denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ignore TLS certificate requests as peer if peer authentication disabled

Browse Source
This commit is contained in:
Martin Willi
2011-04-14 20:02:12 +02:00
parent 1c21f47a06
commit 6a8f1a578f
1 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_peer.c
+3 -2
View File
@@ -502,8 +502,6 @@ static status_t process_certreq(private_tls_peer_t *this, tls_reader_t *reader)
{ {
DBG1(DBG_TLS, "server requested a certificate, but client " DBG1(DBG_TLS, "server requested a certificate, but client "
"authentication disabled"); "authentication disabled");
this->alert->add(this->alert, TLS_FATAL, TLS_HANDSHAKE_FAILURE);
return NEED_MORE;
} }
this->crypto->append_handshake(this->crypto, this->crypto->append_handshake(this->crypto,
TLS_CERTIFICATE_REQUEST, reader->peek(reader)); TLS_CERTIFICATE_REQUEST, reader->peek(reader));
@@ -541,6 +539,8 @@ static status_t process_certreq(private_tls_peer_t *this, tls_reader_t *reader)
authorities->destroy(authorities); authorities->destroy(authorities);
return NEED_MORE; return NEED_MORE;
} }
if (this->peer)
{
id = identification_create_from_encoding(ID_DER_ASN1_DN, data); id = identification_create_from_encoding(ID_DER_ASN1_DN, data);
cert = lib->credmgr->get_cert(lib->credmgr, cert = lib->credmgr->get_cert(lib->credmgr,
CERT_X509, KEY_ANY, id, TRUE); CERT_X509, KEY_ANY, id, TRUE);
@@ -555,6 +555,7 @@ static status_t process_certreq(private_tls_peer_t *this, tls_reader_t *reader)
} }
id->destroy(id); id->destroy(id);
} }
}
authorities->destroy(authorities); authorities->destroy(authorities);
this->state = STATE_CERTREQ_RECEIVED; this->state = STATE_CERTREQ_RECEIVED;
return NEED_MORE; return NEED_MORE;