denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cert-validator: Use a separate method for online revocation checking

Browse Source 
This avoids having to repeat offline checks after basic trust chain
validation.
This commit is contained in:
Tobias Brunner
2022-10-03 10:48:46 +02:00
parent 1968615590
commit 1f870ae189
7 changed files with 67 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/acert/acert_validator.c
+1 -2
View File
@@ -91,8 +91,7 @@ static void apply(private_acert_validator_t *this, ac_t *ac, auth_cfg_t *auth)
METHOD(cert_validator_t, validate, bool,
private_acert_validator_t *this, certificate_t *subject,
certificate_t *issuer, bool online, u_int pathlen, bool anchor,
auth_cfg_t *auth)
certificate_t *issuer, u_int pathlen, bool anchor, auth_cfg_t *auth)
{
/* for X.509 end entity certs only */
if (pathlen == 0 && subject->get_type(subject) == CERT_X509)
src/libstrongswan/plugins/constraints/constraints_validator.c
+1 -2
View File
@@ -655,8 +655,7 @@ static bool check_policy_constraints(x509_t *issuer, u_int pathlen,
METHOD(cert_validator_t, validate, bool,
private_constraints_validator_t *this, certificate_t *subject,
certificate_t *issuer, bool online, u_int pathlen, bool anchor,
auth_cfg_t *auth)
certificate_t *issuer, u_int pathlen, bool anchor, auth_cfg_t *auth)
{
if (issuer->get_type(issuer) == CERT_X509 &&
subject->get_type(subject) == CERT_X509)
src/libstrongswan/plugins/revocation/revocation_validator.c
+4 -5
View File
@@ -826,10 +826,9 @@ static cert_validation_t check_crl(x509_t *subject, x509_t *issuer,
return valid;
}
METHOD(cert_validator_t, validate, bool,
METHOD(cert_validator_t, validate_online, bool,
private_revocation_validator_t *this, certificate_t *subject,
certificate_t *issuer, bool online, u_int pathlen, bool anchor,
auth_cfg_t *auth)
certificate_t *issuer, u_int pathlen, bool anchor, auth_cfg_t *auth)
{
bool enable_ocsp, enable_crl;
u_int timeout;
@@ -840,7 +839,7 @@ METHOD(cert_validator_t, validate, bool,
timeout = this->timeout;
this->lock->unlock(this->lock);
if (online && (enable_ocsp || enable_crl) &&
if ((enable_ocsp || enable_crl) &&
subject->get_type(subject) == CERT_X509 &&
issuer->get_type(issuer) == CERT_X509)
{
@@ -956,7 +955,7 @@ revocation_validator_t *revocation_validator_create()
INIT(this,
.public = {
.validator.validate = _validate,
.validator.validate_online = _validate_online,
.reload = _reload,
.destroy = _destroy,
},