/*
 * Copyright (C) 2016 Andreas Steffen
 * Copyright (C) 2009-2025 Tobias Brunner
 * Copyright (C) 2005-2009 Martin Willi
 * Copyright (C) 2005 Jan Hutter
 *
 * Copyright (C) secunet Security Networks AG
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */

#include <string.h>
#include <stdio.h>
#include <errno.h>

#ifdef HAVE_REGEX
#include <regex.h>
#else
/* usually, POSIX regular expressions are supported. for the rare case they are
 * not, e.g. when cross-compiling for Windows, we define some stubs to simplify
 * the implementation below */
typedef void regex_t;
static int regexec(const regex_t *restrict preg, const char *restrict string,
				   size_t nmatch, void *pmatch, int eflags)
{
	return -1;
}

static void regfree(regex_t *preg)
{
}
#endif /* HAVE_REGEX */

#include "identification.h"

#include <utils/utils.h>
#include <asn1/oid.h>
#include <asn1/asn1.h>
#include <crypto/hashers/hasher.h>
#include <collections/array.h>

ENUM_BEGIN(id_match_names, ID_MATCH_NONE, ID_MATCH_MAX_WILDCARDS,
	"MATCH_NONE",
	"MATCH_ANY",
	"MATCH_MAX_WILDCARDS");
ENUM_NEXT(id_match_names, ID_MATCH_PERFECT, ID_MATCH_PERFECT, ID_MATCH_MAX_WILDCARDS,
	"MATCH_PERFECT");
ENUM_END(id_match_names, ID_MATCH_PERFECT);

ENUM_BEGIN(id_type_names, ID_ANY, ID_KEY_ID,
	"ID_ANY",
	"ID_IPV4_ADDR",
	"ID_FQDN",
	"ID_RFC822_ADDR",
	"ID_IPV4_ADDR_SUBNET",
	"ID_IPV6_ADDR",
	"ID_IPV6_ADDR_SUBNET",
	"ID_IPV4_ADDR_RANGE",
	"ID_IPV6_ADDR_RANGE",
	"ID_DER_ASN1_DN",
	"ID_DER_ASN1_GN",
	"ID_KEY_ID");
ENUM_NEXT(id_type_names, ID_DER_ASN1_GN_URI, ID_DER_ASN1_GN_URI, ID_KEY_ID,
	"ID_DER_ASN1_GN_URI");
ENUM_END(id_type_names, ID_DER_ASN1_GN_URI);

/**
 * coding of X.501 distinguished name
 */
typedef struct {
	const u_char *name;
	int oid;
	u_char type;
} x501rdn_t;

static const x501rdn_t x501rdns[] = {
	{"ND", 					OID_NAME_DISTINGUISHER,		ASN1_PRINTABLESTRING},
	{"UID", 				OID_PILOT_USERID,			ASN1_PRINTABLESTRING},
	{"DC", 					OID_PILOT_DOMAIN_COMPONENT, ASN1_PRINTABLESTRING},
	{"CN",					OID_COMMON_NAME,			ASN1_PRINTABLESTRING},
	{"SN", 					OID_SURNAME,				ASN1_PRINTABLESTRING},
	{"serialNumber", 		OID_SERIAL_NUMBER,			ASN1_PRINTABLESTRING},
	{"C", 					OID_COUNTRY,				ASN1_PRINTABLESTRING},
	{"L", 					OID_LOCALITY,				ASN1_PRINTABLESTRING},
	{"ST",					OID_STATE_OR_PROVINCE,		ASN1_PRINTABLESTRING},
	{"STREET",				OID_STREET_ADDRESS,			ASN1_PRINTABLESTRING},
	{"O", 					OID_ORGANIZATION,			ASN1_PRINTABLESTRING},
	{"OU", 					OID_ORGANIZATION_UNIT,		ASN1_PRINTABLESTRING},
	{"T", 					OID_TITLE,					ASN1_PRINTABLESTRING},
	{"D", 					OID_DESCRIPTION,			ASN1_PRINTABLESTRING},
	{"postalAddress",		OID_POSTAL_ADDRESS,			ASN1_PRINTABLESTRING},
	{"postalCode",			OID_POSTAL_CODE,			ASN1_PRINTABLESTRING},
	{"N", 					OID_NAME,					ASN1_PRINTABLESTRING},
	{"G", 					OID_GIVEN_NAME,				ASN1_PRINTABLESTRING},
	{"I", 					OID_INITIALS,				ASN1_PRINTABLESTRING},
	{"dnQualifier", 		OID_DN_QUALIFIER,			ASN1_PRINTABLESTRING},
	{"dmdName", 			OID_DMD_NAME,				ASN1_PRINTABLESTRING},
	{"pseudonym", 			OID_PSEUDONYM,				ASN1_PRINTABLESTRING},
	{"ID", 					OID_UNIQUE_IDENTIFIER,		ASN1_PRINTABLESTRING},
	{"EN", 					OID_EMPLOYEE_NUMBER,		ASN1_PRINTABLESTRING},
	{"employeeNumber",		OID_EMPLOYEE_NUMBER,		ASN1_PRINTABLESTRING},
	{"E",					OID_EMAIL_ADDRESS,			ASN1_IA5STRING},
	{"Email", 				OID_EMAIL_ADDRESS,			ASN1_IA5STRING},
	{"emailAddress",		OID_EMAIL_ADDRESS,			ASN1_IA5STRING},
	{"UN",					OID_UNSTRUCTURED_NAME,		ASN1_IA5STRING},
	{"unstructuredName",	OID_UNSTRUCTURED_NAME,		ASN1_IA5STRING},
	{"UA",					OID_UNSTRUCTURED_ADDRESS,	ASN1_PRINTABLESTRING},
	{"unstructuredAddress", OID_UNSTRUCTURED_ADDRESS,	ASN1_PRINTABLESTRING},
	{"TCGID", 				OID_TCGID,					ASN1_PRINTABLESTRING}
};

/**
 * maximum number of RDNs in atodn()
 */
#define RDN_MAX			20

typedef struct private_identification_t private_identification_t;

/**
 * Private data of an identification_t object.
 */
struct private_identification_t {
	/**
	 * Public interface.
	 */
	identification_t public;

	/**
	 * Encoded representation of this ID.
	 */
	chunk_t encoded;

	/**
	 * Type of this ID.
	 */
	id_type_t type;

	/**
	 * Pointer if we use regex comparison.
	 */
	regex_t *regex;
};

/**
 * Check that neither object uses a regex.
 */
static inline bool neither_is_regex(private_identification_t *this,
									identification_t *other)
{
	private_identification_t *other_priv = (private_identification_t*)other;
	return !this->regex && !other_priv->regex;
}

/**
 * Enumerator over RDNs
 */
typedef struct {
	/* implements enumerator interface */
	enumerator_t public;
	/* next set to parse, if any */
	chunk_t sets;
	/* next sequence in set, if any */
	chunk_t seqs;
} rdn_enumerator_t;

METHOD(enumerator_t, rdn_enumerate, bool,
	rdn_enumerator_t *this, va_list args)
{
	chunk_t rdn, *oid, *data;
	u_char *type;

	VA_ARGS_VGET(args, oid, type, data);

	/* a DN contains one or more SET, each containing one or more SEQUENCES,
	 * each containing a OID/value RDN */
	if (!this->seqs.len)
	{
		/* no SEQUENCEs in current SET, parse next SET */
		if (asn1_unwrap(&this->sets, &this->seqs) != ASN1_SET)
		{
			return FALSE;
		}
	}
	if (asn1_unwrap(&this->seqs, &rdn) == ASN1_SEQUENCE &&
		asn1_unwrap(&rdn, oid) == ASN1_OID)
	{
		int t = asn1_unwrap(&rdn, data);

		if (t != ASN1_INVALID)
		{
			*type = t;
			return TRUE;
		}
	}
	return FALSE;
}

/**
 * Create an enumerator over all RDNs (oid, string type, data) of a DN
 */
static enumerator_t *create_rdn_enumerator(chunk_t dn)
{
	rdn_enumerator_t *e;

	INIT(e,
		.public = {
			.enumerate = enumerator_enumerate_default,
			.venumerate = _rdn_enumerate,
			.destroy = (void*)free,
		},
	);

	/* a DN is a SEQUENCE, get the first SET of it */
	if (asn1_unwrap(&dn, &e->sets) == ASN1_SEQUENCE)
	{
		e->seqs = chunk_empty;
		return &e->public;
	}
	free(e);
	return enumerator_create_empty();
}

/**
 * Part enumerator over RDNs
 */
typedef struct {
	/* implements enumerator interface */
	enumerator_t public;
	/* inner RDN enumerator */
	enumerator_t *inner;
} rdn_part_enumerator_t;

METHOD(enumerator_t, rdn_part_enumerate, bool,
	rdn_part_enumerator_t *this, va_list args)
{
	int i, known_oid, strtype;
	chunk_t oid, inner_data, *data;
	id_part_t *type;
	static const struct {
		int oid;
		id_part_t type;
	} oid2part[] = {
		{OID_COMMON_NAME,		ID_PART_RDN_CN},
		{OID_SURNAME,			ID_PART_RDN_SN},
		{OID_SERIAL_NUMBER,		ID_PART_RDN_SERIAL_NUMBER},
		{OID_COUNTRY,			ID_PART_RDN_C},
		{OID_LOCALITY,			ID_PART_RDN_L},
		{OID_STATE_OR_PROVINCE,	ID_PART_RDN_ST},
		{OID_ORGANIZATION,		ID_PART_RDN_O},
		{OID_ORGANIZATION_UNIT,	ID_PART_RDN_OU},
		{OID_TITLE,				ID_PART_RDN_T},
		{OID_DESCRIPTION,		ID_PART_RDN_D},
		{OID_NAME,				ID_PART_RDN_N},
		{OID_GIVEN_NAME,		ID_PART_RDN_G},
		{OID_INITIALS,			ID_PART_RDN_I},
		{OID_DN_QUALIFIER,		ID_PART_RDN_DNQ},
		{OID_DMD_NAME,			ID_PART_RDN_DMDN},
		{OID_PSEUDONYM,			ID_PART_RDN_PN},
		{OID_UNIQUE_IDENTIFIER,	ID_PART_RDN_ID},
		{OID_EMAIL_ADDRESS,		ID_PART_RDN_E},
		{OID_EMPLOYEE_NUMBER,	ID_PART_RDN_EN},
	};

	VA_ARGS_VGET(args, type, data);

	while (this->inner->enumerate(this->inner, &oid, &strtype, &inner_data))
	{
		known_oid = asn1_known_oid(oid);
		for (i = 0; i < countof(oid2part); i++)
		{
			if (oid2part[i].oid == known_oid)
			{
				*type = oid2part[i].type;
				*data = inner_data;
				return TRUE;
			}
		}
	}
	return FALSE;
}

METHOD(enumerator_t, rdn_part_enumerator_destroy, void,
	rdn_part_enumerator_t *this)
{
	this->inner->destroy(this->inner);
	free(this);
}

METHOD(identification_t, create_part_enumerator, enumerator_t*,
	private_identification_t *this)
{
	switch (this->type)
	{
		case ID_DER_ASN1_DN:
		{
			rdn_part_enumerator_t *e;

			INIT(e,
				.inner = create_rdn_enumerator(this->encoded),
				.public = {
					.enumerate = enumerator_enumerate_default,
					.venumerate = _rdn_part_enumerate,
					.destroy = _rdn_part_enumerator_destroy,
				},
			);
			return &e->public;
		}
		case ID_RFC822_ADDR:
			/* TODO */
		case ID_FQDN:
			/* TODO */
		default:
			return enumerator_create_empty();
	}
}

/**
 * Print a separator between two RDNs
 */
static inline bool print_separator(char **buf, size_t *len)
{
	int written;

	written = snprintf(*buf, *len, ", ");
	if (written < 0 || written >= *len)
	{
		return FALSE;
	}
	*buf += written;
	*len -= written;
	return TRUE;
}

/**
 * Print a DN with all its RDN in a buffer to present it to the user
 */
static void dntoa(chunk_t dn, char *buf, size_t len)
{
	enumerator_t *e;
	chunk_t oid_data, data, printable;
	u_char type;
	int oid, written;
	bool finished = FALSE, empty = TRUE;

	e = create_rdn_enumerator(dn);
	while (e->enumerate(e, &oid_data, &type, &data))
	{
		empty = FALSE;

		/* previous RDN was empty but it wasn't the last one */
		if (finished && !print_separator(&buf, &len))
		{
			break;
		}
		finished = FALSE;

		oid = asn1_known_oid(oid_data);
		if (oid == OID_UNKNOWN)
		{
			written = snprintf(buf, len, "%#B=", &oid_data);
		}
		else
		{
			written = snprintf(buf, len,"%s=", oid_names[oid].name);
		}
		if (written < 0 || written >= len)
		{
			break;
		}
		buf += written;
		len -= written;

		written = 0;
		chunk_printable(data, &printable, '?');
		if (printable.ptr)
		{
			written = snprintf(buf, len, "%.*s", (int)printable.len,
							   printable.ptr);
		}
		chunk_free(&printable);
		if (written < 0 || written >= len)
		{
			break;
		}
		buf += written;
		len -= written;

		if (!data.ptr)
		{	/* we can't calculate if we're finished, assume we are */
			finished = TRUE;
		}
		else if (data.ptr + data.len == dn.ptr + dn.len)
		{
			finished = TRUE;
			break;
		}
		else if (!print_separator(&buf, &len))
		{
			break;
		}
	}
	if (empty)
	{
		snprintf(buf, len, "");
	}
	else if (!finished)
	{
		snprintf(buf, len, "(invalid ID_DER_ASN1_DN)");
	}
	e->destroy(e);
}

/**
 * Converts an LDAP-style human-readable ASCII-encoded
 * ASN.1 distinguished name into binary DER-encoded format
 */
static status_t atodn(char *src, chunk_t *dn)
{
	/* finite state machine for atodn */
	typedef enum {
		SEARCH_OID =	0,
		READ_OID =		1,
		SEARCH_NAME =	2,
		READ_NAME =		3,
		UNKNOWN_OID =	4
	} state_t;

	chunk_t oid  = chunk_empty;
	chunk_t name = chunk_empty;
	chunk_t rdns[RDN_MAX];
	int rdn_count = 0;
	int dn_len = 0;
	int whitespace = 0;
	int i = 0;
	asn1_t rdn_type;
	state_t state = SEARCH_OID;
	status_t status = SUCCESS;
	char sep = '\0';

	do
	{
		switch (state)
		{
			case SEARCH_OID:
				if (!sep && *src == '/')
				{	/* use / as separator if the string starts with a slash */
					sep = '/';
					break;
				}
				if (*src != ' ' && *src != '\0')
				{
					if (!sep)
					{	/* use , as separator by default */
						sep = ',';
					}
					oid.ptr = src;
					oid.len = 1;
					state = READ_OID;
				}
				break;
			case READ_OID:
				if (*src != ' ' && *src != '=')
				{
					oid.len++;
				}
				else
				{
					bool found = FALSE;

					for (i = 0; i < countof(x501rdns); i++)
					{
						if (strlen(x501rdns[i].name) == oid.len &&
							strncasecmp(x501rdns[i].name, oid.ptr, oid.len) == 0)
						{
							found = TRUE;
							break;
						}
					}
					if (!found)
					{
						status = NOT_SUPPORTED;
						state = UNKNOWN_OID;
						break;
					}
					/* reset oid and change state */
					oid = chunk_empty;
					state = SEARCH_NAME;
				}
				break;
			case SEARCH_NAME:
				if (*src == ' ' || *src == '=')
				{
					break;
				}
				else if (*src != sep && *src != '\0')
				{
					name.ptr = src;
					name.len = 1;
					whitespace = 0;
					state = READ_NAME;
					break;
				}
				name = chunk_empty;
				whitespace = 0;
				state = READ_NAME;
				/* fall-through */
			case READ_NAME:
				if (*src != sep && *src != '\0')
				{
					name.len++;
					if (*src == ' ')
						whitespace++;
					else
						whitespace = 0;
				}
				else
				{
					name.len -= whitespace;
					rdn_type = (x501rdns[i].type == ASN1_PRINTABLESTRING
								&& !asn1_is_printablestring(name))
								? ASN1_UTF8STRING : x501rdns[i].type;

					if (rdn_count < RDN_MAX)
					{
						chunk_t rdn_oid;

						rdn_oid = asn1_build_known_oid(x501rdns[i].oid);
						if (rdn_oid.len)
						{
							rdns[rdn_count] =
									asn1_wrap(ASN1_SET, "m",
										asn1_wrap(ASN1_SEQUENCE, "mm",
											rdn_oid,
											asn1_wrap(rdn_type, "c", name)
										)
									);
							dn_len += rdns[rdn_count++].len;
						}
						else
						{
							status = INVALID_ARG;
						}
					}
					else
					{
						status = OUT_OF_RES;
					}
					/* reset name and change state */
					name = chunk_empty;
					state = SEARCH_OID;
				}
				break;
			case UNKNOWN_OID:
				break;
		}
	} while (*src++ != '\0');

	if (state == READ_OID)
	{	/* unterminated OID */
		status = INVALID_ARG;
	}

	/* build the distinguished name sequence */
	{
		int i;
		u_char *pos = asn1_build_object(dn, ASN1_SEQUENCE, dn_len);

		for (i = 0; i < rdn_count; i++)
		{
			memcpy(pos, rdns[i].ptr, rdns[i].len);
			pos += rdns[i].len;
			free(rdns[i].ptr);
		}
	}
	if (status != SUCCESS)
	{
		free(dn->ptr);
		*dn = chunk_empty;
	}
	return status;
}

METHOD(identification_t, get_encoding, chunk_t,
	private_identification_t *this)
{
	return this->encoded;
}

METHOD(identification_t, get_type, id_type_t,
	private_identification_t *this)
{
	return this->type;
}

/**
 * Check if this is a wildcard value
 */
static inline bool is_wildcard(chunk_t data)
{
	return data.len == 1 && data.ptr[0] == '*';
}

METHOD(identification_t, contains_wildcards_dn, bool,
	private_identification_t *this)
{
	enumerator_t *enumerator;
	bool contains = FALSE;
	id_part_t type;
	chunk_t data;

	enumerator = create_part_enumerator(this);
	while (enumerator->enumerate(enumerator, &type, &data))
	{
		if (is_wildcard(data))
		{
			contains = TRUE;
			break;
		}
	}
	enumerator->destroy(enumerator);
	return contains;
}

METHOD(identification_t, contains_wildcards_memchr, bool,
	private_identification_t *this)
{
	return memchr(this->encoded.ptr, '*', this->encoded.len) != NULL;
}

METHOD(identification_t, hash_binary, u_int,
	private_identification_t *this, u_int inc)
{
	u_int hash;

	hash = chunk_hash_inc(chunk_from_thing(this->type), inc);
	if (this->type != ID_ANY)
	{
		hash = chunk_hash_inc(this->encoded, hash);
	}
	if (this->regex)
	{	/* ensure regexes have different hashes even if type/encoding is equal */
		hash = chunk_hash_inc(chunk_from_chars(0x01), hash);
	}
	return hash;
}

METHOD(identification_t, equals_binary, bool,
	private_identification_t *this, identification_t *other)
{
	private_identification_t *other_priv = (private_identification_t*)other;

	if (this->type == other_priv->type &&
	   (neither_is_regex(this, other) || (this->regex && other_priv->regex)))
	{
		if (this->type == ID_ANY)
		{
			return TRUE;
		}
		return chunk_equals(this->encoded, other_priv->encoded);
	}
	return FALSE;
}

/**
 * Compare two RDNs for equality, comparing some string types case insensitive
 */
static bool rdn_equals(chunk_t oid, u_char a_type, chunk_t a, u_char b_type,
					   chunk_t b)
{
	if (a_type == b_type &&
		(a_type == ASN1_PRINTABLESTRING ||
		 (a_type == ASN1_IA5STRING &&
		  asn1_known_oid(oid) == OID_EMAIL_ADDRESS)))
	{	/* ignore case for printableStrings and email RDNs */
		return strncaseeq(a.ptr, b.ptr, a.len);
	}
	else
	{	/* respect case and length for everything else */
		return memeq(a.ptr, b.ptr, a.len);
	}
}

/**
 * RDNs when matching DNs
 */
typedef struct {
	chunk_t oid;
	u_char type;
	chunk_t data;
	bool matched;
} rdn_t;

/**
 * Match DNs (o_dn may contain wildcards and RDNs in a different order, if
 * allow_unmatched is TRUE, t_dn may contain unmatched RDNs)
 */
static bool match_dn(chunk_t t_dn, chunk_t o_dn, int *wc, bool allow_unmatched)
{
	enumerator_t *enumerator;
	array_t *rdns;
	rdn_t *rdn, *found;
	chunk_t oid, data;
	u_char type;
	bool finished = FALSE;
	int i, regular = 0;

	*wc = 0;

	/* try a binary compare */
	if (chunk_equals(t_dn, o_dn))
	{
		return TRUE;
	}

	rdns = array_create(0, 8);

	enumerator = create_rdn_enumerator(o_dn);
	while (TRUE)
	{
		if (!enumerator->enumerate(enumerator, &oid, &type, &data))
		{
			break;
		}
		INIT(rdn,
			.oid = oid,
			.type = type,
			.data = data,
		);
		if (is_wildcard(data))
		{
			/* insert wildcards at the end, to perform exact matches first */
			array_insert(rdns, ARRAY_TAIL, rdn);
		}
		else
		{
			array_insert(rdns, regular++, rdn);
		}
		/* the enumerator returns FALSE on parse error, we are finished
		 * if we have reached the end of the DN only */
		if ((data.ptr + data.len == o_dn.ptr + o_dn.len))
		{
			finished = TRUE;
		}
	}
	enumerator->destroy(enumerator);

	if (!finished)
	{	/* invalid DN */
		array_destroy_function(rdns, (void*)free, NULL);
		return FALSE;
	}
	finished = FALSE;

	enumerator = create_rdn_enumerator(t_dn);
	while (TRUE)
	{
		if (!enumerator->enumerate(enumerator, &oid, &type, &data))
		{
			break;
		}
		for (i = 0, found = NULL; i < array_count(rdns); i++)
		{
			array_get(rdns, i, &rdn);
			if (!rdn->matched && chunk_equals(rdn->oid, oid))
			{
				if (is_wildcard(rdn->data))
				{
					(*wc)++;
				}
				else if (data.len != rdn->data.len ||
						 !rdn_equals(oid, type, data, rdn->type, rdn->data))
				{
					continue;
				}
				rdn->matched = TRUE;
				found = rdn;
				break;
			}
		}
		if (!found)
		{
			/* treat unmatched RDNs like wildcards if allowed */
			if (!allow_unmatched)
			{
				break;
			}
			(*wc)++;
		}
		/* the enumerator returns FALSE on parse error, we are finished
		 * if we have reached the end of the DN only */
		if ((data.ptr + data.len == t_dn.ptr + t_dn.len))
		{
			finished = TRUE;
		}
	}
	enumerator->destroy(enumerator);

	if (finished)
	{
		for (i = 0; i < array_count(rdns); i++)
		{
			array_get(rdns, i, &rdn);
			if (!rdn->matched)
			{
				finished = FALSE;
			}
		}
	}
	array_destroy_function(rdns, (void*)free, NULL);
	return finished;
}

/**
 * Reordered RDNs are fine, but match all
 */
static bool match_dn_reordered(chunk_t t_dn, chunk_t o_dn, int *wc)
{
	return match_dn(t_dn, o_dn, wc, FALSE);
}

/**
 * t_dn may contain more RDNs than o_dn
 */
static bool match_dn_relaxed(chunk_t t_dn, chunk_t o_dn, int *wc)
{
	return match_dn(t_dn, o_dn, wc, TRUE);
}

/**
 * Compare two DNs, for equality if wc == NULL, with wildcard matching otherwise
 */
static bool compare_dn(chunk_t t_dn, chunk_t o_dn, int *wc)
{
	enumerator_t *t, *o;
	chunk_t t_oid, o_oid, t_data, o_data;
	u_char t_type, o_type;
	bool t_next, o_next, finished = FALSE;

	if (wc)
	{
		*wc = 0;
	}
	else if (t_dn.len != o_dn.len)
	{
		return FALSE;
	}

	if (chunk_equals(t_dn, o_dn))
	{
		return TRUE;
	}

	t = create_rdn_enumerator(t_dn);
	o = create_rdn_enumerator(o_dn);
	while (TRUE)
	{
		t_next = t->enumerate(t, &t_oid, &t_type, &t_data);
		o_next = o->enumerate(o, &o_oid, &o_type, &o_data);

		if (!o_next && !t_next)
		{
			break;
		}
		finished = FALSE;
		if (o_next != t_next)
		{
			break;
		}
		if (!chunk_equals(t_oid, o_oid))
		{
			break;
		}
		if (wc && is_wildcard(o_data))
		{
			(*wc)++;
		}
		else
		{
			if (t_data.len != o_data.len)
			{
				break;
			}
			if (!rdn_equals(t_oid, t_type, t_data, o_type, o_data))
			{
				break;
			}
		}
		/* the enumerator returns FALSE on parse error, we are finished
		 * if we have reached the end of the DN only */
		if ((t_data.ptr + t_data.len == t_dn.ptr + t_dn.len) &&
			(o_data.ptr + o_data.len == o_dn.ptr + o_dn.len))
		{
			finished = TRUE;
		}
	}
	t->destroy(t);
	o->destroy(o);
	return finished;
}

/**
 * Check if the data in the given chunk represents a valid DN.
 */
static bool is_valid_dn(chunk_t dn)
{
	enumerator_t *enumerator;
	chunk_t oid, data;
	u_char type;
	bool finished = FALSE;

	enumerator = create_rdn_enumerator(dn);
	while (enumerator->enumerate(enumerator, &oid, &type, &data))
	{
		/* the enumerator returns FALSE on parse error, we are finished
		 * if we have reached the end of the DN only */
		if ((data.ptr + data.len == dn.ptr + dn.len))
		{
			finished = TRUE;
		}
	}
	enumerator->destroy(enumerator);

	return finished;
}

METHOD(identification_t, equals_dn, bool,
	private_identification_t *this, identification_t *other)
{
	return neither_is_regex(this, other) &&
		   compare_dn(this->encoded, other->get_encoding(other), NULL);
}

METHOD(identification_t, hash_dn, u_int,
	private_identification_t *this, u_int inc)
{
	enumerator_t *rdns;
	chunk_t oid, data;
	u_char type;
	u_int hash;

	hash = chunk_hash_inc(chunk_from_thing(this->type), inc);
	rdns = create_rdn_enumerator(this->encoded);
	while (rdns->enumerate(rdns, &oid, &type, &data))
	{
		hash = chunk_hash_inc(data, chunk_hash_inc(oid, hash));
	}
	rdns->destroy(rdns);
	return hash;
}

METHOD(identification_t, equals_strcasecmp,  bool,
	private_identification_t *this, identification_t *other)
{
	chunk_t encoded = other->get_encoding(other);

	/* we do some extra sanity checks to check for invalid IDs with a
	 * terminating null in it. */
	if (this->type == other->get_type(other) &&
		neither_is_regex(this, other) &&
		this->encoded.len == encoded.len &&
		memchr(this->encoded.ptr, 0, this->encoded.len) == NULL &&
		memchr(encoded.ptr, 0, encoded.len) == NULL &&
		strncasecmp(this->encoded.ptr, encoded.ptr, this->encoded.len) == 0)
	{
		return TRUE;
	}
	return FALSE;
}

METHOD(identification_t, matches_binary, id_match_t,
	private_identification_t *this, identification_t *other)
{
	if (other->get_type(other) == ID_ANY)
	{
		return ID_MATCH_ANY;
	}
	if (this->type == other->get_type(other) &&
		chunk_equals(this->encoded, other->get_encoding(other)))
	{
		return ID_MATCH_PERFECT;
	}
	return ID_MATCH_NONE;
}

/**
 * Matches the regex in other against our own encoding.
 */
static id_match_t matches_regex(private_identification_t *this,
								private_identification_t *other)
{
	char buf[BUF_LEN-1];
	int rc;

	if (this->regex)
	{	/* don't match two regex values */
		return ID_MATCH_NONE;
	}
	if (!this->encoded.len)
	{
		return ID_MATCH_NONE;
	}
	/* match against the string representation of the identity */
	if (snprintf(buf, sizeof(buf), "%Y", this) >= sizeof(buf))
	{
		/* fail if the buffer is too small. note that we use BUF_LEN-1 because
		 * the printf hook uses BUF_LEN to print the identity internally */
		return ID_MATCH_NONE;
	}
	rc = regexec(other->regex, buf, 0, NULL, 0);
	return rc == 0 ? ID_MATCH_MAX_WILDCARDS : ID_MATCH_NONE;
}

METHOD(identification_t, matches_string, id_match_t,
	private_identification_t *this, identification_t *other)
{
	private_identification_t *other_priv = (private_identification_t*)other;
	chunk_t encoded = other->get_encoding(other);
	u_int len = encoded.len;

	if (other->get_type(other) == ID_ANY)
	{
		return ID_MATCH_ANY;
	}
	if (this->type != other->get_type(other))
	{
		return ID_MATCH_NONE;
	}
	if (other_priv->regex)
	{
		return matches_regex(this, other_priv);
	}
	/* try a equals check first */
	if (equals_strcasecmp(this, other))
	{
		return ID_MATCH_PERFECT;
	}
	if (len == 0 || this->encoded.len < len)
	{
		return ID_MATCH_NONE;
	}

	/* check for single wildcard at the head of the string */
	if (*encoded.ptr == '*')
	{
		/* single asterisk matches any string */
		if (len-- == 1)
		{	/* not better than ID_ANY */
			return ID_MATCH_ANY;
		}
		if (strncasecmp(this->encoded.ptr + this->encoded.len - len,
						encoded.ptr + 1, len) == 0)
		{
			return ID_MATCH_ONE_WILDCARD;
		}
	}
	return ID_MATCH_NONE;
}

METHOD(identification_t, matches_any, id_match_t,
	private_identification_t *this, identification_t *other)
{
	if (other->get_type(other) == ID_ANY)
	{
		return ID_MATCH_ANY;
	}
	return ID_MATCH_NONE;
}

/**
 * Match DNs given the matching function
 */
static id_match_t matches_dn_internal(private_identification_t *this,
									  identification_t *other,
									  bool (*match)(chunk_t,chunk_t,int*))
{
	private_identification_t *other_priv = (private_identification_t*)other;
	int wc;

	if (other->get_type(other) == ID_ANY)
	{
		return ID_MATCH_ANY;
	}

	if (this->type == other->get_type(other))
	{
		if (other_priv->regex)
		{
			return matches_regex(this, other_priv);
		}
		else if (match(this->encoded, other->get_encoding(other), &wc))
		{
			wc = min(wc, ID_MATCH_ONE_WILDCARD - ID_MATCH_MAX_WILDCARDS);
			return ID_MATCH_PERFECT - wc;
		}
	}
	return ID_MATCH_NONE;
}

METHOD(identification_t, matches_dn, id_match_t,
	private_identification_t *this, identification_t *other)
{
	return matches_dn_internal(this, other, compare_dn);
}

METHOD(identification_t, matches_dn_reordered, id_match_t,
	private_identification_t *this, identification_t *other)
{
	return matches_dn_internal(this, other, match_dn_reordered);
}

METHOD(identification_t, matches_dn_relaxed, id_match_t,
	private_identification_t *this, identification_t *other)
{
	return matches_dn_internal(this, other, match_dn_relaxed);
}

/**
 * Transform netmask to CIDR bits
 */
static uint8_t netmask_to_cidr(char *netmask, uint8_t address_size)
{
	uint8_t i, byte, netbits = 0;

	for (i = 0; i < address_size; i++)
	{
		byte = netmask[i];

		if (byte == 0x00)
		{
			break;
		}
		if (byte == 0xff)
		{
			netbits += 8;
		}
		else
		{
			while (byte & 0x80)
			{
				netbits++;
				byte <<= 1;
			}
		}
	}
	return netbits;
}

/**
 * Converts the given network/netmask to an address range
 */
static void subnet_to_range(chunk_t encoding, uint8_t address_size,
							uint8_t *from, uint8_t *to)
{
	uint8_t *network, *netmask, netbits, mask, i;

	network = encoding.ptr;
	netmask = encoding.ptr + address_size;
	netbits = netmask_to_cidr(netmask, address_size);

	memcpy(from, network, address_size);
	memcpy(to, network, address_size);

	i = netbits / 8;
	if (i < address_size)
	{
		mask = 0xff << (8 - netbits % 8);
		from[i] = from[i] & mask;
		to[i] = to[i] | ~mask;
		memset(&from[i+1], 0, address_size - i - 1);
		memset(&to[i+1], 0xff, address_size - i - 1);
	}
}

/**
 * Matches one subnet (or address if netmask is NULL) against another
 */
static id_match_t match_subnets(uint8_t *network, uint8_t *netmask,
								uint8_t *other_network, uint8_t *other_netmask,
								uint8_t address_size)
{
	uint8_t netbits, other_netbits, i;

	other_netbits = other_netmask ? netmask_to_cidr(other_netmask, address_size)
								  : 8 * address_size;
	if (!other_netbits)
	{
		return ID_MATCH_MAX_WILDCARDS;
	}

	netbits = netmask ? netmask_to_cidr(netmask, address_size) : 8 * address_size;

	if (netbits == other_netbits)
	{
		return memeq(network, other_network, address_size) ? ID_MATCH_PERFECT
														   : ID_MATCH_NONE;
	}
	else if (netbits < other_netbits)
	{
		return ID_MATCH_NONE;
	}

	for (i = 0; i < (other_netbits + 7)/8; i++)
	{
		if ((network[i] ^ other_network[i]) & other_netmask[i])
		{
			return ID_MATCH_NONE;
		}
	}
	return ID_MATCH_ONE_WILDCARD;
}

/**
 * Matches two address ranges against each other
 */
static id_match_t match_ranges(uint8_t *from, uint8_t *to,
							   uint8_t *other_from, uint8_t *other_to,
							   uint8_t address_size)
{
	const uint8_t zeroes[16] = { 0 };
	const uint8_t ones[16] = { 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
							   0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff };
	int match_from, match_to;

	if (memcmp(to, from, address_size) < 0 ||
		memcmp(other_to, other_from, address_size) < 0)
	{
		/* to is smaller than from in one of the ranges */
		return ID_MATCH_NONE;
	}
	else if (memeq(other_from, zeroes, address_size) &&
			 memeq(other_to, ones, address_size))
	{
		return ID_MATCH_MAX_WILDCARDS;
	}

	match_from = memcmp(from, other_from, address_size);
	match_to = memcmp(to, other_to, address_size);

	if (!match_from && !match_to)
	{
		return ID_MATCH_PERFECT;
	}
	else if (match_from >= 0 && match_to <= 0)
	{
		return ID_MATCH_ONE_WILDCARD;
	}
	return ID_MATCH_NONE;
}

/**
 * Match a subnet to an address
 */
static id_match_t matches_subnet_to_addr(private_identification_t *this,
										 identification_t *other,
										 uint8_t address_size)
{
	chunk_t other_encoding;
	uint8_t *network, *netmask, *address;

	other_encoding = other->get_encoding(other);
	if (this->encoded.len != 2 * address_size ||
		other_encoding.len != address_size)
	{
		return ID_MATCH_NONE;
	}
	network = this->encoded.ptr;
	netmask = this->encoded.ptr + address_size;
	address = other_encoding.ptr;
	return match_subnets(network, netmask, address, NULL, address_size);
}

/**
 * Match a subnet to an address
 */
static id_match_t matches_range_to_addr(private_identification_t *this,
										 identification_t *other,
										 uint8_t address_size)
{
	chunk_t other_encoding;
	uint8_t *from, *to, *address;

	other_encoding = other->get_encoding(other);
	if (this->encoded.len != 2 * address_size ||
		other_encoding.len != address_size)
	{
		return ID_MATCH_NONE;
	}
	from = this->encoded.ptr;
	to = this->encoded.ptr + address_size;
	address = other_encoding.ptr;
	return match_ranges(from, to, address, address, address_size);
}

/**
 * Matches an address to a subnet
 */
static id_match_t matches_addr_to_subnet(private_identification_t *this,
										 identification_t *other,
										 uint8_t address_size)
{
	chunk_t other_encoding;
	uint8_t *address, *network, *netmask;

	other_encoding = other->get_encoding(other);
	if (this->encoded.len != address_size ||
		other_encoding.len != 2 * address_size)
	{
		return ID_MATCH_NONE;
	}
	address = this->encoded.ptr;
	network = other_encoding.ptr;
	netmask = other_encoding.ptr + address_size;
	return match_subnets(address, NULL, network, netmask, address_size);
}

/**
 * Matches a subnet to a subnet
 */
static id_match_t matches_subnet_to_subnet(private_identification_t *this,
										   identification_t *other,
										   uint8_t address_size)
{
	chunk_t other_encoding;
	uint8_t *network, *netmask, *other_network, *other_netmask;

	other_encoding = other->get_encoding(other);
	if (this->encoded.len != 2 * address_size ||
		other_encoding.len != 2 * address_size)
	{
		return ID_MATCH_NONE;
	}
	network = this->encoded.ptr;
	netmask = this->encoded.ptr + address_size;
	other_network = other_encoding.ptr;
	other_netmask = other_encoding.ptr + address_size;
	return match_subnets(network, netmask, other_network, other_netmask,
						 address_size);
}

/**
 * Matches a range to a subnet
 */
static id_match_t matches_range_to_subnet(private_identification_t *this,
										  identification_t *other,
										  uint8_t address_size)
{
	chunk_t other_encoding;
	uint8_t *from, *to, other_from[address_size], other_to[address_size];

	other_encoding = other->get_encoding(other);
	if (this->encoded.len != 2 * address_size ||
		other_encoding.len != 2 * address_size)
	{
		return ID_MATCH_NONE;
	}

	from = this->encoded.ptr;
	to = this->encoded.ptr + address_size;
	subnet_to_range(other_encoding, address_size, other_from, other_to);
	return match_ranges(from, to, other_from, other_to, address_size);
}

/**
 * Match an address to a range
 */
static id_match_t matches_addr_to_range(private_identification_t *this,
										identification_t *other,
										uint8_t address_size)
{
	chunk_t other_encoding;
	uint8_t *address, *from, *to;

	other_encoding = other->get_encoding(other);
	if (this->encoded.len != address_size ||
		other_encoding.len != 2 * address_size)
	{
		return ID_MATCH_NONE;
	}
	address = this->encoded.ptr;
	from = other_encoding.ptr;
	to = other_encoding.ptr + address_size;
	return match_ranges(address, address, from, to, address_size);
}

/**
 * Match a subnet to a range
 */
static id_match_t matches_subnet_to_range(private_identification_t *this,
										  identification_t *other,
										  uint8_t address_size)
{
	chunk_t other_encoding;
	uint8_t from[address_size], to[address_size], *other_from, *other_to;

	other_encoding = other->get_encoding(other);
	if (this->encoded.len != 2 * address_size ||
		other_encoding.len != 2 * address_size)
	{
		return ID_MATCH_NONE;
	}
	subnet_to_range(this->encoded, address_size, from, to);
	other_from = other_encoding.ptr;
	other_to = other_encoding.ptr + address_size;
	return match_ranges(from, to, other_from, other_to, address_size);
}

/**
 * Match a range to a range
 */
static id_match_t matches_range_to_range(private_identification_t *this,
										 identification_t *other,
										 uint8_t address_size)
{
	chunk_t other_encoding;
	uint8_t *from, *to, *other_from, *other_to;

	other_encoding = other->get_encoding(other);
	if (this->encoded.len != 2 * address_size ||
		other_encoding.len != 2 * address_size)
	{
		return ID_MATCH_NONE;
	}
	from = this->encoded.ptr;
	to = this->encoded.ptr + address_size;
	other_from = other_encoding.ptr;
	other_to = other_encoding.ptr + address_size;
	return match_ranges(from, to, other_from, other_to, address_size);
}

METHOD(identification_t, matches_range, id_match_t,
	private_identification_t *this, identification_t *other)
{
	id_type_t other_type;
	uint8_t address_size = 0;

	other_type = other->get_type(other);
	if (other_type == ID_ANY)
	{
		return ID_MATCH_ANY;
	}
	if (this->type == other_type &&
		chunk_equals(this->encoded, other->get_encoding(other)))
	{
		return ID_MATCH_PERFECT;
	}
	if (other_type == ID_IPV4_ADDR &&
		(this->type == ID_IPV4_ADDR_SUBNET || this->type == ID_IPV4_ADDR_RANGE))
	{
		address_size = sizeof(struct in_addr);
	}
	else if (other_type == ID_IPV6_ADDR &&
			(this->type == ID_IPV6_ADDR_SUBNET || this->type == ID_IPV6_ADDR_RANGE))
	{
		address_size = sizeof(struct in6_addr);
	}
	if (address_size)
	{
		if (this->type == ID_IPV4_ADDR_SUBNET || this->type == ID_IPV6_ADDR_SUBNET)
		{
			return matches_subnet_to_addr(this, other, address_size);
		}
		return matches_range_to_addr(this, other, address_size);
	}
	if (other_type == ID_IPV4_ADDR_SUBNET &&
		(this->type == ID_IPV4_ADDR || this->type == ID_IPV4_ADDR_SUBNET ||
		 this->type == ID_IPV4_ADDR_RANGE))
	{
		address_size = sizeof(struct in_addr);
	}
	else if (other_type == ID_IPV6_ADDR_SUBNET &&
			(this->type == ID_IPV6_ADDR || this->type == ID_IPV6_ADDR_SUBNET ||
			 this->type == ID_IPV6_ADDR_RANGE))
	{
		address_size = sizeof(struct in6_addr);
	}
	if (address_size)
	{
		if (this->type == ID_IPV4_ADDR || this->type == ID_IPV6_ADDR)
		{
			return matches_addr_to_subnet(this, other, address_size);
		}
		else if (this->type == ID_IPV4_ADDR_SUBNET || this->type == ID_IPV6_ADDR_SUBNET)
		{
			return matches_subnet_to_subnet(this, other, address_size);
		}
		return matches_range_to_subnet(this, other, address_size);
	}
	if (other_type == ID_IPV4_ADDR_RANGE &&
		(this->type == ID_IPV4_ADDR || this->type == ID_IPV4_ADDR_SUBNET ||
		 this->type == ID_IPV4_ADDR_RANGE))
	{
		address_size = sizeof(struct in_addr);
	}
	else if (other_type == ID_IPV6_ADDR_RANGE &&
			(this->type == ID_IPV6_ADDR || this->type == ID_IPV6_ADDR_SUBNET ||
			 this->type == ID_IPV6_ADDR_RANGE))
	{
		address_size = sizeof(struct in6_addr);
	}
	if (address_size)
	{
		if (this->type == ID_IPV4_ADDR || this->type == ID_IPV6_ADDR)
		{
			return matches_addr_to_range(this, other, address_size);
		}
		else if (this->type == ID_IPV4_ADDR_SUBNET || this->type == ID_IPV6_ADDR_SUBNET)
		{
			return matches_subnet_to_range(this, other, address_size);
		}
		return matches_range_to_range(this, other, address_size);
	}
	return ID_MATCH_NONE;
}

/**
 * Convert the given identity to a string depending on its type.
 */
static void identity_to_string(private_identification_t *this, char buf[BUF_LEN])
{
	chunk_t proper;
	char *pos;
	uint8_t address_size;
	size_t len;
	int written;

	if (this->regex)
	{
		snprintf(buf, BUF_LEN, "%s", this->encoded.ptr);
		return;
	}

	switch (this->type)
	{
		case ID_ANY:
			snprintf(buf, BUF_LEN, "%%any");
			break;
		case ID_IPV4_ADDR:
			if (this->encoded.len < sizeof(struct in_addr) ||
				inet_ntop(AF_INET, this->encoded.ptr, buf, BUF_LEN) == NULL)
			{
				snprintf(buf, BUF_LEN, "(invalid ID_IPV4_ADDR)");
			}
			break;
		case ID_IPV4_ADDR_SUBNET:
			address_size = sizeof(struct in_addr);
			if (this->encoded.len < 2 * address_size ||
				inet_ntop(AF_INET, this->encoded.ptr, buf, BUF_LEN) == NULL)
			{
				snprintf(buf, BUF_LEN, "(invalid ID_IPV4_ADDR_SUBNET)");
				break;
			}
			written = strlen(buf);
			snprintf(buf + written, BUF_LEN - written, "/%d",
					 netmask_to_cidr(this->encoded.ptr + address_size,
														 address_size));
			break;
		case ID_IPV4_ADDR_RANGE:
			address_size = sizeof(struct in_addr);
			if (this->encoded.len < 2 * address_size ||
				inet_ntop(AF_INET, this->encoded.ptr, buf, BUF_LEN) == NULL)
			{
				snprintf(buf, BUF_LEN, "(invalid ID_IPV4_ADDR_RANGE)");
				break;
			}
			written = strlen(buf);
			pos = buf + written;
			len = BUF_LEN - written;
			written = snprintf(pos, len, "-");
			if (written < 0 || written >= len ||
			    inet_ntop(AF_INET, this->encoded.ptr + address_size,
						  pos + written, len - written) == NULL)
			{
				snprintf(buf, BUF_LEN, "(invalid ID_IPV4_ADDR_RANGE)");
			}
			break;
		case ID_IPV6_ADDR:
			if (this->encoded.len < sizeof(struct in6_addr) ||
				inet_ntop(AF_INET6, this->encoded.ptr, buf, BUF_LEN) == NULL)
			{
				snprintf(buf, BUF_LEN, "(invalid ID_IPV6_ADDR)");
			}
			break;
		case ID_IPV6_ADDR_SUBNET:
			address_size = sizeof(struct in6_addr);
			if (this->encoded.len < 2 * address_size ||
				inet_ntop(AF_INET6, this->encoded.ptr, buf, BUF_LEN) == NULL)
			{
				snprintf(buf, BUF_LEN, "(invalid ID_IPV6_ADDR_SUBNET)");
			}
			else
			{
				written = strlen(buf);
				snprintf(buf + written, BUF_LEN - written, "/%d",
						 netmask_to_cidr(this->encoded.ptr + address_size,
															 address_size));
			}
			break;
		case ID_IPV6_ADDR_RANGE:
			address_size = sizeof(struct in6_addr);
			if (this->encoded.len < 2 * address_size ||
				inet_ntop(AF_INET6, this->encoded.ptr, buf, BUF_LEN) == NULL)
			{
				snprintf(buf, BUF_LEN, "(invalid ID_IPV6_ADDR_RANGE)");
				break;
			}
			written = strlen(buf);
			pos = buf + written;
			len = BUF_LEN - written;
			written = snprintf(pos, len, "-");
			if (written < 0 || written >= len ||
			    inet_ntop(AF_INET6, this->encoded.ptr + address_size,
						  pos + written, len - written) == NULL)
			{
				snprintf(buf, BUF_LEN, "(invalid ID_IPV6_ADDR_RANGE)");
			}
			break;
		case ID_FQDN:
		case ID_RFC822_ADDR:
		case ID_DER_ASN1_GN_URI:
			chunk_printable(this->encoded, &proper, '?');
			snprintf(buf, BUF_LEN, "%.*s", (int)proper.len, proper.ptr);
			chunk_free(&proper);
			break;
		case ID_DER_ASN1_DN:
			dntoa(this->encoded, buf, BUF_LEN);
			break;
		case ID_DER_ASN1_GN:
			snprintf(buf, BUF_LEN, "(ASN.1 general name)");
			break;
		case ID_KEY_ID:
			if (chunk_printable(this->encoded, NULL, '?') &&
				this->encoded.len != HASH_SIZE_SHA1)
			{	/* fully printable, use ascii version */
				snprintf(buf, BUF_LEN, "%.*s", (int)this->encoded.len,
						 this->encoded.ptr);
			}
			else
			{	/* not printable, hex dump */
				snprintf(buf, BUF_LEN, "%#B", &this->encoded);
			}
			break;
		default:
			snprintf(buf, BUF_LEN, "(unknown ID type: %d)", this->type);
			break;
	}
}

/**
 * Described in header.
 */
int identification_printf_hook(printf_hook_data_t *data,
							printf_hook_spec_t *spec, const void *const *args)
{
	private_identification_t *this = *((private_identification_t**)(args[0]));
	char buf[BUF_LEN];

	if (!this)
	{
		return print_in_hook(data, "%*s", spec->width, "(null)");
	}

	identity_to_string(this, buf);

	if (spec->minus)
	{
		return print_in_hook(data, "%-*s", spec->width, buf);
	}
	return print_in_hook(data, "%*s", spec->width, buf);
}

#ifdef HAVE_REGEX

/**
 * Compile the encoded regular expression.
 */
static bool compile_regex(private_identification_t *this)
{
	char buf[BUF_LEN];
	int err = 0;

	this->regex = malloc(sizeof(*this->regex));
	err = regcomp(this->regex, this->encoded.ptr,
				  REG_EXTENDED | REG_ICASE | REG_NOSUB);
	if (err != 0)
	{
		regerror(err, NULL, buf, sizeof(buf));
		DBG1(DBG_LIB, "invalid regular expression '%s': %s",
			 this->encoded.ptr, buf);
		return FALSE;
	}
	return TRUE;
}

#else /* HAVE_REGEX */

static bool compile_regex(private_identification_t *this)
{
	DBG1(DBG_LIB, "regular expressions are not supported");
	return FALSE;
}

#endif /* HAVE_REGEX */

METHOD(identification_t, clone_, identification_t*,
	private_identification_t *this)
{
	private_identification_t *clone = malloc_thing(private_identification_t);

	memcpy(clone, this, sizeof(private_identification_t));
	if (this->regex)
	{
		/* make sure we have the full encoding cloned */
		clone->encoded = chunk_from_str(strdup(this->encoded.ptr));
		compile_regex(clone);
	}
	else if (this->encoded.len)
	{
		clone->encoded = chunk_clone(this->encoded);
	}
	return &clone->public;
}

METHOD(identification_t, destroy, void,
	private_identification_t *this)
{
	chunk_free(&this->encoded);
	if (this->regex)
	{
		regfree(this->regex);
		free(this->regex);
	}
	free(this);
}

/**
 * Generic constructor used for the other constructors.
 */
static private_identification_t *identification_create(id_type_t type)
{
	private_identification_t *this;
	char *rdn_matching;

	INIT(this,
		.public = {
			.get_encoding = _get_encoding,
			.get_type = _get_type,
			.create_part_enumerator = _create_part_enumerator,
			.clone = _clone_,
			.destroy = _destroy,
		},
		.type = type,
	);

	switch (type)
	{
		case ID_ANY:
			this->public.hash = _hash_binary;
			this->public.equals = _equals_binary;
			this->public.matches = _matches_any;
			this->public.contains_wildcards = (void*)return_true;
			break;
		case ID_FQDN:
		case ID_RFC822_ADDR:
			this->public.hash = _hash_binary;
			this->public.equals = _equals_strcasecmp;
			this->public.matches = _matches_string;
			this->public.contains_wildcards = _contains_wildcards_memchr;
			break;
		case ID_DER_ASN1_DN:
			this->public.hash = _hash_dn;
			this->public.equals = _equals_dn;
			this->public.matches = _matches_dn;
			this->public.contains_wildcards = _contains_wildcards_dn;
			/* check for more relaxed matching config */
			rdn_matching = lib->settings->get_str(lib->settings,
											"%s.rdn_matching", NULL, lib->ns);
			if (streq("reordered", rdn_matching))
			{
				this->public.matches = _matches_dn_reordered;
			}
			else if (streq("relaxed", rdn_matching))
			{
				this->public.matches = _matches_dn_relaxed;
			}
			break;
		case ID_IPV4_ADDR:
		case ID_IPV6_ADDR:
		case ID_IPV4_ADDR_SUBNET:
		case ID_IPV6_ADDR_SUBNET:
		case ID_IPV4_ADDR_RANGE:
		case ID_IPV6_ADDR_RANGE:
			this->public.hash = _hash_binary;
			this->public.equals = _equals_binary;
			this->public.matches = _matches_range;
			this->public.contains_wildcards = (void*)return_false;
			break;
		default:
			this->public.hash = _hash_binary;
			this->public.equals = _equals_binary;
			this->public.matches = _matches_binary;
			this->public.contains_wildcards = (void*)return_false;
			break;
	}
	return this;
}

/**
 * Prefixes used when parsing identities.
 */
static const struct {
	const char *str;
	id_type_t type;
	bool regex;
} prefixes[] = {
	{ "ipv4:",			ID_IPV4_ADDR,			FALSE},
	{ "ipv6:",			ID_IPV6_ADDR,			FALSE},
	{ "ipv4net:",		ID_IPV4_ADDR_SUBNET,	FALSE},
	{ "ipv6net:",		ID_IPV6_ADDR_SUBNET,	FALSE},
	{ "ipv4range:",		ID_IPV4_ADDR_RANGE,		FALSE},
	{ "ipv6range:",		ID_IPV6_ADDR_RANGE,		FALSE},
	{ "rfc822:",		ID_RFC822_ADDR,			TRUE},
	{ "email:",			ID_RFC822_ADDR,			TRUE},
	{ "userfqdn:",		ID_RFC822_ADDR,			TRUE},
	{ "fqdn:",			ID_FQDN,				TRUE},
	{ "dns:",			ID_FQDN,				TRUE},
	{ "asn1dn:",		ID_DER_ASN1_DN,			TRUE},
	{ "asn1gn:",		ID_DER_ASN1_GN,			FALSE},
	{ "xmppaddr:",		ID_DER_ASN1_GN,         FALSE},
	{ "keyid:",			ID_KEY_ID,				FALSE},
	{ "uri:",			ID_DER_ASN1_GN_URI,		FALSE},
};

/**
 * Create an identity for a specific type, determined by prefix
 */
static private_identification_t *create_from_string_with_prefix_type(char *str)
{
	private_identification_t *this;
	int i;

	for (i = 0; i < countof(prefixes); i++)
	{
		if (strcasepfx(str, prefixes[i].str))
		{
			this = identification_create(prefixes[i].type);
			str += strlen(prefixes[i].str);

			if (*str == '#')
			{
				this->encoded = chunk_from_hex(chunk_from_str(str + 1), NULL);
			}
			else
			{
				this->encoded = chunk_clone(chunk_from_str(str));
			}

			if (prefixes[i].type == ID_DER_ASN1_GN &&
				strcasepfx(prefixes[i].str, "xmppaddr:"))
			{
				this->encoded = asn1_wrap(ASN1_CONTEXT_C_0, "mm",
									asn1_build_known_oid(OID_XMPP_ADDR),
									asn1_wrap(ASN1_CONTEXT_C_0, "m",
										asn1_wrap(ASN1_UTF8STRING, "m",
											this->encoded)));
			}
			return this;
		}
	}
	return NULL;
}

/**
 * Create an identity for a specific type, determined by a numerical prefix
 *
 * The prefix is of the form "{x}:", where x denotes the numerical identity
 * type.
 */
static private_identification_t *create_from_string_with_num_type(char *str)
{
	private_identification_t *this;
	u_long type;

	if (*str++ != '{')
	{
		return NULL;
	}
	errno = 0;
	type = strtoul(str, &str, 0);
	if (errno || *str++ != '}' || *str++ != ':')
	{
		return NULL;
	}
	this = identification_create(type);
	if (*str == '#')
	{
		this->encoded = chunk_from_hex(chunk_from_str(str + 1), NULL);
	}
	else
	{
		this->encoded = chunk_clone(chunk_from_str(str));
	}
	return this;
}

/**
 * Convert to an IPv4/IPv6 host address, subnet or address range
 */
static private_identification_t *create_ip_address_from_string(char *string,
															   bool is_ipv4)
{
	private_identification_t *this;
	uint8_t encoding[32];
	uint8_t *str, *pos, *address, *to_address, *netmask;
	size_t address_size;
	int bits, bytes, i;
	bool has_subnet = FALSE, has_range = FALSE;

	address = encoding;
	address_size = is_ipv4 ? sizeof(struct in_addr) : sizeof(struct in6_addr);

	str = strdup(string);
	pos = strchr(str, '/');
	if (pos)
	{	/* separate IP address from optional netmask */

		*pos = '\0';
		has_subnet = TRUE;
	}
	else
	{
		pos = strchr(str, '-');
		if (pos)
		{	/* separate lower address from upper address of IP range */
			*pos = '\0';
			has_range = TRUE;
		}
	}

	if (inet_pton(is_ipv4 ? AF_INET : AF_INET6, str, address) != 1)
	{
		free(str);
		return NULL;
	}

	if (has_subnet)
	{	/* is IP subnet */
		bits = atoi(pos + 1);
		if (bits > 8 * address_size)
		{
			free(str);
			return NULL;
		}
		bytes = bits / 8;
		bits -= 8 * bytes;
		netmask = encoding + address_size;

		for (i = 0; i < address_size; i++)
		{
			if (bytes)
			{
				*netmask = 0xff;
				bytes--;
			}
			else if (bits)
			{
				*netmask = 0xff << (8 - bits);
				bits = 0;
			}
			else
			{
				*netmask = 0x00;
			}
			*address++ &= *netmask++;
		}
		this = identification_create(is_ipv4 ? ID_IPV4_ADDR_SUBNET :
											   ID_IPV6_ADDR_SUBNET);
		this->encoded = chunk_clone(chunk_create(encoding, 2 * address_size));
	}
	else if (has_range)
	{	/* is IP range */
		to_address = encoding + address_size;

		if (inet_pton(is_ipv4 ? AF_INET : AF_INET6, pos + 1, to_address) != 1)
		{
			free(str);
			return NULL;
		}
		for (i = 0; i < address_size; i++)
		{
			if (address[i] != to_address[i])
			{
				if (address[i] > to_address[i])
				{
					free(str);
					return NULL;
				}
				break;
			}
		}
		this = identification_create(is_ipv4 ? ID_IPV4_ADDR_RANGE :
											   ID_IPV6_ADDR_RANGE);
		this->encoded = chunk_clone(chunk_create(encoding, 2 * address_size));
	}
	else
	{	/* is IP host address */
		this = identification_create(is_ipv4 ? ID_IPV4_ADDR : ID_IPV6_ADDR);
		this->encoded = chunk_clone(chunk_create(encoding, address_size));
	}
	free(str);

	return this;
}

/*
 * Described in header.
 */
identification_t *identification_create_from_string(char *string)
{
	private_identification_t *this;
	chunk_t encoded;

	if (string == NULL)
	{
		string = "%any";
	}
	this = create_from_string_with_prefix_type(string);
	if (this)
	{
		return &this->public;
	}
	this = create_from_string_with_num_type(string);
	if (this)
	{
		return &this->public;
	}
	if (strchr(string, '=') != NULL)
	{
		/* we interpret this as an ASCII X.501 ID_DER_ASN1_DN.
		 * convert from LDAP style or openssl x509 -subject style to ASN.1 DN
		 */
		if (atodn(string, &encoded) == SUCCESS)
		{
			this = identification_create(ID_DER_ASN1_DN);
			this->encoded = encoded;
		}
		else
		{
			this = identification_create(ID_KEY_ID);
			this->encoded = chunk_clone(chunk_from_str(string));
		}
		return &this->public;
	}
	else if (strchr(string, '@') == NULL)
	{
		if (streq(string, "")
		||	streq(string, "%any")
		||	streq(string, "%any6")
		||	streq(string, "0.0.0.0")
		||	streq(string, "*")
		||	streq(string, "::")
		||	streq(string, "0::0"))
		{
			/* any ID will be accepted */
			this = identification_create(ID_ANY);
			return &this->public;
		}
		else
		{
			if (strchr(string, ':') == NULL)
			{
				/* IPv4 address or subnet */
				this = create_ip_address_from_string(string, TRUE);
				if (!this)
				{	/* not IPv4, mostly FQDN */
					this = identification_create(ID_FQDN);
					this->encoded = chunk_clone(chunk_from_str(string));
				}
				return &this->public;
			}
			else
			{
				/* IPv6 address or subnet */
				this = create_ip_address_from_string(string, FALSE);
				if (!this)
				{	/* not IPv4/6 fallback to KEY_ID */
					this = identification_create(ID_KEY_ID);
					this->encoded = chunk_clone(chunk_from_str(string));
				}
				return &this->public;
			}
		}
	}
	else
	{
		if (*string == '@')
		{
			string++;
			if (*string == '#')
			{
				this = identification_create(ID_KEY_ID);
				this->encoded = chunk_from_hex(chunk_from_str(string + 1), NULL);
				return &this->public;
			}
			else if (*string == '@')
			{
				this = identification_create(ID_RFC822_ADDR);
				this->encoded = chunk_clone(chunk_from_str(string + 1));
				return &this->public;
			}
			else
			{
				this = identification_create(ID_FQDN);
				this->encoded = chunk_clone(chunk_from_str(string));
				return &this->public;
			}
		}
		else
		{
			this = identification_create(ID_RFC822_ADDR);
			this->encoded = chunk_clone(chunk_from_str(string));
			return &this->public;
		}
	}
}

/**
 * Check if the given string should be parsed as regular expression identity.
 * If so, it modifies the string and returns the identity type, otherwise,
 * ID_ANY is returned.
 */
static id_type_t is_regex_identity(char **string)
{
	char *regex;
	int i;

	for (i = 0; i < countof(prefixes); i++)
	{
		if (strcasepfx(*string, prefixes[i].str))
		{
			regex = *string + strlen(prefixes[i].str);

			if (prefixes[i].regex &&
				*regex == '^' && *(regex + strlen(regex) - 1) == '$')
			{
				*string = regex;
				return prefixes[i].type;
			}
			break;
		}
	}
	return ID_ANY;
}

/*
 * Described in header.
 */
identification_t *identification_create_from_string_with_regex(char *string)
{
	private_identification_t *this;
	id_type_t type;

	type = is_regex_identity(&string);
	if (type != ID_ANY)
	{
		this = identification_create(type);

		this->public.hash = _hash_binary;
		this->public.equals = _equals_binary;
		this->public.matches = _matches_any;
		this->public.contains_wildcards = (void*)return_true;

		/* this encoding explicitly includes the null-terminator so we can
		 * directly use it to compile the regex and printing */
		this->encoded = chunk_from_str(strdup(string));
		if (!compile_regex(this))
		{
			destroy(this);
			return NULL;
		}
		return &this->public;
	}
	return identification_create_from_string(string);
}

/*
 * Described in header.
 */
identification_t *identification_create_from_data(chunk_t data)
{
	char buf[data.len + 1];

	if (is_asn1(data) && is_valid_dn(data))
	{
		return identification_create_from_encoding(ID_DER_ASN1_DN, data);
	}
	else
	{
		/* use string constructor */
		snprintf(buf, sizeof(buf), "%.*s", (int)data.len, data.ptr);
		return identification_create_from_string(buf);
	}
}

/*
 * Described in header.
 */
identification_t *identification_create_from_encoding(id_type_t type,
													  chunk_t encoded)
{
	private_identification_t *this = identification_create(type);

	/* apply encoded chunk */
	if (type != ID_ANY)
	{
		this->encoded = chunk_clone(encoded);
	}
	return &(this->public);
}

/*
 * Described in header.
 */
identification_t *identification_create_from_sockaddr(sockaddr_t *sockaddr)
{
	switch (sockaddr->sa_family)
	{
		case AF_INET:
		{
			struct in_addr *addr = &(((struct sockaddr_in*)sockaddr)->sin_addr);

			return identification_create_from_encoding(ID_IPV4_ADDR,
					chunk_create((u_char*)addr, sizeof(struct in_addr)));
		}
		case AF_INET6:
		{
			struct in6_addr *addr = &(((struct sockaddr_in6*)sockaddr)->sin6_addr);

			return identification_create_from_encoding(ID_IPV6_ADDR,
					chunk_create((u_char*)addr, sizeof(struct in6_addr)));
		}
		default:
		{
			private_identification_t *this = identification_create(ID_ANY);

			return &(this->public);
		}
	}
}
