denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

optimized debug output of credential_manager.c

Browse Source
This commit is contained in:
Andreas Steffen
2008-03-21 09:28:25 +00:00
parent dd7924f033
commit 112482d3f4
1 changed files with 21 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/credentials/credential_manager.c
+14 -14
View File
@@ -330,8 +330,7 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
send = request->get_encoding(request); send = request->get_encoding(request);
request->destroy(request); request->destroy(request);
DBG1(DBG_CFG, "requesting ocsp status for '%D' from '%s' ...", DBG1(DBG_CFG, "requesting ocsp status from '%s' ...", url);
subject->get_subject(subject), url);
if (lib->fetcher->fetch(lib->fetcher, url, &receive, if (lib->fetcher->fetch(lib->fetcher, url, &receive,
FETCH_REQUEST_DATA, send, FETCH_REQUEST_DATA, send,
FETCH_REQUEST_TYPE, "application/ocsp-request", FETCH_REQUEST_TYPE, "application/ocsp-request",
@@ -386,7 +385,7 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
} }
else else
{ {
DBG1(DBG_CFG, "ocsp response not issued by \"%D\"", DBG1(DBG_CFG, "ocsp response not accepted from \"%D\"",
issuer_cert->get_subject(issuer_cert)); issuer_cert->get_subject(issuer_cert));
issuer_cert->destroy(issuer_cert); issuer_cert->destroy(issuer_cert);
response->destroy(response); response->destroy(response);
@@ -617,7 +616,7 @@ static certificate_t* fetch_crl(private_credential_manager_t *this, char *url)
} }
else else
{ {
DBG1(DBG_CFG, "crl not issued by \"%D\"", DBG1(DBG_CFG, "crl not accepted from \"%D\"",
issuer_cert->get_subject(issuer_cert)); issuer_cert->get_subject(issuer_cert));
issuer_cert->destroy(issuer_cert); issuer_cert->destroy(issuer_cert);
crl_cert->destroy(crl_cert); crl_cert->destroy(crl_cert);
@@ -830,11 +829,11 @@ static bool check_certificate(private_credential_manager_t *this,
/* has already been logged */ /* has already been logged */
return FALSE; return FALSE;
case VALIDATION_SKIPPED: case VALIDATION_SKIPPED:
DBG2(DBG_CFG, "OCSP check skipped, no OCSP URI found"); DBG2(DBG_CFG, "ocsp check skipped, no ocsp found");
break; break;
case VALIDATION_FAILED: case VALIDATION_FAILED:
case VALIDATION_UNKNOWN: case VALIDATION_UNKNOWN:
DBG1(DBG_CFG, "OCSP check failed, fallback to CRL"); DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
break; break;
} }
} }
@@ -911,9 +910,9 @@ static certificate_t *get_issuer_cert(private_credential_manager_t *this,
} }
/** /**
* try to verify trustchain of subject, return TRUE if trusted * try to verify the trust chain of subject, return TRUE if trusted
*/ */
static bool verify_trustchain(private_credential_manager_t *this, static bool verify_trust_chain(private_credential_manager_t *this,
certificate_t *subject, auth_info_t *result, certificate_t *subject, auth_info_t *result,
bool trusted, bool crl, bool ocsp) bool trusted, bool crl, bool ocsp)
{ {
@@ -929,7 +928,7 @@ static bool verify_trustchain(private_credential_manager_t *this,
if (issuer) if (issuer)
{ {
auth->add_item(auth, AUTHZ_CA_CERT, issuer); auth->add_item(auth, AUTHZ_CA_CERT, issuer);
DBG1(DBG_CFG, " using trusted root CA certificate \"%D\"", DBG1(DBG_CFG, " using trusted ca certificate \"%D\"",
issuer->get_subject(issuer)); issuer->get_subject(issuer));
trusted = TRUE; trusted = TRUE;
} }
@@ -946,7 +945,7 @@ static bool verify_trustchain(private_credential_manager_t *this,
break; break;
} }
auth->add_item(auth, AUTHZ_IM_CERT, issuer); auth->add_item(auth, AUTHZ_IM_CERT, issuer);
DBG1(DBG_CFG, " using intermediate CA certificate \"%D\"", DBG1(DBG_CFG, " using untrusted ca certificate \"%D\"",
issuer->get_subject(issuer)); issuer->get_subject(issuer));
} }
else else
@@ -993,9 +992,10 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
/* check if we have a trusted certificate for that peer */ /* check if we have a trusted certificate for that peer */
subject = get_pretrusted_cert(this, type, id); subject = get_pretrusted_cert(this, type, id);
if (subject) if (subject)
{ /* if we find a trusted certificate, we accept it. However, to {
* fullfill authorization rules, we try build the trustchain anyway. */ /* if we find a trusted certificate, we accept it. However, to fulfill
if (verify_trustchain(this, subject, auth, TRUE, crl, ocsp)) * authorization rules, we try to build the trust chain anyway. */
if (verify_trust_chain(this, subject, auth, TRUE, crl, ocsp))
{ {
DBG1(DBG_CFG, " using pre-trusted certificate \"%D\"", DBG1(DBG_CFG, " using pre-trusted certificate \"%D\"",
subject->get_subject(subject)); subject->get_subject(subject));
@@ -1011,7 +1011,7 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
{ {
DBG1(DBG_CFG, " using certificate \"%D\"", DBG1(DBG_CFG, " using certificate \"%D\"",
current->get_subject(current)); current->get_subject(current));
if (verify_trustchain(this, current, auth, FALSE, crl, ocsp)) if (verify_trust_chain(this, current, auth, FALSE, crl, ocsp))
{ {
subject = current->get_ref(current); subject = current->get_ref(current);
break; break;