Work in progress

checkin of new protocol X.509 Authentication Framework
This new protocol is not linked yet to ethereal or yet used since it needs other support protocols and massaging before it can be used.



svn path=/trunk/; revision=11428

5 files changed, 456 insertions, 0 deletions

diff --git a/asn1/x509af/AuthenticationFramework.asn b/asn1/x509af/AuthenticationFramework.asn
new file mode 100755
index 0000000000..0e1e89f0c6
--- /dev/null
+++ b/asn1/x509af/AuthenticationFramework.asn
@@ -0,0 +1,271 @@
+-- Module AuthenticationFramework (X.509:08/1997)

+

+AuthenticationFramework {joint-iso-itu-t ds(5) module(1)

+  authenticationFramework(7) 3} DEFINITIONS ::=

+BEGIN

+

+--  EXPORTS All 

+--  The types and values defined in this module are exported for use in the other ASN.1 modules contained

+--  within the Directory Specifications, and for the use of other applications which will use them to access

+--  Directory services. Other applications may use them for their own purposes, but this will not constrain

+--  extensions and modifications needed to maintain or improve the Directory service.

+IMPORTS

+  id-at, id-mr, informationFramework, upperBounds, selectedAttributeTypes,

+    basicAccessControl, certificateExtensions

+    FROM UsefulDefinitions {joint-iso-itu-t ds(5) module(1)

+      usefulDefinitions(0) 3}

+  Name, ATTRIBUTE, AttributeType, MATCHING-RULE, Attribute

+    FROM InformationFramework informationFramework

+  ub-user-password

+    FROM UpperBounds upperBounds

+  AuthenticationLevel

+    FROM BasicAccessControl basicAccessControl

+  UniqueIdentifier, octetStringMatch

+    FROM SelectedAttributeTypes selectedAttributeTypes

+  certificateExactMatch, certificatePairExactMatch, certificateListExactMatch,

+    GeneralNames

+    FROM CertificateExtensions certificateExtensions;

+

+--  basic certificate definition

+Certificate ::= SEQUENCE {

+  signedCertificate SEQUENCE {

+               version                  [0]  Version DEFAULT v1,

+               serialNumber             CertificateSerialNumber,

+               signature                AlgorithmIdentifier,

+               issuer                   Name,

+               validity                 Validity,

+               subject                  Name,

+               subjectPublicKeyInfo     SubjectPublicKeyInfo,

+               issuerUniqueIdentifier   [1] IMPLICIT UniqueIdentifier OPTIONAL,

+               --  if present, version must be v2 or v3

+               subjectUniqueIdentifier  [2] IMPLICIT UniqueIdentifier OPTIONAL,

+               --  if present, version must be v2 or v3

+               extensions               [3]  Extensions OPTIONAL

+               --  If present, version must be v3 -- },

+  algorithmIdentifier  AlgorithmIdentifier,

+  encrypted            BIT STRING

+}

+

+Version ::= INTEGER {v1(0), v2(1), v3(2)}

+

+CertificateSerialNumber ::= INTEGER

+

+-- Can not be handled by compiler. Handimplemented in the template

+AlgorithmIdentifier ::= SEQUENCE {

+--  algorithm   ALGORITHM.&id({SupportedAlgorithms}),

+--  parameters  ALGORITHM.&Type({SupportedAlgorithms}{@algorithm}) OPTIONAL

+}

+

+--	Definition of the following information object set is deferred, perhaps to standardized

+--	profiles or to protocol implementation conformance statements. The set is required to

+--	specify a table constraint on the parameters component of AlgorithmIdentifier.

+--SupportedAlgorithms ALGORITHM ::=

+--{...}

+

+Validity ::= SEQUENCE {notBefore  Time,

+                       notAfter   Time

+}

+

+SubjectPublicKeyInfo ::= SEQUENCE {

+  algorithm         AlgorithmIdentifier,

+  subjectPublicKey  BIT STRING

+}

+

+Time ::= CHOICE {utcTime          UTCTime,

+                 generalizedTime  GeneralizedTime

+}

+

+Extensions ::= SEQUENCE OF Extension

+

+--  For those extensions where ordering of individual extensions within the SEQUENCE is significant, the

+--  specification of those individual extensions shall include the rules for the significance of the order therein

+Extension ::= SEQUENCE {

+--  extnId     EXTENSION.&id({ExtensionSet}),

+  critical   BOOLEAN DEFAULT FALSE,

+  extnValue  OCTET STRING--  contains a DER encoding of a value of type &ExtnType

+--  for the extension object identified by extnId 

+}

+

+--ExtensionSet EXTENSION ::=

+--  {...}

+

+--EXTENSION ::= CLASS {&id        OBJECT IDENTIFIER UNIQUE,

+--                     &ExtnType  

+--}WITH SYNTAX {SYNTAX &ExtnType

+--              IDENTIFIED BY &id

+--}

+

+--  other certificate constructs

+Certificates ::= SEQUENCE {

+  userCertificate    Certificate,

+  certificationPath  ForwardCertificationPath OPTIONAL

+}

+

+ForwardCertificationPath ::= SEQUENCE OF CrossCertificates

+

+CrossCertificates ::= SET OF Certificate

+

+CertificationPath ::= SEQUENCE {

+  userCertificate    Certificate,

+  theCACertificates  SEQUENCE OF CertificatePair OPTIONAL

+}

+

+CertificatePair ::= SEQUENCE {

+  issuedByThisCA  [0]  Certificate OPTIONAL,

+  issuedToThisCA  [1]  Certificate OPTIONAL

+  --  at least one of the pair shall be present 

+}

+

+--  Certificate Revocation List (CRL)

+CertificateList ::= SEQUENCE {

+    signedCertificateList SEQUENCE {

+               version              Version OPTIONAL,

+               --  if present, version must be v2

+               signature            AlgorithmIdentifier,

+               issuer               Name,

+               thisUpdate           Time,

+               nextUpdate           Time OPTIONAL,

+               revokedCertificates

+                 SEQUENCE OF

+                   SEQUENCE {userCertificate     CertificateSerialNumber,

+                             revocationDate      Time,

+                             crlEntryExtensions  Extensions OPTIONAL} OPTIONAL,

+               crlExtensions        [0]  Extensions OPTIONAL},

+  algorithmIdentifier  AlgorithmIdentifier,

+  encrypted            BIT STRING

+}

+

+--  attribute certificate

+AttributeCertificationPath ::= SEQUENCE {

+  attributeCertificate  AttributeCertificate,

+  acPath                SEQUENCE OF ACPathData OPTIONAL

+}

+

+ACPathData ::= SEQUENCE {

+  certificate           [0]  Certificate OPTIONAL,

+  attributeCertificate  [1]  AttributeCertificate OPTIONAL

+}

+

+--attributeCertificate ATTRIBUTE ::= {

+--  WITH SYNTAX             AttributeCertificate

+--  EQUALITY MATCHING RULE  attributeCertificateMatch

+--  ID                      id-at-attributeCertificate

+--}

+

+AttributeCertificate ::= SEQUENCE {

+  signedAttributeCertificateInfo AttributeCertificateInfo,

+  algorithmIdentifier  AlgorithmIdentifier,

+  encrypted            BIT STRING

+}

+

+AttributeCertificateInfo ::= SEQUENCE {

+  version                Version DEFAULT v1,

+  subject

+    CHOICE {baseCertificateID  [0]  IssuerSerial,

+            subjectName        [1]  GeneralNames

+           },

+  issuer                 GeneralNames,

+  signature              AlgorithmIdentifier,

+  serialNumber           CertificateSerialNumber,

+  attCertValidityPeriod  AttCertValidityPeriod,

+  attributes             SEQUENCE OF Attribute,

+  issuerUniqueID         UniqueIdentifier OPTIONAL,

+  extensions             Extensions OPTIONAL

+}

+

+IssuerSerial ::= SEQUENCE {

+  issuer     GeneralNames,

+  serial     CertificateSerialNumber,

+  issuerUID  UniqueIdentifier OPTIONAL

+}

+

+AttCertValidityPeriod ::= SEQUENCE {

+  notBeforeTime  GeneralizedTime,

+  notAfterTime   GeneralizedTime

+}

+

+--attributeCertificateMatch MATCHING-RULE ::= {

+--  SYNTAX  AttributeCertificateAssertion

+--  ID      id-mr-attributeCertificateMatch

+--}

+

+AttributeCertificateAssertion ::= SEQUENCE {

+  subject

+    [0]  CHOICE {baseCertificateID  [0]  IssuerSerial,

+                 subjectName        [1]  Name} OPTIONAL,

+  issuer           [1]  Name OPTIONAL,

+  attCertValidity  [2]  GeneralizedTime OPTIONAL,

+  attType          [3]  SET OF AttributeType OPTIONAL

+}

+

+--  At least one component of the sequence must be present

+--  attribute types 

+--userPassword ATTRIBUTE ::= {

+--  WITH SYNTAX             OCTET STRING(SIZE (0..ub-user-password))

+--  EQUALITY MATCHING RULE  octetStringMatch

+--  ID                      id-at-userPassword

+--}

+

+--userCertificate ATTRIBUTE ::= {

+--  WITH SYNTAX             Certificate

+--  EQUALITY MATCHING RULE  certificateExactMatch

+--  ID                      id-at-userCertificate

+--}

+

+--cACertificate ATTRIBUTE ::= {

+--  WITH SYNTAX             Certificate

+--  EQUALITY MATCHING RULE  certificateExactMatch

+--  ID                      id-at-cAcertificate

+--}

+

+--crossCertificatePair ATTRIBUTE ::= {

+--  WITH SYNTAX             CertificatePair

+--  EQUALITY MATCHING RULE  certificatePairExactMatch

+--  ID                      id-at-crossCertificatePair

+--}

+

+--authorityRevocationList ATTRIBUTE ::= {

+--  WITH SYNTAX             CertificateList

+--  EQUALITY MATCHING RULE  certificateListExactMatch

+--  ID                      id-at-authorityRevocationList

+--}

+

+--certificateRevocationList ATTRIBUTE ::= {

+--  WITH SYNTAX             CertificateList

+--  EQUALITY MATCHING RULE  certificateListExactMatch

+--  ID                      id-at-certificateRevocationList

+--}

+

+--attributeCertificateRevocationList ATTRIBUTE ::= {

+--  WITH SYNTAX  CertificateList

+--  ID           id-at-attributeCertificateRevocationList

+--}

+

+--  information object classes 

+--ALGORITHM ::= TYPE-IDENTIFIER

+

+

+--  object identifier assignments 

+--id-at-userPassword OBJECT IDENTIFIER ::=

+--  {id-at 35}

+

+--id-at-userCertificate OBJECT IDENTIFIER ::= {id-at 36}

+

+--id-at-cAcertificate OBJECT IDENTIFIER ::= {id-at 37}

+

+--id-at-authorityRevocationList OBJECT IDENTIFIER ::= {id-at 38}

+

+--id-at-certificateRevocationList OBJECT IDENTIFIER ::= {id-at 39}

+

+--id-at-crossCertificatePair OBJECT IDENTIFIER ::= {id-at 40}

+

+--id-at-attributeCertificate OBJECT IDENTIFIER ::= {id-at 58}

+

+--id-at-attributeCertificateRevocationList OBJECT IDENTIFIER ::= {id-at 59}

+

+--id-mr-attributeCertificateMatch OBJECT IDENTIFIER ::= {id-mr 42}

+

+END

+

+-- Generated by Asnp, the ASN.1 pretty-printer of France Telecom R&D

+

diff --git a/asn1/x509af/packet-x509af-template.c b/asn1/x509af/packet-x509af-template.c
new file mode 100644
index 0000000000..c7423c169d
--- /dev/null
+++ b/asn1/x509af/packet-x509af-template.c
@@ -0,0 +1,108 @@
+/* packet-x509af.c
+ * Routines for X.509 Authentication Framework packet dissection
+ *
+ * $Id: packet-x509af-template.c,v 1.2 2004/05/25 21:07:43 guy Exp $
+ *
+ * Ethereal - Network traffic analyzer
+ * By Gerald Combs <gerald@ethereal.com>
+ * Copyright 1998 Gerald Combs
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <glib.h>
+#include <epan/packet.h>
+#include <epan/conversation.h>
+
+#include <stdio.h>
+#include <string.h>
+
+#include "packet-ber.h"
+#include "packet-x509af.h"
+#include "packet-x509ce.h"
+#include "packet-x509if.h"
+
+#define PNAME  "X.509 Authentication Framework"
+#define PSNAME "X509AF"
+#define PFNAME "x509af"
+
+/* Initialize the protocol and registered fields */
+int proto_x509af = -1;
+int hf_x509af_algorithm_id = -1;
+#include "packet-x509af-hf.c"
+
+/* Initialize the subtree pointers */
+#include "packet-x509af-ett.c"
+
+
+static int dissect_hf_x509af_algorithm_id(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset,
+                                         hf_x509af_algorithm_id, NULL);
+  return offset;
+}
+
+/* Algorithm Identifier can not yet be handled by the compiler */
+static ber_sequence AlgorithmIdentifier_sequence[] = {
+  { BER_CLASS_UNI, BER_UNI_TAG_OID, BER_FLAGS_NOOWNTAG, dissect_hf_x509af_algorithm_id },
+/*QQQ for the Type we need compiler support for ANY (==FT_BYTES) */
+  { 0, 0, 0, NULL }
+};
+
+int
+dissect_x509af_AlgorithmIdentifier(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset,
+                                AlgorithmIdentifier_sequence, hf_index, ett_x509af_AlgorithmIdentifier);
+
+  return offset;
+}
+
+#include "packet-x509af-fn.c"
+
+
+/*--- proto_register_x509af ----------------------------------------------*/
+void proto_register_x509af(void) {
+
+  /* List of fields */
+  static hf_register_info hf[] = {
+    { &hf_x509af_algorithm_id,
+      { "Algorithm Id", "x509af.algorithm.id",
+        FT_STRING, BASE_NONE, NULL, 0,
+        "Algorithm Id", HFILL }},
+#include "packet-x509af-hfarr.c"
+  };
+
+  /* List of subtrees */
+  static gint *ett[] = {
+#include "packet-x509af-ettarr.c"
+  };
+
+  /* Register protocol */
+  proto_x509af = proto_register_protocol(PNAME, PSNAME, PFNAME);
+
+  /* Register fields and subtrees */
+  proto_register_field_array(proto_x509af, hf, array_length(hf));
+  proto_register_subtree_array(ett, array_length(ett));
+
+}
+
+
+/*--- proto_reg_handoff_x509af -------------------------------------------*/
+void proto_reg_handoff_x509af(void) {
+}
+
diff --git a/asn1/x509af/packet-x509af-template.h b/asn1/x509af/packet-x509af-template.h
new file mode 100644
index 0000000000..52ec3c91ea
--- /dev/null
+++ b/asn1/x509af/packet-x509af-template.h
@@ -0,0 +1,33 @@
+/* packet-x509af.h
+ * Routines for X.509 Authentication Framework packet dissection
+ *
+ * $Id: packet-x509af-template.h,v 1.1 2004/05/24 08:42:29 sahlberg Exp $
+ *
+ * Ethereal - Network traffic analyzer
+ * By Gerald Combs <gerald@ethereal.com>
+ * Copyright 1998 Gerald Combs
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#ifndef PACKET_X509AF_H
+#define PACKET_X509AF_H
+
+int dissect_x509af_AlgorithmIdentifier(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index);
+
+#include "packet-x509af-exp.h"
+
+#endif  /* PACKET_X509AF_H */
+
diff --git a/asn1/x509af/x509af.cnf b/asn1/x509af/x509af.cnf
new file mode 100644
index 0000000000..339719ba92
--- /dev/null
+++ b/asn1/x509af/x509af.cnf
@@ -0,0 +1,39 @@
+# x509.cnf

+# X509 conformation file

+

+# $Id: x509.cnf,v 1.2 2004/06/03 08:35:44 guy Exp $

+

+#.MODULE_IMPORT

+InformationFramework x509if

+CertificateExtensions x509ce

+SelectedAttributeTypes x509sat

+

+#.INCLUDE ../x509if/x509if_exp.cnf

+

+#.EXPORTS

+

+Certificate

+CertificateList

+CertificateSerialNumber

+AttributeCertificate

+

+#.NO_EMIT

+

+AlgorithmIdentifier

+

+#.TYPE_RENAME

+AttributeCertificateInfo/subject	InfoSubject

+AttributeCertificateAssertion/subject	AssertionSubject

+

+#.FIELD_RENAME

+AttributeCertificateInfo/subject info_subject

+AttributeCertificateAssertion/subject assertion_subject

+

+AttributeCertificateAssertion/issuer assertionIssuer

+

+AttributeCertificateInfo/subject/subjectName      infoSubjectName

+AttributeCertificateAssertion/subject/subjectName assertionSubjectName

+

+#.END

+

+

diff --git a/asn1/x509af/x509af_exp.cnf b/asn1/x509af/x509af_exp.cnf
new file mode 100644
index 0000000000..cc479cbc77
--- /dev/null
+++ b/asn1/x509af/x509af_exp.cnf
@@ -0,0 +1,5 @@
+

+#.IMPORT_TAG

+Certificate     BER_CLASS_UNI BER_UNI_TAG_SEQUENCE

+AlgorithmIdentifier BER_CLASS_UNI BER_UNI_TAG_SEQUENCE

+