denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updated charon to new fingerprinting API

Browse Source
This commit is contained in:
Martin Willi
2009-08-26 11:23:53 +02:00
parent b4b68b64b8
commit 64fdbce4da
3 changed files with 85 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/tasks/ike_cert_post.c
+34 -36
View File
@@ -50,50 +50,48 @@ struct private_ike_cert_post_t {
/**
* Generates the cert payload, if possible with "Hash and URL"
*/
static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this, certificate_t *cert)
static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this,
certificate_t *cert)
{
cert_payload_t *payload = NULL;
hasher_t *hasher;
identification_t *id;
chunk_t hash, encoded ;
enumerator_t *enumerator;
char *url;
if (this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL))
if (!this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL))
{
/* ok, our peer sent us a HTTP_CERT_LOOKUP_SUPPORTED Notify */
hasher_t *hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (hasher != NULL)
{
chunk_t hash, encoded = cert->get_encoding(cert);
enumerator_t *enumerator;
char *url;
hasher->allocate_hash(hasher, encoded, &hash);
identification_t *id = identification_create_from_encoding(ID_CERT_DER_SHA1, hash);
enumerator = charon->credentials->create_cdp_enumerator(charon->credentials, CERT_X509, id);
if (enumerator->enumerate(enumerator, &url))
{
/* if we have an URL available we send that to our peer */
payload = cert_payload_create_from_hash_and_url(hash, url);
}
enumerator->destroy(enumerator);
id->destroy(id);
chunk_free(&hash);
chunk_free(&encoded);
hasher->destroy(hasher);
}
else
{
DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported");
}
return cert_payload_create_from_cert(cert);
}
if (!payload)
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (!hasher)
{
/* our peer does not support "Hash and URL" or we do not have an URL
* to send to our peer, just create a normal cert payload */
payload = cert_payload_create_from_cert(cert);
DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported");
return cert_payload_create_from_cert(cert);
}
return payload;
encoded = cert->get_encoding(cert);
hasher->allocate_hash(hasher, encoded, &hash);
id = identification_create_from_encoding(ID_KEY_ID, hash);
enumerator = charon->credentials->create_cdp_enumerator(
charon->credentials, CERT_X509, id);
if (!enumerator->enumerate(enumerator, &url))
{
url = NULL;
}
enumerator->destroy(enumerator);
id->destroy(id);
chunk_free(&hash);
chunk_free(&encoded);
hasher->destroy(hasher);
if (url)
{
return cert_payload_create_from_hash_and_url(hash, url);
}
return cert_payload_create_from_cert(cert);
}
/**
src/charon/sa/tasks/ike_cert_pre.c
+10 -9
View File
@@ -70,7 +70,7 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
enumerator = message->create_payload_enumerator(message);
while (enumerator->enumerate(enumerator, &payload))
{
switch(payload->get_type(payload))
switch (payload->get_type(payload))
{
case CERTIFICATE_REQUEST:
{
@@ -92,8 +92,7 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
identification_t *id;
certificate_t *cert;
id = identification_create_from_encoding(
ID_PUBKEY_INFO_SHA1, keyid);
id = identification_create_from_encoding(ID_KEY_ID, keyid);
cert = charon->credentials->get_cert(charon->credentials,
CERT_X509, KEY_ANY, id, TRUE);
if (cert)
@@ -156,7 +155,7 @@ static certificate_t *try_get_cert(cert_payload_t *cert_payload)
/* invalid "Hash and URL" data (logged elsewhere) */
break;
}
id = identification_create_from_encoding(ID_CERT_DER_SHA1, hash);
id = identification_create_from_encoding(ID_KEY_ID, hash);
cert = charon->credentials->get_cert(charon->credentials,
CERT_X509, KEY_ANY, id, FALSE);
id->destroy(id);
@@ -284,7 +283,7 @@ static void add_certreq(certreq_payload_t **req, certificate_t *cert)
case CERT_X509:
{
public_key_t *public;
identification_t *keyid;
chunk_t keyid;
x509_t *x509 = (x509_t*)cert;
if (!(x509->get_flags(x509) & X509_CA))
@@ -300,11 +299,13 @@ static void add_certreq(certreq_payload_t **req, certificate_t *cert)
{
*req = certreq_payload_create_type(CERT_X509);
}
keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
(*req)->add_keyid(*req, keyid->get_encoding(keyid));
if (public->get_fingerprint(public, KEY_ID_PUBKEY_INFO_SHA1, &keyid))
{
(*req)->add_keyid(*req, keyid);
DBG1(DBG_IKE, "sending cert request for \"%Y\"",
cert->get_subject(cert));
}
public->destroy(public);
DBG1(DBG_IKE, "sending cert request for \"%Y\"",
cert->get_subject(cert));
break;
}
default: