denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stroke: Combine CA certificate load methods

Browse Source 
Also use the right credential set for CA cert references loaded from
stroke_ca_t.
This commit is contained in:
Tobias Brunner
2015-08-20 19:19:38 +02:00
parent 99610f406d
commit 01d3ecbaf0
1 changed files with 74 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_cred.c
+74 -82
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright (C) 2008-2013 Tobias Brunner * Copyright (C) 2008-2015 Tobias Brunner
* Copyright (C) 2008 Martin Willi * Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil * Hochschule fuer Technik Rapperswil
* *
@@ -182,70 +182,6 @@ static certificate_t *load_from_smartcard(smartcard_format_t format,
return cred; return cred;
} }
METHOD(stroke_cred_t, load_ca, certificate_t*,
private_stroke_cred_t *this, char *filename)
{
certificate_t *cert = NULL;
char path[PATH_MAX];
if (strpfx(filename, "%smartcard"))
{
smartcard_format_t format;
char module[SC_PART_LEN], keyid[SC_PART_LEN];
u_int slot;
format = parse_smartcard(filename, &slot, module, keyid);
if (format != SC_FORMAT_INVALID)
{
cert = (certificate_t*)load_from_smartcard(format,
slot, module, keyid, CRED_CERTIFICATE, CERT_X509);
}
}
else
{
if (*filename == '/')
{
snprintf(path, sizeof(path), "%s", filename);
}
else
{
snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
}
if (this->force_ca_cert)
{ /* we treat this certificate as a CA certificate even if it has no
* CA basic constraint */
cert = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, path, BUILD_X509_FLAG, X509_CA,
BUILD_END);
}
else
{
cert = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, path,
BUILD_END);
}
}
if (cert)
{
x509_t *x509 = (x509_t*)cert;
if (!(x509->get_flags(x509) & X509_CA))
{
DBG1(DBG_CFG, " ca certificate \"%Y\" misses ca basic constraint, "
"discarded", cert->get_subject(cert));
cert->destroy(cert);
return NULL;
}
DBG1(DBG_CFG, " loaded ca certificate \"%Y\" from '%s'",
cert->get_subject(cert), filename);
return this->creds->get_cert_ref(this->creds, cert);
}
return NULL;
}
METHOD(stroke_cred_t, load_peer, certificate_t*, METHOD(stroke_cred_t, load_peer, certificate_t*,
private_stroke_cred_t *this, char *filename) private_stroke_cred_t *this, char *filename)
{ {
@@ -384,23 +320,52 @@ METHOD(stroke_cred_t, load_pubkey, certificate_t*,
} }
/** /**
* Load a CA certificate from disk * Load a CA certificate, optionally force it to be one
*/ */
static void load_x509_ca(private_stroke_cred_t *this, char *file, static certificate_t *load_ca_cert(char *filename, bool force_ca_cert)
mem_cred_t *creds)
{ {
certificate_t *cert; certificate_t *cert = NULL;
char path[PATH_MAX];
if (this->force_ca_cert) if (strpfx(filename, "%smartcard"))
{ /* treat certificate as CA cert even it has no CA basic constraint */ {
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, smartcard_format_t format;
BUILD_FROM_FILE, file, char module[SC_PART_LEN], keyid[SC_PART_LEN];
BUILD_X509_FLAG, X509_CA, BUILD_END); u_int slot;
format = parse_smartcard(filename, &slot, module, keyid);
if (format != SC_FORMAT_INVALID)
{
cert = (certificate_t*)load_from_smartcard(format,
slot, module, keyid, CRED_CERTIFICATE, CERT_X509);
}
} }
else else
{ {
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, if (*filename == '/')
BUILD_FROM_FILE, file, BUILD_END); {
snprintf(path, sizeof(path), "%s", filename);
}
else
{
snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
}
if (force_ca_cert)
{ /* we treat this certificate as a CA certificate even if it has no
* CA basic constraint */
cert = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, path, BUILD_X509_FLAG, X509_CA,
BUILD_END);
}
else
{
cert = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, path,
BUILD_END);
}
} }
if (cert) if (cert)
{ {
@@ -411,13 +376,40 @@ static void load_x509_ca(private_stroke_cred_t *this, char *file,
DBG1(DBG_CFG, " ca certificate \"%Y\" lacks ca basic constraint, " DBG1(DBG_CFG, " ca certificate \"%Y\" lacks ca basic constraint, "
"discarded", cert->get_subject(cert)); "discarded", cert->get_subject(cert));
cert->destroy(cert); cert->destroy(cert);
return NULL;
} }
else DBG1(DBG_CFG, " loaded ca certificate \"%Y\" from '%s'",
{ cert->get_subject(cert), filename);
DBG1(DBG_CFG, " loaded ca certificate \"%Y\" from '%s'", return cert;
cert->get_subject(cert), file); }
creds->add_cert(creds, TRUE, cert); return NULL;
} }
METHOD(stroke_cred_t, load_ca, certificate_t*,
private_stroke_cred_t *this, char *filename)
{
certificate_t *cert;
cert = load_ca_cert(filename, this->force_ca_cert);
if (cert)
{
return this->cacerts->get_cert_ref(this->cacerts, cert);
}
return NULL;
}
/**
* Load a CA certificate from disk
*/
static void load_x509_ca(private_stroke_cred_t *this, char *file,
mem_cred_t *creds)
{
certificate_t *cert;
cert = load_ca_cert(file, this->force_ca_cert);
if (cert)
{
creds->add_cert(creds, TRUE, cert);
} }
else else
{ {