denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Support multiple different public key strength types in constraints

Browse Source
This commit is contained in:
Martin Willi
2012-06-12 14:24:49 +02:00
parent fd4ff11858
commit 918e92c4c9
1 changed files with 38 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/auth_cfg.c
+38 -41
View File
@@ -497,6 +497,7 @@ METHOD(auth_cfg_t, complies, bool,
enumerator_t *e1, *e2; enumerator_t *e1, *e2;
bool success = TRUE, has_group = FALSE, group_match = FALSE; bool success = TRUE, has_group = FALSE, group_match = FALSE;
signature_scheme_t scheme = SIGN_UNKNOWN; signature_scheme_t scheme = SIGN_UNKNOWN;
u_int strength = 0;
auth_rule_t t1, t2; auth_rule_t t1, t2;
void *value; void *value;
@@ -677,47 +678,7 @@ METHOD(auth_cfg_t, complies, bool,
case AUTH_RULE_RSA_STRENGTH: case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH: case AUTH_RULE_ECDSA_STRENGTH:
{ {
uintptr_t strength; strength = (uintptr_t)value;
e2 = create_enumerator(this);
while (e2->enumerate(e2, &t2, &strength))
{
if (t2 == t1)
{
if ((uintptr_t)value > strength)
{
success = FALSE;
if (log_error)
{
DBG1(DBG_CFG, "constraint requires %d bit "
"public keys, but %d bit key used",
(uintptr_t)value, strength);
}
break;
}
}
else if (t2 == AUTH_RULE_RSA_STRENGTH)
{
success = FALSE;
if (log_error)
{
DBG1(DBG_CFG, "constraint requires %d bit ECDSA, "
"but RSA used", (uintptr_t)value);
}
break;
}
else if (t2 == AUTH_RULE_ECDSA_STRENGTH)
{
success = FALSE;
if (log_error)
{
DBG1(DBG_CFG, "constraint requires %d bit RSA, "
"but ECDSA used", (uintptr_t)value);
}
break;
}
}
e2->destroy(e2);
break; break;
} }
case AUTH_RULE_SIGNATURE_SCHEME: case AUTH_RULE_SIGNATURE_SCHEME:
@@ -800,6 +761,42 @@ METHOD(auth_cfg_t, complies, bool,
e2->destroy(e2); e2->destroy(e2);
} }
/* Check if we have a matching constraint (or none at all) for used
* public key strength */
if (success && strength)
{
e2 = create_enumerator(this);
while (e2->enumerate(e2, &t2, &strength))
{
if (t2 == AUTH_RULE_RSA_STRENGTH ||
t2 == AUTH_RULE_ECDSA_STRENGTH)
{
success = FALSE;
e1 = constraints->create_enumerator(constraints);
while (e1->enumerate(e1, &t1, &value))
{
if (t1 == t2 && (uintptr_t)value <= strength)
{
success = TRUE;
break;
}
}
e1->destroy(e1);
if (!success)
{
if (log_error)
{
DBG1(DBG_CFG, "%s-%d signatures not acceptable",
t2 == AUTH_RULE_RSA_STRENGTH ? "RSA" : "ECDSA",
strength);
}
break;
}
}
}
e2->destroy(e2);
}
if (has_group && !group_match) if (has_group && !group_match)
{ {
if (log_error) if (log_error)