/*
* Decode the CR payload of Phase 1.
*/
void
decode_cr(struct msg_digest *md, generalName_t **requested_ca)
{
struct payload_digest *p;
for (p = md->chain[ISAKMP_NEXT_CR]; p != NULL; p = p->next)
{
struct isakmp_cr *const cr = &p->payload.cr;
chunk_t ca_name;
ca_name.len = pbs_left(&p->pbs);
ca_name.ptr = (ca_name.len > 0)? p->pbs.cur : NULL;
DBG_cond_dump_chunk(DBG_PARSING, "CR", ca_name);
if (cr->isacr_type == CERT_X509_SIGNATURE)
{
if (ca_name.len > 0)
{
generalName_t *gn;
if (!is_asn1(ca_name))
continue;
gn = alloc_thing(generalName_t, "generalName");
clonetochunk(ca_name, ca_name.ptr,ca_name.len, "ca name");
gn->kind = GN_DIRECTORY_NAME;
gn->name = ca_name;
gn->next = *requested_ca;
*requested_ca = gn;
}
DBG(DBG_PARSING | DBG_CONTROL,
char buf[IDTOA_BUF];
dntoa_or_null(buf, IDTOA_BUF, ca_name, "%any");
DBG_log("requested CA: '%s'", buf);
)
}
else
loglog(RC_LOG_SERIOUS, "ignoring %s certificate request payload",
enum_show(&cert_type_names, cr->isacr_type));
}
stf_status
ikev2_verify_rsa_sha1(struct state *st
, enum phase1_role role
, unsigned char *idhash
, const struct pubkey_list *keys_from_dns
, const struct gw_info *gateways_from_dns
, pb_stream *sig_pbs)
{
struct pubkey_list *p, **pp;
struct connection *c = st->st_connection;
int pathlen;
pp = &pluto_pubkeys;
{
DBG(DBG_CONTROL,
char buf[IDTOA_BUF];
dntoa_or_null(buf, IDTOA_BUF, c->spd.that.ca, "%any");
DBG_log("ikev2 verify required CA is '%s'", buf));
}
{
time_t n;
n = 1438262454; /* Thu Jul 30 09:21:01 EDT 2015 in seconds */
list_certs(n);
}
for (p = pluto_pubkeys; p != NULL; p = *pp)
{
char keyname[IDTOA_BUF];
struct pubkey *key = p->key;
pp = &p->next;
idtoa(&key->id, keyname, IDTOA_BUF);
DBG_log("checking alg=%d == %d, keyid=%s same_id=%u\n"
, key->alg, PUBKEY_ALG_RSA
, keyname
, same_id(&st->ikev2.st_peer_id, &key->id));
if (key->alg == PUBKEY_ALG_RSA
&& same_id(&st->ikev2.st_peer_id, &key->id)
&& trusted_ca(key->issuer, c->spd.that.ca, &pathlen))
{
time_t tnow;
DBG(DBG_CONTROL,
char buf[IDTOA_BUF];
dntoa_or_null(buf, IDTOA_BUF, key->issuer, "%any");
DBG_log("key issuer CA is '%s'", buf));
/* check if found public key has expired */
time(&tnow);
if (key->until_time != UNDEFINED_TIME && key->until_time < tnow)
{
loglog(RC_LOG_SERIOUS,
"cached RSA public key has expired and has been deleted");
*pp = free_public_keyentry(p);
continue; /* continue with next public key */
}
return STF_OK;
}
}