 },
90 { RESERVED_BIT, 0 },
91 /* Length of the whole payload*/
92 { PAYLOAD_LENGTH, offsetof(private_certreq_payload_t, payload_length)},
93 /* 1 Byte CERTREQ type*/
94 { U_INT_8, offsetof(private_certreq_payload_t, cert_encoding)},
95 /* some certreq data bytes, length is defined in PAYLOAD_LENGTH */
96 { CERTREQ_DATA, offsetof(private_certreq_payload_t, certreq_data)}
97 };
98
99 /*
100 1 2 3
101 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
102 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
103 ! Next Payload !C! RESERVED ! Payload Length !
104 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
105 ! Cert Encoding ! !
106 +-+-+-+-+-+-+-+-+ !
107 ~ Certification Authority ~
108 ! !
109 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
110 */
111
112 /**
113 * Implementation of payload_t.verify.
114 */
115 static status_t verify(private_certreq_payload_t *this)
116 {
117 if ((this->cert_encoding == 0) ||
118 ((this->cert_encoding >= 14) && (this->cert_encoding <= 200)))
119 {
120 /* reserved IDs */
121 return FAILED;
122 }
123 return SUCCESS;
124 }
125
126 /**
127 * Implementation of certreq_payload_t.get_encoding_rules.
128 */
129 static void get_encoding_rules(private_certreq_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
130 {
131 *rules = certreq_payload_encodings;
132 *rule_count = sizeof(certreq_payload_encodings) / sizeof(encoding_rule_t);
133 }
134
135 /**
136 * Implementation of payload_t.get_type.
137 */
138 static payload_type_t get_payload_type(private_certreq_payload_t *this)
139 {
140 return CERTIFICATE_REQUEST;
141 }
142
143 /**
144 * Implementation of payload_t.get_next_type.
145 */
146 static payload_type_t get_next_type(private_certreq_payload_t *this)
147 {
148 return (this->next_payload);
149 }
150
151 /**
152 * Implementation of payload_t.set_next_type.
153 */
154 static void set_next_type(private_certreq_payload_t *this,payload_type_t type)
155 {
156 this->next_payload = type;
157 }
158
159 /**
160 * Implementation of payload_t.get_length.
161 */
162 static size_t get_length(private_certreq_payload_t *this)
163 {
164 return this->payload_length;
165 }
166
167 /**
168 * Implementation of certreq_payload_t.set_cert_encoding.
169 */
170 static void set_cert_encoding (private_certreq_payload_t *this, cert_encoding_t encoding)
171 {
172 this->cert_encoding = encoding;
173 }
174
175 /**
176 * Implementation of certreq_payload_t.get_cert_encoding.
177 */
178 static cert_encoding_t get_cert_encoding (private_certreq_payload_t *this)
179 {
180 return (this->cert_encoding);
181 }
182
183 /**
184 * Implementation of certreq_payload_t.set_data.
185 */
186 static void set_data (private_certreq_payload_t *this, chunk_t data)
187 {
188 if (this->certreq_data.ptr != NULL)
189 {
190 chunk_free(&(this->certreq_data));
191 }
192 this->certreq_data.ptr = clalloc(data.ptr,data.len);
193 this->certreq_data.len = data.len;
194 this->payload_length = CERTREQ_PAYLOAD_HEADER_LENGTH + this->certreq_data.len;
195 }
196
197 /**
198 * Implementation of certreq_payload_t.get_data.
199 */
200 static chunk_t get_data (private_certreq_payload_t *this)
201 {
202 return (this->certreq_data);
203 }
204
205 /**
206 * Implementation of certreq_payload_t.get_data_clone.
207 */
208 static chunk_t get_data_clone (private_certreq_payload_t *this)
209 {
210 chunk_t cloned_data;
211 if (this->certreq_data.ptr == NULL)
212 {
213 return (this->certreq_data);
214 }
215 cloned_data.ptr = clalloc(this->certreq_data.ptr,this->certreq_data.len);
216 cloned_data.len = this->certreq_data.len;
217 return cloned_data;
218 }
219
220 /**
221 * Implementation of payload_t.destroy and certreq_payload_t.destroy.
222 */
223 static void destroy(private_certreq_payload_t *this)
224 {
225 if (this->certreq_data.ptr != NULL)
226 {
227 chunk_free(&(this->certreq_data));
228 }
229
230 free(this);
231 }
232
233 /*
234 * Described in header
235 */
236 certreq_payload_t *certreq_payload_create()
237 {
238 private_certreq_payload_t *this = malloc_thing(private_certreq_payload_t);
239
240 /* interface functions */
241 this->public.payload_interface.verify = (status_t (*) (payload_t*))verify;
242 this->public.payload_interface.get_encoding_rules = (void (*) (payload_t*,encoding_rule_t**,size_t*))get_encoding_rules;
243 this->public.payload_interface.get_length = (size_t (*) (payload_t*))get_length;
244 this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t*))get_next_type;
245 this->public.payload_interface.set_next_type = (void (*) (payload_t*,payload_type_t))set_next_type;
246 this->public.payload_interface.get_type = (payload_type_t (*) (payload_t*))get_payload_type;
247 this->public.payload_interface.destroy = (void (*) (payload_t*))destroy;
248
249 /* public functions */
250 this->public.destroy = (void (*) (certreq_payload_t*)) destroy;
251 this->public.set_cert_encoding = (void (*) (certreq_payload_t*,cert_encoding_t))set_cert_encoding;
252 this->public.get_cert_encoding = (cert_encoding_t (*) (certreq_payload_t*))get_cert_encoding;
253 this->public.set_data = (void (*) (certreq_payload_t*,chunk_t))set_data;
254 this->public.get_data_clone = (chunk_t (*) (certreq_payload_t*))get_data_clone;
255 this->public.get_data = (chunk_t (*) (certreq_payload_t*))get_data;
256
257 /* private variables */
258 this->critical = FALSE;
259 this->next_payload = NO_PAYLOAD;
260 this->payload_length =CERTREQ_PAYLOAD_HEADER_LENGTH;
261 this->certreq_data = CHUNK_INITIALIZER;
262
263 return (&(this->public));
264 }
265
266 /*
267 * Described in header
268 */
269 certreq_payload_t *certreq_payload_create_from_cacert(identification_t *id)
270 {
271 x509_t *cacert = charon->credentials->get_ca_certificate(charon->credentials, id);
272 rsa_public_key_t *pubkey = cacert->get_public_key(cacert);
273 chunk_t keyid = pubkey->get_keyid(pubkey);
274
275 certreq_payload_t *this = certreq_payload_create();
276
277 DBG1(DBG_IKE, "request certificate issued by '%D'", id);
278 DBG2(DBG_IKE, " with keyid %#B", &keyid);
279
280 this->set_cert_encoding(this, CERT_X509_SIGNATURE);
281 this->set_data(this, keyid);
282 return this;
283 }
284
285 /*
286 * Described in header
287 */
288 certreq_payload_t *certreq_payload_create_from_cacerts(void)
289 {
290 certreq_payload_t *this;
291 chunk_t keyids;
292 u_char *pos;
293 x509_t *cacert;
294
295 iterator_t *iterator = charon->credentials->create_cacert_iterator(charon->credentials);
296 int count = iterator->get_count(iterator);
297
298 if (count == 0)
299 return NULL;
300
301 this = certreq_payload_create();
302 keyids = chunk_alloc(count * HASH_SIZE_SHA1);
303 pos = keyids.ptr;
304
305 while (iterator->iterate(iterator, (void**)&cacert))
306 {
307 rsa_public_key_t *pubkey = cacert->get_public_key(cacert);
308 chunk_t keyid = pubkey->get_keyid(pubkey);
309
310 DBG1(DBG_IKE, "request certificate issued by '%D'", cacert->get_subject(cacert));
311 DBG2(DBG_IKE, " with keyid %#B", &keyid);
312 memcpy(pos, keyid.ptr, keyid.len);
313 pos += HASH_SIZE_SHA1;
314 }
315 iterator->destroy(iterator);
316
317 this->set_cert_encoding(this, CERT_X509_SIGNATURE);
318 this->set_data(this, keyids);
319 free(keyids.ptr);
320 return this;
321 }