44ef38d852ae4589934fa9da0fdba139f5458add
[strongswan.git] / src / libcharon / plugins / addrblock / addrblock_validator.c
1 /*
2 * Copyright (C) 2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 * Copyright (C) 2009 Andreas Steffen
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include "addrblock_validator.h"
19
20 #include <debug.h>
21 #include <credentials/certificates/x509.h>
22 #include <selectors/traffic_selector.h>
23
24 typedef struct private_addrblock_validator_t private_addrblock_validator_t;
25
26 /**
27 * Private data of an addrblock_validator_t object.
28 */
29 struct private_addrblock_validator_t {
30
31 /**
32 * Public addrblock_validator_t interface.
33 */
34 addrblock_validator_t public;
35 };
36
37 /**
38 * Do the addrblock check for two x509 plugins
39 */
40 static bool check_addrblock(x509_t *subject, x509_t *issuer)
41 {
42 bool subject_const, issuer_const, contained = TRUE;
43 enumerator_t *subject_enumerator, *issuer_enumerator;
44 traffic_selector_t *subject_ts, *issuer_ts;
45
46 subject_const = subject->get_flags(subject) & X509_IP_ADDR_BLOCKS;
47 issuer_const = issuer->get_flags(issuer) & X509_IP_ADDR_BLOCKS;
48
49 if (!subject_const && !issuer_const)
50 {
51 return TRUE;
52 }
53 if (!subject_const)
54 {
55 DBG1(DBG_CFG, "subject certficate lacks ipAddrBlocks extension");
56 return FALSE;
57 }
58 if (!issuer_const)
59 {
60 DBG1(DBG_CFG, "issuer certficate lacks ipAddrBlocks extension");
61 return FALSE;
62 }
63 subject_enumerator = subject->create_ipAddrBlock_enumerator(subject);
64 while (subject_enumerator->enumerate(subject_enumerator, &subject_ts))
65 {
66 contained = FALSE;
67
68 issuer_enumerator = issuer->create_ipAddrBlock_enumerator(issuer);
69 while (issuer_enumerator->enumerate(issuer_enumerator, &issuer_ts))
70 {
71 if (subject_ts->is_contained_in(subject_ts, issuer_ts))
72 {
73 DBG2(DBG_CFG, " subject address block %R is contained in "
74 "issuer address block %R", subject_ts, issuer_ts);
75 contained = TRUE;
76 break;
77 }
78 }
79 issuer_enumerator->destroy(issuer_enumerator);
80 if (!contained)
81 {
82 DBG1(DBG_CFG, "subject address block %R is not contained in any "
83 "issuer address block", subject_ts);
84 break;
85 }
86 }
87 subject_enumerator->destroy(subject_enumerator);
88 return contained;
89 }
90
91 METHOD(cert_validator_t, validate, bool,
92 private_addrblock_validator_t *this, certificate_t *subject,
93 certificate_t *issuer, bool online, int pathlen, auth_cfg_t *auth)
94 {
95 if (subject->get_type(subject) == CERT_X509 &&
96 issuer->get_type(issuer) == CERT_X509)
97 {
98 return check_addrblock((x509_t*)subject, (x509_t*)issuer);
99 }
100 return TRUE;
101 }
102
103 METHOD(addrblock_validator_t, destroy, void,
104 private_addrblock_validator_t *this)
105 {
106 free(this);
107 }
108
109 /**
110 * See header
111 */
112 addrblock_validator_t *addrblock_validator_create()
113 {
114 private_addrblock_validator_t *this;
115
116 INIT(this,
117 .public = {
118 .validator.validate = _validate,
119 .destroy = _destroy,
120 },
121 );
122
123 return &this->public;
124 }