denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

certificate: Return signature scheme and parameters from issued_by() method

Browse Source 
This also required some include restructuring (avoid including library.h
in headers) to avoid unresolvable circular dependencies.
This commit is contained in:
Tobias Brunner
2017-11-08 16:48:10 +01:00
parent c2935b03c4
commit 024b979522
29 changed files with 124 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_ac.c
+5 -2
View File
@@ -886,7 +886,8 @@ METHOD(certificate_t, has_issuer, id_match_t,
}
METHOD(certificate_t, issued_by, bool,
private_x509_ac_t *this, certificate_t *issuer, signature_scheme_t *schemep)
private_x509_ac_t *this, certificate_t *issuer,
signature_params_t **schemep)
{
public_key_t *key;
signature_scheme_t scheme;
@@ -938,7 +939,9 @@ METHOD(certificate_t, issued_by, bool,
key->destroy(key);
if (valid && schemep)
{
*schemep = scheme;
INIT(*schemep,
.scheme = scheme,
);
}
return valid;
}
src/libstrongswan/plugins/x509/x509_cert.c
+15 -9
View File
@@ -1677,18 +1677,26 @@ METHOD(certificate_t, has_issuer, id_match_t,
METHOD(certificate_t, issued_by, bool,
private_x509_cert_t *this, certificate_t *issuer,
signature_scheme_t *schemep)
signature_params_t **schemep)
{
public_key_t *key;
signature_scheme_t scheme;
bool valid;
x509_t *x509 = (x509_t*)issuer;
/* determine signature scheme */
scheme = signature_scheme_from_oid(this->algorithm);
if (scheme == SIGN_UNKNOWN)
{
return FALSE;
}
if (&this->public.interface.interface == issuer)
{
if (this->flags & X509_SELF_SIGNED)
{
return TRUE;
valid = TRUE;
goto out;
}
}
else
@@ -1707,12 +1715,6 @@ METHOD(certificate_t, issued_by, bool,
return FALSE;
}
/* determine signature scheme */
scheme = signature_scheme_from_oid(this->algorithm);
if (scheme == SIGN_UNKNOWN)
{
return FALSE;
}
/* get the public key of the issuer */
key = issuer->get_public_key(issuer);
if (!key)
@@ -1722,9 +1724,13 @@ METHOD(certificate_t, issued_by, bool,
valid = key->verify(key, scheme, NULL, this->tbsCertificate,
this->signature);
key->destroy(key);
out:
if (valid && schemep)
{
*schemep = scheme;
INIT(*schemep,
.scheme = scheme,
);
}
return valid;
}
src/libstrongswan/plugins/x509/x509_crl.c
+5 -2
View File
@@ -457,7 +457,8 @@ METHOD(certificate_t, has_issuer, id_match_t,
}
METHOD(certificate_t, issued_by, bool,
private_x509_crl_t *this, certificate_t *issuer, signature_scheme_t *schemep)
private_x509_crl_t *this, certificate_t *issuer,
signature_params_t **schemep)
{
public_key_t *key;
signature_scheme_t scheme;
@@ -506,7 +507,9 @@ METHOD(certificate_t, issued_by, bool,
key->destroy(key);
if (valid && schemep)
{
*schemep = scheme;
INIT(*schemep,
.scheme = scheme,
);
}
return valid;
}
src/libstrongswan/plugins/x509/x509_ocsp_request.c
+1 -1
View File
@@ -372,7 +372,7 @@ METHOD(certificate_t, has_issuer, id_match_t,
METHOD(certificate_t, issued_by, bool,
private_x509_ocsp_request_t *this, certificate_t *issuer,
signature_scheme_t *scheme)
signature_params_t **scheme)
{
DBG1(DBG_LIB, "OCSP request validation not implemented!");
return FALSE;
src/libstrongswan/plugins/x509/x509_ocsp_response.c
+4 -2
View File
@@ -703,7 +703,7 @@ METHOD(certificate_t, has_issuer, id_match_t,
METHOD(certificate_t, issued_by, bool,
private_x509_ocsp_response_t *this, certificate_t *issuer,
signature_scheme_t *schemep)
signature_params_t **schemep)
{
public_key_t *key;
signature_scheme_t scheme;
@@ -758,7 +758,9 @@ METHOD(certificate_t, issued_by, bool,
key->destroy(key);
if (valid && schemep)
{
*schemep = scheme;
INIT(*schemep,
.scheme = scheme,
);
}
return valid;
}
src/libstrongswan/plugins/x509/x509_pkcs10.c
+17 -14
View File
@@ -124,7 +124,7 @@ METHOD(certificate_t, has_subject, id_match_t,
METHOD(certificate_t, issued_by, bool,
private_x509_pkcs10_t *this, certificate_t *issuer,
signature_scheme_t *schemep)
signature_params_t **schemep)
{
public_key_t *key;
signature_scheme_t scheme;
@@ -134,29 +134,32 @@ METHOD(certificate_t, issued_by, bool,
{
return FALSE;
}
if (this->self_signed)
{
return TRUE;
}
/* determine signature scheme */
scheme = signature_scheme_from_oid(this->algorithm);
if (scheme == SIGN_UNKNOWN)
{
return FALSE;
}
/* get the public key contained in the certificate request */
key = this->public_key;
if (!key)
if (this->self_signed)
{
return FALSE;
valid = TRUE;
}
else
{
/* get the public key contained in the certificate request */
key = this->public_key;
if (!key)
{
return FALSE;
}
valid = key->verify(key, scheme, NULL, this->certificationRequestInfo,
this->signature);
}
valid = key->verify(key, scheme, NULL, this->certificationRequestInfo,
this->signature);
if (valid && schemep)
{
*schemep = scheme;
INIT(*schemep,
.scheme = scheme,
);
}
return valid;
}