1 /* $OpenBSD: cert.c,v 1.18 2001/06/05 05:59:42 niklas Exp $ */ 2 /* $EOM: cert.c,v 1.18 2000/09/28 12:53:27 niklas Exp $ */ 3 4 /* 5 * Copyright (c) 1998, 1999 Niels Provos. All rights reserved. 6 * Copyright (c) 1999, 2000 Niklas Hallqvist. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. All advertising materials mentioning features or use of this software 17 * must display the following acknowledgement: 18 * This product includes software developed by Ericsson Radio Systems. 19 * 4. The name of the author may not be used to endorse or promote products 20 * derived from this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 /* 35 * This code was written under funding by Ericsson Radio Systems. 36 */ 37 38 #include <sys/param.h> 39 #include <stdio.h> 40 #include <stdlib.h> 41 #include <string.h> 42 43 #include "sysdep.h" 44 45 #include "isakmp_num.h" 46 #include "log.h" 47 #include "cert.h" 48 49 #ifdef USE_X509 50 #include "x509.h" 51 #ifdef KAME 52 # include <openssl/ssl.h> 53 #else 54 # include <ssl/ssl.h> 55 #endif 56 #endif 57 58 #ifdef USE_KEYNOTE 59 #include "policy.h" 60 #endif 61 62 struct cert_handler cert_handler[] = { 63 #ifdef USE_X509 64 { 65 ISAKMP_CERTENC_X509_SIG, 66 x509_cert_init, x509_cert_get, x509_cert_validate, 67 x509_cert_insert, x509_cert_free, 68 x509_certreq_validate, x509_certreq_decode, x509_free_aca, 69 x509_cert_obtain, x509_cert_get_key, x509_cert_get_subjects, 70 x509_cert_dup, x509_serialize, x509_printable, x509_from_printable 71 }, 72 #endif 73 #ifdef USE_KEYNOTE 74 { 75 ISAKMP_CERTENC_KEYNOTE, 76 keynote_cert_init, keynote_cert_get, keynote_cert_validate, 77 keynote_cert_insert, keynote_cert_free, 78 keynote_certreq_validate, keynote_certreq_decode, keynote_free_aca, 79 keynote_cert_obtain, keynote_cert_get_key, keynote_cert_get_subjects, 80 keynote_cert_dup, keynote_serialize, keynote_printable, 81 keynote_from_printable 82 }, 83 #endif 84 }; 85 86 /* Initialize all certificate handlers */ 87 88 int 89 cert_init (void) 90 { 91 int i, err = 1; 92 93 for (i = 0; i < sizeof cert_handler / sizeof cert_handler[0]; i++) 94 if (cert_handler[i].cert_init && !(*cert_handler[i].cert_init) ()) 95 err = 0; 96 97 return err; 98 } 99 100 struct cert_handler * 101 cert_get (u_int16_t id) 102 { 103 int i; 104 105 for (i = 0; i < sizeof cert_handler / sizeof cert_handler[0]; i++) 106 if (id == cert_handler[i].id) 107 return &cert_handler[i]; 108 return 0; 109 } 110 111 /* 112 * Decode the certificate request of type TYPE contained in DATA extending 113 * DATALEN bytes. Return a certreq_aca structure which the caller is 114 * responsible for deallocating. 115 */ 116 struct certreq_aca * 117 certreq_decode (u_int16_t type, u_int8_t *data, u_int32_t datalen) 118 { 119 struct cert_handler *handler; 120 struct certreq_aca aca, *ret; 121 122 handler = cert_get (type); 123 if (!handler) 124 return 0; 125 126 aca.id = type; 127 aca.handler = handler; 128 129 if (datalen > 0) 130 { 131 aca.data = handler->certreq_decode (data, datalen); 132 if (!aca.data) 133 return 0; 134 } 135 else 136 aca.data = 0; 137 138 ret = malloc (sizeof aca); 139 if (!ret) 140 { 141 log_error ("certreq_decode: malloc (%d) failed", sizeof aca); 142 handler->free_aca (aca.data); 143 return 0; 144 } 145 146 memcpy (ret, &aca, sizeof aca); 147 148 return ret; 149 } 150 151 void 152 cert_free_subjects (int n, u_int8_t **id, u_int32_t *len) 153 { 154 int i; 155 156 for (i = 0; i < n; i++) 157 free (id[i]); 158 free (id); 159 free (len); 160 } 161