denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Support loading cacert certificates in ipsec.conf ca sections from smartcard

Browse Source
This commit is contained in:
Martin Willi
2012-10-24 13:07:53 +02:00
parent 2abe404927
commit 794d713dca
1 changed files with 37 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_cred.c
+37 -19
View File
@@ -168,32 +168,48 @@ static certificate_t *load_from_smartcard(smartcard_format_t format,
METHOD(stroke_cred_t, load_ca, certificate_t*, METHOD(stroke_cred_t, load_ca, certificate_t*,
private_stroke_cred_t *this, char *filename) private_stroke_cred_t *this, char *filename)
{ {
certificate_t *cert; certificate_t *cert = NULL;
char path[PATH_MAX]; char path[PATH_MAX];
if (*filename == '/') if (strneq(filename, "%smartcard", strlen("%smartcard")))
{ {
snprintf(path, sizeof(path), "%s", filename); smartcard_format_t format;
} char module[BUF_LEN], keyid[BUF_LEN];
else u_int slot;
{
snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
}
if (this->force_ca_cert) format = parse_smartcard(filename, &slot, module, keyid);
{ /* we treat this certificate as a CA certificate even if it has no if (format != SC_FORMAT_INVALID)
* CA basic constraint */ {
cert = lib->creds->create(lib->creds, cert = (certificate_t*)load_from_smartcard(format,
CRED_CERTIFICATE, CERT_X509, slot, module, keyid, CRED_CERTIFICATE, CERT_X509);
BUILD_FROM_FILE, path, BUILD_X509_FLAG, X509_CA, }
BUILD_END);
} }
else else
{ {
cert = lib->creds->create(lib->creds, if (*filename == '/')
CRED_CERTIFICATE, CERT_X509, {
BUILD_FROM_FILE, path, snprintf(path, sizeof(path), "%s", filename);
BUILD_END); }
else
{
snprintf(path, sizeof(path), "%s/%s", CA_CERTIFICATE_DIR, filename);
}
if (this->force_ca_cert)
{ /* we treat this certificate as a CA certificate even if it has no
* CA basic constraint */
cert = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, path, BUILD_X509_FLAG, X509_CA,
BUILD_END);
}
else
{
cert = lib->creds->create(lib->creds,
CRED_CERTIFICATE, CERT_X509,
BUILD_FROM_FILE, path,
BUILD_END);
}
} }
if (cert) if (cert)
{ {
@@ -206,6 +222,8 @@ METHOD(stroke_cred_t, load_ca, certificate_t*,
cert->destroy(cert); cert->destroy(cert);
return NULL; return NULL;
} }
DBG1(DBG_CFG, " loaded ca certificate \"%Y\" from '%s",
cert->get_subject(cert), filename);
return this->creds->add_cert_ref(this->creds, TRUE, cert); return this->creds->add_cert_ref(this->creds, TRUE, cert);
} }
return NULL; return NULL;