denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

detect trusted self-signed before trust chain verification

Browse Source
This commit is contained in:
Andreas Steffen
2008-03-21 19:10:55 +00:00
parent ffce5db1b7
commit 02fd225ea5
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/credentials/credential_manager.c
+14 -4
View File
@@ -993,11 +993,21 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
subject = get_pretrusted_cert(this, type, id); subject = get_pretrusted_cert(this, type, id);
if (subject) if (subject)
{ {
/* if we find a trusted certificate, we accept it. However, to fulfill
* authorization rules, we try to build the trust chain anyway. */ if (subject->issued_by(subject, subject, TRUE))
{
DBG1(DBG_CFG, " using trusted self-signed certificate \"%D\"",
subject->get_subject(subject));
return subject;
}
/* if we find a trusted certificate, we accept it. However, in order
* to fulfill authorization rules, we try to build the trust chain
* anyway.
*/
if (verify_trust_chain(this, subject, auth, TRUE, crl, ocsp)) if (verify_trust_chain(this, subject, auth, TRUE, crl, ocsp))
{ {
DBG1(DBG_CFG, " using pre-trusted certificate \"%D\"", DBG1(DBG_CFG, " using trusted certificate \"%D\"",
subject->get_subject(subject)); subject->get_subject(subject));
return subject; return subject;
} }
@@ -1005,7 +1015,7 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
} }
subject = NULL; subject = NULL;
/* try to verify the trustchain for each certificate found */ /* try to verify the trust chain for each certificate found */
enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE); enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE);
while (enumerator->enumerate(enumerator, &current)) while (enumerator->enumerate(enumerator, &current))
{ {