denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

credmgr: introduce a hook function to catch trust chain validation errors

Browse Source
This commit is contained in:
Martin Willi
2013-07-18 16:00:30 +02:00
parent f7cff7fac4
commit 4d7a762871
7 changed files with 120 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/constraints/constraints_validator.c
+8
View File
@@ -533,20 +533,28 @@ METHOD(cert_validator_t, validate, bool,
{
if (!check_pathlen((x509_t*)issuer, pathlen))
{
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_EXCEEDED_PATH_LEN,
subject);
return FALSE;
}
if (!check_name_constraints(subject, (x509_t*)issuer))
{
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_POLICY_VIOLATION,
subject);
return FALSE;
}
if (!check_policy((x509_t*)subject, (x509_t*)issuer, !pathlen, auth))
{
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_POLICY_VIOLATION,
subject);
return FALSE;
}
if (anchor)
{
if (!check_policy_constraints((x509_t*)issuer, pathlen, auth))
{
lib->credmgr->call_hook(lib->credmgr,
CRED_HOOK_POLICY_VIOLATION, issuer);
return FALSE;
}
}
src/libstrongswan/plugins/revocation/revocation_validator.c
+6
View File
@@ -691,6 +691,8 @@ METHOD(cert_validator_t, validate, bool,
case VALIDATION_REVOKED:
case VALIDATION_ON_HOLD:
/* has already been logged */
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
subject);
return FALSE;
case VALIDATION_SKIPPED:
DBG2(DBG_CFG, "ocsp check skipped, no ocsp found");
@@ -711,6 +713,8 @@ METHOD(cert_validator_t, validate, bool,
case VALIDATION_REVOKED:
case VALIDATION_ON_HOLD:
/* has already been logged */
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
subject);
return FALSE;
case VALIDATION_FAILED:
case VALIDATION_SKIPPED:
@@ -720,6 +724,8 @@ METHOD(cert_validator_t, validate, bool,
DBG1(DBG_CFG, "certificate status is unknown, crl is stale");
break;
}
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_VALIDATION_FAILED,
subject);
}
return TRUE;
}