denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Set client identity with TLS certificate authentication

Browse Source
This commit is contained in:
Andreas Steffen
2013-08-15 23:34:23 +02:00
parent 9cc606d22a
commit 0a09b02dcf
1 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libpttls/pt_tls_server.c
+18 -7
View File
@@ -321,34 +321,45 @@ static status_t read_sasl_mech_selection(private_pt_tls_server_t *this,
static bool do_sasl(private_pt_tls_server_t *this) static bool do_sasl(private_pt_tls_server_t *this)
{ {
sasl_mechanism_t *sasl; sasl_mechanism_t *sasl;
identification_t *client_id;
tnccs_t *tnccs;
status_t status; status_t status;
client_id = this->tls->get_peer_id(this->tls);
tnccs = (tnccs_t*)this->tnccs;
switch (this->auth) switch (this->auth)
{ {
case PT_TLS_AUTH_NONE: case PT_TLS_AUTH_NONE:
return TRUE; return TRUE;
case PT_TLS_AUTH_TLS: case PT_TLS_AUTH_TLS:
if (this->tls->get_peer_id(this->tls)) if (client_id)
{ {
this->tnccs->set_peer_id(this->tnccs, client_id);
tnccs->set_auth_type(tnccs, TNC_AUTH_X509_CERT);
return TRUE; return TRUE;
} }
DBG1(DBG_TNC, "requiring TLS certificate client authentication"); DBG1(DBG_TNC, "requiring TLS certificate-based "
"client authentication");
return FALSE; return FALSE;
case PT_TLS_AUTH_SASL: case PT_TLS_AUTH_SASL:
break; break;
case PT_TLS_AUTH_TLS_OR_SASL: case PT_TLS_AUTH_TLS_OR_SASL:
if (this->tls->get_peer_id(this->tls)) if (client_id)
{ {
DBG1(DBG_TNC, "skipping SASL, client authenticated with TLS " this->tnccs->set_peer_id(this->tnccs, client_id);
"certificate"); tnccs->set_auth_type(tnccs, TNC_AUTH_X509_CERT);
DBG1(DBG_TNC, "skipping SASL, client already authenticated by "
"TLS certificate");
return TRUE; return TRUE;
} }
break; break;
case PT_TLS_AUTH_TLS_AND_SASL: case PT_TLS_AUTH_TLS_AND_SASL:
default: default:
if (!this->tls->get_peer_id(this->tls)) if (!client_id)
{ {
DBG1(DBG_TNC, "requiring TLS certificate client authentication"); DBG1(DBG_TNC, "requiring TLS certificate-based "
"client authentication");
return FALSE; return FALSE;
} }
break; break;