Added plugin stub for advanced X509 constraint checking
This commit is contained in:
Martin Willi
parent
0beb1d6fbb
commit
01d3038137
|
|
@ -79,6 +79,7 @@ ARG_DISBL_SET([gmp], [disable GNU MP (libgmp) based crypto implementa
|
|||
ARG_DISBL_SET([random], [disable RNG implementation on top of /dev/(u)random.])
|
||||
ARG_DISBL_SET([x509], [disable X509 certificate implementation plugin.])
|
||||
ARG_DISBL_SET([revocation], [disable X509 CRL/OCSP revocation check plugin.])
|
||||
ARG_DISBL_SET([constraints], [disable advanced X509 constraint checking plugin.])
|
||||
ARG_DISBL_SET([pubkey], [disable RAW public key support plugin.])
|
||||
ARG_DISBL_SET([pkcs1], [disable PKCS1 key decoding plugin.])
|
||||
ARG_DISBL_SET([pgp], [disable PGP key decoding plugin.])
|
||||
|
|
@ -720,6 +721,7 @@ ADD_PLUGIN([md5], [s libcharon pluto openac scepclient pki])
|
|||
ADD_PLUGIN([random], [s libcharon pluto openac scepclient pki scripts medsrv])
|
||||
ADD_PLUGIN([x509], [s libcharon pluto openac scepclient pki scripts])
|
||||
ADD_PLUGIN([revocation], [s libcharon])
|
||||
ADD_PLUGIN([constraints], [s libcharon])
|
||||
ADD_PLUGIN([pubkey], [s libcharon])
|
||||
ADD_PLUGIN([pkcs1], [s libcharon pluto openac scepclient pki scripts manager medsrv])
|
||||
ADD_PLUGIN([pgp], [s libcharon pluto])
|
||||
|
|
@ -822,6 +824,7 @@ AM_CONDITIONAL(USE_GMP, test x$gmp = xtrue)
|
|||
AM_CONDITIONAL(USE_RANDOM, test x$random = xtrue)
|
||||
AM_CONDITIONAL(USE_X509, test x$x509 = xtrue)
|
||||
AM_CONDITIONAL(USE_REVOCATION, test x$revocation = xtrue)
|
||||
AM_CONDITIONAL(USE_CONSTRAINTS, test x$constraints = xtrue)
|
||||
AM_CONDITIONAL(USE_PUBKEY, test x$pubkey = xtrue)
|
||||
AM_CONDITIONAL(USE_PKCS1, test x$pkcs1 = xtrue)
|
||||
AM_CONDITIONAL(USE_PGP, test x$pgp = xtrue)
|
||||
|
|
@ -968,6 +971,7 @@ AC_OUTPUT(
|
|||
src/libstrongswan/plugins/xcbc/Makefile
|
||||
src/libstrongswan/plugins/x509/Makefile
|
||||
src/libstrongswan/plugins/revocation/Makefile
|
||||
src/libstrongswan/plugins/constraints/Makefile
|
||||
src/libstrongswan/plugins/pubkey/Makefile
|
||||
src/libstrongswan/plugins/pkcs1/Makefile
|
||||
src/libstrongswan/plugins/pgp/Makefile
|
||||
|
|
|
|||
|
|
@ -233,6 +233,13 @@ if MONOLITHIC
|
|||
endif
|
||||
endif
|
||||
|
||||
if USE_CONSTRAINTS
|
||||
SUBDIRS += plugins/constraints
|
||||
if MONOLITHIC
|
||||
libstrongswan_la_LIBADD += plugins/constraints/libstrongswan-constraints.la
|
||||
endif
|
||||
endif
|
||||
|
||||
if USE_PUBKEY
|
||||
SUBDIRS += plugins/pubkey
|
||||
if MONOLITHIC
|
||||
|
|
|
|||
|
|
@ -0,0 +1,16 @@
|
|||
|
||||
INCLUDES = -I$(top_srcdir)/src/libstrongswan
|
||||
|
||||
AM_CFLAGS = -rdynamic
|
||||
|
||||
if MONOLITHIC
|
||||
noinst_LTLIBRARIES = libstrongswan-constraints.la
|
||||
else
|
||||
plugin_LTLIBRARIES = libstrongswan-constraints.la
|
||||
endif
|
||||
|
||||
libstrongswan_constraints_la_SOURCES = \
|
||||
constraints_plugin.h constraints_plugin.c \
|
||||
constraints_validator.h constraints_validator.c
|
||||
|
||||
libstrongswan_constraints_la_LDFLAGS = -module -avoid-version
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
/*
|
||||
* Copyright (C) 2010 Martin Willi
|
||||
* Copyright (C) 2010 revosec AG
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
#include "constraints_plugin.h"
|
||||
|
||||
#include <library.h>
|
||||
#include "constraints_validator.h"
|
||||
|
||||
typedef struct private_constraints_plugin_t private_constraints_plugin_t;
|
||||
|
||||
/**
|
||||
* private data of constraints_plugin
|
||||
*/
|
||||
struct private_constraints_plugin_t {
|
||||
|
||||
/**
|
||||
* public functions
|
||||
*/
|
||||
constraints_plugin_t public;
|
||||
|
||||
/**
|
||||
* Validator implementation instance.
|
||||
*/
|
||||
constraints_validator_t *validator;
|
||||
};
|
||||
|
||||
METHOD(plugin_t, destroy, void,
|
||||
private_constraints_plugin_t *this)
|
||||
{
|
||||
lib->credmgr->remove_validator(lib->credmgr, &this->validator->validator);
|
||||
this->validator->destroy(this->validator);
|
||||
free(this);
|
||||
}
|
||||
|
||||
/*
|
||||
* see header file
|
||||
*/
|
||||
plugin_t *constraints_plugin_create()
|
||||
{
|
||||
private_constraints_plugin_t *this;
|
||||
|
||||
INIT(this,
|
||||
.public = {
|
||||
.plugin = {
|
||||
.destroy = _destroy,
|
||||
},
|
||||
},
|
||||
.validator = constraints_validator_create(),
|
||||
);
|
||||
lib->credmgr->add_validator(lib->credmgr, &this->validator->validator);
|
||||
|
||||
return &this->public.plugin;
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
/*
|
||||
* Copyright (C) 2010 Martin Willi
|
||||
* Copyright (C) 2010 revosec AG
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @defgroup constraints constraints
|
||||
* @ingroup plugins
|
||||
*
|
||||
* @defgroup constraints_plugin constraints_plugin
|
||||
* @{ @ingroup constraints
|
||||
*/
|
||||
|
||||
#ifndef CONSTRAINTS_PLUGIN_H_
|
||||
#define CONSTRAINTS_PLUGIN_H_
|
||||
|
||||
#include <plugins/plugin.h>
|
||||
|
||||
typedef struct constraints_plugin_t constraints_plugin_t;
|
||||
|
||||
/**
|
||||
* Advanced X509 constraint checking.
|
||||
*/
|
||||
struct constraints_plugin_t {
|
||||
|
||||
/**
|
||||
* Implements plugin_t. interface.
|
||||
*/
|
||||
plugin_t plugin;
|
||||
};
|
||||
|
||||
#endif /** CONSTRAINTS_PLUGIN_H_ @}*/
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
/*
|
||||
* Copyright (C) 2010 Martin Willi
|
||||
* Copyright (C) 2010 revosec AG
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
#include "constraints_validator.h"
|
||||
|
||||
typedef struct private_constraints_validator_t private_constraints_validator_t;
|
||||
|
||||
/**
|
||||
* Private data of an constraints_validator_t object.
|
||||
*/
|
||||
struct private_constraints_validator_t {
|
||||
|
||||
/**
|
||||
* Public constraints_validator_t interface.
|
||||
*/
|
||||
constraints_validator_t public;
|
||||
};
|
||||
|
||||
METHOD(cert_validator_t, validate, bool,
|
||||
private_constraints_validator_t *this, certificate_t *subject,
|
||||
certificate_t *issuer, bool online, int pathlen, auth_cfg_t *auth)
|
||||
{
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
METHOD(constraints_validator_t, destroy, void,
|
||||
private_constraints_validator_t *this)
|
||||
{
|
||||
free(this);
|
||||
}
|
||||
|
||||
/**
|
||||
* See header
|
||||
*/
|
||||
constraints_validator_t *constraints_validator_create()
|
||||
{
|
||||
private_constraints_validator_t *this;
|
||||
|
||||
INIT(this,
|
||||
.public = {
|
||||
.validator.validate = _validate,
|
||||
.destroy = _destroy,
|
||||
},
|
||||
);
|
||||
|
||||
return &this->public;
|
||||
}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
/*
|
||||
* Copyright (C) 2010 Martin Willi
|
||||
* Copyright (C) 2010 revosec AG
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
* Free Software Foundation; either version 2 of the License, or (at your
|
||||
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful, but
|
||||
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* for more details.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @defgroup constraints_validator constraints_validator
|
||||
* @{ @ingroup constraints
|
||||
*/
|
||||
|
||||
#ifndef CONSTRAINTS_VALIDATOR_H_
|
||||
#define CONSTRAINTS_VALIDATOR_H_
|
||||
|
||||
#include <credentials/cert_validator.h>
|
||||
|
||||
typedef struct constraints_validator_t constraints_validator_t;
|
||||
|
||||
/**
|
||||
* Certificate validator doing advanced X509 constraint checking.
|
||||
*/
|
||||
struct constraints_validator_t {
|
||||
|
||||
/**
|
||||
* Implements cert_validator_t interface.
|
||||
*/
|
||||
cert_validator_t validator;
|
||||
|
||||
/**
|
||||
* Destroy a constraints_validator_t.
|
||||
*/
|
||||
void (*destroy)(constraints_validator_t *this);
|
||||
};
|
||||
|
||||
/**
|
||||
* Create a constraints_validator instance.
|
||||
*/
|
||||
constraints_validator_t *constraints_validator_create();
|
||||
|
||||
#endif /** CONSTRAINTS_VALIDATOR_H_ @}*/
|
||||
Loading…
Reference in New Issue