denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipseckey: Properly handle failure to create a certificate

Browse Source 
Also, try the next key (if available) if parsing an IPSECKEY failed.
This commit is contained in:
Tobias Brunner
2013-10-11 15:45:41 +02:00
parent e8130a9498
commit 8ac54970f5
1 changed files with 28 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/ipseckey/ipseckey_cred.c
+28 -33
View File
@@ -62,64 +62,59 @@ typedef struct {
METHOD(enumerator_t, cert_enumerator_enumerate, bool, METHOD(enumerator_t, cert_enumerator_enumerate, bool,
cert_enumerator_t *this, certificate_t **cert) cert_enumerator_t *this, certificate_t **cert)
{ {
rr_t *cur_rr = NULL; ipseckey_t *cur_ipseckey;
ipseckey_t *cur_ipseckey = NULL; public_key_t *public;
chunk_t pub_key; rr_t *cur_rr;
public_key_t * key = NULL; chunk_t key;
bool supported_ipseckey_found = FALSE;
/* Get the next supported IPSECKEY using the inner enumerator. */ /* Get the next supported IPSECKEY using the inner enumerator. */
while (this->inner->enumerate(this->inner, &cur_rr) && while (this->inner->enumerate(this->inner, &cur_rr))
!supported_ipseckey_found)
{ {
supported_ipseckey_found = TRUE;
cur_ipseckey = ipseckey_create_frm_rr(cur_rr); cur_ipseckey = ipseckey_create_frm_rr(cur_rr);
if (!cur_ipseckey) if (!cur_ipseckey)
{ {
DBG1(DBG_CFG, "failed to parse ipseckey - skipping this key"); DBG1(DBG_CFG, " failed to parse IPSECKEY, skipping");
supported_ipseckey_found = FALSE; continue;
} }
if (cur_ipseckey && if (cur_ipseckey->get_algorithm(cur_ipseckey) != IPSECKEY_ALGORITHM_RSA)
cur_ipseckey->get_algorithm(cur_ipseckey) != IPSECKEY_ALGORITHM_RSA)
{ {
DBG1(DBG_CFG, "unsupported ipseckey algorithm - skipping this key"); DBG1(DBG_CFG, " unsupported IPSECKEY algorithm, skipping");
cur_ipseckey->destroy(cur_ipseckey); cur_ipseckey->destroy(cur_ipseckey);
supported_ipseckey_found = FALSE; continue;
} }
}
if (supported_ipseckey_found) /* wrap the key of the IPSECKEY in a certificate and return this
{ * certificate */
/* key = cur_ipseckey->get_public_key(cur_ipseckey);
* Wrap the key of the IPSECKEY in a certificate and return this public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_RSA,
* certificate. BUILD_BLOB_DNSKEY, key,
*/ BUILD_END);
pub_key = cur_ipseckey->get_public_key(cur_ipseckey); if (!public)
key = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_RSA,
BUILD_BLOB_DNSKEY, pub_key,
BUILD_END);
if (!key)
{ {
DBG1(DBG_CFG, "failed to create public key from ipseckey"); DBG1(DBG_CFG, " failed to create public key from IPSECKEY");
cur_ipseckey->destroy(cur_ipseckey); cur_ipseckey->destroy(cur_ipseckey);
return FALSE; continue;
} }
*cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, *cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
CERT_TRUSTED_PUBKEY, CERT_TRUSTED_PUBKEY,
BUILD_PUBLIC_KEY, key, BUILD_PUBLIC_KEY, public,
BUILD_SUBJECT, this->identity, BUILD_SUBJECT, this->identity,
BUILD_NOT_BEFORE_TIME, this->notBefore, BUILD_NOT_BEFORE_TIME, this->notBefore,
BUILD_NOT_AFTER_TIME, this->notAfter, BUILD_NOT_AFTER_TIME, this->notAfter,
BUILD_END); BUILD_END);
if (*cert == NULL)
{
DBG1(DBG_CFG, " failed to create certificate from IPSECKEY");
cur_ipseckey->destroy(cur_ipseckey);
public->destroy(public);
continue;
}
cur_ipseckey->destroy(cur_ipseckey);
return TRUE; return TRUE;
} }
return FALSE; return FALSE;
} }