denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Always pass auth info to validate(), use pathlen to check for user certificate

Browse Source
This commit is contained in:
Martin Willi
2011-01-05 16:46:04 +01:00
parent 98ef286580
commit 09e319d419
3 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/credential_manager.c
+1 -2
View File
@@ -622,8 +622,7 @@ static bool verify_trust_chain(private_credential_manager_t *this,
break; break;
} }
} }
if (!check_certificate(this, current, issuer, online, pathlen, if (!check_certificate(this, current, issuer, online, pathlen, auth))
current == subject ? auth : NULL))
{ {
trusted = FALSE; trusted = FALSE;
issuer->destroy(issuer); issuer->destroy(issuer);
src/libstrongswan/plugins/constraints/constraints_validator.c
+4 -3
View File
@@ -293,7 +293,8 @@ static bool has_policy(x509_t *issuer, chunk_t oid)
/** /**
* Check certificatePolicies * Check certificatePolicies
*/ */
static bool check_policy(x509_t *subject, x509_t *issuer, auth_cfg_t *auth) static bool check_policy(x509_t *subject, x509_t *issuer, int pathlen,
auth_cfg_t *auth)
{ {
certificate_t *cert = (certificate_t*)subject; certificate_t *cert = (certificate_t*)subject;
x509_policy_mapping_t *mapping; x509_policy_mapping_t *mapping;
@@ -329,7 +330,7 @@ static bool check_policy(x509_t *subject, x509_t *issuer, auth_cfg_t *auth)
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
return FALSE; return FALSE;
} }
if (auth) if (pathlen == 0)
{ {
oid = asn1_oid_to_string(policy->oid); oid = asn1_oid_to_string(policy->oid);
if (oid) if (oid)
@@ -358,7 +359,7 @@ METHOD(cert_validator_t, validate, bool,
{ {
return FALSE; return FALSE;
} }
if (!check_policy((x509_t*)subject, (x509_t*)issuer, auth)) if (!check_policy((x509_t*)subject, (x509_t*)issuer, pathlen, auth))
{ {
return FALSE; return FALSE;
} }
src/libstrongswan/plugins/revocation/revocation_validator.c
+4 -2
View File
@@ -576,7 +576,8 @@ METHOD(cert_validator_t, validate, bool,
{ {
DBG1(DBG_CFG, "checking certificate status of \"%Y\"", DBG1(DBG_CFG, "checking certificate status of \"%Y\"",
subject->get_subject(subject)); subject->get_subject(subject));
switch (check_ocsp((x509_t*)subject, (x509_t*)issuer, auth)) switch (check_ocsp((x509_t*)subject, (x509_t*)issuer,
pathlen ? NULL : auth))
{ {
case VALIDATION_GOOD: case VALIDATION_GOOD:
DBG1(DBG_CFG, "certificate status is good"); DBG1(DBG_CFG, "certificate status is good");
@@ -594,7 +595,8 @@ METHOD(cert_validator_t, validate, bool,
DBG1(DBG_CFG, "ocsp check failed, fallback to crl"); DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
break; break;
} }
switch (check_crl((x509_t*)subject, (x509_t*)issuer, auth)) switch (check_crl((x509_t*)subject, (x509_t*)issuer,
pathlen ? NULL : auth))
{ {
case VALIDATION_GOOD: case VALIDATION_GOOD:
DBG1(DBG_CFG, "certificate status is good"); DBG1(DBG_CFG, "certificate status is good");