constraints: Add support for IP address nameConstraints

diff --git a/src/libstrongswan/plugins/constraints/constraints_validator.c b/src/libstrongswan/plugins/constraints/constraints_validator.c
index 379bb40f7b9225a734e3422a1d61bdbf6ebdad37..b1f60fb156037aeb720ad2c66358deb858ab26fb 100644 (file)
--- a/src/libstrongswan/plugins/constraints/constraints_validator.c
+++ b/src/libstrongswan/plugins/constraints/constraints_validator.c
@@ -143,6 +143,26 @@ static bool dn_matches(identification_t *constraint, identification_t *id)
        return match;
 }
 
+/**
+ * Check if the given identity type matches the type of NameConstraint
+ */
+static bool type_matches(id_type_t constraint, id_type_t id)
+{
+       switch (constraint)
+       {
+               case ID_FQDN:
+               case ID_RFC822_ADDR:
+               case ID_DER_ASN1_DN:
+                       return constraint == id;
+               case ID_IPV4_ADDR_SUBNET:
+                       return id == ID_IPV4_ADDR;
+               case ID_IPV6_ADDR_SUBNET:
+                       return id == ID_IPV6_ADDR;
+               default:
+                       return FALSE;
+       }
+}
+
 /**
  * Check if a certificate matches to a NameConstraint
  */
@@ -168,7 +188,7 @@ static bool name_constraint_matches(identification_t *constraint,
        enumerator = x509->create_subjectAltName_enumerator(x509);
        while (enumerator->enumerate(enumerator, &id))
        {
-               if (id->get_type(id) == type)
+               if (type_matches(type, id->get_type(id)))
                {
                        switch (type)
                        {
@@ -181,6 +201,10 @@ static bool name_constraint_matches(identification_t *constraint,
                                case ID_DER_ASN1_DN:
                                        matches = dn_matches(constraint, id);
                                        break;
+                               case ID_IPV4_ADDR_SUBNET:
+                               case ID_IPV6_ADDR_SUBNET:
+                                       matches = id->matches(id, constraint);
+                                       break;
                                default:
                                        DBG1(DBG_CFG, "%N NameConstraint matching not implemented",
                                                 id_type_names, type);