denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

optimized debug output of credential_manager.c

Browse Source
This commit is contained in:
Andreas Steffen
2008-03-21 09:28:25 +00:00
parent dd7924f033
commit 112482d3f4
1 changed files with 21 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/credentials/credential_manager.c
+21 -21
View File
@@ -330,8 +330,7 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
send = request->get_encoding(request); send = request->get_encoding(request);
request->destroy(request); request->destroy(request);
DBG1(DBG_CFG, "requesting ocsp status for '%D' from '%s' ...", DBG1(DBG_CFG, "requesting ocsp status from '%s' ...", url);
subject->get_subject(subject), url);
if (lib->fetcher->fetch(lib->fetcher, url, &receive, if (lib->fetcher->fetch(lib->fetcher, url, &receive,
FETCH_REQUEST_DATA, send, FETCH_REQUEST_DATA, send,
FETCH_REQUEST_TYPE, "application/ocsp-request", FETCH_REQUEST_TYPE, "application/ocsp-request",
@@ -366,7 +365,7 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
this->sets->insert_first(this->sets, wrapper); this->sets->insert_first(this->sets, wrapper);
this->sets->insert_first(this->sets, this->cache); this->sets->insert_first(this->sets, this->cache);
responder = response->get_issuer(response); responder = response->get_issuer(response);
DBG1(DBG_CFG, "ocsp signer is \"%D\"", responder); DBG1(DBG_CFG, " ocsp signer is \"%D\"", responder);
issuer_cert = get_trusted_cert(this, KEY_ANY, responder, auth, FALSE, FALSE); issuer_cert = get_trusted_cert(this, KEY_ANY, responder, auth, FALSE, FALSE);
this->sets->remove(this->sets, wrapper, NULL); this->sets->remove(this->sets, wrapper, NULL);
wrapper->destroy(wrapper); wrapper->destroy(wrapper);
@@ -380,13 +379,13 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
} }
if (this->cache->issued_by(this->cache, response, issuer_cert)) if (this->cache->issued_by(this->cache, response, issuer_cert))
{ {
DBG1(DBG_CFG, "ocsp response correctly signed by \"%D\"", DBG1(DBG_CFG, " ocsp response correctly signed by \"%D\"",
issuer_cert->get_subject(issuer_cert)); issuer_cert->get_subject(issuer_cert));
issuer_cert->destroy(issuer_cert); issuer_cert->destroy(issuer_cert);
} }
else else
{ {
DBG1(DBG_CFG, "ocsp response not issued by \"%D\"", DBG1(DBG_CFG, "ocsp response not accepted from \"%D\"",
issuer_cert->get_subject(issuer_cert)); issuer_cert->get_subject(issuer_cert));
issuer_cert->destroy(issuer_cert); issuer_cert->destroy(issuer_cert);
response->destroy(response); response->destroy(response);
@@ -611,13 +610,13 @@ static certificate_t* fetch_crl(private_credential_manager_t *this, char *url)
if (this->cache->issued_by(this->cache, crl_cert, issuer_cert)) if (this->cache->issued_by(this->cache, crl_cert, issuer_cert))
{ {
DBG1(DBG_CFG, "crl correctly signed by \"%D\"", DBG1(DBG_CFG, " crl correctly signed by \"%D\"",
issuer_cert->get_subject(issuer_cert)); issuer_cert->get_subject(issuer_cert));
issuer_cert->destroy(issuer_cert); issuer_cert->destroy(issuer_cert);
} }
else else
{ {
DBG1(DBG_CFG, "crl not issued by \"%D\"", DBG1(DBG_CFG, "crl not accepted from \"%D\"",
issuer_cert->get_subject(issuer_cert)); issuer_cert->get_subject(issuer_cert));
issuer_cert->destroy(issuer_cert); issuer_cert->destroy(issuer_cert);
crl_cert->destroy(crl_cert); crl_cert->destroy(crl_cert);
@@ -830,11 +829,11 @@ static bool check_certificate(private_credential_manager_t *this,
/* has already been logged */ /* has already been logged */
return FALSE; return FALSE;
case VALIDATION_SKIPPED: case VALIDATION_SKIPPED:
DBG2(DBG_CFG, "OCSP check skipped, no OCSP URI found"); DBG2(DBG_CFG, "ocsp check skipped, no ocsp found");
break; break;
case VALIDATION_FAILED: case VALIDATION_FAILED:
case VALIDATION_UNKNOWN: case VALIDATION_UNKNOWN:
DBG1(DBG_CFG, "OCSP check failed, fallback to CRL"); DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
break; break;
} }
} }
@@ -911,11 +910,11 @@ static certificate_t *get_issuer_cert(private_credential_manager_t *this,
} }
/** /**
* try to verify trustchain of subject, return TRUE if trusted * try to verify the trust chain of subject, return TRUE if trusted
*/ */
static bool verify_trustchain(private_credential_manager_t *this, static bool verify_trust_chain(private_credential_manager_t *this,
certificate_t *subject, auth_info_t *result, certificate_t *subject, auth_info_t *result,
bool trusted, bool crl, bool ocsp) bool trusted, bool crl, bool ocsp)
{ {
certificate_t *current, *issuer; certificate_t *current, *issuer;
auth_info_t *auth; auth_info_t *auth;
@@ -929,7 +928,7 @@ static bool verify_trustchain(private_credential_manager_t *this,
if (issuer) if (issuer)
{ {
auth->add_item(auth, AUTHZ_CA_CERT, issuer); auth->add_item(auth, AUTHZ_CA_CERT, issuer);
DBG1(DBG_CFG, " using trusted root CA certificate \"%D\"", DBG1(DBG_CFG, " using trusted ca certificate \"%D\"",
issuer->get_subject(issuer)); issuer->get_subject(issuer));
trusted = TRUE; trusted = TRUE;
} }
@@ -940,13 +939,13 @@ static bool verify_trustchain(private_credential_manager_t *this,
{ {
if (current->equals(current, issuer)) if (current->equals(current, issuer))
{ {
DBG1(DBG_CFG, " certificate \"%D\" is self-signed, but ", DBG1(DBG_CFG, "certificate \"%D\" is self-signed, but ",
"not trusted", current->get_subject(current)); "not trusted", current->get_subject(current));
issuer->destroy(issuer); issuer->destroy(issuer);
break; break;
} }
auth->add_item(auth, AUTHZ_IM_CERT, issuer); auth->add_item(auth, AUTHZ_IM_CERT, issuer);
DBG1(DBG_CFG, " using intermediate CA certificate \"%D\"", DBG1(DBG_CFG, " using untrusted ca certificate \"%D\"",
issuer->get_subject(issuer)); issuer->get_subject(issuer));
} }
else else
@@ -981,7 +980,7 @@ static bool verify_trustchain(private_credential_manager_t *this,
} }
/** /**
* Get a trusted certificate by verifying the trustchain * Get a trusted certificate by verifying the trust chain
*/ */
static certificate_t *get_trusted_cert(private_credential_manager_t *this, static certificate_t *get_trusted_cert(private_credential_manager_t *this,
key_type_t type, identification_t *id, key_type_t type, identification_t *id,
@@ -993,9 +992,10 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
/* check if we have a trusted certificate for that peer */ /* check if we have a trusted certificate for that peer */
subject = get_pretrusted_cert(this, type, id); subject = get_pretrusted_cert(this, type, id);
if (subject) if (subject)
{ /* if we find a trusted certificate, we accept it. However, to {
* fullfill authorization rules, we try build the trustchain anyway. */ /* if we find a trusted certificate, we accept it. However, to fulfill
if (verify_trustchain(this, subject, auth, TRUE, crl, ocsp)) * authorization rules, we try to build the trust chain anyway. */
if (verify_trust_chain(this, subject, auth, TRUE, crl, ocsp))
{ {
DBG1(DBG_CFG, " using pre-trusted certificate \"%D\"", DBG1(DBG_CFG, " using pre-trusted certificate \"%D\"",
subject->get_subject(subject)); subject->get_subject(subject));
@@ -1011,7 +1011,7 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
{ {
DBG1(DBG_CFG, " using certificate \"%D\"", DBG1(DBG_CFG, " using certificate \"%D\"",
current->get_subject(current)); current->get_subject(current));
if (verify_trustchain(this, current, auth, FALSE, crl, ocsp)) if (verify_trust_chain(this, current, auth, FALSE, crl, ocsp))
{ {
subject = current->get_ref(current); subject = current->get_ref(current);
break; break;