denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Set client identity with TLS certificate authentication

Browse Source
This commit is contained in:
Andreas Steffen
2013-08-15 23:34:23 +02:00
parent 9cc606d22a
commit 0a09b02dcf
1 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libpttls/pt_tls_server.c
+18 -7
View File
@@ -321,34 +321,45 @@ static status_t read_sasl_mech_selection(private_pt_tls_server_t *this,
static bool do_sasl(private_pt_tls_server_t *this)
{
sasl_mechanism_t *sasl;
identification_t *client_id;
tnccs_t *tnccs;
status_t status;
client_id = this->tls->get_peer_id(this->tls);
tnccs = (tnccs_t*)this->tnccs;
switch (this->auth)
{
case PT_TLS_AUTH_NONE:
return TRUE;
case PT_TLS_AUTH_TLS:
if (this->tls->get_peer_id(this->tls))
if (client_id)
{
this->tnccs->set_peer_id(this->tnccs, client_id);
tnccs->set_auth_type(tnccs, TNC_AUTH_X509_CERT);
return TRUE;
}
DBG1(DBG_TNC, "requiring TLS certificate client authentication");
DBG1(DBG_TNC, "requiring TLS certificate-based "
"client authentication");
return FALSE;
case PT_TLS_AUTH_SASL:
break;
case PT_TLS_AUTH_TLS_OR_SASL:
if (this->tls->get_peer_id(this->tls))
if (client_id)
{
DBG1(DBG_TNC, "skipping SASL, client authenticated with TLS "
"certificate");
this->tnccs->set_peer_id(this->tnccs, client_id);
tnccs->set_auth_type(tnccs, TNC_AUTH_X509_CERT);
DBG1(DBG_TNC, "skipping SASL, client already authenticated by "
"TLS certificate");
return TRUE;
}
break;
case PT_TLS_AUTH_TLS_AND_SASL:
default:
if (!this->tls->get_peer_id(this->tls))
if (!client_id)
{
DBG1(DBG_TNC, "requiring TLS certificate client authentication");
DBG1(DBG_TNC, "requiring TLS certificate-based "
"client authentication");
return FALSE;
}
break;