denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pass an additional anchor flag to validate() hook if we reach the root CA

Browse Source
This commit is contained in:
Martin Willi
2011-01-05 16:46:04 +01:00
parent 09e319d419
commit 6aba6ff061
4 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/credential_manager.c
+5 -4
View File
@@ -452,8 +452,8 @@ static void cache_queue(private_credential_manager_t *this)
* check a certificate for its lifetime
*/
static bool check_certificate(private_credential_manager_t *this,
certificate_t *subject, certificate_t *issuer,
bool online, int pathlen, auth_cfg_t *auth)
certificate_t *subject, certificate_t *issuer, bool online,
int pathlen, bool trusted, auth_cfg_t *auth)
{
time_t not_before, not_after;
cert_validator_t *validator;
@@ -476,7 +476,7 @@ static bool check_certificate(private_credential_manager_t *this,
while (enumerator->enumerate(enumerator, &validator))
{
if (!validator->validate(validator, subject, issuer,
online, pathlen, auth))
online, pathlen, trusted, auth))
{
enumerator->destroy(enumerator);
return FALSE;
@@ -622,7 +622,8 @@ static bool verify_trust_chain(private_credential_manager_t *this,
break;
}
}
if (!check_certificate(this, current, issuer, online, pathlen, auth))
if (!check_certificate(this, current, issuer, online,
pathlen, trusted, auth))
{
trusted = FALSE;
issuer->destroy(issuer);