denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merged multi-auth branch back into trunk

Browse Source
This commit is contained in:
Martin Willi
2009-04-14 10:34:24 +00:00
parent 6e5c8d9413
commit a44bb9345f
230 changed files with 6163 additions and 4193 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/Makefile.am
+15 -1
View File
@@ -84,11 +84,12 @@ AM_CFLAGS = \
-DIPSEC_CONFDIR=\"${confdir}\" \
-DIPSEC_PIDDIR=\"${piddir}\" \
-DSHARED_SECRETS_FILE=\"${confdir}/ipsec.secrets\" \
-DSTRONGSWAN_CONF=\"${strongswan_conf}\" \
-DKERNEL26_SUPPORT -DKERNEL26_HAS_KAME_DUPLICATES \
-DPLUTO -DKLIPS -DDEBUG
pluto_LDADD = \
oid.o \
oid.o debug.o linked_list.o enumerator.o settings.o \
$(LIBFREESWANDIR)/libfreeswan.a \
$(LIBCRYPTODIR)/libcrypto.a \
-lgmp -lresolv -lpthread -ldl
@@ -99,9 +100,22 @@ $(LIBFREESWANDIR)/libfreeswan.a \
dist_man_MANS = pluto.8 ipsec.secrets.5
# Copy functions from libstrongswan
oid.o : $(LIBSTRONGSWANDIR)/asn1/oid.c $(LIBSTRONGSWANDIR)/asn1/oid.h
$(COMPILE) -c -o $@ $<
debug.o : $(LIBSTRONGSWANDIR)/debug.c $(LIBSTRONGSWANDIR)/debug.h
$(COMPILE) -c -o $@ $<
linked_list.o : $(LIBSTRONGSWANDIR)/utils/linked_list.c $(LIBSTRONGSWANDIR)/utils/linked_list.h
$(COMPILE) -c -o $@ $<
enumerator.o : $(LIBSTRONGSWANDIR)/utils/enumerator.c $(LIBSTRONGSWANDIR)/utils/enumerator.h
$(COMPILE) -c -o $@ $<
settings.o : $(LIBSTRONGSWANDIR)/settings.c $(LIBSTRONGSWANDIR)/settings.h
$(COMPILE) -c -o $@ $<
# This compile option activates the sending of a strongSwan VID
if USE_VENDORID
AM_CFLAGS += -DVENDORID
src/pluto/ac.c
+1 -1
View File
@@ -321,7 +321,7 @@ static bool
same_attribute(const ietfAttr_t *a, const ietfAttr_t *b)
{
return (a->kind == b->kind && a->value.len == b->value.len
&& memcmp(a->value.ptr, b->value.ptr, b->value.len) == 0);
&& memeq(a->value.ptr, b->value.ptr, b->value.len));
}
bool
src/pluto/alg_info.c
+5 -2
View File
@@ -171,12 +171,15 @@ static int
ealg_getbyname_esp(const char *const str, int len)
{
if (!str || !*str)
{
return -1;
}
/* leave special case for eg: "id248" string */
if (strcmp("id", str) == 0)
if (streq("id", str))
{
return ESP_MAGIC_ID;
}
return enum_search_prefix(&esp_transformid_names, "ESP_", str, len);
}
src/pluto/constants.c
+10 -4
View File
@@ -1208,14 +1208,20 @@ enum_search(enum_names *ed, const char *str)
unsigned en;
for (p = ed; p != NULL; p = p->en_next_range)
{
for (en = p->en_first; en <= p->en_last ;en++)
{
ptr = p->en_names[en - p->en_first];
if (ptr == 0) continue;
/* if (strncmp(ptr, str, strlen(ptr))==0) */
if (strcmp(ptr, str) == 0)
return en;
if (ptr == 0)
{
continue;
}
if (streq(ptr, str))
{
return en;
}
}
}
return -1;
}
src/pluto/constants.h
+2 -7
View File
@@ -19,6 +19,8 @@
#ifndef _CONSTANTS_H
#define _CONSTANTS_H
#include <utils.h>
extern const char compile_time_interop_options[];
extern void init_constants(void);
@@ -39,17 +41,10 @@ extern void init_constants(void);
* <freeswan.h> defines err_t for this return type.
*/
typedef int bool;
#define FALSE 0
#define TRUE 1
#define NULL_FD (-1) /* NULL file descriptor */
#define dup_any(fd) ((fd) == NULL_FD? NULL_FD : dup(fd))
#define close_any(fd) { if ((fd) != NULL_FD) { close(fd); (fd) = NULL_FD; } }
#define BITS_PER_BYTE 8
#define streq(a, b) (strcmp((a), (b)) == 0) /* clearer shorthand */
#define strcaseeq(a, b) (strcasecmp((a), (b)) == 0) /* clearer shorthand */
/* set type with room for at least 64 elements for ALG opts (was 32 in stock FS) */
src/pluto/crl.c
+1 -1
View File
@@ -536,7 +536,7 @@ check_revocation(const x509crl_t *crl, chunk_t serial
{
/* compare serial numbers */
if (revokedCert->userCertificate.len == serial.len &&
memcmp(revokedCert->userCertificate.ptr, serial.ptr, serial.len) == 0)
memeq(revokedCert->userCertificate.ptr, serial.ptr, serial.len))
{
*revocationDate = revokedCert->revocationDate;
*revocationReason = revokedCert->revocationReason;
src/pluto/defs.h
-7
View File
@@ -32,10 +32,6 @@
# define USED_BY_DEBUG UNUSED
#endif
/* Length of temporary buffers */
#define BUF_LEN 512
/* type of serial number of a state object
* Needed in connections.h and state.h; here to simplify dependencies.
*/
@@ -118,9 +114,6 @@ typedef struct {
int fd;
} prompt_pass_t;
/* no time defined in time_t */
#define UNDEFINED_TIME 0
/* size of timetoa string buffer */
#define TIMETOA_BUF 30
src/pluto/demux.c
+1 -1
View File
@@ -1713,7 +1713,7 @@ process_packet(struct msg_digest **mdp)
if (st != NULL
&& st->st_rpacket.ptr != NULL
&& st->st_rpacket.len == pbs_room(&md->packet_pbs)
&& memcmp(st->st_rpacket.ptr, md->packet_pbs.start, st->st_rpacket.len) == 0)
&& memeq(st->st_rpacket.ptr, md->packet_pbs.start, st->st_rpacket.len))
{
if (smc->flags & SMF_RETRANSMIT_ON_DUPLICATE)
{
src/pluto/fetch.c
+1 -1
View File
@@ -905,7 +905,7 @@ add_distribution_points(const generalName_t *newPoints ,generalName_t **distribu
{
if (gn->kind == newPoints->kind
&& gn->name.len == newPoints->name.len
&& memcmp(gn->name.ptr, newPoints->name.ptr, gn->name.len) == 0)
&& memeq(gn->name.ptr, newPoints->name.ptr, gn->name.len))
{
/* skip if the distribution point is already present */
add = FALSE;
src/pluto/id.c
+1 -1
View File
@@ -423,7 +423,7 @@ same_id(const struct id *a, const struct id *b)
case ID_KEY_ID:
return a->name.len == b->name.len
&& memcmp(a->name.ptr, b->name.ptr, a->name.len) == 0;
&& memeq(a->name.ptr, b->name.ptr, a->name.len);
default:
bad_case(a->kind);
src/pluto/ike_alg.c
+4 -4
View File
@@ -464,8 +464,8 @@ ike_hash_test(const struct hash_desc *desc)
desc->hash_update(&ctx, desc->hash_testvectors[i].msg
,desc->hash_testvectors[i].msg_size);
desc->hash_final(digest, &ctx);
result = memcmp(digest, desc->hash_testvectors[i].msg_digest
, desc->hash_digest_size) == 0;
result = memeq(digest, desc->hash_testvectors[i].msg_digest
, desc->hash_digest_size);
DBG(DBG_CRYPT,
DBG_log(" hash testvector %d: %s", i, result ? "ok":"failed")
)
@@ -495,8 +495,8 @@ ike_hash_test(const struct hash_desc *desc)
hmac_update(&ctx, desc->hmac_testvectors[i].msg
,desc->hmac_testvectors[i].msg_size);
hmac_final(digest, &ctx);
result = memcmp(digest, desc->hmac_testvectors[i].hmac
, desc->hash_digest_size) == 0;
result = memeq(digest, desc->hmac_testvectors[i].hmac
, desc->hash_digest_size);
DBG(DBG_CRYPT,
DBG_log(" hmac testvector %d: %s", i, result ? "ok":"failed")
)
src/pluto/kernel.c
+1 -1
View File
@@ -2955,7 +2955,7 @@ was_eroute_idle(struct state *st, time_t idle_max, time_t *idle_time)
break;
}
if (strncmp(line, text_said, strlen(text_said)) == 0)
if (strneq(line, text_said, strlen(text_said)))
{
/* we found a match, now try to find idle= */
char *p = strstr(line, idle);
src/pluto/keys.c
+1 -1
View File
@@ -253,7 +253,7 @@ get_secret(const struct connection *c, enum PrivateKeyKind kind, bool asym)
{
case PPK_PSK:
same = s->u.preshared_secret.len == best->u.preshared_secret.len
&& memcmp(s->u.preshared_secret.ptr, best->u.preshared_secret.ptr, s->u.preshared_secret.len) == 0;
&& memeq(s->u.preshared_secret.ptr, best->u.preshared_secret.ptr, s->u.preshared_secret.len);
break;
case PPK_RSA:
/* Dirty trick: since we have code to compare
src/pluto/modecfg.c
+144 -35
View File
@@ -26,6 +26,7 @@
#include <string.h>
#include <freeswan.h>
#include <settings.h>
#include "constants.h"
#include "defs.h"
@@ -42,6 +43,8 @@
#include "xauth.h"
#define MAX_XAUTH_TRIES 3
#define DNS_SERVER_MAX 2
#define NBNS_SERVER_MAX 2
#define SUPPORTED_ATTR_SET ( LELEM(INTERNAL_IP4_ADDRESS) \
| LELEM(INTERNAL_IP4_NETMASK) \
@@ -54,6 +57,8 @@
#define UNITY_BANNER_STR "Welcome to strongSwan - the Linux VPN Solution!\n"
extern settings_t *settings;
/*
* Addresses assigned (usually via ModeCfg) to the Initiator
*/
@@ -67,8 +72,8 @@ struct internal_addr
/* ModeCfg variables */
ip_address ipaddr;
ip_address dns[2];
ip_address wins[2];
ip_address dns[DNS_SERVER_MAX];
ip_address nbns[NBNS_SERVER_MAX];
char *unity_banner;
@@ -84,6 +89,8 @@ struct internal_addr
static void
init_internal_addr(internal_addr_t *ia)
{
int i;
ia->attr_set = LEMPTY;
ia->xauth_attr_set = LEMPTY;
ia->xauth_secret.user_name = empty_chunk;
@@ -94,10 +101,18 @@ init_internal_addr(internal_addr_t *ia)
ia->unity_banner = NULL;
anyaddr(AF_INET, &ia->ipaddr);
anyaddr(AF_INET, &ia->dns[0]);
anyaddr(AF_INET, &ia->dns[1]);
anyaddr(AF_INET, &ia->wins[0]);
anyaddr(AF_INET, &ia->wins[1]);
/* initialize DNS server information */
for (i = 0; i < DNS_SERVER_MAX; i++)
{
anyaddr(AF_INET, &ia->dns[i]);
}
/* initialize WINS server information */
for (i = 0; i < NBNS_SERVER_MAX; i++)
{
anyaddr(AF_INET, &ia->nbns[i]);
}
}
/*
@@ -106,6 +121,8 @@ init_internal_addr(internal_addr_t *ia)
static void
get_internal_addr(struct connection *c, internal_addr_t *ia)
{
int i, dns_idx = 0, nbns_idx = 0;
if (isanyaddr(&c->spd.that.host_srcip))
{
/* not defined in connection - fetch it from LDAP */
@@ -130,13 +147,60 @@ get_internal_addr(struct connection *c, internal_addr_t *ia)
| LELEM(INTERNAL_IP4_NETMASK);
}
if (!isanyaddr(&ia->dns[0])) /* We got DNS addresses, send them */
ia->attr_set |= LELEM(INTERNAL_IP4_DNS);
/* assign DNS servers */
for (i = 1; i <= DNS_SERVER_MAX; i++)
{
char dns_key[16], *dns_str;
if (!isanyaddr(&ia->wins[0])) /* We got WINS addresses, send them */
ia->attr_set |= LELEM(INTERNAL_IP4_NBNS);
snprintf(dns_key, sizeof(dns_key), "pluto.dns%d", i);
dns_str = settings->get_str(settings, dns_key, NULL);
if (dns_str)
{
err_t ugh;
sa_family_t family = strchr(dns_str, ':') ? AF_INET6 : AF_INET;
ugh = ttoaddr(dns_str, 0, family, &ia->dns[dns_idx]);
if (ugh != NULL)
{
plog("error in DNS server address: %s", ugh);
continue;
}
plog("assigning DNS server %s to peer", dns_str);
/* differentiate between IP4 and IP6 in modecfg_build_msg() */
ia->attr_set |= LELEM(INTERNAL_IP4_DNS);
dns_idx++;
}
}
/* assign WINS servers */
for (i = 1; i <= NBNS_SERVER_MAX; i++)
{
char nbns_key[16], *nbns_str;
snprintf(nbns_key, sizeof(nbns_key), "pluto.nbns%d", i);
nbns_str = settings->get_str(settings, nbns_key, NULL);
if (nbns_str)
{
err_t ugh;
sa_family_t family = strchr(nbns_str, ':') ? AF_INET6 : AF_INET;
ugh = ttoaddr(nbns_str, 0, family, &ia->nbns[nbns_idx]);
if (ugh != NULL)
{
plog("error in WINS server address: %s", ugh);
continue;
}
plog("assigning NBNS server %s to peer", nbns_str);
/* differentiate between IP4 and IP6 in modecfg_build_msg() */
ia->attr_set |= LELEM(INTERNAL_IP4_NBNS);
nbns_idx++;
}
}
}
/*
* Set srcip and client subnet to internal IP address
*/
@@ -218,8 +282,8 @@ modecfg_build_msg(struct state *st, pb_stream *rbody
struct isakmp_mode_attr attrh;
struct isakmp_attribute attr;
pb_stream strattr,attrval;
int attr_type;
int dns_idx, wins_idx;
int attr_type, dns_attr_type, nbns_attr_type;
int dns_idx, nbns_idx;
bool dont_advance;
bool is_xauth_attr_set = ia->xauth_attr_set != LEMPTY;
bool is_unity_attr_set = ia->unity_attr_set != LEMPTY;
@@ -230,11 +294,12 @@ modecfg_build_msg(struct state *st, pb_stream *rbody
attrh.isama_identifier = ap_id;
if (!out_struct(&attrh, &isakmp_attr_desc, rbody, &strattr))
{
return STF_INTERNAL_ERROR;
}
attr_type = 0;
dns_idx = 0;
wins_idx = 0;
nbns_idx = 0;
while (attr_set != LEMPTY || is_xauth_attr_set || is_unity_attr_set)
{
@@ -272,6 +337,20 @@ modecfg_build_msg(struct state *st, pb_stream *rbody
attr.isaat_af_type = attr_type | ISAKMP_ATTR_AF_TV;
attr.isaat_lv = ia->xauth_status;
}
else if (attr_type == INTERNAL_IP4_DNS && !isanyaddr(&ia->dns[dns_idx]))
{
dns_attr_type = (addrtypeof(&ia->dns[dns_idx]) == AF_INET) ?
INTERNAL_IP4_DNS : INTERNAL_IP6_DNS;
attr.isaat_af_type = dns_attr_type | ISAKMP_ATTR_AF_TLV;
}
else if (attr_type == INTERNAL_IP4_NBNS && !isanyaddr(&ia->nbns[nbns_idx]))
{
nbns_attr_type = (addrtypeof(&ia->nbns[nbns_idx]) == AF_INET) ?
INTERNAL_IP4_NBNS : INTERNAL_IP6_NBNS;
attr.isaat_af_type = nbns_attr_type | ISAKMP_ATTR_AF_TLV;
}
else
{
attr.isaat_af_type = attr_type | ISAKMP_ATTR_AF_TLV;
@@ -303,10 +382,14 @@ modecfg_build_msg(struct state *st, pb_stream *rbody
}
#endif
if (st->st_connection->spd.this.client.maskbits == 0)
{
mask = 0;
}
else
{
mask = 0xffffffff * 1;
out_raw(&mask, 4, &attrval, "IP4_mask");
}
}
break;
case INTERNAL_IP4_SUBNET:
@@ -318,13 +401,12 @@ modecfg_build_msg(struct state *st, pb_stream *rbody
for (t = 0; t < 4; t++)
{
if (m < 8)
mask[t] = bits[m];
else
mask[t] = 0xff;
mask[t] = (m < 8) ? bits[m] : 0xff;
m -= 8;
if (m < 0)
{
m = 0;
}
}
len = addrbytesptr(&st->st_connection->spd.this.client.addr, &byte_ptr);
out_raw(byte_ptr, len, &attrval, "IP4_subnet");
@@ -332,23 +414,25 @@ modecfg_build_msg(struct state *st, pb_stream *rbody
}
break;
case INTERNAL_IP4_DNS:
case INTERNAL_IP6_DNS:
if (!isanyaddr(&ia->dns[dns_idx]))
{
len = addrbytesptr(&ia->dns[dns_idx++], &byte_ptr);
out_raw(byte_ptr, len, &attrval, "IP4_dns");
out_raw(byte_ptr, len, &attrval, "IP_dns");
}
if (dns_idx < 2 && !isanyaddr(&ia->dns[dns_idx]))
if (dns_idx < DNS_SERVER_MAX && !isanyaddr(&ia->dns[dns_idx]))
{
dont_advance = TRUE;
}
break;
case INTERNAL_IP4_NBNS:
if (!isanyaddr(&ia->wins[wins_idx]))
case INTERNAL_IP6_NBNS:
if (!isanyaddr(&ia->nbns[nbns_idx]))
{
len = addrbytesptr(&ia->wins[wins_idx++], &byte_ptr);
out_raw(byte_ptr, len, &attrval, "IP4_wins");
len = addrbytesptr(&ia->nbns[nbns_idx++], &byte_ptr);
out_raw(byte_ptr, len, &attrval, "IP_nbns");
}
if (wins_idx < 2 && !isanyaddr(&ia->wins[wins_idx]))
if (nbns_idx < NBNS_SERVER_MAX && !isanyaddr(&ia->nbns[nbns_idx]))
{
dont_advance = TRUE;
}
@@ -619,7 +703,9 @@ modecfg_parse_msg(struct msg_digest *md, int isama_type, u_int16_t *isama_id
stat = modecfg_parse_attributes(&p->pbs, &ia_candidate);
}
if (stat != STF_OK)
{
return stat;
}
}
return STF_IGNORE;
}
@@ -642,7 +728,9 @@ modecfg_send_request(struct state *st)
st->st_state = STATE_MODE_CFG_I1;
stat = modecfg_send_msg(st, ISAKMP_CFG_REQUEST, &ia);
if (stat == STF_OK)
{
st->st_modecfg.started = TRUE;
}
return stat;
}
@@ -662,10 +750,11 @@ modecfg_inR0(struct msg_digest *md)
stat = modecfg_parse_msg(md, ISAKMP_CFG_REQUEST, &isama_id, &ia);
if (stat != STF_OK)
{
return stat;
}
want_unity_banner = (ia.unity_attr_set & LELEM(UNITY_BANNER - UNITY_BASE)) != LEMPTY;
init_internal_addr(&ia);
get_internal_addr(st->st_connection, &ia);
@@ -682,8 +771,9 @@ modecfg_inR0(struct msg_digest *md)
, &ia
, isama_id);
if (stat_build != STF_OK)
{
return stat_build;
}
st->st_msgid = 0;
return STF_OK;
}
@@ -705,8 +795,9 @@ modecfg_inI1(struct msg_digest *md)
stat = modecfg_parse_msg(md, ISAKMP_CFG_REPLY, &isama_id, &ia);
if (stat != STF_OK)
{
return stat;
}
st->st_modecfg.vars_set = set_internal_addr(st->st_connection, &ia);
st->st_msgid = 0;
return STF_OK;
@@ -734,7 +825,9 @@ modecfg_send_set(struct state *st)
st->st_state = STATE_MODE_CFG_R3;
stat = modecfg_send_msg(st, ISAKMP_CFG_SET, &ia);
if (stat == STF_OK)
{
st->st_modecfg.started = TRUE;
}
return stat;
}
@@ -756,8 +849,9 @@ modecfg_inI0(struct msg_digest *md)
stat = modecfg_parse_msg(md, ISAKMP_CFG_SET, &isama_id, &ia);
if (stat != STF_OK)
{
return stat;
}
st->st_modecfg.vars_set = set_internal_addr(st->st_connection, &ia);
/* prepare ModeCfg ack which sends zero length attributes */
@@ -774,8 +868,9 @@ modecfg_inI0(struct msg_digest *md)
, &ia
, isama_id);
if (stat_build != STF_OK)
{
return stat_build;
}
st->st_msgid = 0;
return STF_OK;
}
@@ -797,8 +892,9 @@ modecfg_inR3(struct msg_digest *md)
stat = modecfg_parse_msg(md, ISAKMP_CFG_ACK, &isama_id, &ia);
if (stat != STF_OK)
{
return stat;
}
st->st_msgid = 0;
return STF_OK;
}
@@ -820,7 +916,9 @@ xauth_send_request(struct state *st)
st->st_state = STATE_XAUTH_R1;
stat = modecfg_send_msg(st, ISAKMP_CFG_REQUEST, &ia);
if (stat == STF_OK)
{
st->st_xauth.started = TRUE;
}
return stat;
}
@@ -842,8 +940,10 @@ xauth_inI0(struct msg_digest *md)
stat = modecfg_parse_msg(md, ISAKMP_CFG_REQUEST, &isama_id, &ia);
if (stat != STF_OK)
{
return stat;
}
/* check XAUTH attributes */
xauth_type_present = (ia.xauth_attr_set & LELEM(XAUTH_TYPE - XAUTH_BASE)) != LEMPTY;
@@ -890,7 +990,9 @@ xauth_inI0(struct msg_digest *md)
ia.xauth_attr_set = LELEM(XAUTH_USER_NAME - XAUTH_BASE)
| LELEM(XAUTH_USER_PASSWORD - XAUTH_BASE);
if (xauth_type_present)
{
ia.xauth_attr_set |= LELEM(XAUTH_TYPE - XAUTH_BASE);
}
}
else
{
@@ -905,8 +1007,9 @@ xauth_inI0(struct msg_digest *md)
, &ia
, isama_id);
if (stat_build != STF_OK)
{
return stat_build;
}
if (stat == STF_OK)
{
st->st_xauth.started = TRUE;
@@ -942,8 +1045,10 @@ xauth_inR1(struct msg_digest *md)
stat = modecfg_parse_msg(md, ISAKMP_CFG_REPLY, &isama_id, &ia);
if (stat != STF_OK)
{
return stat;
}
/* did the client return an XAUTH FAIL status? */
if ((ia.xauth_attr_set & LELEM(XAUTH_STATUS - XAUTH_BASE)) != LEMPTY)
{
@@ -997,7 +1102,9 @@ xauth_inR1(struct msg_digest *md)
stat_build = modecfg_send_msg(st, ISAKMP_CFG_SET, &ia);
if (stat_build != STF_OK)
{
return stat_build;
}
return STF_OK;
}
@@ -1033,8 +1140,9 @@ xauth_inI1(struct msg_digest *md)
, &ia
, isama_id);
if (stat_build != STF_OK)
{
return stat_build;
}
if (st->st_xauth.status)
{
st->st_msgid = 0;
@@ -1069,8 +1177,9 @@ xauth_inR2(struct msg_digest *md)
stat = modecfg_parse_msg(md, ISAKMP_CFG_ACK, &isama_id, &ia);
if (stat != STF_OK)
{
return stat;
}
st->st_msgid = 0;
if (st->st_xauth.status)
{
src/pluto/nat_traversal.c
+2 -2
View File
@@ -237,7 +237,7 @@ void nat_traversal_natd_lookup(struct msg_digest *md)
&(md->iface->addr), ntohs(st->st_connection->spd.this.host_port));
if (!(pbs_left(&p->pbs) == st->st_oakley.hasher->hash_digest_len &&
memcmp(p->pbs.cur, hash, st->st_oakley.hasher->hash_digest_len) == 0))
memeq(p->pbs.cur, hash, st->st_oakley.hasher->hash_digest_len)))
{
#ifdef NAT_D_DEBUG
DBG(DBG_NATT,
@@ -258,7 +258,7 @@ void nat_traversal_natd_lookup(struct msg_digest *md)
for (p = p->next, i=0 ; p != NULL; p = p->next)
{
if (pbs_left(&p->pbs) == st->st_oakley.hasher->hash_digest_len &&
memcmp(p->pbs.cur, hash, st->st_oakley.hasher->hash_digest_len) == 0)
memeq(p->pbs.cur, hash, st->st_oakley.hasher->hash_digest_len))
{
i++;
}
src/pluto/pem.c
+2 -3
View File
@@ -45,7 +45,7 @@ present(const char* pattern, chunk_t* ch)
{
u_int pattern_len = strlen(pattern);
if (ch->len >= pattern_len && strncmp(ch->ptr, pattern, pattern_len) == 0)
if (ch->len >= pattern_len && strneq(ch->ptr, pattern, pattern_len))
{
ch->ptr += pattern_len;
ch->len -= pattern_len;
@@ -60,8 +60,7 @@ present(const char* pattern, chunk_t* ch)
static bool
match(const char *pattern, const chunk_t *ch)
{
return ch->len == strlen(pattern) &&
strncmp(pattern, ch->ptr, ch->len) == 0;
return ch->len == strlen(pattern) && strneq(pattern, ch->ptr, ch->len);
}
/*
src/pluto/pgp.c
+3 -1
View File
@@ -521,7 +521,7 @@ static bool
same_pgpcert(pgpcert_t *a, pgpcert_t *b)
{
return a->certificate.len == b->certificate.len &&
memcmp(a->certificate.ptr, b->certificate.ptr, b->certificate.len) == 0;
memeq(a->certificate.ptr, b->certificate.ptr, b->certificate.len);
}
/*
@@ -531,7 +531,9 @@ void
share_pgpcert(pgpcert_t *cert)
{
if (cert != NULL)
{
cert->count++;
}
}
/*
src/pluto/plutomain.c
+8
View File
@@ -38,6 +38,7 @@
#endif /* CAPABILITIES */
#include <freeswan.h>
#include <settings.h>
#include <pfkeyv2.h>
#include <pfkey.h>
@@ -197,6 +198,9 @@ delete_lock(void)
}
}
/* settings defined by strongswan.conf */
settings_t *settings;
/* by default pluto sends certificate requests to its peers */
bool no_cr_send = FALSE;
@@ -239,6 +243,9 @@ main(int argc, char **argv)
int keep[] = { CAP_NET_ADMIN, CAP_NET_BIND_SERVICE };
#endif /* CAPABILITIES */
/* getting settings from strongswan.conf */
settings = settings_create(STRONGSWAN_CONF);
/* handle arguments */
for (;;)
{
@@ -703,6 +710,7 @@ exit_pluto(int status)
free_ifaces();
scx_finalize(); /* finalize and unload PKCS #11 module */
xauth_finalize(); /* finalize and unload XAUTH module */
settings->destroy(settings);
stop_adns();
free_md_pool();
delete_lock();
src/pluto/server.c
+4 -2
View File
@@ -544,8 +544,10 @@ process_raw_ifaces(struct raw_iface *rifaces)
struct raw_iface *vfp;
/* ignore if virtual (ipsec*) interface */
if (strncmp(ifp->name, IPSECDEVPREFIX, sizeof(IPSECDEVPREFIX)-1) == 0)
if (strneq(ifp->name, IPSECDEVPREFIX, sizeof(IPSECDEVPREFIX)-1))
{
continue;
}
for (vfp = rifaces; vfp != NULL; vfp = vfp->next)
{
@@ -558,7 +560,7 @@ process_raw_ifaces(struct raw_iface *rifaces)
/* Different entries with matching IP addresses.
* Many interesting cases.
*/
if (strncmp(vfp->name, IPSECDEVPREFIX, sizeof(IPSECDEVPREFIX)-1) == 0)
if (strneq(vfp->name, IPSECDEVPREFIX, sizeof(IPSECDEVPREFIX)-1))
{
if (v != NULL && !streq(v->name, vfp->name))
{
src/pluto/smartcard.c
+2 -2
View File
@@ -787,7 +787,7 @@ scx_finalize(void)
bool
scx_on_smartcard(const char *filename)
{
return strncmp(filename, SCX_TOKEN, strlen(SCX_TOKEN)) == 0;
return strneq(filename, SCX_TOKEN, strlen(SCX_TOKEN));
}
#ifdef SMARTCARD
@@ -1619,7 +1619,7 @@ scx_op_via_whack(const char* msg, int inbase, int outbase, sc_op_t op
if (keyid != NULL)
{
number_slot_id = (strncmp(keyid, SCX_TOKEN, strlen(SCX_TOKEN)) == 0)
number_slot_id = (strneq(keyid, SCX_TOKEN, strlen(SCX_TOKEN)))
? keyid + strlen(SCX_TOKEN) : keyid;
}
src/pluto/state.c
+17 -5
View File
@@ -578,14 +578,19 @@ find_state(const u_char *icookie
struct state *st = *state_hash(icookie, rcookie, peer);
while (st != (struct state *) NULL)
{
if (sameaddr(peer, &st->st_connection->spd.that.host_addr)
&& memcmp(icookie, st->st_icookie, COOKIE_SIZE) == 0
&& memcmp(rcookie, st->st_rcookie, COOKIE_SIZE) == 0
&& memeq(icookie, st->st_icookie, COOKIE_SIZE)
&& memeq(rcookie, st->st_rcookie, COOKIE_SIZE)
&& msgid == st->st_msgid)
{
break;
}
else
{
st = st->st_hashchain_next;
}
}
DBG(DBG_CONTROL,
if (st == NULL)
DBG_log("state object not found");
@@ -607,13 +612,20 @@ find_sender(size_t packet_len, u_char *packet)
struct state *st;
if (packet_len >= sizeof(struct isakmp_hdr))
{
for (i = 0; i < STATE_TABLE_SIZE; i++)
{
for (st = statetable[i]; st != NULL; st = st->st_hashchain_next)
{
if (st->st_tpacket.ptr != NULL
&& st->st_tpacket.len == packet_len
&& memcmp(st->st_tpacket.ptr, packet, packet_len) == 0)
&& memeq(st->st_tpacket.ptr, packet, packet_len))
{
return st;
}
}
}
}
return NULL;
}
src/pluto/vendor.c
+2 -2
View File
@@ -497,7 +497,7 @@ handle_vendorid (struct msg_digest *md, const char *vid, size_t len)
{
if (pvid->vid_len == len)
{
if (memcmp(pvid->vid, vid, len) == 0)
if (memeq(pvid->vid, vid, len))
{
handle_known_vendorid(md, vid, len, pvid);
return;
@@ -505,7 +505,7 @@ handle_vendorid (struct msg_digest *md, const char *vid, size_t len)
}
else if ((pvid->vid_len < len) && (pvid->flags & VID_SUBSTRING))
{
if (memcmp(pvid->vid, vid, pvid->vid_len) == 0)
if (memeq(pvid->vid, vid, pvid->vid_len))
{
handle_known_vendorid(md, vid, len, pvid);
return;
src/pluto/virtual.c
+9 -9
View File
@@ -54,11 +54,11 @@ _read_subnet(const char *src, size_t len, ip_subnet *dst, ip_subnet *dstko,
bool ok;
int af;
if ((len > 4) && (strncmp(src, "%v4:", 4)==0))
if ((len > 4) && (strneq(src, "%v4:", 4)))
{
af = AF_INET;
}
else if ((len > 4) && (strncmp(src, "%v6:", 4)==0))
else if ((len > 4) && (strneq(src, "%v6:", 4)))
{
af = AF_INET6;
}
@@ -196,12 +196,12 @@ struct virtual_t
if (!string || string[0] == '\0')
return NULL;
if (strlen(string) >= 6 && strncmp(string,"vhost:",6) == 0)
if (strlen(string) >= 6 && strneq(string,"vhost:",6))
{
flags |= F_VIRTUAL_HOST;
str += 6;
}
else if (strlen(string) >= 5 && strncmp(string,"vnet:",5) == 0)
else if (strlen(string) >= 5 && strneq(string,"vnet:",5))
str += 5;
else
goto fail;
@@ -213,17 +213,17 @@ struct virtual_t
{
next = strchr(str,',');
if (!next) next = str + strlen(str);
if (next-str == 3 && strncmp(str, "%no", 3) == 0)
if (next-str == 3 && strneq(str, "%no", 3))
flags |= F_VIRTUAL_NO;
#if 0
else if (next-str == 4 && strncmp(str, "%ike", 4) == 0)
else if (next-str == 4 && strneq(str, "%ike", 4))
flags |= F_VIRTUAL_IKE_CONFIG;
else if (next-str == 5 && strncmp(str, "%dhcp", 5) == 0)
else if (next-str == 5 && strneq(str, "%dhcp", 5))
flags |= F_VIRTUAL_DHCP;
#endif
else if (next-str == 5 && strncmp(str, "%priv", 5) == 0)
else if (next-str == 5 && strneq(str, "%priv", 5))
flags |= F_VIRTUAL_PRIVATE;
else if (next-str == 4 && strncmp(str, "%all", 4) == 0)
else if (next-str == 4 && strneq(str, "%all", 4))
flags |= F_VIRTUAL_ALL;
else if (_read_subnet(str, next-str, &sub, NULL, NULL))
{
src/pluto/x509.c
+141 -25
View File
@@ -423,8 +423,9 @@ init_rdn(chunk_t dn, chunk_t *rdn, chunk_t *attribute, bool *next)
rdn->len = asn1_length(&dn);
if (rdn->len == ASN1_INVALID_LENGTH)
{
return "Invalid RDN length";
}
rdn->ptr = dn.ptr;
/* are there any RDNs ? */
@@ -451,13 +452,15 @@ get_next_rdn(chunk_t *rdn, chunk_t * attribute, chunk_t *oid, chunk_t *value
{
/* an RDN is a SET OF attributeTypeAndValue */
if (*rdn->ptr != ASN1_SET)
{
return "RDN is not a SET";
}
attribute->len = asn1_length(rdn);
if (attribute->len == ASN1_INVALID_LENGTH)
{
return "Invalid attribute length";
}
attribute->ptr = rdn->ptr;
/* advance to start of next RDN */
@@ -467,14 +470,17 @@ get_next_rdn(chunk_t *rdn, chunk_t * attribute, chunk_t *oid, chunk_t *value
/* an attributeTypeAndValue is a SEQUENCE */
if (*attribute->ptr != ASN1_SEQUENCE)
{
return "attributeTypeAndValue is not a SEQUENCE";
}
/* extract the attribute body */
body.len = asn1_length(attribute);
if (body.len == ASN1_INVALID_LENGTH)
{
return "Invalid attribute body length";
}
body.ptr = attribute->ptr;
/* advance to start of next attribute */
@@ -483,14 +489,17 @@ get_next_rdn(chunk_t *rdn, chunk_t * attribute, chunk_t *oid, chunk_t *value
/* attribute type is an OID */
if (*body.ptr != ASN1_OID)
{
return "attributeType is not an OID";
}
/* extract OID */
oid->len = asn1_length(&body);
if (oid->len == ASN1_INVALID_LENGTH)
if (oid->len == ASN1_INVALID_LENGTH)
{
return "Invalid attribute OID length";
}
oid->ptr = body.ptr;
/* advance to the attribute value */
@@ -504,8 +513,9 @@ get_next_rdn(chunk_t *rdn, chunk_t * attribute, chunk_t *oid, chunk_t *value
value->len = asn1_length(&body);
if (value->len == ASN1_INVALID_LENGTH)
{
return "Invalid attribute string length";
}
value->ptr = body.ptr;
/* are there any RDNs left? */
@@ -529,27 +539,39 @@ dn_parse(chunk_t dn, chunk_t *str)
err_t ugh = init_rdn(dn, &rdn, &attribute, &next);
if (ugh != NULL) /* a parsing error has occured */
{
return ugh;
}
while (next)
{
ugh = get_next_rdn(&rdn, &attribute, &oid, &value, &type, &next);
if (ugh != NULL) /* a parsing error has occured */
{
return ugh;
}
if (first) /* first OID/value pair */
{
first = FALSE;
}
else /* separate OID/value pair by a comma */
{
update_chunk(str, snprintf(str->ptr,str->len,", "));
}
/* print OID */
oid_code = known_oid(oid);
if (oid_code == OID_UNKNOWN) /* OID not found in list */
{
hex_str(oid, str);
}
else
{
update_chunk(str, snprintf(str->ptr,str->len,"%s",
oid_names[oid_code].name));
}
/* print value */
update_chunk(str, snprintf(str->ptr,str->len,"=%.*s",
@@ -572,16 +594,22 @@ dn_count_wildcards(chunk_t dn)
err_t ugh = init_rdn(dn, &rdn, &attribute, &next);
if (ugh != NULL) /* a parsing error has occured */
{
return -1;
}
while (next)
{
ugh = get_next_rdn(&rdn, &attribute, &oid, &value, &type, &next);
if (ugh != NULL) /* a parsing error has occured */
{
return -1;
}
if (value.len == 1 && *value.ptr == '*')
{
wildcards++; /* we have found a wildcard RDN */
}
}
return wildcards;
}
@@ -631,9 +659,13 @@ int
dntoa_or_null(char *dst, size_t dstlen, chunk_t dn, const char* null_dn)
{
if (dn.ptr == NULL)
{
return snprintf(dst, dstlen, "%s", null_dn);
}
else
{
return dntoa(dst, dstlen, dn);
}
}
/* Converts an LDAP-style human-readable ASCII-encoded
@@ -692,14 +724,18 @@ atodn(char *src, chunk_t *dn)
break;
case READ_OID:
if (*src != ' ' && *src != '=')
{
oid.len++;
}
else
{
for (pos = 0; pos < X501_RDN_ROOF; pos++)
{
if (strlen(x501rdns[pos].name) == oid.len &&
strncasecmp(x501rdns[pos].name, oid.ptr, oid.len) == 0)
{
break; /* found a valid OID */
}
}
if (pos == X501_RDN_ROOF)
{
@@ -728,9 +764,13 @@ atodn(char *src, chunk_t *dn)
{
name.len++;
if (*src == ' ')
{
whitespace++;
}
else
{
whitespace = 0;
}
}
else
{
@@ -796,16 +836,22 @@ same_dn(chunk_t a, chunk_t b)
/* same lengths for the DNs */
if (a.len != b.len)
{
return FALSE;
}
/* try a binary comparison first */
if (memcmp(a.ptr, b.ptr, b.len) == 0)
if (memeq(a.ptr, b.ptr, b.len))
{
return TRUE;
}
/* initialize DN parsing */
if (init_rdn(a, &rdn_a, &attribute_a, &next_a) != NULL
|| init_rdn(b, &rdn_b, &attribute_b, &next_b) != NULL)
{
return FALSE;
}
/* fetch next RDN pair */
while (next_a && next_b)
@@ -819,28 +865,38 @@ same_dn(chunk_t a, chunk_t b)
/* OIDs must agree */
if (oid_a.len != oid_b.len || memcmp(oid_a.ptr, oid_b.ptr, oid_b.len) != 0)
{
return FALSE;
}
/* same lengths for values */
if (value_a.len != value_b.len)
{
return FALSE;
}
/* printableStrings and email RDNs require uppercase comparison */
if (type_a == type_b && (type_a == ASN1_PRINTABLESTRING ||
(type_a == ASN1_IA5STRING && known_oid(oid_a) == OID_PKCS9_EMAIL)))
{
if (strncasecmp(value_a.ptr, value_b.ptr, value_b.len) != 0)
{
return FALSE;
}
}
else
{
if (strncmp(value_a.ptr, value_b.ptr, value_b.len) != 0)
{
return FALSE;
}
}
}
/* both DNs must have same number of RDNs */
if (next_a || next_b)
{
return FALSE;
}
/* the two DNs are equal! */
return TRUE;
@@ -864,7 +920,9 @@ match_dn(chunk_t a, chunk_t b, int *wildcards)
/* initialize DN parsing */
if (init_rdn(a, &rdn_a, &attribute_a, &next_a) != NULL
|| init_rdn(b, &rdn_b, &attribute_b, &next_b) != NULL)
{
return FALSE;
}
/* fetch next RDN pair */
while (next_a && next_b)
@@ -878,7 +936,9 @@ match_dn(chunk_t a, chunk_t b, int *wildcards)
/* OIDs must agree */
if (oid_a.len != oid_b.len || memcmp(oid_a.ptr, oid_b.ptr, oid_b.len) != 0)
{
return FALSE;
}
/* does rdn_b contain a wildcard? */
if (value_b.len == 1 && *value_b.ptr == '*')
@@ -889,24 +949,33 @@ match_dn(chunk_t a, chunk_t b, int *wildcards)
/* same lengths for values */
if (value_a.len != value_b.len)
{
return FALSE;
}
/* printableStrings and email RDNs require uppercase comparison */
if (type_a == type_b && (type_a == ASN1_PRINTABLESTRING ||
(type_a == ASN1_IA5STRING && known_oid(oid_a) == OID_PKCS9_EMAIL)))
{
if (strncasecmp(value_a.ptr, value_b.ptr, value_b.len) != 0)
{
return FALSE;
}
}
else
{
if (strncmp(value_a.ptr, value_b.ptr, value_b.len) != 0)
{
return FALSE;
}
}
}
/* both DNs must have same number of RDNs */
if (next_a || next_b)
{
return FALSE;
}
/* the two DNs match! */
return TRUE;
@@ -928,7 +997,9 @@ void
share_x509cert(x509cert_t *cert)
{
if (cert != NULL)
{
cert->count++;
}
}
/*
@@ -1009,8 +1080,9 @@ bool
same_keyid(chunk_t a, chunk_t b)
{
if (a.ptr == NULL || b.ptr == NULL)
{
return FALSE;
}
return same_chunk(a, b);
}
@@ -1022,8 +1094,9 @@ same_serial(chunk_t a, chunk_t b)
{
/* do not compare serial numbers if one of them is not defined */
if (a.ptr == NULL || b.ptr == NULL)
{
return TRUE;
}
return same_chunk(a, b);
}
@@ -1175,7 +1248,9 @@ release_x509cert(x509cert_t *cert)
{
x509cert_t **pp = &x509certs;
while (*pp != cert)
{
pp = &(*pp)->next;
}
*pp = cert->next;
free_x509cert(cert);
}
@@ -1215,7 +1290,9 @@ store_x509certs(x509cert_t **firstcert, bool strict)
}
}
else
{
pp = &cert->next;
}
}
/* now verify the candidate CA certs */
@@ -1330,9 +1407,13 @@ check_signature(chunk_t tbs, chunk_t sig, int digest_alg, int enc_alg
DBG(DBG_PARSING,
if (digest_alg != OID_UNKNOWN)
{
DBG_log("signature digest algorithm: '%s'",oid_names[digest_alg].name);
}
else
{
DBG_log("unknown signature digest algorithm");
}
)
if (!compute_digest(tbs, digest_alg, &digest))
@@ -1349,9 +1430,13 @@ check_signature(chunk_t tbs, chunk_t sig, int digest_alg, int enc_alg
DBG(DBG_PARSING,
if (enc_alg != OID_UNKNOWN)
{
DBG_log("signature encryption algorithm: '%s'",oid_names[enc_alg].name);
}
else
{
DBG_log("unknown signature encryption algorithm");
}
)
if (!decrypt_sig(sig, enc_alg, issuer_cert, &decrypted))
@@ -1361,7 +1446,7 @@ check_signature(chunk_t tbs, chunk_t sig, int digest_alg, int enc_alg
}
/* check if digests are equal */
return !memcmp(decrypted.ptr, digest.ptr, digest.len);
return memeq(decrypted.ptr, digest.ptr, digest.len);
}
/*
@@ -1382,8 +1467,9 @@ parse_basicConstraints(chunk_t blob, int level0)
if (!extract_object(basicConstraintsObjects, &objectID,
&object,&level, &ctx))
{
break;
}
if (objectID == BASIC_CONSTRAINTS_CA)
{
isCA = object.len && *object.ptr;
@@ -1460,7 +1546,9 @@ parse_otherName(chunk_t blob, int level0)
while (objectID < ON_OBJ_ROOF)
{
if (!extract_object(otherNameObjects, &objectID, &object, &level, &ctx))
{
return FALSE;
}
switch (objectID)
{
@@ -1505,7 +1593,9 @@ parse_generalName(chunk_t blob, int level0)
bool valid_gn = FALSE;
if (!extract_object(generalNameObjects, &objectID, &object, &level, &ctx))
{
return NULL;
}
switch (objectID) {
case GN_OBJ_RFC822_NAME:
@@ -1574,8 +1664,9 @@ parse_generalNames(chunk_t blob, int level0, bool implicit)
while (objectID < GENERAL_NAMES_ROOF)
{
if (!extract_object(generalNamesObjects, &objectID, &object, &level, &ctx))
{
return NULL;
}
if (objectID == GENERAL_NAMES_GN)
{
generalName_t *gn = parse_generalName(object, level+1);
@@ -1599,10 +1690,10 @@ chunk_t get_directoryName(chunk_t blob, int level, bool implicit)
generalName_t * gn = parse_generalNames(blob, level, implicit);
if (gn != NULL && gn->kind == GN_DIRECTORY_NAME)
{
name= gn->name;
}
free_generalNames(gn, FALSE);
return name;
}
@@ -1622,8 +1713,9 @@ parse_time(chunk_t blob, int level0)
while (objectID < TIME_ROOF)
{
if (!extract_object(timeObjects, &objectID, &object, &level, &ctx))
{
return UNDEFINED_TIME;
}
if (objectID == TIME_UTC || objectID == TIME_GENERALIZED)
{
return asn1totime(&object, (objectID == TIME_UTC)
@@ -1668,9 +1760,11 @@ parse_authorityKeyIdentifier(chunk_t blob, int level0
while (objectID < AUTH_KEY_ID_ROOF)
{
if (!extract_object(authorityKeyIdentifierObjects, &objectID, &object, &level, &ctx))
{
return;
switch (objectID) {
}
switch (objectID)
{
case AUTH_KEY_ID_KEY_ID:
*authKeyID = parse_keyIdentifier(object, level+1, TRUE);
break;
@@ -1708,9 +1802,12 @@ parse_authorityInfoAccess(chunk_t blob, int level0, chunk_t *accessLocation)
while (objectID < AUTH_INFO_ACCESS_ROOF)
{
if (!extract_object(authorityInfoAccessObjects, &objectID, &object, &level, &ctx))
{
return;
}
switch (objectID) {
switch (objectID)
{
case AUTH_INFO_ACCESS_METHOD:
accessMethod = known_oid(object);
break;
@@ -1722,8 +1819,9 @@ parse_authorityInfoAccess(chunk_t blob, int level0, chunk_t *accessLocation)
if (*object.ptr == ASN1_CONTEXT_S_6)
{
if (asn1_length(&object) == ASN1_INVALID_LENGTH)
{
return;
}
DBG(DBG_PARSING,
DBG_log(" '%.*s'",(int)object.len, object.ptr)
)
@@ -1768,11 +1866,14 @@ parse_extendedKeyUsage(chunk_t blob, int level0)
{
if (!extract_object(extendedKeyUsageObjects, &objectID
, &object, &level, &ctx))
{
return FALSE;
}
if (objectID == EXT_KEY_USAGE_PURPOSE_ID
&& known_oid(object) == OID_OCSP_SIGNING)
{
return TRUE;
}
objectID++;
}
return FALSE;
@@ -1798,8 +1899,9 @@ parse_crlDistributionPoints(chunk_t blob, int level0)
{
if (!extract_object(crlDistributionPointsObjects, &objectID,
&object, &level, &ctx))
{
return NULL;
}
if (objectID == CRL_DIST_POINTS_FULLNAME)
{
generalName_t *gn = parse_generalNames(object, level+1, TRUE);
@@ -1836,7 +1938,9 @@ parse_x509cert(chunk_t blob, u_int level0, x509cert_t *cert)
while (objectID < X509_OBJ_ROOF)
{
if (!extract_object(certObjects, &objectID, &object, &level, &ctx))
{
return FALSE;
}
/* those objects which will parsed further need the next higher level */
level++;
@@ -1882,7 +1986,9 @@ parse_x509cert(chunk_t blob, u_int level0, x509cert_t *cert)
break;
case X509_OBJ_SUBJECT_PUBLIC_KEY_ALGORITHM:
if (parse_algorithmIdentifier(object, level, NULL) == OID_RSA_ENCRYPTION)
{
cert->subjectPublicKeyAlgorithm = PUBKEY_ALG_RSA;
}
else
{
plog(" unsupported public key algorithm");
@@ -2003,14 +2109,22 @@ check_validity(const x509cert_t *cert, time_t *until)
DBG_log(" not after : %s", timetoa(&cert->notAfter, TRUE));
)
if (cert->notAfter < *until) *until = cert->notAfter;
if (cert->notAfter < *until)
{
*until = cert->notAfter;
}
if (current_time < cert->notBefore)
{
return "certificate is not valid yet";
}
if (current_time > cert->notAfter)
{
return "certificate has expired";
}
else
{
return NULL;
}
}
/*
@@ -2126,7 +2240,9 @@ verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
* lifetime as the validity of the ocsp status or crl lifetime
*/
if (strict && nextUpdate < *until)
{
*until = nextUpdate;
}
break;
case CERT_REVOKED:
plog("certificate was revoked on %s, reason: %s"