Import upstream version 5.1.3

10 files changed, 45 insertions, 671 deletions

diff --git a/src/libstrongswan/credentials/auth_cfg.c b/src/libstrongswan/credentials/auth_cfg.c
index 2203519e2..4ff9aa6dd 100644
--- a/src/libstrongswan/credentials/auth_cfg.c
+++ b/src/libstrongswan/credentials/auth_cfg.c
@@ -31,7 +31,7 @@ ENUM(auth_class_names, AUTH_CLASS_ANY, AUTH_CLASS_XAUTH,
 	"XAuth",
 );
 
-ENUM(auth_rule_names, AUTH_RULE_IDENTITY, AUTH_HELPER_REVOCATION_CERT,
+ENUM(auth_rule_names, AUTH_RULE_IDENTITY, AUTH_HELPER_AC_CERT,
 	"RULE_IDENTITY",
 	"RULE_IDENTITY_LOOSE",
 	"RULE_AUTH_CLASS",
@@ -56,6 +56,7 @@ ENUM(auth_rule_names, AUTH_RULE_IDENTITY, AUTH_HELPER_REVOCATION_CERT,
 	"HELPER_IM_HASH_URL",
 	"HELPER_SUBJECT_HASH_URL",
 	"HELPER_REVOCATION_CERT",
+	"HELPER_AC_CERT",
 );
 
 /**
@@ -91,6 +92,7 @@ static inline bool is_multi_value_rule(auth_rule_t type)
 		case AUTH_HELPER_IM_CERT:
 		case AUTH_HELPER_IM_HASH_URL:
 		case AUTH_HELPER_REVOCATION_CERT:
+		case AUTH_HELPER_AC_CERT:
 			return TRUE;
 	}
 	return FALSE;
@@ -224,6 +226,7 @@ static void init_entry(entry_t *this, auth_rule_t type, va_list args)
 		case AUTH_HELPER_IM_HASH_URL:
 		case AUTH_HELPER_SUBJECT_HASH_URL:
 		case AUTH_HELPER_REVOCATION_CERT:
+		case AUTH_HELPER_AC_CERT:
 			/* pointer type */
 			this->value = va_arg(args, void*);
 			break;
@@ -262,6 +265,7 @@ static bool entry_equals(entry_t *e1, entry_t *e2)
 		case AUTH_HELPER_IM_CERT:
 		case AUTH_HELPER_SUBJECT_CERT:
 		case AUTH_HELPER_REVOCATION_CERT:
+		case AUTH_HELPER_AC_CERT:
 		{
 			certificate_t *c1, *c2;
 
@@ -319,6 +323,7 @@ static void destroy_entry_value(entry_t *entry)
 		case AUTH_HELPER_IM_CERT:
 		case AUTH_HELPER_SUBJECT_CERT:
 		case AUTH_HELPER_REVOCATION_CERT:
+		case AUTH_HELPER_AC_CERT:
 		{
 			certificate_t *cert = (certificate_t*)entry->value;
 			cert->destroy(cert);
@@ -390,6 +395,7 @@ static void replace(private_auth_cfg_t *this, entry_enumerator_t *enumerator,
 			case AUTH_HELPER_IM_HASH_URL:
 			case AUTH_HELPER_SUBJECT_HASH_URL:
 			case AUTH_HELPER_REVOCATION_CERT:
+			case AUTH_HELPER_AC_CERT:
 				/* pointer type */
 				entry->value = va_arg(args, void*);
 				break;
@@ -467,6 +473,7 @@ METHOD(auth_cfg_t, get, void*,
 		case AUTH_HELPER_IM_HASH_URL:
 		case AUTH_HELPER_SUBJECT_HASH_URL:
 		case AUTH_HELPER_REVOCATION_CERT:
+		case AUTH_HELPER_AC_CERT:
 		case AUTH_RULE_MAX:
 			break;
 	}
@@ -736,6 +743,7 @@ METHOD(auth_cfg_t, complies, bool,
 			case AUTH_HELPER_IM_HASH_URL:
 			case AUTH_HELPER_SUBJECT_HASH_URL:
 			case AUTH_HELPER_REVOCATION_CERT:
+			case AUTH_HELPER_AC_CERT:
 			case AUTH_RULE_MAX:
 				/* skip helpers */
 				continue;
@@ -868,6 +876,7 @@ static void merge(private_auth_cfg_t *this, private_auth_cfg_t *other, bool copy
 				case AUTH_HELPER_IM_CERT:
 				case AUTH_HELPER_SUBJECT_CERT:
 				case AUTH_HELPER_REVOCATION_CERT:
+				case AUTH_HELPER_AC_CERT:
 				{
 					certificate_t *cert = (certificate_t*)value;
 
@@ -1029,6 +1038,7 @@ METHOD(auth_cfg_t, clone_, auth_cfg_t*,
 			case AUTH_HELPER_IM_CERT:
 			case AUTH_HELPER_SUBJECT_CERT:
 			case AUTH_HELPER_REVOCATION_CERT:
+			case AUTH_HELPER_AC_CERT:
 			{
 				certificate_t *cert = (certificate_t*)value;
 				clone->add(clone, type, cert->get_ref(cert));
diff --git a/src/libstrongswan/credentials/auth_cfg.h b/src/libstrongswan/credentials/auth_cfg.h
index d87935589..95b36d706 100644
--- a/src/libstrongswan/credentials/auth_cfg.h
+++ b/src/libstrongswan/credentials/auth_cfg.h
@@ -117,6 +117,8 @@ enum auth_rule_t {
 	AUTH_HELPER_SUBJECT_HASH_URL,
 	/** revocation certificate (CRL, OCSP), certificate_t* */
 	AUTH_HELPER_REVOCATION_CERT,
+	/** attribute certificate for authorization decisions, certificate_t */
+	AUTH_HELPER_AC_CERT,
 
 	/** helper to determine the number of elements in this enum */
 	AUTH_RULE_MAX,
diff --git a/src/libstrongswan/credentials/builder.c b/src/libstrongswan/credentials/builder.c
index 4e52272a7..ddb64ef88 100644
--- a/src/libstrongswan/credentials/builder.c
+++ b/src/libstrongswan/credentials/builder.c
@@ -38,7 +38,7 @@ ENUM(builder_part_names, BUILD_FROM_FILE, BUILD_END,
 	"BUILD_SERIAL",
 	"BUILD_DIGEST_ALG",
 	"BUILD_ENCRYPTION_ALG",
-	"BUILD_IETF_GROUP_ATTR",
+	"BUILD_AC_GROUP_STRINGS",
 	"BUILD_CA_CERT",
 	"BUILD_CERT",
 	"BUILD_CRL_DISTRIBUTION_POINTS",
@@ -72,4 +72,3 @@ ENUM(builder_part_names, BUILD_FROM_FILE, BUILD_END,
 	"BUILD_THRESHOLD",
 	"BUILD_END",
 );
-
diff --git a/src/libstrongswan/credentials/builder.h b/src/libstrongswan/credentials/builder.h
index 103b823c0..627e0934d 100644
--- a/src/libstrongswan/credentials/builder.h
+++ b/src/libstrongswan/credentials/builder.h
@@ -87,8 +87,8 @@ enum builder_part_t {
 	BUILD_DIGEST_ALG,
 	/** encryption algorithm to use, encryption_algorithm_t */
 	BUILD_ENCRYPTION_ALG,
-	/** a comma-separated list of ietf group attributes, char* */
-	BUILD_IETF_GROUP_ATTR,
+	/** list of AC group memberships, linked_list_t* with char* */
+	BUILD_AC_GROUP_STRINGS,
 	/** a ca certificate, certificate_t* */
 	BUILD_CA_CERT,
 	/** a certificate, certificate_t* */
diff --git a/src/libstrongswan/credentials/certificates/ac.h b/src/libstrongswan/credentials/certificates/ac.h
index 57b44adca..9a3d8f0b9 100644
--- a/src/libstrongswan/credentials/certificates/ac.h
+++ b/src/libstrongswan/credentials/certificates/ac.h
@@ -24,9 +24,18 @@
 
 #include <library.h>
 #include <credentials/certificates/certificate.h>
-#include <credentials/ietf_attributes/ietf_attributes.h>
 
 typedef struct ac_t ac_t;
+typedef enum ac_group_type_t ac_group_type_t;
+
+/**
+ * Common group types, from IETF Attributes Syntax
+ */
+enum ac_group_type_t {
+	AC_GROUP_TYPE_OCTETS,
+	AC_GROUP_TYPE_STRING,
+	AC_GROUP_TYPE_OID,
+};
 
 /**
  * X.509 attribute certificate interface.
@@ -70,19 +79,11 @@ struct ac_t {
 	chunk_t (*get_authKeyIdentifier)(ac_t *this);
 
 	/**
-	 * Get the group memberships as a list of IETF attributes
-	 *
-	 * @return			object containing a list of IETF attributes
-	 */
-	ietf_attributes_t* (*get_groups)(ac_t *this);
-
-	/**
-	 * @brief Checks if two attribute certificates belong to the same holder
+	 * Create an enumerator of contained Group memberships.
 	 *
-	 * @param that			other attribute certificate
-	 * @return				TRUE if same holder
+	 * @return			enumerator over (ac_group_type_t, chunk_t)
 	 */
-	bool (*equals_holder) (ac_t *this, ac_t *other);
+	enumerator_t* (*create_group_enumerator)(ac_t *this);
 };
 
 #endif /** AC_H_ @}*/
diff --git a/src/libstrongswan/credentials/certificates/x509.h b/src/libstrongswan/credentials/certificates/x509.h
index 4e8d4317f..6cbfcdeed 100644
--- a/src/libstrongswan/credentials/certificates/x509.h
+++ b/src/libstrongswan/credentials/certificates/x509.h
@@ -39,25 +39,27 @@ typedef enum x509_constraint_t x509_constraint_t;
  */
 enum x509_flag_t {
 	/** cert has no constraints */
-	X509_NONE =				0,
+	X509_NONE =	               0,
 	/** cert has CA constraint */
-	X509_CA =				(1<<0),
+	X509_CA =                 (1<<0),
 	/** cert has AA constraint */
-	X509_AA =				(1<<1),
+	X509_AA =                 (1<<1),
 	/** cert has OCSP signer constraint */
-	X509_OCSP_SIGNER =		(1<<2),
+	X509_OCSP_SIGNER =        (1<<2),
 	/** cert has serverAuth key usage */
-	X509_SERVER_AUTH =		(1<<3),
+	X509_SERVER_AUTH =        (1<<3),
 	/** cert has clientAuth key usage */
-	X509_CLIENT_AUTH =		(1<<4),
+	X509_CLIENT_AUTH =        (1<<4),
 	/** cert is self-signed */
-	X509_SELF_SIGNED =		(1<<5),
+	X509_SELF_SIGNED =        (1<<5),
 	/** cert has an ipAddrBlocks extension */
-	X509_IP_ADDR_BLOCKS =	(1<<6),
+	X509_IP_ADDR_BLOCKS =     (1<<6),
 	/** cert has CRL sign key usage */
-	X509_CRL_SIGN =			(1<<7),
+	X509_CRL_SIGN =           (1<<7),
 	/** cert has iKEIntermediate key usage */
-	X509_IKE_INTERMEDIATE =	(1<<8),
+	X509_IKE_INTERMEDIATE =   (1<<8),
+	/** cert has Microsoft Smartcard Logon usage */
+	X509_MS_SMARTCARD_LOGON = (1<<9),
 };
 
 /**
diff --git a/src/libstrongswan/credentials/cred_encoding.c b/src/libstrongswan/credentials/cred_encoding.c
index 53ac13cbb..303816391 100644
--- a/src/libstrongswan/credentials/cred_encoding.c
+++ b/src/libstrongswan/credentials/cred_encoding.c
@@ -94,22 +94,6 @@ bool cred_encoding_args(va_list args, ...)
 	return !failed;
 }
 
-/**
- * hashtable hash() function
- */
-static u_int hash(void *key)
-{
-	return (uintptr_t)key;
-}
-
-/**
- * hashtable equals() function
- */
-static bool equals(void *key1, void *key2)
-{
-	return key1 == key2;
-}
-
 METHOD(cred_encoding_t, get_cache, bool,
 	private_cred_encoding_t *this, cred_encoding_type_t type, void *cache,
 	chunk_t *encoding)
@@ -289,7 +273,8 @@ cred_encoding_t *cred_encoding_create()
 
 	for (type = 0; type < CRED_ENCODING_MAX; type++)
 	{
-		this->cache[type] = hashtable_create(hash, equals, 8);
+		this->cache[type] = hashtable_create(hashtable_hash_ptr,
+											 hashtable_equals_ptr, 8);
 	}
 
 	return &this->public;
diff --git a/src/libstrongswan/credentials/ietf_attributes/ietf_attributes.c b/src/libstrongswan/credentials/ietf_attributes/ietf_attributes.c
deleted file mode 100644
index 49af5a079..000000000
--- a/src/libstrongswan/credentials/ietf_attributes/ietf_attributes.c
+++ /dev/null
@@ -1,534 +0,0 @@
-/*
- * Copyright (C) 2007-2009 Andreas Steffen
- *
- * HSR Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <asn1/oid.h>
-#include <asn1/asn1.h>
-#include <asn1/asn1_parser.h>
-#include <collections/linked_list.h>
-#include <utils/lexparser.h>
-
-#include "ietf_attributes.h"
-
-/**
- * Private definition of IETF attribute types
- */
-typedef enum {
-	IETF_ATTRIBUTE_OCTETS =	0,
-	IETF_ATTRIBUTE_OID =	1,
-	IETF_ATTRIBUTE_STRING =	2
-} ietf_attribute_type_t;
-
-typedef struct ietf_attr_t ietf_attr_t;
-
-/**
- * Private definition of an IETF attribute
- */
-struct ietf_attr_t {
-	/**
-	 * IETF attribute type
-	 */
-	ietf_attribute_type_t type;
-
-	/**
-	 * IETF attribute value
-	 */
-	chunk_t value;
-
-	/**
-	 * Compares two IETF attributes
-	 *
-	 * return -1 if this is earlier in the alphabet than other
-	 * return  0 if this equals other
-	 * return +1 if this is later in the alphabet than other
-	 *
-	 * @param other		other object
-	 */
-	int (*compare) (ietf_attr_t *this, ietf_attr_t *other);
-
-	/**
-	 * Destroys an ietf_attr_t object.
-	 */
-	void (*destroy) (ietf_attr_t *this);
-};
-
-/**
- * Implements ietf_attr_t.compare.
- */
-static int ietf_attr_compare(ietf_attr_t *this, ietf_attr_t *other)
-{
-	int cmp_len, len, cmp_value;
-
-	/* OID attributes are appended after STRING and OCTETS attributes */
-	if (this->type != IETF_ATTRIBUTE_OID && other->type == IETF_ATTRIBUTE_OID)
-	{
-		return -1;
-	}
-	if (this->type == IETF_ATTRIBUTE_OID && other->type != IETF_ATTRIBUTE_OID)
-	{
-		return 1;
-	}
-
-	cmp_len = this->value.len - other->value.len;
-	len = (cmp_len < 0) ? this->value.len : other->value.len;
-	cmp_value = memcmp(this->value.ptr, other->value.ptr, len);
-
-	return (cmp_value == 0) ? cmp_len : cmp_value;
-}
-
-/**
- * Implements ietf_attr_t.destroy.
- */
-static void ietf_attr_destroy(ietf_attr_t *this)
-{
-	free(this->value.ptr);
-	free(this);
-}
-
-/**
- * Creates an ietf_attr_t object.
- */
-static ietf_attr_t* ietf_attr_create(ietf_attribute_type_t type, chunk_t value)
-{
-	ietf_attr_t *this;
-
-	INIT(this,
-		.compare = ietf_attr_compare,
-		.destroy = ietf_attr_destroy,
-		.type = type,
-		.value = chunk_clone(value),
-	);
-
-	return this;
-}
-
-typedef struct private_ietf_attributes_t private_ietf_attributes_t;
-
-/**
- * Private data of an ietf_attributes_t object.
- */
-struct private_ietf_attributes_t {
-	/**
-	 * Public interface.
-	 */
-	ietf_attributes_t public;
-
-	/**
-	 * Printable representation of the IETF attributes
-	 */
-	char *string;
-
-	/**
-	 * Linked list of IETF attributes.
-	 */
-	linked_list_t *list;
-
-	/**
-	 * reference count
-	 */
-	refcount_t ref;
-};
-
-METHOD(ietf_attributes_t, get_string, char*,
-	private_ietf_attributes_t *this)
-{
-	if (this->string == NULL)
-	{
-		char buf[BUF_LEN];
-		char *pos = buf;
-		int len = BUF_LEN;
-		bool first = TRUE;
-		ietf_attr_t *attr;
-		enumerator_t *enumerator;
-
-		enumerator = this->list->create_enumerator(this->list);
-		while (enumerator->enumerate(enumerator, &attr))
-		{
-			int written;
-
-			if (first)
-			{
-				first = FALSE;
-			}
-			else
-			{
-				written = snprintf(pos, len, ", ");
-				if (written < 0 || written >= len)
-				{
-					break;
-				}
-				pos += written;
-				len -= written;
-			}
-
-			switch (attr->type)
-			{
-				case IETF_ATTRIBUTE_OCTETS:
-				case IETF_ATTRIBUTE_STRING:
-					written = snprintf(pos, len, "%.*s", (int)attr->value.len,
-														 attr->value.ptr);
-					break;
-				case IETF_ATTRIBUTE_OID:
-				{
-					int oid = asn1_known_oid(attr->value);
-
-					if (oid == OID_UNKNOWN)
-					{
-						written = snprintf(pos, len, "0x%#B", &attr->value);
-					}
-					else
-					{
-						written = snprintf(pos, len, "%s", oid_names[oid].name);
-					}
-					break;
-				}
-				default:
-					written = 0;
-					break;
-			}
-			if (written < 0 || written >= len)
-			{
-				break;
-			}
-			pos += written;
-			len -= written;
-		}
-		enumerator->destroy(enumerator);
-		if (len < BUF_LEN)
-		{
-			this->string = strdup(buf);
-		}
-	}
-	return this->string;
-}
-
-METHOD(ietf_attributes_t, get_encoding, chunk_t,
-	private_ietf_attributes_t *this)
-{
-	chunk_t values;
-	size_t size = 0;
-	u_char *pos;
-	ietf_attr_t *attr;
-	enumerator_t *enumerator;
-
-	/* precalculate the total size of all values */
-	enumerator = this->list->create_enumerator(this->list);
-	while (enumerator->enumerate(enumerator, &attr))
-	{
-		size_t len = attr->value.len;
-
-		size += 1 + (len > 0) + (len >= 128) + (len >= 256) + (len >= 65536) + len;
-	}
-	enumerator->destroy(enumerator);
-
-	pos = asn1_build_object(&values, ASN1_SEQUENCE, size);
-
-	enumerator = this->list->create_enumerator(this->list);
-	while (enumerator->enumerate(enumerator, &attr))
-	{
-		chunk_t ietfAttribute;
-		asn1_t type = ASN1_NULL;
-
-		switch (attr->type)
-		{
-			case IETF_ATTRIBUTE_OCTETS:
-				type = ASN1_OCTET_STRING;
-				break;
-			case IETF_ATTRIBUTE_STRING:
-				type = ASN1_UTF8STRING;
-				break;
-			case IETF_ATTRIBUTE_OID:
-				type = ASN1_OID;
-				break;
-		}
-		ietfAttribute = asn1_simple_object(type, attr->value);
-
-		/* copy ietfAttribute into values chunk */
-		memcpy(pos, ietfAttribute.ptr, ietfAttribute.len);
-		pos += ietfAttribute.len;
-		free(ietfAttribute.ptr);
-	}
-	enumerator->destroy(enumerator);
-
-	return asn1_wrap(ASN1_SEQUENCE, "m", values);
-}
-
-/**
- * Implementation of ietf_attributes_t.equals.
- */
-static bool equals(private_ietf_attributes_t *this,
-				   private_ietf_attributes_t *other)
-{
-	 bool result = TRUE;
-
-	/* lists must have the same number of attributes */
-	if (other == NULL ||
-		this->list->get_count(this->list) != other->list->get_count(other->list))
-	{
-		return FALSE;
-	}
-
-	/* compare two alphabetically-sorted lists */
-	{
-		ietf_attr_t *attr_a, *attr_b;
-		enumerator_t *enum_a, *enum_b;
-
-		enum_a = this->list->create_enumerator(this->list);
-		enum_b = other->list->create_enumerator(other->list);
-		while (enum_a->enumerate(enum_a, &attr_a) &&
-			   enum_b->enumerate(enum_b, &attr_b))
-		{
-			if (attr_a->compare(attr_a, attr_b) != 0)
-			{
-				/* we have a mismatch */
-				result = FALSE;
-				break;
-			}
-		}
-		enum_a->destroy(enum_a);
-		enum_b->destroy(enum_b);
-	}
-	return result;
-}
-
-/**
- * Implementation of ietf_attributes_t.matches.
- */
-static bool matches(private_ietf_attributes_t *this,
-					private_ietf_attributes_t *other)
-{
-	bool result = FALSE;
-	ietf_attr_t *attr_a, *attr_b;
-	enumerator_t *enum_a, *enum_b;
-
-	/* always match if this->list does not contain any attributes */
-	if (this->list->get_count(this->list) == 0)
-	{
-		return TRUE;
-	}
-
-	/* never match if other->list does not contain any attributes */
-	if (other == NULL || other->list->get_count(other->list) == 0)
-	{
-		return FALSE;
-	}
-
-	/* get first attribute from both lists */
-	enum_a = this->list->create_enumerator(this->list);
-	enum_a->enumerate(enum_a, &attr_a);
-	enum_b = other->list->create_enumerator(other->list);
-	enum_b->enumerate(enum_b, &attr_b);
-
-	/* look for at least one common attribute */
-	while (TRUE)
-	{
-		int cmp = attr_a->compare(attr_a, attr_b);
-
-		if (cmp == 0)
-		{
-			/* we have a match */
-			result = TRUE;
-			break;
-		}
-		if (cmp == -1)
-		{
-			/* attr_a is earlier in the alphabet, get next attr_a */
-			if (!enum_a->enumerate(enum_a, &attr_a))
-			{
-				/* we have reached the end of enum_a */
-				break;
-			}
-		}
-		else
-		{
-			/* attr_a is later in the alphabet, get next attr_b */
-			if (!enum_b->enumerate(enum_b, &attr_b))
-			{
-				/* we have reached the end of enum_b */
-				break;
-			}
-		}
-	}
-	enum_a->destroy(enum_a);
-	enum_b->destroy(enum_b);
-
-	return result;
-}
-
-METHOD(ietf_attributes_t, get_ref, ietf_attributes_t*,
-	private_ietf_attributes_t *this)
-{
-	ref_get(&this->ref);
-	return &this->public;
-}
-
-METHOD(ietf_attributes_t, destroy, void,
-	private_ietf_attributes_t *this)
-{
-	if (ref_put(&this->ref))
-	{
-		this->list->destroy_offset(this->list, offsetof(ietf_attr_t, destroy));
-		free(this->string);
-		free(this);
-	}
-}
-
-static private_ietf_attributes_t* create_empty(void)
-{
-	private_ietf_attributes_t *this;
-
-	INIT(this,
-		.public = {
-			.get_string = _get_string,
-			.get_encoding = _get_encoding,
-			.equals = (bool (*)(ietf_attributes_t*,ietf_attributes_t*))equals,
-			.matches = (bool (*)(ietf_attributes_t*,ietf_attributes_t*))matches,
-			.get_ref = _get_ref,
-			.destroy = _destroy,
-		},
-		.list = linked_list_create(),
-		.ref = 1,
-	);
-
-	return this;
-}
-
-/**
- * Adds an ietf_attr_t object to a sorted linked list
- */
-static void ietf_attributes_add(private_ietf_attributes_t *this,
-								ietf_attr_t *attr)
-{
-	ietf_attr_t *current_attr;
-	enumerator_t *enumerator;
-	int cmp = -1;
-
-	enumerator = this->list->create_enumerator(this->list);
-	while (enumerator->enumerate(enumerator, (void **)&current_attr) &&
-		  (cmp = attr->compare(attr, current_attr)) > 0)
-	{
-		continue;
-	}
-	if (cmp == 0)
-	{
-		attr->destroy(attr);
-	}
-	else
-	{	/* the enumerator either points to the end or to the attribute > attr */
-		this->list->insert_before(this->list, enumerator, attr);
-	}
-	enumerator->destroy(enumerator);
-}
-
-/*
- * Described in header.
- */
-ietf_attributes_t *ietf_attributes_create_from_string(char *string)
-{
-	private_ietf_attributes_t *this = create_empty();
-
-	chunk_t line = { string, strlen(string) };
-
-	while (eat_whitespace(&line))
-	{
-		chunk_t group;
-
-		/* extract the next comma-separated group attribute */
-		if (!extract_token(&group, ',', &line))
-		{
-			group = line;
-			line.len = 0;
-		}
-
-		/* remove any trailing spaces */
-		while (group.len > 0 && *(group.ptr + group.len - 1) == ' ')
-		{
-			group.len--;
-		}
-
-		/* add the group attribute to the list */
-		if (group.len > 0)
-		{
-			ietf_attr_t *attr = ietf_attr_create(IETF_ATTRIBUTE_STRING, group);
-
-			ietf_attributes_add(this, attr);
-		}
-	}
-
-	return &(this->public);
-}
-
-/**
- * ASN.1 definition of ietfAttrSyntax
- */
-static const asn1Object_t ietfAttrSyntaxObjects[] =
-{
-	{ 0, "ietfAttrSyntax",		ASN1_SEQUENCE,		ASN1_NONE }, /*  0 */
-	{ 1,   "policyAuthority",	ASN1_CONTEXT_C_0,	ASN1_OPT |
-													ASN1_BODY }, /*  1 */
-	{ 1,   "end opt",			ASN1_EOC,			ASN1_END  }, /*  2 */
-	{ 1,   "values",			ASN1_SEQUENCE,		ASN1_LOOP }, /*  3 */
-	{ 2,     "octets",			ASN1_OCTET_STRING,	ASN1_OPT |
-													ASN1_BODY }, /*  4 */
-	{ 2,     "end choice",		ASN1_EOC,			ASN1_END  }, /*  5 */
-	{ 2,     "oid",				ASN1_OID,			ASN1_OPT |
-													ASN1_BODY }, /*  6 */
-	{ 2,     "end choice",		ASN1_EOC,			ASN1_END  }, /*  7 */
-	{ 2,     "string",			ASN1_UTF8STRING,	ASN1_OPT |
-													ASN1_BODY }, /*  8 */
-	{ 2,     "end choice",		ASN1_EOC,			ASN1_END  }, /*  9 */
-	{ 1,   "end loop",			ASN1_EOC,			ASN1_END  }, /* 10 */
-	{ 0, "exit",				ASN1_EOC,			ASN1_EXIT }
-};
-#define IETF_ATTR_OCTETS	 4
-#define IETF_ATTR_OID		 6
-#define IETF_ATTR_STRING	 8
-
-/*
- * Described in header.
- */
-ietf_attributes_t *ietf_attributes_create_from_encoding(chunk_t encoded)
-{
-	private_ietf_attributes_t *this = create_empty();
-	asn1_parser_t *parser;
-	chunk_t object;
-	int objectID;
-
-	parser = asn1_parser_create(ietfAttrSyntaxObjects, encoded);
-	while (parser->iterate(parser, &objectID, &object))
-	{
-		switch (objectID)
-		{
-			case IETF_ATTR_OCTETS:
-			case IETF_ATTR_OID:
-			case IETF_ATTR_STRING:
-				{
-					ietf_attribute_type_t type;
-					ietf_attr_t *attr;
-
-					type = (objectID - IETF_ATTR_OCTETS) / 2;
-					attr = ietf_attr_create(type, object);
-					ietf_attributes_add(this, attr);
-				}
-				break;
-			default:
-				break;
-		}
-	}
-	parser->destroy(parser);
-
-	return &(this->public);
-}
-
diff --git a/src/libstrongswan/credentials/ietf_attributes/ietf_attributes.h b/src/libstrongswan/credentials/ietf_attributes/ietf_attributes.h
deleted file mode 100644
index ab6bae984..000000000
--- a/src/libstrongswan/credentials/ietf_attributes/ietf_attributes.h
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2007-2009 Andreas Steffen
- *
- * HSR Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup ietf_attributes ietf_attributes
- * @{ @ingroup credentials
- */
-
-#ifndef IETF_ATTRIBUTES_H_
-#define IETF_ATTRIBUTES_H_
-
-typedef struct ietf_attributes_t ietf_attributes_t;
-
-#include <library.h>
-
-/**
- *
- */
-struct ietf_attributes_t {
-
-	/**
-	 * Get the an alphabetically sorted list of printable IETF attributes.
-	 *
-	 * Result points to internal data, do not free.
-	 *
-	 * @return 			a string containing printable attributes
-	 */
-	char* (*get_string) (ietf_attributes_t *this);
-
-	/**
-	 * Get the ASN.1 encoding of the IETF attributes.
-	 *
-	 * @return 			allocated chunk containing the encoded bytes
-	 */
-	chunk_t (*get_encoding) (ietf_attributes_t *this);
-
-	/**
-	 * Check for equality between two lists.
-	 *
-	 * @param other		attribute list to be checked for equality
-	 * @return 			TRUE if equal
-	 */
-	bool (*equals) (ietf_attributes_t *this, ietf_attributes_t *other);
-
-	/**
-	 * Check for common attributes between two lists.
-	 *
-	 * @param other		attribute list to be matched 
-	 * @return 			TRUE if there is at least a common attribute
-	 */
-	bool (*matches) (ietf_attributes_t *this, ietf_attributes_t *other);
-
-	/**
-	 * Get a new reference to the IETF attributes.
-	 *
-	 * @return			this, with an increased refcount
-	 */
-	ietf_attributes_t* (*get_ref)(ietf_attributes_t *this);
-
-	/**
-	 * Destroys an ietf_attributes_t object.
-	 */
-	void (*destroy) (ietf_attributes_t *this);
-};
-
-/**
- * @param string	input string, which will be converted
- * @return			ietf_attributes_t
- */
-ietf_attributes_t *ietf_attributes_create_from_string(char *string);
-
-/**
- * @param encoded	ASN.1 encoded bytes, such as from ietf_attributes.get_encoding
- * @return			ietf_attributes_t
- */
-ietf_attributes_t *ietf_attributes_create_from_encoding(chunk_t encoded);
-
-#endif /** IETF_ATTRIBUTES_H_ @}*/
-
diff --git a/src/libstrongswan/credentials/sets/auth_cfg_wrapper.c b/src/libstrongswan/credentials/sets/auth_cfg_wrapper.c
index 46bfb5c6e..c6b8d0c7e 100644
--- a/src/libstrongswan/credentials/sets/auth_cfg_wrapper.c
+++ b/src/libstrongswan/credentials/sets/auth_cfg_wrapper.c
@@ -133,7 +133,8 @@ static bool enumerate(wrapper_enumerator_t *this, certificate_t **cert)
 		}
 		else if (rule != AUTH_HELPER_SUBJECT_CERT &&
 				 rule != AUTH_HELPER_IM_CERT &&
-				 rule != AUTH_HELPER_REVOCATION_CERT)
+				 rule != AUTH_HELPER_REVOCATION_CERT &&
+				 rule != AUTH_HELPER_AC_CERT)
 		{	/* handle only HELPER certificates */
 			continue;
 		}