denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Load multiple comma seperarated certificates in the leftcert option

Browse Source
This commit is contained in:
Martin Willi
2013-01-18 09:33:15 +01:00
parent f29783af8c
commit 78af36db50
1 changed files with 32 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_config.c
+23 -6
View File
@@ -446,6 +446,13 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
/* add identity and peer certificate */ /* add identity and peer certificate */
identity = identification_create_from_string(id); identity = identification_create_from_string(id);
if (cert) if (cert)
{
enumerator_t *enumerator;
bool has_subject = FALSE;
certificate_t *first = NULL;
enumerator = enumerator_create_token(cert, ",", " ");
while (enumerator->enumerate(enumerator, &cert))
{ {
certificate = this->cred->load_peer(this->cred, cert); certificate = this->cred->load_peer(this->cred, cert);
if (certificate) if (certificate)
@@ -455,18 +462,28 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
this->ca->check_for_hash_and_url(this->ca, certificate); this->ca->check_for_hash_and_url(this->ca, certificate);
} }
cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate); cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
if (identity->get_type(identity) == ID_ANY || if (!first)
!certificate->has_subject(certificate, identity)) {
first = certificate;
}
if (identity->get_type(identity) != ID_ANY &&
certificate->has_subject(certificate, identity))
{
has_subject = TRUE;
}
}
}
enumerator->destroy(enumerator);
if (first && !has_subject)
{ {
DBG1(DBG_CFG, " id '%Y' not confirmed by certificate, " DBG1(DBG_CFG, " id '%Y' not confirmed by certificate, "
"defaulting to '%Y'", identity, "defaulting to '%Y'", identity, first->get_subject(first));
certificate->get_subject(certificate));
identity->destroy(identity); identity->destroy(identity);
identity = certificate->get_subject(certificate); identity = first->get_subject(first);
identity = identity->clone(identity); identity = identity->clone(identity);
} }
} }
}
if (identity->get_type(identity) != ID_ANY) if (identity->get_type(identity) != ID_ANY)
{ {
cfg->add(cfg, AUTH_RULE_IDENTITY, identity); cfg->add(cfg, AUTH_RULE_IDENTITY, identity);