On Tue, Jul 08, 2014 at 09:11:44AM +1200, Matt Grant wrote: > Hi! > > You should be able to identify parts of the functionality - like the > config file parser, and then there will other bits in the X509 code, to > do with verifications, and subject Alt-name parsing.
I'm not sure we are talking about the same thing here. I've attached the patch for reference and clarity. > Have to remember that IPv6 address can be written different ways and in > binary be the same thing. Use the getaddrinfo() function to convert to > binary for comparison. Not applicable. IPv6 addresses in SubjectAlt seem to be always 16 bytes. At least for certificates created with OpenSSL. There is no other way to differentiate between IPv4 and IPv6 except for IP address length in certificate. Anyway, if for some reason an address is not 16-bytes (IPv6) or 4 bytes (IPv4), it just defaults back to its previous functionality - failure parsing a given record. Comparisons are done by function that calls the modified function (it uses getaddrinfo). There is no patches required anywhere else except to the X509 parser that does not handle IPv6 IPADDR. Yes, I'm using IPv6 literal addresses in certificates, hence my interest in getting it working (so I don't have to patch manually!). - Adam -- Adam Majer [email protected]
Index: ipsec-tools-0.8.1/src/racoon/crypto_openssl.c
===================================================================
--- ipsec-tools-0.8.1.orig/src/racoon/crypto_openssl.c 2012-12-24
08:50:39.000000000 -0600
+++ ipsec-tools-0.8.1/src/racoon/crypto_openssl.c 2014-02-10
12:19:43.072038693 -0600
@@ -601,26 +601,47 @@
/* read IP address */
else if (gen->type == GEN_IPADD)
{
- unsigned char p[5], *ip;
- ip = p;
-
- /* only support IPv4 */
- if (gen->d.ip->length != 4)
- goto end;
-
- /* convert Octet String to String
- * XXX ???????
- */
- /*i2d_ASN1_OCTET_STRING(gen->d.ip,&ip);*/
- ip = gen->d.ip->data;
-
- /* XXX Magic, enough for an IPv4 address
- */
- *altname = racoon_malloc(20);
- if (!*altname)
+ switch (gen->d.iPAddress->length) {
+ case 4: /* IPv4 */
+ *altname = racoon_malloc(4*3 + 3 + 1); /* digits +
decimals + null */
+ if (!*altname)
+ goto end;
+
+ snprintf(*altname, 12+3+1, "%u.%u.%u.%u",
+ (unsigned)gen->d.iPAddress->data[0],
+ (unsigned)gen->d.iPAddress->data[1],
+ (unsigned)gen->d.iPAddress->data[2],
+ (unsigned)gen->d.iPAddress->data[3]);
+ break;
+ case 16: { /* IPv6 */
+ int i;
+
+ *altname = racoon_malloc(16*2 + 7 + 1); /* digits +
colons + null */
+ if (!*altname)
+ goto end;
+
+ /* Make NULL terminated IPv6 address */
+ for (i=0; i<16; ++i) {
+ int pos = i*2 + i/2;
+
+ if (i>0 && i%2==0)
+ (*altname)[pos-1] = ':';
+
+ snprintf(*altname + pos, 3, "%02x",
+ (unsigned)gen->d.iPAddress->data[i]);
+
+ }
+ plog(LLV_INFO, LOCATION, NULL,
+ "Remote X509 IPv6 addr: %s", *altname);
+ break;
+ }
+ default:
+ plog(LLV_ERROR, LOCATION, NULL,
+ "Unknown IP address length: %u octects.",
+ gen->d.iPAddress->length);
goto end;
-
- sprintf(*altname, "%u.%u.%u.%u", ip[0], ip[1], ip[2], ip[3]);
+ }
+
*type = gen->type;
error = 0;
}
signature.asc
Description: Digital signature
