Merge lp:~fahad-aizaz/hipl/cert-config into lp:hipl

[Fahad Aizaz]

Configuration file code removal. Continuing the removal of configuration file code removal. Though this branch also contain some other changes in relation to 'hip_cert.conf' configuration file.

As decided by hipl core team, there is no more requirement of 'hip_cert.conf' file anymore to be part of HIPL codebase at all. So the following changes has been done.

1. The removal of runtime generation of 'hip_cert.conf' file.
2. The references to the functions that read, sign and verify certificates.

Note: here the references to the function from the codebase is removed. But the files containing the declarations and definitions are still not yet removed. I need your approval for doing that. (files: cert.h, cert.c). Please also note I looked in the codebase for anymore references towards the functions in these files and safely I can say I didn't find any. Therefore these files are feasible to be removed from the HIPL.

There exist some other helper functions (such as opening configuration file, read it section by section) being used in functions defined in 'cert.c' but are part of hipl core library. (lib/core/certtools.c/h). Though these functions are referenced from a test code, but also being used in the firewall code with PISA specific handling of SPKI certificates.

Any comment on keeping this code will also be helpful.

[Miika Komu (miika-iki)]

review: Approve

[Diego Biurrun (diego-biurrun)]

 review needs-fixing

On Sun, Feb 19, 2012 at 12:29:18PM +0000, Fahad Aizaz wrote:
>
> Configuration file code removal. Continuing the removal of configuration file code removal. Though this branch also contain some other changes in relation to 'hip_cert.conf' configuration file.
>
> As decided by hipl core team, there is no more requirement of 'hip_cert.conf' file anymore to be part of HIPL codebase at all. So the following changes has been done.
>
> 1. The removal of runtime generation of 'hip_cert.conf' file.
> 2. The references to the functions that read, sign and verify certificates.
>
> Note: here the references to the function from the codebase is removed. But the files containing the declarations and definitions are still not yet removed. I need your approval for doing that. (files: cert.h, cert.c). Please also note I looked in the codebase for anymore references towards the functions in these files and safely I can say I didn't find any. Therefore these files are feasible to be removed from the HIPL.
>
> There exist some other helper functions (such as opening configuration file, read it section by section) being used in functions defined in 'cert.c' but are part of hipl core library. (lib/core/certtools.c/h). Though these functions are referenced from a test code, but also being used in the firewall code with PISA specific handling of SPKI certificates.

I say nuke them all.

Diego

review: Needs Fixing

[lp:~fahad-aizaz/hipl/cert-config]

6288. By Fahad Aizaz on 2012-02-20

Certificate code for signing and verification removal.

As agreed, the certificate signing and verification code is no longer required.
And therefore is being removed from hipl codebase. With it any reference
to the headers are also removed.

6289. By Fahad Aizaz on 2012-02-20

Removing files that are no longer required from make.

6290. By Fahad Aizaz on 2012-02-20

Removing certificate related code.

The code was utilized by other library functions defined in the file
"certtools.c". Since "certtools.c" is no longer required thus these
functions were also redundant and therefore removed from the codebase.

6291. By Fahad Aizaz on 2012-02-20

Fixing Makefile to handle the removed code and let it compile properly.

6292. By Fahad Aizaz on 2012-02-20

Cosmetics: stylecheck changes that were found and fixed.

6293. By Fahad Aizaz on 2012-02-20

Adding, removing and fixing the redundant code.

This commit contains the files which contained headers of removed code files
having the certificate functionality which is no longer required.

Thus the headers were removed from the following files and also the
the redundant functions in case "hipfw.c" is removed.

6294. By Fahad Aizaz on 2012-02-20

Removing useless code.

The code that was related to reading, signing and verfication of
certificates is removed.

Starting from certtools.c/h which contains code for reading certificate
configuration file, reading it section by section, verifictaion etc
is removed.

certtools.c uses functions defined in builder.c; thus these functions
are also removed since they are no longer required.

hipfw/pisa.c/.h uses also functions from certtools.c and thus removed.
hipfw/pisa_cert.c/.h uses also functions from certtools.c and is removed.

certteststub and pisacert.c were the only code files generating and
testing certificates and thus are removed.

6295. By Fahad Aizaz on 2012-02-20

Missing file to be removed from Makefile

Unmerged revisions

6295. By Fahad Aizaz on 2012-02-20

Missing file to be removed from Makefile

6294. By Fahad Aizaz on 2012-02-20

Removing useless code.

The code that was related to reading, signing and verfication of
certificates is removed.

Starting from certtools.c/h which contains code for reading certificate
configuration file, reading it section by section, verifictaion etc
is removed.

certtools.c uses functions defined in builder.c; thus these functions
are also removed since they are no longer required.

hipfw/pisa.c/.h uses also functions from certtools.c and thus removed.
hipfw/pisa_cert.c/.h uses also functions from certtools.c and is removed.

certteststub and pisacert.c were the only code files generating and
testing certificates and thus are removed.

6293. By Fahad Aizaz on 2012-02-20

Adding, removing and fixing the redundant code.

This commit contains the files which contained headers of removed code files
having the certificate functionality which is no longer required.

Thus the headers were removed from the following files and also the
the redundant functions in case "hipfw.c" is removed.

6292. By Fahad Aizaz on 2012-02-20

Cosmetics: stylecheck changes that were found and fixed.

6291. By Fahad Aizaz on 2012-02-20

Fixing Makefile to handle the removed code and let it compile properly.

6290. By Fahad Aizaz on 2012-02-20

Removing certificate related code.

The code was utilized by other library functions defined in the file
"certtools.c". Since "certtools.c" is no longer required thus these
functions were also redundant and therefore removed from the codebase.

6289. By Fahad Aizaz on 2012-02-20

Removing files that are no longer required from make.

6288. By Fahad Aizaz on 2012-02-20

Certificate code for signing and verification removal.

As agreed, the certificate signing and verification code is no longer required.
And therefore is being removed from hipl codebase. With it any reference
to the headers are also removed.

6287. By Fahad Aizaz on 2012-02-19

The references for certificate sigining and verifications removal.

The references to the functions that are used to sign and verify
certificates are removed. (As they are no longer required)

Note: this change makes the files cert.c and cert.h and all the functions
declared and defined in these files redundant.

6286. By Fahad Aizaz on 2012-02-19

Removing configuration file generation code.

The cofiguration file 'hip_cert.conf' that is being generated at runtime
is removed from the hipl code base.

=== modified file 'Makefile.am'
--- Makefile.am	2012-02-13 11:20:22 +0000
+++ Makefile.am	2012-02-20 21:42:18 +0000
@@ -35,11 +35,9 @@
 EXTRA_DIST += $(wildcard $(addprefix $(srcdir)/tools/,*.cfg *.pl *.sh *.xml))
 EXTRA_DIST += $(wildcard $(addprefix $(srcdir)/hipfw/,*.cfg))
 EXTRA_DIST += $(HIPL_HEADER_LIST)
-EXTRA_DIST += hipd/pisa.c hipfw/pisa.c hipfw/pisa_cert.c
 
 ### user programs ###
 bin_PROGRAMS = test/auth_performance                                    \
-               test/certteststub                                        \
                test/hc_performance
 
 if HIP_PERFORMANCE
@@ -49,8 +47,7 @@
 
 ### superuser programs ###
 sbin_PROGRAMS = hipd/hipd                                               \
-                tools/hipconf                                           \
-                tools/pisacert
+                tools/hipconf
 
 if HIP_FIREWALL
 sbin_PROGRAMS += hipfw/hipfw
@@ -84,7 +81,6 @@
 ### source declarations ###
 
 test_auth_performance_SOURCES             = test/auth_performance.c
-test_certteststub_SOURCES                 = test/certteststub.c
 test_dh_performance_SOURCES               = test/dh_performance.c
 test_fw_port_bindings_performance_SOURCES = hipfw/file_buffer.c         \
                                             hipfw/line_parser.c         \
@@ -93,10 +89,8 @@
 test_hc_performance_SOURCES               = test/hc_performance.c
 
 tools_hipconf_SOURCES  = tools/hipconf.c
-tools_pisacert_SOURCES = tools/pisacert.c
 
 hipd_hipd_sources = hipd/accessor.c                                     \
-                    hipd/cert.c                                         \
                     hipd/close.c                                        \
                     hipd/configfilereader.c                             \
                     hipd/cookie.c                                       \
@@ -175,7 +169,6 @@
 
 lib_core_libhipcore_la_SOURCES = lib/core/builder.c                     \
                                  lib/core/capability.c                  \
-                                 lib/core/certtools.c                   \
                                  lib/core/conf.c                        \
                                  lib/core/crypto.c                      \
                                  lib/core/debug.c                       \
@@ -251,12 +244,10 @@
 test_check_lib_core_LDADD                = lib/core/libhipcore.la
 test_check_lib_tool_LDADD                = lib/core/libhipcore.la
 test_check_modules_midauth_LDADD         = lib/core/libhipcore.la
-test_certteststub_LDADD                  = lib/core/libhipcore.la
 test_dh_performance_LDADD                = lib/core/libhipcore.la
 test_fw_port_bindings_performance_LDADD  = lib/core/libhipcore.la
 test_hc_performance_LDADD                = lib/core/libhipcore.la
 tools_hipconf_LDADD                      = lib/core/libhipcore.la
-tools_pisacert_LDADD                     = lib/core/libhipcore.la
 
 ### dynamic library dependencies ###
 

=== removed file 'hipd/cert.c'
--- hipd/cert.c	2012-01-16 22:12:49 +0000
+++ hipd/cert.c	1970-01-01 00:00:00 +0000
@@ -1,1029 +0,0 @@
-/*
- * Copyright (c) 2010-2012 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- *
- * This file defines the certificate signing and verification
- * functions to use with HIP
- */
-
-#include <errno.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <arpa/inet.h>
-#include <openssl/conf.h>
-#include <openssl/dsa.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/rsa.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-
-#include "lib/core/builder.h"
-#include "lib/core/certtools.h"
-#include "lib/core/common.h"
-#include "lib/core/crypto.h"
-#include "lib/core/debug.h"
-#include "lib/core/ife.h"
-#include "lib/core/protodefs.h"
-#include "lib/core/straddr.h"
-#include "lib/tool/pk.h"
-#include "hidb.h"
-#include "cert.h"
-
-
-/****************************************************************************
- *
- * SPKI
- *
- ***************************************************************************/
-
-/**
- * Function that signs the cert sequence and creates the public key
- * sequence and the signature sequence
- *
- * @param msg points to the msg gotten from "client" that should
- *            contain HIP_PARAM_CERT_SPKI_INFO
- *
- * @return 0 if signature was created without errors, negative value
- *         is returned on errors
- */
-int hip_cert_spki_sign(struct hip_common *msg)
-{
-    int                              err = 0, sig_len = 0, algo = 0, t = 0;
-    const struct hip_cert_spki_info *p_cert;
-    struct hip_cert_spki_info       *cert;
-    struct hip_host_id              *host_id = NULL;
-    unsigned char                    sha_digest[SHA_DIGEST_LENGTH];
-    unsigned char                   *signature_b64 = NULL;
-    unsigned char                   *digest_b64    = NULL;
-    unsigned char                   *sha_retval;
-    uint8_t                         *signature = NULL;
-    DSA_SIG                         *dsa_sig   = NULL;
-
-    /* RSA needed variables */
-    RSA           *rsa   = NULL;
-    unsigned char *e_bin = NULL, *n_bin = NULL, *n_b64 = NULL;
-    char          *e_hex = NULL;
-
-    /* DSA needed variables */
-    DSA           *dsa   = NULL;
-    unsigned char *p_bin = NULL, *q_bin = NULL, *g_bin = NULL, *y_bin = NULL;
-    unsigned char *p_b64 = NULL, *q_b64 = NULL, *g_b64 = NULL, *y_b64 = NULL;
-
-    HIP_IFEL(!(cert = calloc(1, sizeof(struct hip_cert_spki_info))),
-             -1, "calloc for cert failed\n");
-    HIP_IFEL(!(p_cert = hip_get_param(msg, HIP_PARAM_CERT_SPKI_INFO)),
-             -1, "No cert_info struct found\n");
-    memcpy(cert, p_cert, sizeof(struct hip_cert_spki_info));
-
-    HIP_DEBUG_HIT("Getting keys for HIT", &cert->issuer_hit);
-
-    HIP_IFEL(hip_get_host_id_and_priv_key(&cert->issuer_hit,
-                                          HIP_ANY_ALGO,
-                                          &host_id,
-                                          (void **) &rsa),
-             -1, "Private key not found\n");
-
-    algo = host_id->rdata.algorithm;
-    if (algo == HIP_HI_DSA) {
-        dsa = (DSA *) rsa;
-    }
-
-    // Note: EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int dlen) (vintage SSLeay
-    //  code) is used to generate the different BASE64 representations. It requires an area of
-    //  ((dlen + 2) / 3 * 4 + 1) bytes - so, obviously larger than the size of the input - to be
-    //  available for its output (at location "t") - you have been warned.
-    digest_b64 = calloc(1, (SHA_DIGEST_LENGTH + 2) / 3 * 4 + 1);
-    HIP_IFEL(!digest_b64, -1, "calloc for digest_b64 failed\n");
-
-    /* build sha1 digest that will be signed */
-    HIP_IFEL(!(sha_retval = SHA1((unsigned char *) cert->cert, strlen(cert->cert), sha_digest)),
-             -1, "SHA1 error when creating digest.\n");
-
-    switch (algo) {
-    case HIP_HI_RSA:
-        sig_len = RSA_size(rsa);
-
-        signature = calloc(1, sig_len);
-        HIP_IFEL(!signature, -1, "calloc for signature failed\n");
-
-        signature_b64 = calloc(1, (sig_len + 2) / 3 * 4 + 1);
-        HIP_IFEL(!signature_b64, -1, "calloc for signature_b64 failed\n");
-
-        n_bin = calloc(1, BN_num_bytes(rsa->n));
-        HIP_IFEL(!n_bin, -1, "calloc for n_bin failed\n");
-
-        n_b64 = calloc(1, (BN_num_bytes(rsa->n) + 2) / 3 * 4 + 1);
-        HIP_IFEL(!n_b64, -1, "calloc for n_b64 failed\n");
-
-        e_bin = calloc(1, BN_num_bytes(rsa->e));
-        HIP_IFEL(!e_bin, -1, "calloc for e_bin failed\n");
-
-        /* RSA sign the digest */
-        err = RSA_sign(NID_sha1, sha_digest, SHA_DIGEST_LENGTH, signature,
-                       (unsigned int *) &sig_len, rsa);
-        HIP_IFEL((err = err == 0 ? -1 : 0), -1, "RSA_sign error\n");
-        break;
-    case HIP_HI_ECDSA:
-        HIP_DEBUG("CALL TO UNIMPLEMENTED ECDSA CASE\n");
-        HIP_OUT_ERR(-1, "Unknown algorithm\n");
-        break;
-    case HIP_HI_DSA:
-        p_bin = malloc(BN_num_bytes(dsa->p) + 1);
-        HIP_IFEL(!p_bin, -1, "Malloc for p_bin failed\n");
-
-        q_bin = malloc(BN_num_bytes(dsa->q) + 1);
-        HIP_IFEL(!q_bin, -1, "Malloc for q_bin failed\n");
-
-        g_bin = malloc(BN_num_bytes(dsa->g) + 1);
-        HIP_IFEL(!g_bin, -1, "Malloc for g_bin failed\n");
-
-        y_bin = malloc(BN_num_bytes(dsa->pub_key) + 1);
-        HIP_IFEL(!y_bin, -1, "Malloc for y_bin failed\n");
-
-        p_b64 = malloc(BN_num_bytes(dsa->p) + 20);
-        HIP_IFEL(!p_b64, -1, "Malloc for p_b64 failed\n");
-
-        q_b64 = malloc(BN_num_bytes(dsa->q) + 20);
-        HIP_IFEL(!q_b64, -1, "Malloc for q_b64 failed\n");
-
-        g_b64 = malloc(BN_num_bytes(dsa->g) + 20);
-        HIP_IFEL(!g_b64, -1, "Malloc for g_b64 failed\n");
-
-        y_b64 = malloc(BN_num_bytes(dsa->pub_key) + 20);
-        HIP_IFEL(!y_b64, -1, "Malloc for y_b64 failed\n");
-
-#define HIP_DSA_SIG_SIZE 41 /* T(1) + R(20) + S(20)  from RFC 2536 */
-        signature = calloc(1, HIP_DSA_SIG_SIZE);
-
-        t = BN_num_bytes(dsa->p);
-        t = (t - 64) / 8;
-        HIP_IFEL(t > 8, 1, "Illegal DSA key\n");
-
-        signature[0] = t;
-        dsa_sig      = DSA_do_sign(sha_digest, SHA_DIGEST_LENGTH, dsa);
-        bn2bin_safe(dsa_sig->r, &signature[1], DSA_PRIV);
-        bn2bin_safe(dsa_sig->s, &signature[1 + DSA_PRIV], DSA_PRIV);
-        sig_len = SHA_DIGEST_LENGTH + DSA_PRIV * 2;
-        break;
-    default:
-        HIP_OUT_ERR(-1, "Unknown algorithm for signing\n");
-    }
-
-    HIP_IFEL(!EVP_EncodeBlock(digest_b64, sha_digest, SHA_DIGEST_LENGTH),
-             -1, "Failed to encode digest_b64\n");
-    HIP_IFEL(!EVP_EncodeBlock(signature_b64, signature, sig_len),
-             -1, "Failed to encode signature_b64\n");
-
-    /* create (signature (hash sha1 |digest|)|signature|) */
-    sprintf(cert->signature, "(signature (hash sha1 |%s|)|%s|)",
-            digest_b64, signature_b64);
-
-    /* Create the public key sequence */
-    switch (algo) {
-    case HIP_HI_RSA:
-        /*
-         * RSA public-key
-         * draft-paajarvi-xml-spki-cert-00 section 3.1.1
-         *
-         * <!ELEMENT rsa-pubkey (rsa-e,rsa-n)>
-         * <!ELEMENT rsa-e (#PCDATA)>
-         * <!ELEMENT rsa-n (#PCDATA)>
-         */
-        HIP_IFEL(!BN_bn2bin(rsa->n, n_bin),
-                 -1,
-                 "Error in converting public exponent from BN to bin\n");
-
-        HIP_IFEL(!EVP_EncodeBlock(n_b64, n_bin, BN_num_bytes(rsa->n)),
-                 -1,
-                 "Failed to encode n_b64\n");
-
-        HIP_IFEL(!BN_bn2bin(rsa->e, e_bin),
-                 -1,
-                 "Error in converting public exponent from BN to bin\n");
-
-        e_hex = BN_bn2hex(rsa->e);
-
-        sprintf(cert->public_key, "(public_key (rsa-pkcs1-sha1 (e #%s#)(n |%s|)))",
-                e_hex,
-                n_b64);
-        break;
-    case HIP_HI_ECDSA:
-        HIP_DEBUG("CALL TO UNIMPLEMENTED ECDSA CASE\n");
-        HIP_OUT_ERR(-1, "Unknown algorithm for signing\n");
-        break;
-    case HIP_HI_DSA:
-        /*
-         * DSA public-key
-         * draft-paajarvi-xml-spki-cert-00 section 3.1.2
-         *
-         * <!ELEMENT dsa-pubkey (dsa-p,dsa-q,dsa-g,dsa-y)>
-         * <!ELEMENT dsa-p (#PCDATA)>
-         * <!ELEMENT dsa-q (#PCDATA)>
-         * <!ELEMENT dsa-g (#PCDATA)>
-         * <!ELEMENT dsa-y (#PCDATA)>
-         */
-        HIP_IFEL(!BN_bn2bin(dsa->p, p_bin), -1,
-                 "Error in converting public exponent from BN to bin\n");
-        HIP_IFEL(!EVP_EncodeBlock(p_b64, p_bin, BN_num_bytes(dsa->p)),
-                 -1, "Failed to encode p_b64\n");
-
-        HIP_IFEL(!BN_bn2bin(dsa->q, q_bin), -1,
-                 "Error in converting public exponent from BN to bin\n");
-        HIP_IFEL(!EVP_EncodeBlock(q_b64, q_bin, BN_num_bytes(dsa->q)),
-                 -1, "Failed to encode q_64");
-
-        HIP_IFEL(!(BN_bn2bin(dsa->g, g_bin)), -1,
-                 "Error in converting public exponent from BN to bin\n");
-        HIP_IFEL(!EVP_EncodeBlock(g_b64, g_bin, BN_num_bytes(dsa->g)),
-                 -1, "Failed to encode g_b64\n");
-
-        HIP_IFEL(!BN_bn2bin(dsa->pub_key, y_bin), -1,
-                 "Error in converting public exponent from BN to bin\n");
-        HIP_IFEL(!EVP_EncodeBlock(y_b64, y_bin, BN_num_bytes(dsa->pub_key)),
-                 -1, "Failed to encode y_b64\n");
-
-        sprintf(cert->public_key, "(public_key (dsa-pkcs1-sha1 (p |%s|)(q |%s|)"
-                                  "(g |%s|)(y |%s|)))",
-                p_b64, q_b64, g_b64, y_b64);
-        break;
-    default:
-        HIP_OUT_ERR(-1, "Unknown algorithm for public-key element\n");
-    }
-
-    /* Put the results into the msg back */
-    hip_msg_init(msg);
-
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_SPKI_SIGN, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_spki_info(msg, cert), -1,
-             "Failed to build cert_info\n");
-
-out_err:
-
-    /* free malloced memory */
-    free(digest_b64);
-    free(signature_b64);
-    free(signature);
-    free(host_id);
-
-    /* RSA pubkey */
-    free(e_bin);
-    free(n_bin);
-    /* encoded */
-    OPENSSL_free(e_hex);
-    free(n_b64);
-
-    /* DSA pubkey */
-    free(p_bin);
-    free(q_bin);
-    free(g_bin);
-    free(y_bin);
-    /* encoded */
-    free(p_b64);
-    free(q_b64);
-    free(g_b64);
-    free(y_b64);
-
-    DSA_SIG_free(dsa_sig);
-
-    free(cert);
-
-    return err;
-}
-
-/**
- * Function that verifies the signature in the given SPKI cert sent by
- * the "client"
- *
- * @param msg points to the msg gotten from "client" that contains a
- *            spki cert in CERT parameter
- *
- * @return 0 if signature matches, -1 if error or signature did NOT match
- */
-int hip_cert_spki_verify(struct hip_common *msg)
-{
-    int  err = 0, start = 0, stop = 0, evpret = 0, keylen = 0, algo = 0;
-    char buf[200];
-
-    unsigned char  sha_digest[21];
-    unsigned char *sha_retval;
-    unsigned char *signature_hash     = NULL;
-    unsigned char *signature_hash_b64 = NULL;
-    unsigned char *signature_b64      = NULL;
-
-    const struct hip_cert_spki_info *p_cert;
-    struct hip_cert_spki_info       *cert      = NULL;
-    unsigned char                   *signature = NULL;
-
-    /** RSA */
-    RSA           *rsa = NULL;
-    unsigned long  e_code;
-    char          *e_hex       = NULL;
-    unsigned char *modulus_b64 = NULL;
-    unsigned char *modulus     = NULL;
-
-    /** DSA */
-    DSA           *dsa     = NULL;
-    unsigned char *p_bin   = NULL, *q_bin = NULL, *g_bin = NULL, *y_bin = NULL;
-    unsigned char *p_b64   = NULL, *q_b64 = NULL, *g_b64 = NULL, *y_b64 = NULL;
-    DSA_SIG       *dsa_sig = NULL;
-
-    /* rules for regular expressions */
-
-    /*
-     * Rule to get the info if we are using DSA
-     */
-    char dsa_rule[] = "[d][s][a][-][p][k][c][s][1][-][s][h][a][1]";
-
-    /*
-     * Rule to get the info if we are using RSA
-     */
-    char rsa_rule[] = "[r][s][a][-][p][k][c][s][1][-][s][h][a][1]";
-
-    /*
-     * Rule to get DSA p
-     * Look for pattern "(p |" and stop when first "|"
-     * anything in base 64 is accepted inbetween
-     */
-    char p_rule[] = "[(][p][ ][|][[A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * Rule to get DSA q
-     * Look for pattern "(q |" and stop when first "|"
-     * anything in base 64 is accepted inbetween
-     */
-    char q_rule[] = "[(][q][ ][|][[A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * Rule to get DSA g
-     * Look for pattern "(g |" and stop when first "|"
-     * anything in base 64 is accepted inbetween
-     */
-    char g_rule[] = "[(][g][ ][|][[A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * Rule to get DSA y / pub_key
-     * Look for pattern "(y |" and stop when first "|"
-     * anything in base 64 is accepted inbetween
-     */
-    char y_rule[] = "[(][y][ ][|][[A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * rule to get the public exponent RSA
-     * Look for the part that says # and after that some hex blob and #
-     */
-    char e_rule[] = "[#][0-9A-Fa-f]*[#]";
-
-    /*
-     * rule to get the public modulus RSA
-     * Look for the part that starts with '|' and after that anything
-     * that is in base 64 char set and then '|' again
-     */
-    char n_rule[] = "[|][A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * rule to get the signature hash
-     * Look for the similar than the n_rule
-     */
-    char h_rule[] = "[|][A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * rule to get the signature
-     * Look for part that starts ")|" and base 64 blob after it
-     * and stops to '|' char remember to add and subtract 2 from
-     * the indexes below
-     */
-    char s_rule[] = "[)][|][A-Za-z0-9+/()#=-]*[|]";
-
-    cert = calloc(1, sizeof(struct hip_cert_spki_info));
-    HIP_IFEL(!cert, -1, "calloc for cert failed\n");
-
-    HIP_IFEL(!(p_cert = hip_get_param(msg, HIP_PARAM_CERT_SPKI_INFO)),
-             -1, "No cert_info struct found\n");
-    memcpy(cert, p_cert, sizeof(struct hip_cert_spki_info));
-
-    /* check the algo DSA or RSA  */
-    HIP_DEBUG("Verifying\nRunning regexps to identify algo\n");
-    start = stop = 0;
-    algo  = hip_cert_regex(dsa_rule, cert->public_key, &start, &stop);
-    if (algo != -1) {
-        HIP_DEBUG("Public-key is DSA\n");
-        algo = HIP_HI_DSA;
-        goto algo_check_done;
-    }
-    start = stop = 0;
-    algo  = hip_cert_regex(rsa_rule, cert->public_key, &start, &stop);
-    if (algo != -1) {
-        HIP_DEBUG("Public-key is RSA\n");
-        algo = HIP_HI_RSA;
-        goto algo_check_done;
-    }
-
-algo_check_done:
-    switch (algo) {
-    case HIP_HI_RSA:
-        /* malloc space for new rsa */
-        rsa = RSA_new();
-        HIP_IFEL(!rsa, -1, "Failed to malloc RSA\n");
-
-        /* extract the public-key from cert to rsa */
-
-        /* public exponent first */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(e_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex (exponent)\n");
-        e_hex = malloc(stop - start);
-        HIP_IFEL(!e_hex, -1, "Malloc for e_hex failed\n");
-        snprintf(e_hex, stop - start - 1, "%s", &cert->public_key[start + 1]);
-
-        /* public modulus */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(n_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex (modulus)\n");
-        modulus_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!modulus_b64, -1, "calloc for modulus_b64 failed\n");
-        modulus = calloc(1, stop - start + 1);
-        HIP_IFEL(!modulus, -1, "calloc for modulus failed\n");
-        snprintf((char *) modulus_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-
-        /* put the stuff into the RSA struct */
-        BN_hex2bn(&rsa->e, e_hex);
-        evpret = EVP_DecodeBlock(modulus, modulus_b64,
-                                 strlen((char *) modulus_b64));
-
-        /* EVP returns a multiple of 3 octets, subtract any extra */
-        keylen = evpret;
-        if (keylen % 4 != 0) {
-            --keylen;
-            keylen = keylen - keylen % 2;
-        }
-        signature = malloc(keylen);
-        HIP_IFEL(!signature, -1, "Malloc for signature failed.\n");
-        rsa->n = BN_bin2bn(modulus, keylen, 0);
-        break;
-    case HIP_HI_DSA:
-        /* malloc space for new dsa */
-        dsa = DSA_new();
-        HIP_IFEL(!dsa, -1, "Failed to malloc DSA\n");
-
-        /* Extract public key from the cert */
-
-        /* dsa->p */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(p_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex dsa->p\n");
-        p_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!p_b64, -1, "calloc for p_b64 failed\n");
-        p_bin = calloc(1, stop - start + 1);
-        HIP_IFEL(!p_bin, -1, "calloc for p_bin failed\n");
-        snprintf((char *) p_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-        evpret = EVP_DecodeBlock(p_bin, p_b64, strlen((char *) p_b64));
-
-        /* dsa->q */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(q_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex dsa->q\n");
-        q_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!q_b64, -1, "calloc for q_b64 failed\n");
-        q_bin = calloc(1, stop - start + 1);
-        HIP_IFEL(!q_bin, -1, "calloc for q_bin failed\n");
-        snprintf((char *) q_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-        evpret = EVP_DecodeBlock(q_bin, q_b64, strlen((char *) q_b64));
-
-        /* dsa->g */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(g_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex dsa->g\n");
-        g_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!g_b64, -1, "calloc for g_b64 failed\n");
-        g_bin = calloc(1, stop - start + 1);
-        HIP_IFEL(!g_bin, -1, "calloc for g_bin failed\n");
-        snprintf((char *) g_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-        evpret = EVP_DecodeBlock(g_bin, g_b64, strlen((char *) g_b64));
-
-        /* dsa->y */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(y_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex dsa->y\n");
-        y_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!y_b64, -1, "calloc for y_b64 failed\n");
-        y_bin = calloc(1, stop - start + 1);
-        HIP_IFEL(!y_bin, -1, "calloc for y_bin failed\n");
-        snprintf((char *) y_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-        evpret = EVP_DecodeBlock(y_bin, y_b64, strlen((char *) y_b64));
-        break;
-    case HIP_HI_ECDSA:
-        HIP_DEBUG("CALL TO UNIMPLEMENTED ECDSA CASE\n");
-        HIP_OUT_ERR(-1, "Unknown algorithm\n");
-        break;
-    default:
-        HIP_OUT_ERR(-1, "Unknown algorithm\n");
-    }
-
-    /* build sha1 digest that will be signed */
-    HIP_IFEL(!(sha_retval = SHA1((unsigned char *) cert->cert,
-                                 strlen(cert->cert), sha_digest)),
-             -1, "SHA1 error when creating digest.\n");
-
-    /* Get the signature hash and compare it to the sha_digest we just made */
-    start = stop = 0;
-    HIP_IFEL(hip_cert_regex(h_rule, cert->signature, &start, &stop), -1,
-             "Failed to run hip_cert_regex (signature hash)\n");
-    signature_hash_b64 = calloc(1, stop - start + 1);
-    HIP_IFEL(!signature_hash_b64, -1, "Failed to calloc signature_hash_b64\n");
-    signature_hash = malloc(stop - start + 1);
-    HIP_IFEL(!signature_hash, -1, "Failed to malloc signature_hash\n");
-    snprintf((char *) signature_hash_b64, stop - start - 1, "%s",
-             &cert->signature[start + 1]);
-    evpret = EVP_DecodeBlock(signature_hash, signature_hash_b64,
-                             strlen((char *) signature_hash_b64));
-    HIP_IFEL(memcmp(sha_digest, signature_hash, 20), -1,
-             "Signature hash did not match of the one made from the"
-             "cert sequence in the certificate\n");
-
-    /* memset signature and put it into its place */
-    start = stop = 0;
-    HIP_IFEL(hip_cert_regex(s_rule, cert->signature, &start, &stop), -1,
-             "Failed to run hip_cert_regex (signature)\n");
-    signature_b64 = calloc(1, stop - start + 1);
-    HIP_IFEL(!signature_b64, -1, "Failed to calloc signature_b64\n");
-    snprintf((char *) signature_b64, stop - start - 2, "%s",
-             &cert->signature[start + 2]);
-    if (algo == HIP_HI_DSA) {
-        signature = malloc(stop - start + 1);
-        HIP_IFEL(!signature, -1, "Failed to malloc signature (dsa)\n");
-    }
-    evpret = EVP_DecodeBlock(signature, signature_b64,
-                             strlen((char *) signature_b64));
-
-    switch (algo) {
-    case HIP_HI_RSA:
-        /* do the verification */
-        err = RSA_verify(NID_sha1, sha_digest, SHA_DIGEST_LENGTH,
-                         signature, RSA_size(rsa), rsa);
-        e_code = ERR_get_error();
-        ERR_load_crypto_strings();
-        ERR_error_string(e_code, buf);
-
-        /* RSA_verify returns 1 if success. */
-        cert->success = err == 1 ? 0 : -1;
-        HIP_IFEL((err = err == 1 ? 0 : -1), -1, "RSA_verify error\n");
-        break;
-    case HIP_HI_DSA:
-        /* build the signature structure */
-        dsa_sig = DSA_SIG_new();
-        HIP_IFEL(!dsa_sig, 1, "Failed to allocate DSA_SIG\n");
-        dsa_sig->r = BN_bin2bn(&signature[1], DSA_PRIV, NULL);
-        dsa_sig->s = BN_bin2bn(&signature[1 + DSA_PRIV], DSA_PRIV, NULL);
-
-        /* verify the DSA signature */
-        err = DSA_do_verify(sha_digest, SHA_DIGEST_LENGTH,
-                            dsa_sig, dsa) == 0 ? 1 : 0;
-
-        /* DSA_do_verify returns 1 if success. */
-        cert->success = err == 1 ? 0 : -1;
-        HIP_IFEL((err = err == 1 ? 0 : -1), -1, "DSA_do_verify error\n");
-        break;
-    case HIP_HI_ECDSA:
-        HIP_DEBUG("CALL TO UNIMPLEMENTED ECDSA CASE\n");
-        HIP_OUT_ERR(-1, "Unknown algorithm for signing\n");
-        break;
-    default:
-        HIP_OUT_ERR(-1, "Unknown algorithm\n");
-    }
-
-    hip_msg_init(msg);
-
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_SPKI_SIGN, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_spki_info(msg, cert), -1,
-             "Failed to build cert_info\n");
-
-out_err:
-    free(signature_hash_b64);
-    free(signature_hash);
-    free(modulus_b64);
-    free(modulus);
-    free(cert);
-    free(signature);
-    free(e_hex);
-    RSA_free(rsa);
-    DSA_free(dsa);
-    DSA_SIG_free(dsa_sig);
-
-    return err;
-}
-
-/****************************************************************************
- *
- * X.509v3
- *
- ***************************************************************************/
-
-/**
- * Function that creates the certificate and sends it to back to the client.
- *
- * @param msg is a pointer to the msg containing a x509v3 cert in cert parameter
- *
- * @return 0 on success negative otherwise.
- */
-int hip_cert_x509v3_handle_request_to_sign(struct hip_common *msg)
-{
-    int                   err = 0, i = 0, nid = 0, ret = 0, secs = 0, algo = 0;
-    CONF                 *conf;
-    CONF_VALUE           *item;
-    STACK_OF(CONF_VALUE) *sec_general = NULL;
-    STACK_OF(CONF_VALUE) *sec_name    = NULL;
-    STACK_OF(CONF_VALUE) *sec_ext     = NULL;
-
-    X509_REQ                 *req     = NULL;
-    X509_NAME                *issuer  = NULL;
-    X509_NAME                *subj    = NULL;
-    X509_EXTENSION           *ext     = NULL;
-    STACK_OF(X509_EXTENSION) *extlist = NULL;
-    X509_NAME_ENTRY          *ent;
-    EVP_PKEY                 *pkey;
-    /** XX TODO THIS should come from a configuration file
-     *  monotonically increasing counter */
-    long                            serial = 0;
-    const EVP_MD                   *digest = NULL;
-    X509                           *cert;
-    X509V3_CTX                      ctx;
-    const struct hip_cert_x509_req *subject;
-    char                            subject_hit[41];
-    char                            issuer_hit[41];
-    char                            ialtname[45];
-    char                            saltname[45];
-    struct in6_addr                *issuer_hit_n;
-    struct hip_host_id             *host_id;
-    RSA                            *rsa          = NULL;
-    DSA                            *dsa          = NULL;
-    unsigned char                  *der_cert     = NULL;
-    int                             der_cert_len = 0;
-    char                            arg1[21];
-    char                            arg2[21];
-
-    HIP_IFEL(!(issuer_hit_n = malloc(sizeof(struct in6_addr))), -1,
-             "Malloc for subject failed\n");
-    HIP_IFEL(!(pkey = malloc(sizeof(EVP_PKEY))), -1,
-             "Malloc for pkey failed\n");
-
-    OpenSSL_add_all_algorithms();
-    ERR_load_crypto_strings();
-
-    HIP_DEBUG("Reading configuration file (%s)\n", HIP_CERT_CONF_PATH);
-    conf        = hip_open_conf(HIP_CERT_CONF_PATH);
-    sec_general = hip_read_conf_section("hip_x509v3", conf);
-    sec_name    = hip_read_conf_section("hip_x509v3_name", conf);
-    sec_ext     = hip_read_conf_section("hip_x509v3_extensions", conf);
-    NCONF_free(conf);
-
-    /* Get the general information */
-    HIP_IFEL(sec_general == NULL, -1,
-             "Failed to load general certificate information\n");
-    HIP_IFEL(!(req = X509_REQ_new()), -1, "Failed to create X509_REQ object");
-
-    HIP_IFEL(sec_name == NULL, -1,
-             "Failed to load issuer naming information for the certificate\n");
-
-    /* Issuer naming */
-    if (sec_general != NULL) {
-        /* Loop through the conf stack for general information */
-        extlist = sk_X509_EXTENSION_new_null();
-        for (i = 0; i < sk_CONF_VALUE_num(sec_general); i++) {
-            item = sk_CONF_VALUE_value(sec_general, i);
-            if (!strcmp(item->name, "issuerhit")) {
-                strcpy(issuer_hit, item->value);
-                ret = inet_pton(AF_INET6, item->value, issuer_hit_n);
-                HIP_IFEL(ret < 0 && errno == EAFNOSUPPORT, -1,
-                         "Failed to convert issuer HIT to hip_hit_t\n");
-                HIP_DEBUG_HIT("Issuer HIT", issuer_hit_n);
-                HIP_IFEL(!inet_ntop(AF_INET6, issuer_hit_n,
-                                    issuer_hit, sizeof(issuer_hit)),
-                         -1, "Failed to convert subject hit to "
-                             "presentation format\n");
-            }
-            if (!strcmp(item->name, "days")) {
-                secs = HIP_CERT_DAY * atoi(item->value);
-            }
-        }
-    }
-    HIP_IFEL(!(issuer = X509_NAME_new()), -1, "Failed to set create issuer name");
-    nid = OBJ_txt2nid("commonName");
-    HIP_IFEL(nid == NID_undef, -1, "NID text not defined\n");
-    HIP_IFEL(!(ent = X509_NAME_ENTRY_create_by_NID(NULL, nid, MBSTRING_ASC,
-                                                   (unsigned char *) issuer_hit, -1)), -1,
-             "Failed to create name entry for issuer\n");
-    HIP_IFEL(X509_NAME_add_entry(issuer, ent, -1, 0) != 1, -1,
-             "Failed to add entry to issuer name\n");
-
-    /* Subject naming */
-    /* Get the subject hit from msg */
-    HIP_IFEL(!(subject = hip_get_param(msg, HIP_PARAM_CERT_X509_REQ)),
-             -1, "No cert_info struct found\n");
-    HIP_IFEL(!inet_ntop(AF_INET6, &subject->addr, subject_hit, sizeof(subject_hit)),
-             -1, "Failed to convert subject hit to presentation format\n");
-    HIP_IFEL(!(subj = X509_NAME_new()), -1, "Failed to set create subject name");
-    nid = OBJ_txt2nid("commonName");
-    HIP_IFEL(nid == NID_undef, -1, "NID text not defined\n");
-    HIP_IFEL(!(ent = X509_NAME_ENTRY_create_by_NID(NULL, nid, MBSTRING_ASC,
-                                                   (unsigned char *) subject_hit, -1)), -1,
-             "Failed to create name entry for subject\n");
-    HIP_IFEL(X509_NAME_add_entry(subj, ent, -1, 0) != 1, -1,
-             "Failed to add entry to subject name\n");
-    HIP_IFEL(X509_REQ_set_subject_name(req, subj) != 1, -1,
-             "Failed to add subject name to certificate request\n");
-
-    /* XX TODO add a check to skip subjectAltName and issuerAltName because they are
-     * already in use by with IP:<hit> stuff */
-    if (sec_ext != NULL) {
-        /* Loop through the conf stack and add extensions to ext stack */
-        extlist = sk_X509_EXTENSION_new_null();
-        for (i = 0; i < sk_CONF_VALUE_num(sec_ext); i++) {
-            item = sk_CONF_VALUE_value(sec_ext, i);
-            HIP_IFEL(!(ext = X509V3_EXT_conf(NULL, &ctx,
-                                             item->name, item->value)), -1,
-                     "Failed to create extension\n");
-            sk_X509_EXTENSION_push(extlist, ext);
-        }
-        HIP_IFEL(!X509_REQ_add_extensions(req, extlist), -1,
-                 "Failed to add extensions to the request\n");
-    }
-
-    /** NOW WE ARE READY TO CREATE A CERTIFICATE FROM THE REQUEST */
-    HIP_DEBUG("Starting the certificate creation\n");
-
-    HIP_IFEL(!(cert = X509_new()), -1,
-             "Failed to create X509 object\n");
-
-    HIP_IFEL(X509_set_version(cert, 2L) != 1, -1,
-             "Failed to set certificate version\n");
-    /** XX TODO serial should be stored after increasing it */
-    ASN1_INTEGER_set(X509_get_serialNumber(cert), serial++);
-
-    HIP_IFEL(X509_set_subject_name(cert, subj) != 1, -1,
-             "Failed to set subject name of certificate\n");
-    HIP_IFEL(X509_set_issuer_name(cert, issuer) != 1, -1,
-             "Failed to set issuer name of certificate\n");
-    HIP_IFEL(!X509_gmtime_adj(X509_get_notBefore(cert), 0), -1,
-             "Error setting beginning time of the certificate");
-    HIP_IFEL(!X509_gmtime_adj(X509_get_notAfter(cert), secs), -1,
-             "Error setting ending time of the certificate");
-
-    HIP_DEBUG("Getting the key\n");
-
-    HIP_IFEL(hip_get_host_id_and_priv_key(issuer_hit_n,
-                                          HIP_ANY_ALGO,
-                                          &host_id,
-                                          (void *) &rsa),
-             -1, "Private key not found\n");
-
-    algo = host_id->rdata.algorithm;
-    if (algo == HIP_HI_DSA) {
-        dsa = (DSA *) rsa;
-    }
-
-    switch (algo) {
-    case HIP_HI_RSA:
-        HIP_IFEL(!EVP_PKEY_assign_RSA(pkey, rsa), -1,
-                 "Failed to convert RSA to EVP_PKEY\n");
-        HIP_IFEL(X509_set_pubkey(cert, pkey) != 1, -1,
-                 "Failed to set public key of the certificate\n");
-        break;
-    case HIP_HI_DSA:
-        HIP_IFEL(!EVP_PKEY_assign_DSA(pkey, dsa), -1,
-                 "Failed to convert DSA to EVP_PKEY\n");
-        HIP_IFEL(X509_set_pubkey(cert, pkey) != 1, -1,
-                 "Failed to set public key of the certificate\n");
-        break;
-    case HIP_HI_ECDSA:
-        HIP_DEBUG("CALL TO UNIMPLEMENTED ECDSA CASE\n");
-        HIP_OUT_ERR(-1, "Unknown algorithm for signing\n");
-        break;
-    default:
-        HIP_OUT_ERR(-1, "Unknown algorithm\n");
-    }
-
-    if (sec_ext != NULL) {
-        for (i = 0; i < sk_CONF_VALUE_num(sec_ext); i++) {
-            item = sk_CONF_VALUE_value(sec_ext, i);
-            /*
-             * Skip issuerAltName and subjectAltName because
-             * HITs use them already. Skip also basicConstraint =
-             * CA:true and subjectKeyIdentifier because they are
-             * added automatically in the code below
-             */
-            if (!strcmp(item->name, "issuerAltname")) {
-                continue;
-            }
-            if (!strcmp(item->name, "subjectAltname")) {
-                continue;
-            }
-            if (0 == memcmp(subject_hit, issuer_hit, sizeof(issuer_hit))) {
-                if (!strcmp(item->name, "basicConstraints") &&
-                    !strcmp(item->value, "CA:true")) {
-                    continue;
-                }
-                if (!strcmp(item->name, "subjectKeyIdentifier")) {
-                    continue;
-                }
-            }
-            HIP_IFEL(!(ext = X509V3_EXT_conf(NULL, &ctx,
-                                             item->name, item->value)), -1,
-                     "Failed to create extension\n");
-            HIP_IFEL(!X509_add_ext(cert, ext, -1), -1,
-                     "Failed to add extensions to the cert\n");
-        }
-    }
-
-    if (0 == memcmp(subject_hit, issuer_hit, sizeof(issuer_hit))) {
-        /* Subjects and issuers hit match so
-         * we are writing a CA cert and in CA self-signed
-         * certificate you have to have subject key identifier
-         * present, when adding subjectKeyIdentifier give string
-         * hash to the X509_EXT_conf it knows what to do with it */
-
-        /* X509V3_EXT_conf() doesn't accept const char *, so we
-         * write the arguments to a buffer first */
-        sprintf(arg1, "basicConstraints");
-        sprintf(arg2, "CA:true");
-        HIP_IFEL(!(ext = X509V3_EXT_conf(NULL, &ctx,
-                                         arg1, arg2)), -1,
-                 "Failed to create extension\n");
-        HIP_IFEL(!X509_add_ext(cert, ext, -1), -1,
-                 "Failed to add extensions to the cert\n");
-
-        sprintf(arg1, "subjectKeyIdentifier");
-        sprintf(arg2, "hash");
-        HIP_IFEL(!(ext = X509V3_EXT_conf(NULL, &ctx,
-                                         arg1, arg2)), -1,
-                 "Failed to create extension\n");
-        HIP_IFEL(!X509_add_ext(cert, ext, -1), -1,
-                 "Failed to add extensions to the cert\n");
-    }
-
-    /* add subjectAltName = IP:<HIT> */
-    sprintf(arg1, "issuerAltName");
-    sprintf(ialtname, "IP:%s", issuer_hit);
-    HIP_IFEL(!(ext = X509V3_EXT_conf(NULL, &ctx,
-                                     arg1, ialtname)), -1,
-             "Failed to create extension\n");
-    HIP_IFEL(!X509_add_ext(cert, ext, -1), -1,
-             "Failed to add extensions to the cert\n");
-    /* add subjectAltName = IP:<HIT> */
-    sprintf(arg1, "subjectAltName");
-    sprintf(saltname, "IP:%s", subject_hit);
-    HIP_IFEL(!(ext = X509V3_EXT_conf(NULL, &ctx,
-                                     arg1, saltname)), -1,
-             "Failed to create extension\n");
-    HIP_IFEL(!X509_add_ext(cert, ext, -1), -1,
-             "Failed to add extensions to the cert\n");
-
-    switch (algo) {
-    case HIP_HI_RSA:
-        digest = EVP_sha1();
-        break;
-    case HIP_HI_DSA:
-        digest = EVP_dss1();
-        break;
-    case HIP_HI_ECDSA:
-        HIP_DEBUG("CALL TO UNIMPLEMENTED ECDSA CASE\n");
-        HIP_OUT_ERR(-1, "Unknown algorithm for signing\n");
-        break;
-    default:
-        HIP_OUT_ERR(-1, "Unknown algorithm\n");
-    }
-
-    HIP_IFEL(!X509_sign(cert, pkey, digest), -1,
-             "Failed to sign x509v3 certificate\n");
-
-    /** DER */
-    HIP_IFEL((der_cert_len = i2d_X509(cert, &der_cert)) < 0, -1,
-             "Failed to convert cert to DER\n");
-    /** end DER */
-
-    hip_msg_init(msg);
-
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_X509V3_SIGN, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_x509_resp(msg, (char *) der_cert, der_cert_len), -1,
-             "Failed to create x509 response parameter\n");
-
-out_err:
-    free(host_id);
-    X509_REQ_free(req);
-    sk_X509_EXTENSION_pop_free(extlist, X509_EXTENSION_free);
-    return err;
-}
-
-static int verify_callback(int ok, DBG X509_STORE_CTX *stor)
-{
-    /* This is not called from anywhere else than this file */
-    if (!ok) {
-        HIP_DEBUG("Error: %s\n", X509_verify_cert_error_string(stor->error));
-    }
-    return ok;
-}
-
-/**
- * Function verifies the given certificate and sends it to back to the client.
- *
- * @param msg is a pointer to the requesting msg that contains a cert parameter with x509v3 cert
- *
- * @return 0 on success negative otherwise.
- */
-int hip_cert_x509v3_handle_request_to_verify(struct hip_common *msg)
-{
-    int                              err = 0;
-    struct hip_cert_x509_resp        verify;
-    const struct hip_cert_x509_resp *p;
-    X509                            *cert       = NULL;
-    X509_STORE                      *store      = NULL;
-    X509_STORE_CTX                  *verify_ctx = NULL;
-    unsigned char                   *der_cert   = NULL;
-    const unsigned char             *vessel;
-
-    OpenSSL_add_all_algorithms();
-    ERR_load_crypto_strings();
-
-    HIP_IFEL(!(p = hip_get_param(msg, HIP_PARAM_CERT_X509_REQ)), -1,
-             "Failed to get cert info from the msg\n");
-    memcpy(&verify, p, sizeof(struct hip_cert_x509_resp));
-
-    der_cert = (unsigned char *) &p->der;
-
-    vessel = p->der;
-    HIP_IFEL((cert = d2i_X509(NULL, &vessel, verify.der_len)) == NULL, -1,
-             "Failed to convert cert from DER to internal format\n");
-    /*
-     * HIP_IFEL(!X509_print_fp(stdout, cert), -1,
-     *       "Failed to print x.509v3 in human readable format\n");
-     */
-
-    HIP_IFEL(!(store = X509_STORE_new()), -1,
-             "Failed to create X509_STORE_CTX object\n");
-    X509_STORE_set_verify_cb_func(store, verify_callback);
-
-    /* self signed so te cert itself should verify itself */
-
-    HIP_IFEL(!X509_STORE_add_cert(store, cert), -1,
-             "Failed to add cert to ctx\n");
-
-    HIP_IFEL(!(verify_ctx = X509_STORE_CTX_new()), -1,
-             "Failed to create X509_STORE_CTX object\n");
-
-    HIP_IFEL(X509_STORE_CTX_init(verify_ctx, store, cert, NULL) != 1, -1,
-             "Failed to initialize verification context\n");
-
-    if (X509_verify_cert(verify_ctx) != 1) {
-        HIP_DEBUG("Error verifying the certificate\n");
-        err = -1;
-    } else {
-        HIP_DEBUG("Certificate verified correctly!\n");
-        err = 0;
-    }
-
-    hip_msg_init(msg);
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_X509V3_VERIFY, err), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_x509_resp(msg, (char *) &der_cert, p->der_len), -1,
-             "Failed to create x509 response parameter\n");
-
-out_err:
-    X509_STORE_CTX_cleanup(verify_ctx);
-    X509_STORE_free(store);
-    X509_free(cert);
-    return err;
-}

=== removed file 'hipd/cert.h'
--- hipd/cert.h	2011-11-25 17:56:24 +0000
+++ hipd/cert.h	1970-01-01 00:00:00 +0000
@@ -1,48 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- *
- * Certificate signing and verification functions.
- */
-
-#ifndef HIPL_HIPD_CERT_H
-#define HIPL_HIPD_CERT_H
-
-#include <openssl/rsa.h>
-
-#include "lib/core/hashtable.h"
-#include "lib/core/protodefs.h"
-
-/** SPKI */
-int hip_cert_spki_sign(struct hip_common *);
-int hip_cert_spki_verify(struct hip_common *);
-
-/** x509v3 */
-int hip_cert_x509v3_handle_request_to_sign(struct hip_common *);
-int hip_cert_x509v3_handle_request_to_verify(struct hip_common *);
-
-#endif /* HIPL_HIPD_CERT_H */

=== modified file 'hipd/init.c'
--- hipd/init.c	2012-01-18 21:21:26 +0000
+++ hipd/init.c	2012-02-20 21:42:18 +0000
@@ -435,81 +435,6 @@
     return err;
 }
 
-/* Needed if the configuration file for certs did not exist  */
-#define HIP_CERT_INIT_DAYS 10
-
-/**
- * Initialize certificates for the local host
- *
- * @return zero on success or negative on failure
- */
-static int init_certs(void)
-{
-    int                   err = 0;
-    char                  hit[41];
-    FILE                 *conf_file;
-    struct local_host_id *entry;
-    char                  hostname[HIP_HOST_ID_HOSTNAME_LEN_MAX];
-
-    HIP_IFEL(gethostname(hostname, sizeof(hostname)), -1,
-             "gethostname failed\n");
-
-    conf_file = fopen(HIP_CERT_CONF_PATH, "r");
-    if (!conf_file) {
-        HIP_DEBUG("Configuration file did NOT exist creating it and "
-                  "filling it with default information\n");
-        /* Fetch the first RSA HIT */
-        entry = hip_get_hostid_entry_by_lhi_and_algo(NULL, HIP_HI_RSA, -1);
-        if (entry == NULL) {
-            HIP_DEBUG("Failed to get the first RSA HI");
-            goto out_err;
-        }
-        hip_in6_ntop(&entry->hit, hit);
-        conf_file = fopen(HIP_CERT_CONF_PATH, "w+");
-        fprintf(conf_file,
-                "# Section containing SPKI related information\n"
-                "#\n"
-                "# issuerhit = what hit is to be used when signing\n"
-                "# days = how long is this key valid\n"
-                "\n"
-                "[ hip_spki ]\n"
-                "issuerhit = %s\n"
-                "days = %d\n"
-                "\n"
-                "# Section containing HIP related information\n"
-                "#\n"
-                "# issuerhit = what hit is to be used when signing\n"
-                "# days = how long is this key valid\n"
-                "\n"
-                "[ hip_x509v3 ]\n"
-                "issuerhit = %s\n"
-                "days = %d\n"
-                "\n"
-                "#Section containing the name section for the x509v3 issuer name"
-                "\n"
-                "[ hip_x509v3_name ]\n"
-                "issuerhit = %s\n"
-                "\n"
-                "# Uncomment this section to add x509 extensions\n"
-                "# to the certificate\n"
-                "#\n"
-                "# DO NOT use subjectAltName, issuerAltName or\n"
-                "# basicConstraints implementation uses them already\n"
-                "# All other extensions are allowed\n"
-                "\n"
-                "# [ hip_x509v3_extensions ]\n",
-                hit, HIP_CERT_INIT_DAYS,
-                hit, HIP_CERT_INIT_DAYS,
-                hit /* TODO SAMU: removed because not used:*/  /*, hostname*/);
-    } else {
-        HIP_DEBUG("Configuration file existed exiting init_certs\n");
-    }
-    fclose(conf_file);
-
-out_err:
-    return err;
-}
-
 static void init_packet_types(void)
 {
     lmod_register_packet_type(HIP_I1,        "HIP_I1");
@@ -894,7 +819,7 @@
  */
 int hipd_init(const uint64_t flags)
 {
-    int                 err     = 0, certerr = 0, i, j;
+    int                 err     = 0, i, j;
     int                 killold = (flags & HIPD_START_KILL_OLD) > 0;
     unsigned int        mtu_val = HIP_HIT_DEV_MTU;
     char                str[64];
@@ -1035,12 +960,6 @@
         return -1;
     }
 
-    certerr = 0;
-    certerr = init_certs();
-    if (certerr < 0) {
-        HIP_DEBUG("Initializing cert configuration file returned error\n");
-    }
-
     /* Service initialization. */
     hip_init_services();
 

=== modified file 'hipd/input.c'
--- hipd/input.c	2012-02-17 10:45:47 +0000
+++ hipd/input.c	2012-02-20 21:42:18 +0000
@@ -73,7 +73,6 @@
 #include "netdev.h"
 #include "opp_mode.h"
 #include "output.h"
-#include "pisa.h"
 #include "pkt_handling.h"
 #include "registration.h"
 #include "input.h"

=== modified file 'hipd/output.c'
--- hipd/output.c	2012-02-15 17:37:10 +0000
+++ hipd/output.c	2012-02-20 21:42:18 +0000
@@ -65,7 +65,6 @@
 #include "hiprelay.h"
 #include "nat.h"
 #include "netdev.h"
-#include "pisa.h"
 #include "registration.h"
 #include "output.h"
 

=== removed file 'hipd/pisa.c'
--- hipd/pisa.c	2011-10-25 21:14:16 +0000
+++ hipd/pisa.c	1970-01-01 00:00:00 +0000
@@ -1,83 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * This file contains functions that are specific to PISA. They deal with the
- * certificate loading.
- *
- * @brief Functions for certificate loading
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "config.h"
-#include "lib/core/debug.h"
-#include "hipd.h"
-#include "pisa.h"
-
-#define CERT_MAX_SIZE 1024
-
-static char *midauth_cert = NULL;
-
-/**
- * Load a certificate from the file HIPL_SYSCONFDIR/cert and store it in memory
- *
- * @return 0 on success
- */
-static int pisa_load_certificate(void)
-{
-    FILE *f = NULL;
-
-    free(midauth_cert);
-    midauth_cert = calloc(1, CERT_MAX_SIZE);
-
-    if (!(f = fopen(HIPL_SYSCONFDIR "/cert", "r"))) {
-        HIP_ERROR("Could not open certificate file.\n");
-        return -1;
-    }
-
-    if (fread(midauth_cert, CERT_MAX_SIZE - 1, 1, f) == 0) {
-        perror("fread returned 0");
-    }
-    fclose(f);
-    return 0;
-}
-
-/**
- * Load a certificate from disk and return a pointer to the global
- * variable containing it.
- *
- * @see pisa_load_certificate*
- *
- * @return pointer to midauth_cert
- */
-char *hip_pisa_get_certificate(void)
-{
-    pisa_load_certificate();
-    return midauth_cert;
-}

=== removed file 'hipd/pisa.h'
--- hipd/pisa.h	2011-11-25 17:56:24 +0000
+++ hipd/pisa.h	1970-01-01 00:00:00 +0000
@@ -1,44 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * This file contains function declarations  specific to PISA. They deal with the
- * certificate loading.
- *
- * @brief Functions declarations for certificate loading
- */
-
-#ifndef HIPL_HIPD_PISA_H
-#define HIPL_HIPD_PISA_H
-
-/**
- * Get the certificate text that will be appended to R2 and U2 packets
- *
- * @return pointer to the certificate text
- */
-char *hip_pisa_get_certificate(void);
-
-#endif /* HIPL_HIPD_PISA_H */

=== modified file 'hipd/user.c'
--- hipd/user.c	2012-02-15 17:37:10 +0000
+++ hipd/user.c	2012-02-20 21:42:18 +0000
@@ -65,7 +65,6 @@
 #include "lib/tool/nlink.h"
 #include "config.h"
 #include "accessor.h"
-#include "cert.h"
 #include "close.h"
 #include "cookie.h"
 #include "esp_prot_anchordb.h"
@@ -240,7 +239,7 @@
 {
     const hip_hit_t                       *src_hit   = NULL, *dst_hit = NULL;
     struct hip_hadb_state                 *entry     = NULL;
-    int                                    err       = 0, msg_type = 0, reti = 0;
+    int                                    err       = 0, msg_type = 0;
     int                                    access_ok = 0, is_root = 0, name_len;
     const struct hip_tlv_common           *param     = NULL;
     const struct hip_transformation_order *transorder;
@@ -359,40 +358,6 @@
         dst_hit = hip_get_param_contents(msg, HIP_PARAM_HIT);
         hip_dec_cookie_difficulty();
         break;
-    case HIP_MSG_CERT_SPKI_VERIFY:
-    {
-        HIP_DEBUG("Got an request to verify SPKI cert\n");
-        reti = hip_cert_spki_verify(msg);
-        HIP_IFEL(reti, -1, "Verifying SPKI cert returned an error\n");
-        HIP_DEBUG("SPKI cert verified sending it back to requester\n");
-    }
-    break;
-    case HIP_MSG_CERT_SPKI_SIGN:
-    {
-        HIP_DEBUG("Got an request to sign SPKI cert sequence\n");
-        reti = hip_cert_spki_sign(msg);
-        HIP_IFEL(reti, -1, "Signing SPKI cert returned an error\n");
-        HIP_DEBUG("SPKI cert signed sending it back to requester\n");
-    }
-    break;
-    case HIP_MSG_CERT_X509V3_SIGN:
-    {
-        HIP_DEBUG("Got an request to sign X509v3 cert\n");
-        reti = hip_cert_x509v3_handle_request_to_sign(msg);
-        HIP_IFEL(reti, -1, "Signing of x509v3 cert returned an error\n");
-        HIP_DEBUG("X509v3 cert signed sending it back to requester\n");
-    }
-    break;
-    case HIP_MSG_CERT_X509V3_VERIFY:
-    {
-        HIP_DEBUG("Got an request to verify X509v3 cert\n");
-        reti = hip_cert_x509v3_handle_request_to_verify(msg);
-        HIP_IFEL(reti, -1, "Verification of x509v3 cert "
-                           "returned an error\n");
-        HIP_DEBUG("X509v3 verification ended "
-                  "sending it back to requester\n");
-    }
-    break;
     case HIP_MSG_TRANSFORM_ORDER:
     {
         err = 0;

=== modified file 'hipfw/conntrack.c'
--- hipfw/conntrack.c	2012-02-17 18:01:18 +0000
+++ hipfw/conntrack.c	2012-02-20 21:42:18 +0000
@@ -72,8 +72,8 @@
 #include "hipfw.h"
 #include "helpers.h"
 #include "hslist.h"
-#include "pisa.h"
 #include "reinject.h"
+#include "midauth.h"
 
 
 static struct dlist *hip_list  = NULL;
@@ -1386,7 +1386,7 @@
             return 0;
         }
 
-        esp_tuple->spi       = ntohl(esp_info->new_spi);
+        esp_tuple->spi           = ntohl(esp_info->new_spi);
         esp_tuple->spi_update_id = seq->update_id;
 
         HIP_IFEL(!update_esp_dest_addr(locator, seq, esp_tuple),
@@ -1400,7 +1400,7 @@
             return 0;
         }
 
-        esp_tuple->spi       = ntohl(esp_info->new_spi);
+        esp_tuple->spi           = ntohl(esp_info->new_spi);
         esp_tuple->spi_update_id = seq->update_id;
     } else if (locator && seq) {
         HIP_DEBUG("locator and seq\n");

=== modified file 'hipfw/hipfw.c'
--- hipfw/hipfw.c	2011-11-25 16:40:40 +0000
+++ hipfw/hipfw.c	2012-02-20 21:42:18 +0000
@@ -87,7 +87,6 @@
 #include "helpers.h"
 #include "lsi.h"
 #include "midauth.h"
-#include "pisa.h"
 #include "port_bindings.h"
 #include "reinject.h"
 #include "rewrite.h"
@@ -1885,12 +1884,6 @@
             continue;
         }
 
-#ifdef CONFIG_HIP_PISA
-        if (use_midauth) {
-            pisa_check_for_random_update();
-        }
-#endif
-
         if (FD_ISSET(h4->fd, &read_fdset)) {
             HIP_DEBUG("received IPv4 packet from iptables queue\n");
             err = fw_handle_packet(buf, h4, 4, &ctx);

=== removed file 'hipfw/pisa.c'
--- hipfw/pisa.c	2011-11-25 13:52:20 +0000
+++ hipfw/pisa.c	1970-01-01 00:00:00 +0000
@@ -1,575 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * This file contains PISA specific functions for the firewall. The basic idea
- * is to modify the HIP messages and manage state for allowed connections to
- * allow or reject associated ESP traffic.
- *
- * @brief PISA functions for the firewall
- */
-
-#define _BSD_SOURCE
-
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <arpa/inet.h>
-#include <netinet/in.h>
-#include <linux/netfilter.h>
-#include <openssl/hmac.h>
-
-#include "config.h"
-#include "lib/core/builder.h"
-#include "lib/core/certtools.h"
-#include "lib/core/crypto.h"
-#include "lib/core/debug.h"
-#include "lib/core/ife.h"
-#include "lib/core/performance.h"
-#include "lib/core/prefix.h"
-#include "modules/midauth/hipd/midauth.h"
-#include "conntrack.h"
-#include "hipfw_defines.h"
-#include "midauth.h"
-#include "pisa_cert.h"
-#include "pisa.h"
-
-
-#define PISA_RANDOM_LEN 16
-#define PISA_PUZZLE_SEED 0xDEADC0DE
-#define PISA_PUZZLE_OPAQUE_LEN (4 + HIP_AH_SHA_LEN)
-
-/* pisa_check_for_random_update is called at least every PISA_RANDOM_TTL
- * seconds. Worst case timer resolution depends on the timeout in the select
- * call */
-#define PISA_RANDOM_TTL 2.0
-
-static char            pisa_random_data[2][PISA_RANDOM_LEN];
-static struct in6_addr community_operator_hit;
-
-/* @todo make this configurable, issuer HIT */
-#define CO_HIT "2001:001a:b1b0:0aad:0f92:15ca:280c:9430"
-#define CO_HIT_FILE HIPL_SYSCONFDIR "/co_hit"
-
-/**
- * Generate a new random number and shift the old one down.
- */
-static void pisa_generate_random(void)
-{
-    void *p0, *p1;
-
-    p0 = &pisa_random_data[0][0];
-    p1 = &pisa_random_data[1][0];
-
-    memcpy(p0, p1, PISA_RANDOM_LEN);
-    get_random_bytes(p1, PISA_RANDOM_LEN);
-}
-
-/**
- * Reads out the HIT of the Community-Operator
- * from file CO_HIT_FILE
- * @param hit A pointer to the char where the HIT should be stored
- * @return 1-> success
- * @return 0-> error
- */
-static int pisa_read_communit_operator_hit(char *hit)
-{
-    FILE *f;
-    char *eofline;
-
-    f = fopen(CO_HIT_FILE, "r");
-
-    if (f == NULL) {
-        return 0;
-    }
-
-    if (fgets(hit, INET6_ADDRSTRLEN, f) != NULL) {
-        eofline = strchr(hit, '\n');
-        if (eofline) {
-            *eofline = '\0';
-        }
-    } else {
-        HIP_ERROR("Fgets failed");
-    }
-    fclose(f);
-
-    return 1;
-}
-
-void pisa_check_for_random_update(void)
-{
-    static time_t lastupdate = 0;
-    time_t        now;
-
-    time(&now);
-    if (difftime(now, lastupdate) > PISA_RANDOM_TTL) {
-        pisa_generate_random();
-        lastupdate = now;
-    }
-}
-
-/**
- * Appends HMAC/SHA1 to a block of data.
- *
- * @param hit1 first HIT
- * @param hit2 second HIT
- * @param rnd which random number to use, either 0 or 1
- * @param data pointer to buffer for data and the HMAC
- * @param data_len length of data
- * @return 0 on success
- */
-static int pisa_append_hmac(struct in6_addr *hit1, struct in6_addr *hit2,
-                            int rnd, void *data, int data_len)
-{
-    uint8_t      key[32 + PISA_RANDOM_LEN];
-    int          err = 0;
-    unsigned int len = HIP_AH_SHA_LEN;
-
-    /* sanity checks for arguments */
-    HIP_IFEL(data == NULL, -1, "No data given.\n");
-    HIP_IFEL(hit1 == NULL, -1, "No first HIT given.\n");
-    HIP_IFEL(hit2 == NULL, -1, "No second HIT given.\n");
-    HIP_IFEL(data_len < 1, -1, "Data has invalid length.\n");
-    HIP_IFEL(rnd != 0 && rnd != 1, -1, "Random ID is neither 0 nor 1.\n");
-
-    /* The key for HMAC/SHA1 consists of:
-     *                16 bytes HIT1
-     *                16 bytes HIT2
-     *   PISA_RANDOM_LEN bytes pisa_random_data
-     */
-
-    ipv6_addr_copy((struct in6_addr *) (key + 0), hit1);
-    ipv6_addr_copy((struct in6_addr *) (key + 16), hit2);
-    memcpy(key + 32, &pisa_random_data[rnd][0], PISA_RANDOM_LEN);
-
-    HMAC(EVP_sha1(), key, 32 + PISA_RANDOM_LEN, data, data_len,
-         (uint8_t *) data + data_len, &len);
-
-out_err:
-    return err;
-}
-
-/**
- * Insert a PISA puzzle into a packet.
- *
- * @param ctx context of the packet where the puzzle will be inserted
- * @return success (0) or failure
- */
-static int pisa_insert_puzzle(struct hip_fw_context *ctx)
-{
-    uint8_t opaque[PISA_PUZZLE_OPAQUE_LEN];
-
-    struct hip_common *hip  = ctx->transport_hdr.hip;
-    int                seed = PISA_PUZZLE_SEED;
-
-    memcpy(&opaque, &seed, 4);
-
-    /* here we switch order of initiator and receiver to obtain a
-     * different SHA1 hash */
-    pisa_append_hmac(&hip->hitr, &hip->hits, 1, &opaque, 4);
-
-    return midauth_add_challenge_request(ctx, 3, 4, opaque, PISA_PUZZLE_OPAQUE_LEN);
-}
-
-/**
- * Check the validity of a PISA challenge_response.
- *
- * @param ctx context of the packet with the puzzle to check
- * @return pointer to the puzzle we accepted or NULL at failure
- */
-static struct hip_challenge_response *pisa_check_challenge_response(struct hip_fw_context *ctx)
-{
-    struct hip_challenge_response *response;
-    struct hip_common             *hip = ctx->transport_hdr.hip;
-    uint8_t                        hash[2][PISA_PUZZLE_OPAQUE_LEN];
-    int                            seed = PISA_PUZZLE_SEED;
-
-    memcpy(&hash[0][0], &seed, 4);
-    memcpy(&hash[1][0], &seed, 4);
-
-    pisa_append_hmac(&hip->hits, &hip->hitr, 0, &hash[0], 4);
-    pisa_append_hmac(&hip->hits, &hip->hitr, 1, &hash[1], 4);
-
-    response = hip_get_param_readwrite(hip, HIP_PARAM_CHALLENGE_RESPONSE);
-
-    while (response) {
-        /* loop over all HIP_PARAM_CHALLENGE_RESPONSE */
-        if (hip_get_param_type(response) != HIP_PARAM_CHALLENGE_RESPONSE) {
-            break;
-        }
-        if ((!memcmp(response->opaque, &hash[1][0], PISA_PUZZLE_OPAQUE_LEN)) ||
-            (!memcmp(response->opaque, &hash[0][0], PISA_PUZZLE_OPAQUE_LEN))) {
-            if (!midauth_verify_challenge_response(response,
-                                                   hip->hits,
-                                                   hip->hitr)) {
-                return response;
-            }
-        }
-
-        response = (struct hip_challenge_response *)
-                   hip_get_next_param_readwrite(hip,
-                                                (struct hip_tlv_common *) response);
-    }
-
-    return NULL;
-}
-
-/**
- * Check the certificate of the packet.
- *
- * @param ctx context of the packet with the certificate to check
- * @return success (0) or failure
- */
-static int pisa_check_certificate(struct hip_fw_context *ctx)
-{
-    struct hip_common        *hip = ctx->transport_hdr.hip;
-    const struct hip_cert    *cert;
-    struct hip_cert_spki_info ci;
-    struct pisa_cert          pc;
-    char                     *buf = NULL;
-    int                       err = 0, len;
-    time_t                    now = time(NULL);
-
-    cert = hip_get_param(hip, HIP_PARAM_CERT);
-    HIP_IFEL(cert == NULL, -1, "No certificate found.\n");
-
-    len = ntohs(cert->length);
-    buf = calloc(1, len);
-    memcpy(buf, cert + 1, len);
-
-    HIP_IFEL(hip_cert_spki_char2certinfo(buf, &ci), -1,
-             "Certificate could not be parsed.\n");
-    HIP_IFEL(hip_cert_spki_lib_verify(&ci), -1,
-             "Certificate could not be verified.\n");
-
-    pisa_split_cert(ci.cert, &pc);
-
-    /* Three conditions must be fulfilled for a certificate to be valid:
-     *
-     *  - The current time on the middlebox must be in the before/after
-     *    interval
-     *  - The certificate must be issued by the community operator (i.e.
-     *    the CO HIT must be used by the issuer)
-     *  - The host sending the certificate must be the one mentioned in
-     *    the certificate
-     */
-    HIP_IFEL(now < pc.not_before, -1,
-             "Certificate is not valid yet.\n");
-    HIP_IFEL(now > pc.not_after, -1,
-             "Certificate has expired.\n");
-
-
-    HIP_IFEL(ipv6_addr_cmp(&pc.hit_issuer, &community_operator_hit) != 0,
-             -1, "Certificate not issued by the community operator.\n");
-    HIP_IFEL(ipv6_addr_cmp(&pc.hit_subject, &hip->hits) != 0, -1,
-             "Certificate does not belong to subject.\n");
-
-    HIP_INFO("Certificate successfully verified.\n");
-
-out_err:
-    free(buf);
-    return err;
-}
-
-/**
- * Accept a connection via PISA. Update firewall to allow data packets to
- * pass through.
- *
- * @param ctx context of the packet that belongs to that connection
- */
-static void pisa_accept_connection(const struct hip_fw_context *ctx)
-{
-    struct hip_common *hip = ctx->transport_hdr.hip;
-    struct tuple      *t   = get_tuple_by_hits(&hip->hits, &hip->hitr);
-
-    if (t) {
-        t->connection->pisa_state = PISA_STATE_ALLOW;
-        HIP_INFO("PISA accepted the connection.\n");
-        hip_fw_manage_all_esp_tuples(t, true);
-    } else {
-        HIP_ERROR("Connection not found.\n");
-    }
-}
-
-/**
- * Remove a connection from the list of accepted connections based on the hits
- * of a packet.
- *
- * @param ctx context of the packet that contains HITs of the connection
- */
-static void pisa_remove_connection(const struct hip_fw_context *ctx)
-{
-    struct hip_common *hip = ctx->transport_hdr.hip;
-    struct tuple      *t   = get_tuple_by_hits(&hip->hits, &hip->hitr);
-
-    if (t) {
-        t->connection->pisa_state = PISA_STATE_DISALLOW;
-        HIP_INFO("PISA removed the connection.\n");
-        hip_fw_manage_all_esp_tuples(t, false);
-    } else {
-        HIP_ERROR("Connection not found.\n");
-    }
-}
-
-/**
- * Reject a connection via PISA. Update firewall to allow no data packets
- * to pass through.
- *
- * @param ctx context of the packet that belongs to that connection
- */
-static void pisa_reject_connection(const struct hip_fw_context *ctx)
-{
-    HIP_INFO("PISA rejected the connection.\n");
-    pisa_remove_connection(ctx);
-}
-
-/**
- * Dummy function, necessary only for performance measurements.
- *
- * @param ctx context of the packet containing the I1
- * @return NF_ACCEPT verdict
- */
-static int pisa_handler_i1(UNUSED struct hip_fw_context *ctx)
-{
-#ifdef CONFIG_HIP_PERFORMANCE
-    HIP_DEBUG("Start PERF_BASE, PERF_I1\n");
-    hip_perf_start_benchmark(perf_set, PERF_BASE);
-    hip_perf_start_benchmark(perf_set, PERF_I1);
-#endif
-
-#ifdef CONFIG_HIP_PERFORMANCE
-    HIP_DEBUG("Stop and write PERF_I1\n");
-    hip_perf_stop_benchmark(perf_set, PERF_I1);
-    hip_perf_write_benchmark(perf_set, PERF_I1);
-#endif
-
-    return NF_ACCEPT;
-}
-
-/**
- * Dummy function, necessary only for performance measurements.
- *
- * @param ctx context of the packet containing the R1
- * @return NF_ACCEPT verdict
- */
-static int pisa_handler_r1(UNUSED struct hip_fw_context *ctx)
-{
-#ifdef CONFIG_HIP_PERFORMANCE
-    HIP_DEBUG("Start PERF_R1\n");
-    hip_perf_start_benchmark(perf_set, PERF_R1);
-#endif
-
-#ifdef CONFIG_HIP_PERFORMANCE
-    HIP_DEBUG("Stop and write PERF_R1\n");
-    hip_perf_stop_benchmark(perf_set, PERF_R1);
-    hip_perf_write_benchmark(perf_set, PERF_R1);
-#endif
-
-    return NF_ACCEPT;
-}
-
-/**
- * Insert a PISA puzzle into the I2 packet.
- *
- * @param ctx context of the packet to modify
- * @return NF_ACCEPT verdict
- */
-static int pisa_handler_i2(struct hip_fw_context *ctx)
-{
-#ifdef CONFIG_HIP_PERFORMANCE
-    HIP_DEBUG("Start PERF_I2\n");
-    hip_perf_start_benchmark(perf_set, PERF_I2);
-#endif
-    pisa_insert_puzzle(ctx);
-
-#ifdef CONFIG_HIP_PERFORMANCE
-    HIP_DEBUG("Stop and write PERF_I2\n");
-    hip_perf_stop_benchmark(perf_set, PERF_I2);
-    hip_perf_write_benchmark(perf_set, PERF_I2);
-#endif
-
-    return NF_ACCEPT;
-}
-
-/**
- * Check for a PISA puzzle, a valid signature and a valid
- * certificate in the R2 packet.
- *
- * @param ctx context of the packet to check
- * @return verdict, either NF_ACCEPT or NF_DROP
- */
-static int pisa_handler_r2(struct hip_fw_context *ctx)
-{
-    int                            verdict  = NF_DROP, sig = 0, cert = 0;
-    struct hip_challenge_response *solution = NULL;
-
-#ifdef CONFIG_HIP_PERFORMANCE
-    HIP_DEBUG("Start PERF_R2\n");
-    hip_perf_start_benchmark(perf_set, PERF_R2);
-#endif
-
-    solution = pisa_check_challenge_response(ctx);
-    cert     = pisa_check_certificate(ctx);
-
-    if (solution == NULL || sig != 0 || cert != 0) {
-        /* disallow further communication if either nonce, solution,
-         * signature or certificate were not correct */
-        pisa_reject_connection(ctx);
-        verdict = NF_DROP;
-    } else {
-        /* allow futher communication otherwise */
-        pisa_accept_connection(ctx);
-        verdict = NF_ACCEPT;
-    }
-
-#ifdef CONFIG_HIP_PERFORMANCE
-    HIP_DEBUG("Stop and write PERF_R2, PERF_BASE\n");
-    hip_perf_stop_benchmark(perf_set, PERF_R2);
-    hip_perf_stop_benchmark(perf_set, PERF_BASE);
-    hip_perf_write_benchmark(perf_set, PERF_R2);
-    hip_perf_write_benchmark(perf_set, PERF_BASE);
-#endif
-
-    return verdict;
-}
-
-/**
- * Insert a PISA nonce and a PISA puzzle into the U1 packet.
- *
- * @param ctx context of the packet to modify
- * @return NF_ACCEPT verdict
- */
-static int pisa_handler_u1(struct hip_fw_context *ctx)
-{
-    pisa_insert_puzzle(ctx);
-
-    return NF_ACCEPT;
-}
-
-/**
- * Check for a PISA nonce, a PISA puzzle, a valid signature and a valid
- * certificate in the U2 packet.
- *
- * @param ctx context of the packet to check
- * @return verdict, either NF_ACCEPT or NF_DROP
- */
-static int pisa_handler_u2(struct hip_fw_context *ctx)
-{
-    int                            verdict  = NF_DROP;
-    int                            sig      = 0;
-    int                            cert     = 0;
-    struct hip_challenge_response *solution = NULL;
-
-    solution = pisa_check_challenge_response(ctx);
-    cert     = pisa_check_certificate(ctx);
-
-    if (solution == NULL || sig != 0 || cert != 0) {
-        HIP_DEBUG("U2 packet did not match criteria:  "
-                  "solution %p, signature %i, cert %i\n",
-                  solution, sig, cert);
-        verdict = NF_DROP;
-    } else {
-        /* packet was ok, insert another puzzle */
-        pisa_insert_puzzle(ctx);
-        verdict = NF_ACCEPT;
-    }
-
-    return verdict;
-}
-
-/**
- * Check for a PISA nonce and a valid signature in the U3 packet.
- *
- * @param ctx context of the packet to check
- * @return verdict, either NF_ACCEPT or NF_DROP
- */
-static int pisa_handler_u3(struct hip_fw_context *ctx)
-{
-    int                            verdict  = NF_DROP;
-    int                            sig      = 0;
-    struct hip_challenge_response *solution = NULL;
-
-    solution = pisa_check_challenge_response(ctx);
-
-    if (solution == NULL || sig != 0) {
-        HIP_DEBUG("U2 packet did not match criteria:  "
-                  "solution %p\n",
-                  solution);
-        pisa_reject_connection(ctx);
-        verdict = NF_DROP;
-    } else {
-        pisa_accept_connection(ctx);
-        verdict = NF_ACCEPT;
-    }
-    return verdict;
-}
-
-/**
- * Handle CLOSE_ACK packet. Remove the connection from the list of accepted
- * connections
- *
- * @param ctx context of the packet
- * @return verdict, either NF_ACCEPT or NF_DROP
- */
-static int pisa_handler_close_ack(struct hip_fw_context *ctx)
-{
-    pisa_remove_connection(ctx);
-    return NF_ACCEPT;
-}
-
-/**
- * Initialize basic PISA functionality
- *
- * @param h function pointers for packet handlers
- */
-void pisa_init(struct midauth_handlers *h)
-{
-    char hit[INET6_ADDRSTRLEN];
-    h->i1        = pisa_handler_i1;
-    h->r1        = pisa_handler_r1;
-    h->i2        = pisa_handler_i2;
-    h->r2        = pisa_handler_r2;
-    h->u1        = pisa_handler_u1;
-    h->u2        = pisa_handler_u2;
-    h->u3        = pisa_handler_u3;
-    h->close     = midauth_handler_accept;
-    h->close_ack = pisa_handler_close_ack;
-
-    pisa_generate_random();
-    pisa_generate_random();
-
-    if (!pisa_read_communit_operator_hit(hit)) {
-        hit[0] = '\0';
-        HIP_ERROR("Could not load Communit-Operator HIT from file %s\n",
-                  CO_HIT_FILE);
-    }
-
-    if (inet_pton(AF_INET6, hit, &community_operator_hit) <= 0) {
-        HIP_ERROR("Coult not parse Community-Operator HIT\n");
-    }
-}

=== removed file 'hipfw/pisa.h'
--- hipfw/pisa.h	2011-11-25 13:52:20 +0000
+++ hipfw/pisa.h	1970-01-01 00:00:00 +0000
@@ -1,48 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-#ifndef HIPL_HIPFW_PISA_H
-#define HIPL_HIPFW_PISA_H
-
-#include "midauth.h"
-
-#define PISA_STATE_DISALLOW     0
-#define PISA_STATE_ALLOW        1
-
-#ifdef CONFIG_HIP_PISA
-/**
- * Register PISA handlers with midauth and initialize data structures.
- *
- * @param h pointer to the handlers
- */
-void pisa_init(struct midauth_handlers *h);
-#endif
-
-/**
- * Check if a new random number is necessary.
- */
-void pisa_check_for_random_update(void);
-
-#endif /* HIPL_HIPFW_PISA_H */

=== removed file 'hipfw/pisa_cert.c'
--- hipfw/pisa_cert.c	2011-08-15 14:11:56 +0000
+++ hipfw/pisa_cert.c	1970-01-01 00:00:00 +0000
@@ -1,205 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * This file deals with the PISA specific handling of SPKI certificates. The
- * certificate is parsed and split into small chunks.
- *
- * @brief PISA handling for SPKI certificates
- */
-
-#define _BSD_SOURCE
-
-#include <string.h>
-#include <time.h>
-#include <arpa/inet.h>
-#include <netinet/in.h>
-#include <sys/types.h>
-
-#include "pisa_cert.h"
-
-
-/**
- * Extract parts of a SPKI certificate.
- *
- * @param cert pointer to the certificate text or part of a certificate text
- * @param name pointer to the pattern we are looking for
- * @param r pointer to a buffer that the search result will be copied to
- * @return 0 on success
- */
-static char *pisa_cert_get_part(char *cert, const char *name, char *r)
-{
-    int   level = 0, len = 0;
-    char *p     = cert, *start = NULL;
-
-    if (!r) {
-        return NULL;
-    }
-
-    if (!cert) {
-        goto out_err;
-    }
-
-    if (!name) {
-        goto out_err;
-    }
-
-    len = strlen(name);
-    if (len == 0) {
-        goto out_err;
-    }
-
-    while (*p) {
-        if (*p == '(') {
-            level++;
-            if (level == 2 && !strncmp(p + 1, name, len)) {
-                if (*(p + len + 1) == ' ') {
-                    start = p++;
-                    break;
-                }
-            }
-        }
-        if (*p == ')') {
-            level--;
-        }
-        if (level == 0) {
-            break;
-        }
-        p++;
-    }
-
-    if (!start) {
-        goto out_err;
-    }
-
-    len = 0;
-
-    while (*p) {
-        if (*p == '(') {
-            level++;
-        }
-        if (*p == ')') {
-            level--;
-            if (level == 1) {
-                len = p - start + 1;
-                break;
-            }
-        }
-        if (level == 0) {
-            break;
-        }
-        p++;
-    }
-
-    strncpy(r, start, len);
-    r[len] = '\0';
-
-    return r;
-
-out_err:
-    r[0] = '\0';
-    return NULL;
-}
-
-/**
- * Get the content from a SPKI certificate part.
- *
- * @param cert pointer to the certificate text or part of a certificate text
- * @param name pointer to the pattern we are looking for
- * @param r pointer to a buffer that the search result will be copied to
- * @return 0 on success
- */
-static void pisa_cert_get_content(char *cert, const char *name, char *r)
-{
-    char *start = cert;
-    int   len   = 0;
-
-    if (!r) {
-        return;
-    }
-
-    if (!cert || !name || !*name == '(') {
-        goto out_err;
-    }
-
-    if (strlen(name) + 3 > strlen(cert)) {
-        goto out_err;
-    }
-
-    if (strncmp(name, cert + 1, strlen(name))) {
-        goto out_err;
-    }
-    start = cert + strlen(name) + 2;
-
-    if (*start == '\0') {
-        goto out_err;
-    }
-
-    len = strlen(start) - 1;
-    if (*(start + len) != ')') {
-        goto out_err;
-    }
-    strncpy(r, start, len);
-
-out_err:
-    r[len] = '\0';
-}
-
-/**
- * Splits a certificate into semantic chunks and converts these to
- * sensible binary representations.
- *
- * @param cert    the original certificate
- * @param pc internal representation of the certificate
- */
-void pisa_split_cert(char *cert, struct pisa_cert *pc)
-{
-    struct tm       t;
-    char            buffer1[224], buffer2[224];
-    struct in6_addr addr;
-
-    pisa_cert_get_part(cert, "not-before", buffer1);
-    pisa_cert_get_content(buffer1, "not-before", buffer2);
-    strptime(buffer2, "\"%Y-%m-%d_%H:%M:%S\"", &t);
-    pc->not_before = mktime(&t);
-
-    pisa_cert_get_part(cert, "not-after", buffer1);
-    pisa_cert_get_content(buffer1, "not-after", buffer2);
-    strptime(buffer2, "\"%Y-%m-%d_%H:%M:%S\"", &t);
-    pc->not_after = mktime(&t);
-
-    pisa_cert_get_part(cert, "issuer", buffer1);
-    pisa_cert_get_part(buffer1, "hash hit", buffer2);
-    pisa_cert_get_content(buffer2, "hash hit", buffer1);
-    inet_pton(AF_INET6, buffer1, &addr);
-    memcpy(&pc->hit_issuer, &addr, sizeof(struct in6_addr));
-
-    pisa_cert_get_part(cert, "subject", buffer1);
-    pisa_cert_get_part(buffer1, "hash hit", buffer2);
-    pisa_cert_get_content(buffer2, "hash hit", buffer1);
-    inet_pton(AF_INET6, buffer1, &addr);
-    memcpy(&pc->hit_subject, &addr, sizeof(struct in6_addr));
-}

=== removed file 'hipfw/pisa_cert.h'
--- hipfw/pisa_cert.h	2011-11-25 13:52:20 +0000
+++ hipfw/pisa_cert.h	1970-01-01 00:00:00 +0000
@@ -1,47 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-#ifndef HIPL_HIPFW_PISA_CERT_H
-#define HIPL_HIPFW_PISA_CERT_H
-
-#include <time.h>
-#include <netinet/in.h>
-
-struct pisa_cert {
-    struct in6_addr hit_issuer;
-    struct in6_addr hit_subject;
-    time_t          not_before;
-    time_t          not_after;
-};
-
-/**
- * Split the hip_cert_spki_info.cert part into small chunks
- *
- * @param cert the hip_cert_spki_info.cert part of the certificate
- * @param pc   datastructure that will contain the chunks
- */
-void pisa_split_cert(char *cert, struct pisa_cert *pc);
-
-#endif /* HIPL_HIPFW_PISA_CERT_H */

=== modified file 'lib/core/builder.c'
--- lib/core/builder.c	2012-01-10 17:53:47 +0000
+++ lib/core/builder.c	2012-02-20 21:42:18 +0000
@@ -3326,107 +3326,6 @@
 }
 
 /**
- * Build and append a SPKI infor parameter into a HIP control message (on-the-wire)
- *
- * @param msg a pointer to the message where the parameter will be
- *            appended
- * @param cert_info certificate information
- * @return zero on success, or negative on failure
- * @see <a href="http://tools.ietf.org/html/draft-ietf-hip-cert">draft-ietf-hip-cert</a>
- *
- */
-int hip_build_param_cert_spki_info(struct hip_common *msg,
-                                   struct hip_cert_spki_info *cert_info)
-{
-    struct hip_cert_spki_info local;
-
-    memcpy(&local, cert_info, sizeof(struct hip_cert_spki_info));
-    hip_set_param_type((struct hip_tlv_common *) &local,
-                       HIP_PARAM_CERT_SPKI_INFO);
-    hip_calc_param_len((struct hip_tlv_common *) &local,
-                       sizeof(struct hip_cert_spki_info)
-                       - sizeof(struct hip_tlv_common));
-
-    return hip_build_param(msg, &local);
-}
-
-/**
- * Build and append a X509 certiticate request parameter into a HIP control
- * message (on-the-wire)
- *
- * @param msg a pointer to the message where the parameter will be
- *            appended
- * @param addr the subject for the certificate
- * @return zero on success, or negative on failure
- * @see <a href="http://tools.ietf.org/html/draft-ietf-hip-cert">draft-ietf-hip-cert</a>
- *
- */
-int hip_build_param_cert_x509_req(struct hip_common *msg, struct in6_addr *addr)
-{
-    struct hip_cert_x509_req subj;
-
-    hip_set_param_type((struct hip_tlv_common *) &subj, HIP_PARAM_CERT_X509_REQ);
-    hip_calc_param_len((struct hip_tlv_common *) &subj,
-                       sizeof(struct hip_cert_x509_req)
-                       - sizeof(struct hip_tlv_common));
-    ipv6_addr_copy(&subj.addr, addr);
-
-    return hip_build_param(msg, &subj);
-}
-
-/**
- * build and append a X509 certificate verification parameter into a
- * HIP control message (on-the-wire)
- *
- * @param msg a pointer to the message where the parameter will be
- *            appended
- * @param der der field
- * @param len length of the der field in bytes
- * @return zero on success, or negative on failure
- * @see <a href="http://tools.ietf.org/html/draft-ietf-hip-cert">draft-ietf-hip-cert</a>
- *
- */
-int hip_build_param_cert_x509_ver(struct hip_common *msg, char *der, int len)
-{
-    struct hip_cert_x509_resp subj;
-
-    hip_set_param_type((struct hip_tlv_common *) &subj, HIP_PARAM_CERT_X509_REQ);
-    hip_calc_param_len((struct hip_tlv_common *) &subj,
-                       sizeof(struct hip_cert_x509_resp)
-                       - sizeof(struct hip_tlv_common));
-    memcpy(&subj.der, der, len);
-    subj.der_len = len;
-
-    return hip_build_param(msg, &subj);
-}
-
-/**
- * build and append a X509 certificate response into a HIP control message
- * (on-the-wire)
- *
- * @param msg a pointer to the message where the parameter will be
- *            appended
- * @param der der field
- * @param len length of the der field in bytes
- * @return zero on success, or negative on failure
- * @see <a href="http://tools.ietf.org/html/draft-ietf-hip-cert">draft-ietf-hip-cert</a>
- *
- */
-int hip_build_param_cert_x509_resp(struct hip_common *msg, char *der, int len)
-{
-    struct hip_cert_x509_resp local;
-    hip_set_param_type((struct hip_tlv_common *) &local,
-                       HIP_PARAM_CERT_X509_RESP);
-    hip_calc_param_len((struct hip_tlv_common *) &local,
-                       sizeof(struct hip_cert_x509_resp)
-                       - sizeof(struct hip_tlv_common));
-    memcpy(&local.der, der, len);
-    local.der_len = len;
-
-    return hip_build_param(msg, &local);
-}
-
-/**
  * Build an append a zone parameter for hit-to-ip extension.
  *
  * @param msg a pointer to the message where the parameter will be

=== modified file 'lib/core/builder.h'
--- lib/core/builder.h	2011-04-04 11:46:20 +0000
+++ lib/core/builder.h	2012-02-20 21:42:18 +0000
@@ -36,7 +36,6 @@
 #include <openssl/ec.h>
 #endif /* HAVE_EC_CRYPTO */
 
-#include "certtools.h"
 #include "debug.h"
 #include "icomm.h"
 #include "state.h"
@@ -156,11 +155,6 @@
                              const in_port_t port);
 int hip_build_param_via_rvs(struct hip_common *msg,
                             const struct in6_addr rvs_addresses[]);
-int hip_build_param_cert_spki_info(struct hip_common *msg,
-                                   struct hip_cert_spki_info *cert_info);
-int hip_build_param_cert_x509_req(struct hip_common *, struct in6_addr *);
-int hip_build_param_cert_x509_resp(struct hip_common *, char *, int);
-int hip_build_param_cert_x509_ver(struct hip_common *, char *, int);
 
 int hip_build_param_hit_to_ip_set(struct hip_common *, const char *);
 int hip_build_user_hdr(struct hip_common *, hip_hdr, hip_hdr_err);

=== removed file 'lib/core/certtools.c'
--- lib/core/certtools.c	2012-01-14 15:29:47 +0000
+++ lib/core/certtools.c	1970-01-01 00:00:00 +0000
@@ -1,856 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * certificate building and verification functions to use with HIP
- */
-
-#include <regex.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <openssl/bn.h>
-#include <openssl/conf.h>
-#include <openssl/dsa.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/rsa.h>
-#include <openssl/safestack.h>
-
-#include "crypto.h"
-#include "debug.h"
-#include "ife.h"
-#include "message.h"
-#include "prefix.h"
-#include "straddr.h"
-#include "certtools.h"
-
-/*******************************************************************************
- * FUNCTIONS FOR SPKI                                                          *
- *******************************************************************************/
-
-/**
- * Function that verifies the signature in
- * the given SPKI cert sent by the "client"
- *
- * @param cert points to hip_cert_spki_info that is going to be verified
- *
- * @return 0 if signature matches, -1 if error or signature did NOT match
- *
- * @note see hip_cert_spki_char2certinfo to convert from wire to hip_cert_spki_info
- */
-int hip_cert_spki_lib_verify(struct hip_cert_spki_info *cert)
-{
-    int  err = 0, start = 0, stop = 0, evpret = 0, keylen = 0, algo = 0;
-    char buf[200];
-
-    unsigned char  sha_digest[21];
-    unsigned char *sha_retval;
-    unsigned char *signature_hash     = NULL;
-    unsigned char *signature_hash_b64 = NULL;
-    unsigned char *signature_b64      = NULL;
-
-    unsigned char *signature = NULL;
-
-    /** RSA */
-    RSA           *rsa = NULL;
-    unsigned long  e_code;
-    char          *e_hex       = NULL;
-    unsigned char *modulus_b64 = NULL;
-    unsigned char *modulus     = NULL;
-
-    /** DSA */
-    DSA           *dsa   = NULL;
-    unsigned char *p_bin = NULL, *q_bin = NULL, *g_bin = NULL, *y_bin = NULL;
-    unsigned char *p_b64 = NULL, *q_b64 = NULL, *g_b64 = NULL, *y_b64 = NULL;
-    DSA_SIG       *dsa_sig;
-
-    /* rules for regular expressions */
-
-    /*
-     * Rule to get the info if we are using DSA
-     */
-    char dsa_rule[] = "[d][s][a][-][p][k][c][s][1][-][s][h][a][1]";
-
-    /*
-     * Rule to get the info if we are using RSA
-     */
-    char rsa_rule[] = "[r][s][a][-][p][k][c][s][1][-][s][h][a][1]";
-
-    /*
-     * Rule to get DSA p
-     * Look for pattern "(p |" and stop when first "|"
-     * anything in base 64 is accepted inbetween
-     */
-    char p_rule[] = "[(][p][ ][|][[A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * Rule to get DSA q
-     * Look for pattern "(q |" and stop when first "|"
-     * anything in base 64 is accepted inbetween
-     */
-    char q_rule[] = "[(][q][ ][|][[A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * Rule to get DSA g
-     * Look for pattern "(g |" and stop when first "|"
-     * anything in base 64 is accepted inbetween
-     */
-    char g_rule[] = "[(][g][ ][|][[A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * Rule to get DSA y / pub_key
-     * Look for pattern "(y |" and stop when first "|"
-     * anything in base 64 is accepted inbetween
-     */
-    char y_rule[] = "[(][y][ ][|][[A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * rule to get the public exponent RSA
-     * Look for the part that says # and after that some hex blob and #
-     */
-    char e_rule[] = "[#][0-9A-Fa-f]*[#]";
-
-    /*
-     * rule to get the public modulus RSA
-     * Look for the part that starts with '|' and after that anything
-     * that is in base 64 char set and then '|' again
-     */
-    char n_rule[] = "[|][A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * rule to get the signature hash
-     * Look for the similar than the n_rule
-     */
-    char h_rule[] = "[|][A-Za-z0-9+/()#=-]*[|]";
-
-    /*
-     * rule to get the signature
-     * Look for part that starts ")|" and base 64 blob after it
-     * and stops to '|' char remember to add and subtract 2 from
-     * the indexes below
-     */
-    char s_rule[] = "[)][|][A-Za-z0-9+/()#=-]*[|]";
-
-    /* check the algo DSA or RSA  */
-    HIP_DEBUG("Verifying\nRunning regexps to identify algo\n");
-    start = stop = 0;
-    algo  = hip_cert_regex(dsa_rule, cert->public_key, &start, &stop);
-    if (algo != -1) {
-        HIP_DEBUG("Public-key is DSA\n");
-        algo = HIP_HI_DSA;
-        goto algo_check_done;
-    }
-    start = stop = 0;
-    algo  = hip_cert_regex(rsa_rule, cert->public_key, &start, &stop);
-    if (algo != -1) {
-        HIP_DEBUG("Public-key is RSA\n");
-        algo = HIP_HI_RSA;
-        goto algo_check_done;
-    }
-    HIP_DEBUG((1 != 1), -1, "Unknown algorithm\n");
-
-algo_check_done:
-    if (algo == HIP_HI_RSA) {
-        /* malloc space for new rsa */
-        rsa = RSA_new();
-        HIP_IFEL(!rsa, -1, "Failed to malloc RSA\n");
-
-        /* extract the public-key from cert to rsa */
-
-        /* public exponent first */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(e_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex (exponent)\n");
-        e_hex = malloc(stop - start);
-        HIP_IFEL(!e_hex, -1, "Malloc for e_hex failed\n");
-        snprintf((char *) e_hex, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-
-        /* public modulus */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(n_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex (modulus)\n");
-        modulus_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!modulus_b64, -1, "calloc for modulus_b64 failed\n");
-        modulus = calloc(1, stop - start + 1);
-        HIP_IFEL(!modulus, -1, "calloc for modulus failed\n");
-        snprintf((char *) modulus_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-
-        /* put the stuff into the RSA struct */
-        BN_hex2bn(&rsa->e, e_hex);
-        evpret = EVP_DecodeBlock(modulus, modulus_b64,
-                                 strlen((char *) modulus_b64));
-
-        /* EVP returns a multiple of 3 octets, subtract any extra */
-        keylen = evpret;
-        if (keylen % 4 != 0) {
-            --keylen;
-            keylen = keylen - keylen % 2;
-        }
-        signature = malloc(keylen);
-        HIP_IFEL(!signature, -1, "Malloc for signature failed.\n");
-        rsa->n = BN_bin2bn(modulus, keylen, 0);
-    } else if (algo == HIP_HI_DSA) {
-        /* malloc space for new dsa */
-        dsa = DSA_new();
-        HIP_IFEL(!dsa, -1, "Failed to malloc DSA\n");
-
-        /* Extract public key from the cert */
-
-        /* dsa->p */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(p_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex dsa->p\n");
-        p_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!p_b64, -1, "calloc for p_b64 failed\n");
-        p_bin = calloc(1, stop - start + 1);
-        HIP_IFEL(!p_bin, -1, "calloc for p_bin failed\n");
-        snprintf((char *) p_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-        evpret = EVP_DecodeBlock(p_bin, p_b64, strlen((char *) p_b64));
-
-        /* dsa->q */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(q_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex dsa->q\n");
-        q_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!q_b64, -1, "calloc for q_b64 failed\n");
-        q_bin = calloc(1, stop - start + 1);
-        HIP_IFEL(!q_bin, -1, "calloc for q_bin failed\n");
-        snprintf((char *) q_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-        evpret = EVP_DecodeBlock(q_bin, q_b64, strlen((char *) q_b64));
-
-        /* dsa->g */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(g_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex dsa->g\n");
-        g_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!g_b64, -1, "calloc for g_b64 failed\n");
-        g_bin = calloc(1, stop - start + 1);
-        HIP_IFEL(!g_bin, -1, "calloc for g_bin failed\n");
-        snprintf((char *) g_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-        evpret = EVP_DecodeBlock(g_bin, g_b64, strlen((char *) g_b64));
-
-        /* dsa->y */
-        start = stop = 0;
-        HIP_IFEL(hip_cert_regex(y_rule, cert->public_key, &start, &stop), -1,
-                 "Failed to run hip_cert_regex dsa->y\n");
-        y_b64 = calloc(1, stop - start + 1);
-        HIP_IFEL(!y_b64, -1, "calloc for y_b64 failed\n");
-        y_bin = calloc(1, stop - start + 1);
-        HIP_IFEL(!y_bin, -1, "calloc for y_bin failed\n");
-        snprintf((char *) y_b64, stop - start - 1, "%s",
-                 &cert->public_key[start + 1]);
-        evpret = EVP_DecodeBlock(y_bin, y_b64, strlen((char *) y_b64));
-    } else if (algo == HIP_HI_ECDSA) {
-        HIP_OUT_ERR(-1, "Call to unimplemented ECDSA case.\n");
-    } else {
-        HIP_OUT_ERR(-1, "Unknown algorithm\n");
-    }
-
-    /* build sha1 digest that will be signed */
-    HIP_IFEL(!(sha_retval = SHA1((unsigned char *) cert->cert,
-                                 strlen((char *) cert->cert), sha_digest)),
-             -1, "SHA1 error when creating digest.\n");
-
-    /* Get the signature hash and compare it to the sha_digest we just made */
-    start = stop = 0;
-    HIP_IFEL(hip_cert_regex(h_rule, cert->signature, &start, &stop), -1,
-             "Failed to run hip_cert_regex (signature hash)\n");
-    signature_hash_b64 = calloc(1, stop - start + 1);
-    HIP_IFEL(!signature_hash_b64, -1, "Failed to calloc signature_hash_b64\n");
-    signature_hash = malloc(stop - start + 1);
-    HIP_IFEL(!signature_hash, -1, "Failed to malloc signature_hash\n");
-    snprintf((char *) signature_hash_b64, stop - start - 1, "%s",
-             &cert->signature[start + 1]);
-    evpret = EVP_DecodeBlock(signature_hash, signature_hash_b64,
-                             strlen((char *) signature_hash_b64));
-    HIP_IFEL(memcmp(sha_digest, signature_hash, 20), -1,
-             "Signature hash did not match of the one made from the"
-             "cert sequence in the certificate\n");
-
-    /* memset signature and put it into its place */
-    start = stop = 0;
-    HIP_IFEL(hip_cert_regex(s_rule, cert->signature, &start, &stop), -1,
-             "Failed to run hip_cert_regex (signature)\n");
-    signature_b64 = calloc(1, stop - start + 1);
-    HIP_IFEL(!signature_b64, -1, "Failed to calloc signature_b64\n");
-    snprintf((char *) signature_b64, stop - start - 2, "%s",
-             &cert->signature[start + 2]);
-    if (algo == HIP_HI_DSA) {
-        signature = malloc(stop - start + 1);
-        HIP_IFEL(!signature, -1, "Failed to malloc signature (dsa)\n");
-    }
-    evpret = EVP_DecodeBlock(signature, signature_b64,
-                             strlen((char *) signature_b64));
-
-    if (algo == HIP_HI_RSA) {
-        /* do the verification */
-        err = RSA_verify(NID_sha1, sha_digest, SHA_DIGEST_LENGTH,
-                         signature, RSA_size(rsa), rsa);
-        e_code = ERR_get_error();
-        ERR_load_crypto_strings();
-        ERR_error_string(e_code, buf);
-
-        /* RSA_verify returns 1 if success. */
-        cert->success = err == 1 ? 0 : -1;
-        HIP_IFEL((err = err == 1 ? 0 : -1), -1, "RSA_verify error\n");
-    } else if (algo == HIP_HI_DSA) {
-        /* build the signature structure */
-        dsa_sig = DSA_SIG_new();
-        HIP_IFEL(!dsa_sig, 1, "Failed to allocate DSA_SIG\n");
-        dsa_sig->r = BN_bin2bn(&signature[1], DSA_PRIV, NULL);
-        dsa_sig->s = BN_bin2bn(&signature[1 + DSA_PRIV], DSA_PRIV, NULL);
-
-        /* verify the DSA signature */
-        err = DSA_do_verify(sha_digest, SHA_DIGEST_LENGTH,
-                            dsa_sig, dsa) == 0 ? 1 : 0;
-
-        /* DSA_do_verify returns 1 if success. */
-        cert->success = err == 1 ? 0 : -1;
-        HIP_IFEL((err = err == 1 ? 0 : -1), -1, "DSA_do_verify error\n");
-    } else if (algo == HIP_HI_ECDSA) {
-        HIP_OUT_ERR(-1, "Call to unimplemented ECDSA case.\n");
-    } else {
-        HIP_OUT_ERR(-1, "Unknown algorithm\n");
-    }
-
-out_err:
-    free(signature_hash_b64);
-    free(signature_hash);
-    free(modulus_b64);
-    free(modulus);
-    free(e_hex);
-    RSA_free(rsa);
-    DSA_free(dsa);
-    return err;
-}
-
-/**
- * Function to build the basic cert object of SPKI clears public-key
- * object and signature in hip_cert_spki_header
- *
- * @param minimal_content holds the struct hip_cert_spki_header
- *                        containing the minimal needed information for
- *                        cert object, also contains the char table where
- *                        the cert object is to be stored
- *
- * @return always 0
- */
-static int cert_spki_build_cert(struct hip_cert_spki_info *minimal_content)
-{
-    char needed[] = "(cert )";
-    memset(minimal_content->public_key, '\0', sizeof(minimal_content->public_key));
-    memset(minimal_content->cert, '\0', sizeof(minimal_content->cert));
-    memset(minimal_content->signature, '\0', sizeof(minimal_content->signature));
-    sprintf(minimal_content->cert, "%s", needed);
-
-    return 0;
-}
-
-/**
- * Function for injecting objects to cert object
- *
- * @param to hip_cert_spki_info containing the char table where to insert
- * @param after is a char pointer for the regcomp after which the inject happens
- * @param what is char pointer of what to
- *
- * @return 0 if ok and negative if error. -1 returned for example when after is NOT found
- */
-static int cert_spki_inject(struct hip_cert_spki_info *to,
-                            const char *after, const char *what)
-{
-    int        err = 0, status = 0;
-    regex_t    re;
-    regmatch_t pm[1];
-    char      *tmp_cert;
-
-    tmp_cert = calloc(1, strlen(to->cert) + strlen(what) + 1);
-    if (!tmp_cert) {
-        return -ENOMEM;
-    }
-    /* Compiling the regular expression */
-    HIP_IFEL(regcomp(&re, after, REG_EXTENDED), -1,
-             "Compilation of the regular expression failed\n");
-    /* Running the regular expression */
-    HIP_IFEL((status = regexec(&re, to->cert, 1, pm, 0)), -1,
-             "Handling of regular expression failed\n");
-    /* Using tmp char table to do the inject (remember the terminators)
-     * first the beginning */
-    snprintf(tmp_cert, pm[0].rm_eo + 2, "%s", to->cert);
-    /* Then the middle part to be injected */
-    snprintf(&tmp_cert[pm[0].rm_eo + 1], strlen(what) + 1, "%s", what);
-    /* then glue back the rest of the original at the end */
-    snprintf(&tmp_cert[(pm[0].rm_eo + strlen(what) + 1)],
-             (strlen(to->cert) - pm[0].rm_eo), "%s", &to->cert[pm[0].rm_eo + 1]);
-    /* move tmp to the result */
-    sprintf(to->cert, "%s", tmp_cert);
-out_err:
-    free(tmp_cert);
-    regfree(&re);
-    return err;
-}
-
-/**
- * Function to build the create minimal SPKI cert (plus socket parameter)
- *
- * @param content holds the struct hip_cert_spki_info containing
- *                the minimal needed information for cert object,
- *                also contains the char table where the cert object
- *                is to be stored
- * @param issuer_type With HIP its HIT
- * @param issuer HIT in representation encoding 2001:001...
- * @param subject_type With HIP its HIT
- * @param subject HIT in representation encoding 2001:001...
- * @param not_before time in timeval before which the cert should not be used
- * @param not_after time in timeval after which the cert should not be used
- * @param hip_user_socket socket, already connected to hipd, to pass through to
- *                hip_send_recv_daemon_info
- * @return 0 if ok -1 if error
- */
-static int cert_spki_create_cert_sock(struct hip_cert_spki_info *content,
-                                      const char *issuer_type,
-                                      struct in6_addr *issuer,
-                                      const char *subject_type,
-                                      struct in6_addr *subject,
-                                      time_t *not_before,
-                                      time_t *not_after,
-                                      int hip_user_socket)
-{
-    int                              err         = 0;
-    char                            *tmp_issuer  = NULL;
-    char                            *tmp_subject = NULL;
-    char                            *tmp_before  = NULL;
-    char                            *tmp_after   = NULL;
-    struct tm                       *ts          = NULL;
-    char                             buf_before[80];
-    char                             buf_after[80];
-    char                             present_issuer[41]  = { 0 };
-    char                             present_subject[41] = { 0 };
-    struct hip_common               *msg                 = NULL;
-    const struct hip_cert_spki_info *returned            = NULL;
-
-    /* Malloc needed */
-    tmp_issuer = calloc(1, 128);
-    if (!tmp_issuer) {
-        goto out_err;                  /* Why does this return 0? */
-    }
-    tmp_subject = calloc(1, 128);
-    if (!tmp_subject) {
-        goto out_err;
-    }
-    tmp_before = calloc(1, 128);
-    if (!tmp_before) {
-        goto out_err;
-    }
-    tmp_after = calloc(1, 128);
-    if (!tmp_after) {
-        goto out_err;
-    }
-    HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
-             "Malloc for msg failed\n");
-
-    /* Make needed transforms to the date */
-    /*  Format and print the time, "yyyy-mm-dd hh:mm:ss"
-     * (not-after "1998-04-15_00:00:00") */
-    ts = localtime(not_before);
-    strftime(buf_before, sizeof(buf_before), "%Y-%m-%d_%H:%M:%S", ts);
-    ts = localtime(not_after);
-    strftime(buf_after, sizeof(buf_after), "%Y-%m-%d_%H:%M:%S", ts);
-
-    sprintf(tmp_before, "(not-before \"%s\")", buf_before);
-    sprintf(tmp_after, "(not-after \"%s\")", buf_after);
-
-    ipv6_addr_copy(&content->issuer_hit, issuer);
-    inet_ntop(AF_INET6, issuer, present_issuer, INET6_ADDRSTRLEN);
-    inet_ntop(AF_INET6, subject, present_subject, INET6_ADDRSTRLEN);
-
-    sprintf(tmp_issuer, "(hash %s %s)", issuer_type, present_issuer);
-    sprintf(tmp_subject, "(hash %s %s)", subject_type, present_subject);
-
-    /* Create the cert sequence */
-    HIP_IFEL(cert_spki_build_cert(content), -1,
-             "cert_spki_build_cert failed\n");
-
-    HIP_IFEL(cert_spki_inject(content, "cert", tmp_after), -1,
-             "cert_spki_inject failed to inject\n");
-    HIP_IFEL(cert_spki_inject(content, "cert", tmp_before), -1,
-             "cert_spki_inject failed to inject\n");
-    HIP_IFEL(cert_spki_inject(content, "cert", "(subject )"), -1,
-             "cert_spki_inject failed to inject\n");
-    HIP_IFEL(cert_spki_inject(content, "subject", tmp_subject), -1,
-             "cert_spki_inject failed to inject\n");
-    HIP_IFEL(cert_spki_inject(content, "cert", "(issuer )"), -1,
-             "cert_spki_inject failed to inject\n");
-    HIP_IFEL(cert_spki_inject(content, "issuer", tmp_issuer), -1,
-             "cert_spki_inject failed to inject\n");
-
-    /* Create the signature and the public-key sequences */
-
-    /* Send the daemon the struct hip_cert_spki_header
-     * containing the cert sequence in content->cert.
-     * As a result you should get the struct back with
-     * public-key and signature fields filled */
-
-    /* build the msg to be sent to the daemon */
-    hip_msg_init(msg);
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_SPKI_SIGN, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_spki_info(msg, content), -1,
-             "Failed to build cert_info\n");
-    /* send and wait */
-    HIP_DEBUG("Sending request to sign SPKI cert sequence to "
-              "daemon and waiting for answer\n");
-    hip_send_recv_daemon_info(msg, 0, hip_user_socket);
-
-    /* get the struct from the message sent back by the daemon */
-    HIP_IFEL(!(returned = hip_get_param(msg, HIP_PARAM_CERT_SPKI_INFO)),
-             -1, "No hip_cert_spki_info struct found from daemons msg\n");
-
-    memcpy(content, returned, sizeof(struct hip_cert_spki_info));
-
-out_err:
-    /* free everything malloced */
-    free(tmp_before);
-    free(tmp_after);
-    free(tmp_issuer);
-    free(tmp_subject);
-    free(msg);
-    return err;
-}
-
-/**
- * Function to build the create minimal SPKI cert
- *
- * @param content holds the struct hip_cert_spki_info containing
- *                the minimal needed information for cert object,
- *                also contains the char table where the cert object
- *                is to be stored
- * @param issuer_type With HIP its HIT
- * @param issuer HIT in representation encoding 2001:001...
- * @param subject_type With HIP its HIT
- * @param subject HIT in representation encoding 2001:001...
- * @param not_before time in timeval before which the cert should not be used
- * @param not_after time in timeval after which the cert should not be used
- * @return 0 if ok -1 if error
- */
-int hip_cert_spki_create_cert(struct hip_cert_spki_info *content,
-                              const char *issuer_type, struct in6_addr *issuer,
-                              const char *subject_type, struct in6_addr *subject,
-                              time_t *not_before, time_t *not_after)
-{
-    return cert_spki_create_cert_sock(content, issuer_type, issuer,
-                                      subject_type, subject, not_before,
-                                      not_after, 0);
-}
-
-/**
- * Function that takes the cert in single char table and constructs
- * hip_cert_spki_info from it
- *
- * @param from char pointer to the whole certificate
- * @param to hip_cert_spki_info containing the char table where to insert
- *
- * @return 0 if ok and negative if error.
- */
-int hip_cert_spki_char2certinfo(char *from, struct hip_cert_spki_info *to)
-{
-    int start = 0, stop = 0;
-    /*
-     * p_rule looks for string "(public_key " after which there can be
-     * pretty much anything until string "|)))" is encountered.
-     * This is the public-key sequence.
-     */
-    char p_rule[] = "[(]public_key [ A-Za-z0-9+|/()#=-]*[|][)][)][)]";
-    /*
-     * c_rule looks for string "(cert " after which there can be
-     * pretty much anything until string '"))' is encountered.
-     * This is the cert sequence.
-     */
-    char c_rule[] = "[(]cert [ A-Za-z0-9+|/():=_\"-]*[\"][)][)]";     //\" is one char
-    /*
-     * s_rule looks for string "(signature " after which there can be
-     * pretty much anything until string "|))" is encountered.
-     * This is the signature sequence.
-     */
-    char s_rule[] = "[(]signature [ A-Za-z0-9+/|()=]*[|][)][)]";
-
-    /* Look for the public key */
-    if (hip_cert_regex(p_rule, from, &start, &stop)) {
-        HIP_ERROR("Failed to run hip_cert_regex (public-key)\n");
-        return -1;
-    }
-    snprintf(to->public_key, stop - start + 1, "%s", &from[start]);
-
-    /* Look for the cert sequence */
-    start = stop = 0;
-    if (hip_cert_regex(c_rule, from, &start, &stop)) {
-        HIP_ERROR("Failed to run hip_cert_regex (cert)\n");
-        return -1;
-    }
-    snprintf(to->cert, stop - start + 1, "%s", &from[start]);
-
-    /* look for the signature sequence */
-    start = stop = 0;
-    if (hip_cert_regex(s_rule, from, &start, &stop)) {
-        HIP_ERROR("Failed to run hip_cert_regex (signature)\n");
-        return -1;
-    }
-    snprintf(to->signature, stop - start + 1, "%s", &from[start]);
-
-    return 0;
-}
-
-/**
- * Function that sends the given hip_cert_spki_info to the daemon to
- * verification
- *
- * @param to_verification is the cert to be verified
- *
- * @return 0 if ok and negative if error or unsuccessful.
- *
- * @note use hip_cert_spki_char2certinfo to build the hip_cert_spki_info
- */
-int hip_cert_spki_send_to_verification(struct hip_cert_spki_info *to_verification)
-{
-    int                              err = 0;
-    struct hip_common               *msg;
-    const struct hip_cert_spki_info *returned;
-
-    if (!(msg = malloc(HIP_MAX_PACKET))) {
-        HIP_ERROR("Malloc for msg failed\n");
-        return -ENOMEM;
-    }
-    hip_msg_init(msg);
-    /* build the msg to be sent to the daemon */
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_SPKI_VERIFY, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_spki_info(msg, to_verification), -1,
-             "Failed to build cert_info\n");
-
-    /* send and wait */
-    HIP_DEBUG("Sending request to verify SPKI cert to "
-              "daemon and waiting for answer\n");
-    hip_send_recv_daemon_info(msg, 0, 0);
-
-    HIP_IFEL(!(returned = hip_get_param(msg, HIP_PARAM_CERT_SPKI_INFO)),
-             -1, "No hip_cert_spki_info struct found from daemons msg\n");
-
-    memcpy(to_verification, returned, sizeof(struct hip_cert_spki_info));
-
-out_err:
-    free(msg);
-    return err;
-}
-
-/******************************************************************************
- * FUNCTIONS FOR x509v3                                                       *
- ******************************************************************************/
-
-/**
- * Function that requests for a certificate from daemon and gives it back.
- *
- * @param subject is the subjects HIT
- *
- * @param certificate is pointer to a buffer to which this function writes the completed cert
- *
- * @return positive on success negative otherwise
- *
- * @note The certificate is given in DER encoding
- */
-int hip_cert_x509v3_request_certificate(struct in6_addr *subject,
-                                        unsigned char *certificate)
-{
-    int                              err = 0;
-    struct hip_common               *msg;
-    const struct hip_cert_x509_resp *p;
-
-    if (!(msg = malloc(HIP_MAX_PACKET))) {
-        HIP_ERROR("Malloc for msg failed\n");
-        return -ENOMEM;
-    }
-    hip_msg_init(msg);
-    /* build the msg to be sent to the daemon */
-
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_X509V3_SIGN, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_x509_req(msg, subject), -1,
-             "Failed to build cert_info\n");
-    /* send and wait */
-    HIP_DEBUG("Sending request to sign x509 cert to "
-              "daemon and waiting for answer\n");
-    hip_send_recv_daemon_info(msg, 0, 0);
-    /* get the struct from the message sent back by the daemon */
-    HIP_IFEL(!(p = hip_get_param(msg, HIP_PARAM_CERT_X509_RESP)), -1,
-             "No name x509 struct found\n");
-    memcpy(certificate, p->der, p->der_len);
-    err = p->der_len;
-
-out_err:
-    free(msg);
-    return err;
-}
-
-/**
- * Function that requests for a verification of a certificate from
- * daemon and tells the result.
- *
- * @param certificate is pointer to a certificate to be verified
- * @param len is the length of the cert in certificate parameter in bytes
- *
- * @return 0 on success negative otherwise
- *
- * @note give the certificate in PEM encoding
- */
-int hip_cert_x509v3_request_verification(unsigned char *certificate, int len)
-{
-    int                              err = 0;
-    struct hip_common               *msg;
-    const struct hip_cert_x509_resp *received;
-
-    if (!(msg = malloc(HIP_MAX_PACKET))) {
-        HIP_ERROR("Malloc for msg failed\n");
-        return -ENOMEM;
-    }
-    hip_msg_init(msg);
-
-    /* build the msg to be sent to the daemon */
-    HIP_IFEL(hip_build_user_hdr(msg, HIP_MSG_CERT_X509V3_VERIFY, 0), -1,
-             "Failed to build user header\n");
-    HIP_IFEL(hip_build_param_cert_x509_ver(msg, (char *) certificate, len), -1,
-             "Failed to build cert_info\n");
-
-    /* send and wait */
-    HIP_DEBUG("Sending request to verify x509  cert to "
-              "daemon and waiting for answer\n");
-    hip_send_recv_daemon_info(msg, 0, 0);
-
-    /* get the struct from the message sent back by the daemon */
-    HIP_IFEL(!(received = hip_get_param(msg, HIP_PARAM_CERT_X509_RESP)), -1,
-             "No x509 struct found\n");
-    err = hip_get_msg_err(msg);
-    if (err == 0) {
-        HIP_DEBUG("Verified successfully\n");
-    } else {
-        HIP_DEBUG("Verification failed\n");
-    }
-
-out_err:
-    free(msg);
-    return err;
-}
-
-/*****************************************************************************
- * UTILITY FUNCTIONS                                                         *
- *****************************************************************************/
-
-/**
- * Read configuration section from loaded configuration file.
- *
- * @param section_name the name of the section to be retrieved
- * @param conf         the loaded configuration to read from
- *
- * @return STACK_OF(CONF_VALUE) pointer if OK, NULL on error
- *
- * @note Remember to open the configuration file with hip_cert_open_conf() and
- *       close it after processing with NCONF_free().
- */
-STACK_OF(CONF_VALUE) *hip_read_conf_section(const char *section_name,
-                                            CONF *conf)
-{
-    STACK_OF(CONF_VALUE) *sec;
-
-    if (!(sec = NCONF_get_section(conf, section_name))) {
-        HIP_ERROR("Section %s was not in the configuration (%s)\n",
-                  section_name, HIP_CERT_CONF_PATH);
-        return NULL;
-    }
-
-    return sec;
-}
-
-/**
- * Load a configuration file from HIP_CERT_CONF_PATH.
- *
- * @return CONF pointer if OK, NULL on error
- */
-CONF *hip_open_conf(const char *filename)
-{
-    long  err;
-    CONF *conf;
-
-    conf = NCONF_new(NCONF_default());
-    if (!NCONF_load(conf, filename, &err)) {
-        HIP_ERROR("Error opening the configuration file");
-        return NULL;
-    }
-    return conf;
-}
-
-/**
- * Function that wraps regular expression stuff and gives the answer :)
- *
- * @param what is a char pointer to the rule used in the search (POSIX)
- * @param from where are we looking for it char pointer
- * @param start will store the start point of the found substr
- * @param stop will store the end point of the found substr
- *
- * @return 0 if ok and negative if error.
- *
- * @note Be carefull with the what so you get what you want :)
- */
-int hip_cert_regex(char *what, char *from, int *start, int *stop)
-{
-    int        err = 0, status = 0;
-    regex_t    re;
-    regmatch_t answer[1];
-
-    *start = *stop = 0;
-
-    /* Compiling the regular expression */
-    if (regcomp(&re, what, REG_EXTENDED)) {
-        HIP_ERROR("Compilation of the regular expression failed\n");
-        return -1;
-    }
-    /* Running the regular expression */
-    // TODO this might need to be an error!?
-    // this needs to be separated to found, not found, and error -Samu
-    if ((status = regexec(&re, from, 1, answer, 0))) {
-        err = -1;
-        goto out_err;
-    }
-
-    *start = answer[0].rm_so;
-    *stop  = answer[0].rm_eo;
-
-out_err:
-    regfree(&re);
-    return err;
-}

=== removed file 'lib/core/certtools.h'
--- lib/core/certtools.h	2012-01-14 15:29:47 +0000
+++ lib/core/certtools.h	1970-01-01 00:00:00 +0000
@@ -1,79 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * Certificate building, parseing and verification functions.
- */
-
-#ifndef HIPL_LIB_CORE_CERTTOOLS_H
-#define HIPL_LIB_CORE_CERTTOOLS_H
-
-#include <stdint.h>
-#include <netinet/in.h>
-#include <openssl/rsa.h>
-#include <openssl/ossl_typ.h>
-#include <sys/types.h>
-
-#include "protodefs.h"
-
-
-/** Defines */
-#define HIP_CERT_CONF_PATH HIPL_SYSCONFDIR "/hip_cert.conf"
-
-#define HIP_CERT_DAY 86400
-
-/** Struct used to deliver the minimal needed information to build SPKI cert */
-struct hip_cert_spki_info {
-    hip_tlv         type;
-    hip_tlv_len     length;
-    char            public_key[768];
-    char            cert[224];
-    char            signature[768];
-    struct in6_addr issuer_hit;
-    /* 0 if successfully verified otherwise negative */
-    uint32_t success;
-};
-
-/** SPKI cert related functions */
-int hip_cert_spki_lib_verify(struct hip_cert_spki_info *);
-int hip_cert_spki_create_cert(struct hip_cert_spki_info *,
-                              const char *, struct in6_addr *,
-                              const char *, struct in6_addr *,
-                              time_t *, time_t *);
-int hip_cert_spki_char2certinfo(char *, struct hip_cert_spki_info *);
-int hip_cert_spki_send_to_verification(struct hip_cert_spki_info *);
-
-/* x509v3 cert related functions */
-int hip_cert_x509v3_request_certificate(struct in6_addr *, unsigned char *);
-int hip_cert_x509v3_request_verification(unsigned char *, int);
-
-/** utility functions */
-STACK_OF(CONF_VALUE) *hip_read_conf_section(const char *section_name,
-                                            CONF *conf);
-CONF *hip_open_conf(const char *filename);
-int hip_cert_regex(char *, char *, int *, int *);
-
-#endif /* HIPL_LIB_CORE_CERTTOOLS_H */

=== removed file 'test/certteststub.c'
--- test/certteststub.c	2012-01-14 15:29:47 +0000
+++ test/certteststub.c	1970-01-01 00:00:00 +0000
@@ -1,196 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * A teststub for certtools.c/h
- *
- * File for testing the main operations of certtools.
- * First this test takes the default HIT and the corresponding key.
- * Secondly it creates a certificate where itself is the issuer and the subject.
- * Then it tries to verify it. If it succeeds everything should be OK :)
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <arpa/inet.h>
-#include <openssl/conf.h>
-#include <openssl/ossl_typ.h>
-#include <openssl/safestack.h>
-
-#include "lib/core/certtools.h"
-#include "lib/core/debug.h"
-#include "lib/core/ife.h"
-#include "lib/core/protodefs.h"
-
-
-int main(int argc, char *argv[])
-{
-    int                        err             = 0, i = 0, len;
-    struct hip_cert_spki_info *cert            = NULL;
-    struct hip_cert_spki_info *to_verification = NULL;
-    time_t                     not_before      = 0, not_after = 0;
-    struct hip_common         *msg;
-    struct in6_addr           *defhit;
-    char                       certificate[1024];
-    unsigned char              der_cert[1024];
-    CONF                      *conf;
-    CONF_VALUE                *item;
-    STACK_OF(CONF_VALUE)      *sec      = NULL;
-    STACK_OF(CONF_VALUE)      *sec_name = NULL;
-
-    if (argc != 2) {
-        printf("Usage: %s spki|x509\n", argv[0]);
-        exit(EXIT_SUCCESS);
-    }
-
-    HIP_DEBUG("- This test tool has to be run as root otherwise this will fail!\n");
-    HIP_DEBUG("- Hipd has to run otherwise this will hang!\n");
-
-    HIP_IFEL(!(msg = malloc(HIP_MAX_PACKET)), -1,
-             "Malloc for msg failed\n");
-    defhit = malloc(sizeof(struct in6_addr));
-    if (!defhit) {
-        goto out_err;
-    }
-
-    if (strcmp(argv[1], "spki")) {
-        goto skip_spki;
-    }
-
-    HIP_DEBUG("Starting to test SPKI certficate tools\n");
-
-    cert = malloc(sizeof(struct hip_cert_spki_info));
-    if (!cert) {
-        goto out_err;
-    }
-
-    to_verification = malloc(sizeof(struct hip_cert_spki_info));
-    if (!to_verification) {
-        goto out_err;
-    }
-
-    time(&not_before);
-    time(&not_after);
-    HIP_DEBUG("Reading configuration file (%s)\n", HIP_CERT_CONF_PATH);
-    conf = hip_open_conf(HIP_CERT_CONF_PATH);
-    sec  = hip_read_conf_section("hip_spki", conf);
-
-    for (i = 0; i < sk_CONF_VALUE_num(sec); i++) {
-        item = sk_CONF_VALUE_value(sec, i);
-        if (!strcmp(item->name, "issuerhit")) {
-            err = inet_pton(AF_INET6, item->value, defhit);
-            if (err < 1) {
-                err = -1;
-                goto out_err;
-            }
-        }
-        if (!strcmp(item->name, "days")) {
-            not_after += HIP_CERT_DAY * atoi(item->value);
-        }
-    }
-    NCONF_free(conf);
-
-    hip_cert_spki_create_cert(cert,
-                              "hit", defhit,
-                              "hit", defhit,
-                              &not_before,
-                              &not_after);
-
-    /*
-     * Concatenate everything together as if we would have gotten
-     * it from someone else and we would be starting to verify.
-     *
-     * So the process would be take the cert blob and take out
-     * public-key sequence, cert sequence and signature sequence
-     * and create a hip_cert_spki_info and send it to the daemon
-     * for verification.
-     */
-    sprintf((char *) &certificate, "(sequence %s%s%s)",
-            cert->public_key,
-            cert->cert,
-            cert->signature);
-    HIP_DEBUG("\n\nCertificate gotten back from daemon:\n\n"
-              "%s\n\nCertificate len %d\n\n",
-              certificate,
-              strlen(certificate));
-
-    HIP_IFEL(hip_cert_spki_char2certinfo(certificate, to_verification), -1,
-             "Failed to construct the hip_cert_spki_info from certificate\n");
-
-    /*
-     * below, commented out, is the daemons version of the verification
-     * and below that is the lib version of the verification
-     */
-    /*
-     * HIP_DEBUG("Sending the certificate to daemon for verification\n");
-     *
-     * HIP_IFEL(hip_cert_spki_send_to_verification(to_verification), -1,
-     *       "Failed in sending to verification\n");
-     * HIP_IFEL(to_verification->success, -1,
-     *       "Verification was not successful\n");
-     * HIP_DEBUG("Verification was successful (return value %d)\n",
-     *        to_verification->success);
-     */
-    /* Lets do the verification in library */
-    HIP_IFEL(hip_cert_spki_lib_verify(to_verification), -1,
-             "Verification was not successful\n");
-    HIP_DEBUG("Verification was successful (return value %d)\n",
-              to_verification->success);
-
-    goto out_err;
-
-skip_spki:
-    HIP_DEBUG("Starting to test x509v3 support\n");
-
-    conf     = hip_open_conf(HIP_CERT_CONF_PATH);
-    sec_name = hip_read_conf_section("hip_x509v3_name", conf);
-
-    for (i = 0; i < sk_CONF_VALUE_num(sec_name); i++) {
-        item = sk_CONF_VALUE_value(sec_name, i);
-        if (!strcmp(item->name, "issuerhit")) {
-            err = inet_pton(AF_INET6, item->value, defhit);
-            if (err < 1) {
-                err = -1;
-                goto out_err;
-            }
-        }
-    }
-    NCONF_free(conf);
-    len = hip_cert_x509v3_request_certificate(defhit, der_cert);
-
-    /** Now send it back for the verification */
-    HIP_IFEL((err = hip_cert_x509v3_request_verification(der_cert, len) < 0),
-             -1, "Failed to verify a certificate\n");
-
-out_err:
-    HIP_DEBUG("If there was no errors above, \"everything\" is OK\n");
-
-    free(cert);
-    free(to_verification);
-    exit(err);
-}

=== removed file 'tools/pisacert.c'
--- tools/pisacert.c	2011-08-15 14:11:56 +0000
+++ tools/pisacert.c	1970-01-01 00:00:00 +0000
@@ -1,154 +0,0 @@
-/*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-/**
- * @file
- * Generate a SPKI certificate for use with PISA.
- */
-
-#include <errno.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <unistd.h>
-#include <sys/types.h>
-
-#include "lib/core/builder.h"
-#include "lib/core/certtools.h"
-#include "lib/core/icomm.h"
-#include "lib/core/ife.h"
-#include "lib/core/message.h"
-#include "lib/core/protodefs.h"
-
-
-/**
- * Get the default hit of the local HIPD.
- *
- * @param result location to store the result in
- * @return 0 on success
- */
-static int get_default_hit(struct in6_addr *result)
-{
-    int                          err   = 0;
-    struct       hip_common     *msg   = NULL;
-    const struct hip_tlv_common *param = NULL;
-    const struct in6_addr       *hit   = NULL;
-
-    if (!(msg = hip_msg_alloc())) {
-        return -1;
-    }
-
-    HIP_IFE(hip_build_user_hdr(msg, HIP_MSG_GET_DEFAULT_HIT, 0), -1);
-    HIP_IFE(hip_send_recv_daemon_info(msg, 0, 0), -ECOMM);
-
-    param = hip_get_param(msg, HIP_PARAM_HIT);
-    hit   = hip_get_param_contents_direct(param);
-    memcpy(result, hit, sizeof(struct in6_addr));
-
-out_err:
-    free(msg);
-    return err;
-}
-
-/**
- * Create the certificate with the given parameters.
- *
- * @param not_before start of certificate lifetime
- * @param not_after end of certificate lifetime
- * @param hit HIT of issuer and subject
- * @param certificate buffer to store the resulting certificate in
- * @param size size of the certificate buffer
- * @return 0 on success
- */
-static int create_certificate(time_t *not_before, time_t *not_after,
-                              struct in6_addr *hit, char *certificate,
-                              size_t size)
-{
-    int                       err = 0;
-    struct hip_cert_spki_info cert;
-
-    HIP_IFEL(!not_before || !not_after || !hit || !certificate, -1,
-             "NULL parameter found.\n");
-
-    hip_cert_spki_create_cert(&cert, "hit", hit, "hit", hit, not_before,
-                              not_after);
-
-    snprintf(certificate, size, "(sequence %s%s%s)", cert.public_key,
-             cert.cert, cert.signature);
-out_err:
-    if (err != 0 && certificate) {
-        certificate[0] = '\0';
-    }
-    return err;
-}
-
-int main(int argc, char *argv[])
-{
-    time_t          not_before = 0, not_after = 0;
-    struct in6_addr hit;
-    int             err               = 0, days = 0;
-    FILE           *f                 = NULL;
-    char            certificate[1024] = "";
-    size_t          cert_len, cert_out;
-
-    HIP_IFEL(argc != 3, -1, "Wrong number of arguments.\n");
-
-    HIP_IFEL(getuid() != 0, -1, "You're not superuser.\n");
-
-    days = atoi(argv[1]);
-    HIP_IFEL(days <= 0, -1, "Specify a positive number of days.\n");
-
-    f = fopen(argv[2], "w");
-    HIP_IFEL(f == NULL, -1, "Could not write to file.\n");
-
-    time(&not_before);
-    time(&not_after);
-    not_after += days * 24 * 60 * 60;
-
-    HIP_IFEL(get_default_hit(&hit), -1, "Could not get HIT from hipd.\n");
-    HIP_IFEL(create_certificate(&not_before, &not_after, &hit,
-                                certificate, sizeof(certificate)) != 0,
-             -1, "Could not create the certificate.\n");
-
-    cert_len = strlen(certificate);
-    cert_out = fwrite(certificate, cert_len, 1, f);
-    if (cert_len != cert_out) {
-        HIP_ERROR("Failed to write certificate to file\n");
-        err = -1;
-    }
-
-out_err:
-    if (err == -1) {
-        fprintf(stderr, "usage: pisacert days filename\n");
-        fprintf(stderr, "must be run as superuser, e.g. with sudo\n");
-    }
-
-    if (f) {
-        fclose(f);
-    }
-
-    return err;
-}