← Back to branch summary

~ubuntu-branches/ubuntu/precise/strongswan/precise

« back to all changes in this revision

Viewing changes to src/libcharon/plugins/addrblock/addrblock_validator.c

  • Committer: Bazaar Package Importer
  • Author(s): Bhavani Shankar
  • Date: 2010-10-18 10:19:52 UTC
  • mfrom: (6.1.9 sid)
  • Revision ID: james.westby@ubuntu.com-20101018101952-zqd04yd4jvls81mj
Tags: 4.4.1-5ubuntu1
* Merge from debian unstable. Remaining change
  - Build depend on libnm-glib-dev instead of libnm-glib-vpn-dev to
    match the network manager package naming in Ubuntu

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/libcharon/plugins/addrblock/addrblock_validator.c
 
1
/*
 
2
 * Copyright (C) 2010 Martin Willi
 
3
 * Copyright (C) 2010 revosec AG
 
4
 * Copyright (C) 2009 Andreas Steffen
 
5
 * Hochschule fuer Technik Rapperswil
 
6
 *
 
7
 * This program is free software; you can redistribute it and/or modify it
 
8
 * under the terms of the GNU General Public License as published by the
 
9
 * Free Software Foundation; either version 2 of the License, or (at your
 
10
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 
11
 *
 
12
 * This program is distributed in the hope that it will be useful, but
 
13
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 
14
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 
15
 * for more details.
 
16
 */
 
17
 
 
18
#include "addrblock_validator.h"
 
19
 
 
20
#include <debug.h>
 
21
#include <credentials/certificates/x509.h>
 
22
#include <selectors/traffic_selector.h>
 
23
 
 
24
typedef struct private_addrblock_validator_t private_addrblock_validator_t;
 
25
 
 
26
/**
 
27
 * Private data of an addrblock_validator_t object.
 
28
 */
 
29
struct private_addrblock_validator_t {
 
30
 
 
31
        /**
 
32
         * Public addrblock_validator_t interface.
 
33
         */
 
34
        addrblock_validator_t public;
 
35
};
 
36
 
 
37
/**
 
38
 * Do the addrblock check for two x509 plugins
 
39
 */
 
40
static bool check_addrblock(x509_t *subject, x509_t *issuer)
 
41
{
 
42
        bool subject_const, issuer_const, contained = TRUE;
 
43
        enumerator_t *subject_enumerator, *issuer_enumerator;
 
44
        traffic_selector_t *subject_ts, *issuer_ts;
 
45
 
 
46
        subject_const = subject->get_flags(subject) & X509_IP_ADDR_BLOCKS;
 
47
        issuer_const = issuer->get_flags(issuer) & X509_IP_ADDR_BLOCKS;
 
48
 
 
49
        if (!subject_const && !issuer_const)
 
50
        {
 
51
                return TRUE;
 
52
        }
 
53
        if (!subject_const)
 
54
        {
 
55
                DBG1(DBG_CFG, "subject certficate lacks ipAddrBlocks extension");
 
56
                return FALSE;
 
57
        }
 
58
        if (!issuer_const)
 
59
        {
 
60
                DBG1(DBG_CFG, "issuer certficate lacks ipAddrBlocks extension");
 
61
                return FALSE;
 
62
        }
 
63
        subject_enumerator = subject->create_ipAddrBlock_enumerator(subject);
 
64
        while (subject_enumerator->enumerate(subject_enumerator, &subject_ts))
 
65
        {
 
66
                contained = FALSE;
 
67
 
 
68
                issuer_enumerator = issuer->create_ipAddrBlock_enumerator(issuer);
 
69
                while (issuer_enumerator->enumerate(issuer_enumerator, &issuer_ts))
 
70
                {
 
71
                        if (subject_ts->is_contained_in(subject_ts, issuer_ts))
 
72
                        {
 
73
                                DBG2(DBG_CFG, "  subject address block %R is contained in "
 
74
                                                          "issuer address block %R", subject_ts, issuer_ts);
 
75
                                contained = TRUE;
 
76
                                break;
 
77
                        }
 
78
                }
 
79
                issuer_enumerator->destroy(issuer_enumerator);
 
80
                if (!contained)
 
81
                {
 
82
                        DBG1(DBG_CFG, "subject address block %R is not contained in any "
 
83
                                                  "issuer address block", subject_ts);
 
84
                        break;
 
85
                }
 
86
        }
 
87
        subject_enumerator->destroy(subject_enumerator);
 
88
        return contained;
 
89
}
 
90
 
 
91
METHOD(cert_validator_t, validate, bool,
 
92
        private_addrblock_validator_t *this, certificate_t *subject,
 
93
        certificate_t *issuer, bool online, int pathlen, auth_cfg_t *auth)
 
94
{
 
95
        if (subject->get_type(subject) == CERT_X509 &&
 
96
                issuer->get_type(issuer) == CERT_X509)
 
97
        {
 
98
                return check_addrblock((x509_t*)subject, (x509_t*)issuer);
 
99
        }
 
100
        return TRUE;
 
101
}
 
102
 
 
103
METHOD(addrblock_validator_t, destroy, void,
 
104
        private_addrblock_validator_t *this)
 
105
{
 
106
        free(this);
 
107
}
 
108
 
 
109
/**
 
110
 * See header
 
111
 */
 
112
addrblock_validator_t *addrblock_validator_create()
 
113
{
 
114
        private_addrblock_validator_t *this;
 
115
 
 
116
        INIT(this,
 
117
                .public = {
 
118
                        .validator.validate = _validate,
 
119
                        .destroy = _destroy,
 
120
                },
 
121
        );
 
122
 
 
123
        return &this->public;
 
124
}