denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-server: Make CertificateRequest conditional in old TLS versions

Browse Source 
The server implementation now only sends a CertificateRequest message if
it has identity information to verify client certificates.
This commit is contained in:
Pascal Knecht
2021-02-12 14:35:23 +01:00
committed by Tobias Brunner
parent 4635f348fa
commit 4bba89fff3
1 changed files with 5 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_server.c
+5 -17
View File
@@ -88,11 +88,6 @@ struct private_tls_server_t {
*/ */
identification_t *peer; identification_t *peer;
/**
* Is it acceptable if we couldn't verify the peer certificate?
*/
bool peer_auth_optional;
/** /**
* State we are in * State we are in
*/ */
@@ -733,12 +728,6 @@ static status_t process_certificate(private_tls_server_t *this,
DBG1(DBG_TLS, "received TLS peer certificate '%Y'", DBG1(DBG_TLS, "received TLS peer certificate '%Y'",
cert->get_subject(cert)); cert->get_subject(cert));
first = FALSE; first = FALSE;
if (this->peer == NULL)
{ /* apply identity to authenticate */
this->peer = cert->get_subject(cert);
this->peer = this->peer->clone(this->peer);
this->peer_auth_optional = TRUE;
}
} }
else else
{ {
@@ -928,11 +917,6 @@ static status_t process_cert_verify(private_tls_server_t *this,
{ {
DBG1(DBG_TLS, "no trusted certificate found for '%Y' to verify TLS peer", DBG1(DBG_TLS, "no trusted certificate found for '%Y' to verify TLS peer",
this->peer); this->peer);
if (!this->peer_auth_optional)
{ /* client authentication is required */
this->alert->add(this->alert, TLS_FATAL, TLS_CERTIFICATE_UNKNOWN);
return NEED_MORE;
}
/* reset peer identity, we couldn't authenticate it */ /* reset peer identity, we couldn't authenticate it */
this->peer->destroy(this->peer); this->peer->destroy(this->peer);
this->peer = NULL; this->peer = NULL;
@@ -1598,7 +1582,11 @@ METHOD(tls_handshake_t, build, status_t,
} }
/* otherwise fall through to next state */ /* otherwise fall through to next state */
case STATE_KEY_EXCHANGE_SENT: case STATE_KEY_EXCHANGE_SENT:
return send_certificate_request(this, type, writer); if (this->peer)
{
return send_certificate_request(this, type, writer);
}
/* otherwise fall through to next state */
case STATE_CERTREQ_SENT: case STATE_CERTREQ_SENT:
return send_hello_done(this, type, writer); return send_hello_done(this, type, writer);
case STATE_CIPHERSPEC_CHANGED_OUT: case STATE_CIPHERSPEC_CHANGED_OUT: