denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Don't do online revocation checks in pubkey authenticator if requested

Browse Source 
We also update the auth config so the constraints are not enforced.
This commit is contained in:
Tobias Brunner
2016-03-10 11:07:14 +01:00
parent e19162a509
commit a05cff1ec0
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+8 -1
View File
@@ -365,6 +365,7 @@ METHOD(authenticator_t, process, status_t,
status_t status = NOT_FOUND; status_t status = NOT_FOUND;
keymat_v2_t *keymat; keymat_v2_t *keymat;
const char *reason = "unsupported"; const char *reason = "unsupported";
bool online;
auth_payload = (auth_payload_t*)message->get_payload(message, PLV2_AUTH); auth_payload = (auth_payload_t*)message->get_payload(message, PLV2_AUTH);
if (!auth_payload) if (!auth_payload)
@@ -408,8 +409,10 @@ METHOD(authenticator_t, process, status_t,
return FAILED; return FAILED;
} }
auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE); auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
online = !this->ike_sa->has_condition(this->ike_sa,
COND_ONLINE_VALIDATION_SUSPENDED);
enumerator = lib->credmgr->create_public_enumerator(lib->credmgr, enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
key_type, id, auth, TRUE); key_type, id, auth, online);
while (enumerator->enumerate(enumerator, &public, &current_auth)) while (enumerator->enumerate(enumerator, &public, &current_auth))
{ {
if (public->verify(public, scheme, octets, auth_data)) if (public->verify(public, scheme, octets, auth_data))
@@ -421,6 +424,10 @@ METHOD(authenticator_t, process, status_t,
auth->merge(auth, current_auth, FALSE); auth->merge(auth, current_auth, FALSE);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY); auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
auth->add(auth, AUTH_RULE_IKE_SIGNATURE_SCHEME, (uintptr_t)scheme); auth->add(auth, AUTH_RULE_IKE_SIGNATURE_SCHEME, (uintptr_t)scheme);
if (!online)
{
auth->add(auth, AUTH_RULE_CERT_VALIDATION_SUSPENDED, TRUE);
}
break; break;
} }
else else