denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

credmgr: introduce a hook function to catch trust chain validation errors

Browse Source
This commit is contained in:
Martin Willi
2013-07-18 16:00:30 +02:00
parent f7cff7fac4
commit 4d7a762871
7 changed files with 120 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/addrblock/addrblock_validator.c
+6 -1
View File
@@ -94,7 +94,12 @@ METHOD(cert_validator_t, validate, bool,
if (subject->get_type(subject) == CERT_X509 &&
issuer->get_type(issuer) == CERT_X509)
{
return check_addrblock((x509_t*)subject, (x509_t*)issuer);
if (!check_addrblock((x509_t*)subject, (x509_t*)issuer))
{
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_POLICY_VIOLATION,
subject);
return FALSE;
}
}
return TRUE;
}
src/libcharon/plugins/coupling/coupling_validator.c
+4
View File
@@ -167,6 +167,8 @@ METHOD(cert_validator_t, validate, bool,
{
DBG1(DBG_CFG, "coupling new certificate '%Y' failed",
subject->get_subject(subject));
lib->credmgr->call_hook(lib->credmgr
CRED_HOOK_POLICY_VIOLATION, subject);
}
}
else
@@ -174,6 +176,8 @@ METHOD(cert_validator_t, validate, bool,
DBG1(DBG_CFG, "coupling new certificate '%Y' failed, limit of %d "
"couplings reached", subject->get_subject(subject),
this->max_couplings);
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_POLICY_VIOLATION,
subject);
}
this->mutex->unlock(this->mutex);
}