denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'swanctl-ssh-public-keys'

Browse Source 
Minor changes that allow loading SSH public keys via `pubkeys` in
swanctl.conf.

References strongswan/strongswan#467
This commit is contained in:
Tobias Brunner
2021-08-23 18:04:50 +02:00
parent b4a34ff5ea 5821f2cc01
commit 1d64b6c462
3 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/vici/vici_config.c
+2 -2
View File
@@ -1469,7 +1469,7 @@ static bool parse_cert(auth_data_t *auth, auth_rule_t rule, chunk_t v)
certificate_t *cert; certificate_t *cert;
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_BLOB_PEM, v, BUILD_END); BUILD_BLOB, v, BUILD_END);
if (cert) if (cert)
{ {
return add_cert(auth, rule, cert); return add_cert(auth, rule, cert);
@@ -1504,7 +1504,7 @@ CALLBACK(parse_pubkeys, bool,
certificate_t *cert; certificate_t *cert;
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_TRUSTED_PUBKEY, cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_TRUSTED_PUBKEY,
BUILD_BLOB_PEM, v, BUILD_END); BUILD_BLOB, v, BUILD_END);
if (cert) if (cert)
{ {
return add_cert(auth, AUTH_RULE_SUBJECT_CERT, cert); return add_cert(auth, AUTH_RULE_SUBJECT_CERT, cert);
src/libcharon/plugins/vici/vici_cred.c
+1 -1
View File
@@ -173,7 +173,7 @@ CALLBACK(load_cert, vici_message_t*,
ext_flag = (flag & X509_CA) ? X509_NONE : flag; ext_flag = (flag & X509_CA) ? X509_NONE : flag;
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, type, cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
BUILD_BLOB_PEM, data, BUILD_BLOB, data,
BUILD_X509_FLAG, ext_flag, BUILD_X509_FLAG, ext_flag,
BUILD_END); BUILD_END);
if (!cert) if (!cert)
src/libstrongswan/plugins/pubkey/pubkey_cert.c
+12 -3
View File
@@ -17,6 +17,7 @@
#include <time.h> #include <time.h>
#include <credentials/certificates/x509.h>
#include <utils/debug.h> #include <utils/debug.h>
typedef struct private_pubkey_cert_t private_pubkey_cert_t; typedef struct private_pubkey_cert_t private_pubkey_cert_t;
@@ -264,15 +265,20 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args)
{ {
public_key_t *key = NULL; public_key_t *key = NULL;
chunk_t blob = chunk_empty; chunk_t blob = chunk_empty;
builder_part_t part, blob_type = BUILD_END;
identification_t *subject = NULL; identification_t *subject = NULL;
time_t notBefore = UNDEFINED_TIME, notAfter = UNDEFINED_TIME; time_t notBefore = UNDEFINED_TIME, notAfter = UNDEFINED_TIME;
while (TRUE) while (TRUE)
{ {
switch (va_arg(args, builder_part_t)) part = va_arg(args, builder_part_t);
switch (part)
{ {
case BUILD_BLOB:
case BUILD_BLOB_PEM:
case BUILD_BLOB_ASN1_DER: case BUILD_BLOB_ASN1_DER:
blob = va_arg(args, chunk_t); blob = va_arg(args, chunk_t);
blob_type = part;
continue; continue;
case BUILD_PUBLIC_KEY: case BUILD_PUBLIC_KEY:
key = va_arg(args, public_key_t*); key = va_arg(args, public_key_t*);
@@ -286,6 +292,10 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args)
case BUILD_SUBJECT: case BUILD_SUBJECT:
subject = va_arg(args, identification_t*); subject = va_arg(args, identification_t*);
continue; continue;
case BUILD_X509_FLAG:
/* just ignore the flags */
va_arg(args, x509_flag_t);
continue;
case BUILD_END: case BUILD_END:
break; break;
default: default:
@@ -300,7 +310,7 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args)
else if (blob.ptr) else if (blob.ptr)
{ {
key = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY, key = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
BUILD_BLOB_ASN1_DER, blob, BUILD_END); blob_type, blob, BUILD_END);
} }
if (key) if (key)
{ {
@@ -308,4 +318,3 @@ pubkey_cert_t *pubkey_cert_wrap(certificate_type_t type, va_list args)
} }
return NULL; return NULL;
} }