denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use trusted self-signed root CA certificates as trust anchor only

Browse Source
This commit is contained in:
Martin Willi
2008-03-27 13:38:02 +00:00
parent e74bc8e51d
commit 0d30ba3343
1 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/credentials/credential_manager.c
+12 -2
View File
@@ -903,6 +903,9 @@ static bool verify_trust_chain(private_credential_manager_t *this,
{ {
issuer = get_issuer_cert(this, current, TRUE); issuer = get_issuer_cert(this, current, TRUE);
if (issuer) if (issuer)
{
/* accept only self-signed CAs as trust anchor */
if (this->cache->issued_by(this->cache, issuer, issuer))
{ {
auth->add_item(auth, AUTHZ_CA_CERT, issuer); auth->add_item(auth, AUTHZ_CA_CERT, issuer);
DBG1(DBG_CFG, " using trusted ca certificate \"%D\"", DBG1(DBG_CFG, " using trusted ca certificate \"%D\"",
@@ -910,6 +913,13 @@ static bool verify_trust_chain(private_credential_manager_t *this,
trusted = TRUE; trusted = TRUE;
} }
else else
{
auth->add_item(auth, AUTHZ_IM_CERT, issuer);
DBG1(DBG_CFG, " using trusted intermediate ca certificate "
"\"%D\"", issuer->get_subject(issuer));
}
}
else
{ {
issuer = get_issuer_cert(this, current, FALSE); issuer = get_issuer_cert(this, current, FALSE);
if (issuer) if (issuer)
@@ -922,8 +932,8 @@ static bool verify_trust_chain(private_credential_manager_t *this,
break; break;
} }
auth->add_item(auth, AUTHZ_IM_CERT, issuer); auth->add_item(auth, AUTHZ_IM_CERT, issuer);
DBG1(DBG_CFG, " using untrusted ca certificate \"%D\"", DBG1(DBG_CFG, " using untrusted intermediate certificate "
issuer->get_subject(issuer)); "\"%D\"", issuer->get_subject(issuer));
} }
else else
{ {