denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

optimized debug output of credential_manager.c

Browse Source
This commit is contained in:
Andreas Steffen
2008-03-21 09:28:25 +00:00
parent dd7924f033
commit 112482d3f4
1 changed files with 21 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/credentials/credential_manager.c
+14 -14
View File
@@ -330,8 +330,7 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
send = request->get_encoding(request);
request->destroy(request);
DBG1(DBG_CFG, "requesting ocsp status for '%D' from '%s' ...",
subject->get_subject(subject), url);
DBG1(DBG_CFG, "requesting ocsp status from '%s' ...", url);
if (lib->fetcher->fetch(lib->fetcher, url, &receive,
FETCH_REQUEST_DATA, send,
FETCH_REQUEST_TYPE, "application/ocsp-request",
@@ -386,7 +385,7 @@ static certificate_t *fetch_ocsp(private_credential_manager_t *this, char *url,
}
else
{
DBG1(DBG_CFG, "ocsp response not issued by \"%D\"",
DBG1(DBG_CFG, "ocsp response not accepted from \"%D\"",
issuer_cert->get_subject(issuer_cert));
issuer_cert->destroy(issuer_cert);
response->destroy(response);
@@ -617,7 +616,7 @@ static certificate_t* fetch_crl(private_credential_manager_t *this, char *url)
}
else
{
DBG1(DBG_CFG, "crl not issued by \"%D\"",
DBG1(DBG_CFG, "crl not accepted from \"%D\"",
issuer_cert->get_subject(issuer_cert));
issuer_cert->destroy(issuer_cert);
crl_cert->destroy(crl_cert);
@@ -830,11 +829,11 @@ static bool check_certificate(private_credential_manager_t *this,
/* has already been logged */
return FALSE;
case VALIDATION_SKIPPED:
DBG2(DBG_CFG, "OCSP check skipped, no OCSP URI found");
DBG2(DBG_CFG, "ocsp check skipped, no ocsp found");
break;
case VALIDATION_FAILED:
case VALIDATION_UNKNOWN:
DBG1(DBG_CFG, "OCSP check failed, fallback to CRL");
DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
break;
}
}
@@ -911,9 +910,9 @@ static certificate_t *get_issuer_cert(private_credential_manager_t *this,
}
/**
* try to verify trustchain of subject, return TRUE if trusted
* try to verify the trust chain of subject, return TRUE if trusted
*/
static bool verify_trustchain(private_credential_manager_t *this,
static bool verify_trust_chain(private_credential_manager_t *this,
certificate_t *subject, auth_info_t *result,
bool trusted, bool crl, bool ocsp)
{
@@ -929,7 +928,7 @@ static bool verify_trustchain(private_credential_manager_t *this,
if (issuer)
{
auth->add_item(auth, AUTHZ_CA_CERT, issuer);
DBG1(DBG_CFG, " using trusted root CA certificate \"%D\"",
DBG1(DBG_CFG, " using trusted ca certificate \"%D\"",
issuer->get_subject(issuer));
trusted = TRUE;
}
@@ -946,7 +945,7 @@ static bool verify_trustchain(private_credential_manager_t *this,
break;
}
auth->add_item(auth, AUTHZ_IM_CERT, issuer);
DBG1(DBG_CFG, " using intermediate CA certificate \"%D\"",
DBG1(DBG_CFG, " using untrusted ca certificate \"%D\"",
issuer->get_subject(issuer));
}
else
@@ -993,9 +992,10 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
/* check if we have a trusted certificate for that peer */
subject = get_pretrusted_cert(this, type, id);
if (subject)
{ /* if we find a trusted certificate, we accept it. However, to
* fullfill authorization rules, we try build the trustchain anyway. */
if (verify_trustchain(this, subject, auth, TRUE, crl, ocsp))
{
/* if we find a trusted certificate, we accept it. However, to fulfill
* authorization rules, we try to build the trust chain anyway. */
if (verify_trust_chain(this, subject, auth, TRUE, crl, ocsp))
{
DBG1(DBG_CFG, " using pre-trusted certificate \"%D\"",
subject->get_subject(subject));
@@ -1011,7 +1011,7 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
{
DBG1(DBG_CFG, " using certificate \"%D\"",
current->get_subject(current));
if (verify_trustchain(this, current, auth, FALSE, crl, ocsp))
if (verify_trust_chain(this, current, auth, FALSE, crl, ocsp))
{
subject = current->get_ref(current);
break;