denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

credential-manager: Check expiry also for last cert in incomplete trust chain

Browse Source 
While the validity of a pre-trusted certificate for which an issuer is
found is enforced via `check_certificate()`, the validity of such a
certificate in an incomplete trust chain, or rather that of the last
certificate in such a chain, was not enforced.  This fixes that
inconsistency.
This commit is contained in:
Thomas Jarosch
2026-05-22 14:33:28 +02:00
committed by Tobias Brunner
parent 95f615a603
commit 0d17838b99
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/credential_manager.c
+7
View File
@@ -806,6 +806,13 @@ static bool verify_trust_chain(private_credential_manager_t *this,
call_hook(this, CRED_HOOK_NO_ISSUER, current); call_hook(this, CRED_HOOK_NO_ISSUER, current);
if (trusted) if (trusted)
{ {
if (!check_lifetime(this, current,
current != subject ? "issuer" : "subject",
pathlen, FALSE, auth))
{
trusted = FALSE;
break;
}
DBG1(DBG_CFG, " reached end of incomplete trust chain for " DBG1(DBG_CFG, " reached end of incomplete trust chain for "
"trusted certificate \"%Y\"", "trusted certificate \"%Y\"",
subject->get_subject(subject)); subject->get_subject(subject));