denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-cert-post: Generate URL for hash-and-URL here

Browse Source 
This avoids having to register certificates with authority/ca backends
beforehand, which is tricky for intermediate CA certificates loaded
themselves via authority/ca sections.  On the other hand, the form of
these URLs can't be determined by config backends anymore (not an issue
for the two current implementations, no idea if custom implementations
ever made use of that possibility).  If that became necessary, we could
perhaps pass the certificate to the CDP enumerator or add a new method
to the credential_set_t interface.
This commit is contained in:
Tobias Brunner
2019-11-26 11:12:26 +01:00
parent a605452c03
commit ae06cfad36
3 changed files with 60 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_ca.c
+5 -19
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2008-2015 Tobias Brunner
* Copyright (C) 2008-2019 Tobias Brunner
* Copyright (C) 2008 Martin Willi
* HSR Hochschule fuer Technik Rapperswil
*
@@ -308,32 +308,18 @@ static enumerator_t *create_inner_cdp(ca_section_t *section, cdp_data_t *data)
*/
static enumerator_t *create_inner_cdp_hashandurl(ca_section_t *section, cdp_data_t *data)
{
enumerator_t *enumerator = NULL, *hash_enum;
identification_t *current;
enumerator_t *enumerator = NULL;
if (!data->id || !section->certuribase)
{
return NULL;
}
hash_enum = section->hashes->create_enumerator(section->hashes);
while (hash_enum->enumerate(hash_enum, &current))
if (section->cert->has_subject(section->cert, data->id) != ID_MATCH_NONE)
{
if (current->matches(current, data->id))
{
char *url, *hash;
url = malloc(strlen(section->certuribase) + 40 + 1);
strcpy(url, section->certuribase);
hash = chunk_to_hex(current->get_encoding(current), NULL, FALSE).ptr;
strncat(url, hash, 40);
free(hash);
enumerator = enumerator_create_single(url, free);
break;
}
enumerator = enumerator_create_single(strdup(section->certuribase),
free);
}
hash_enum->destroy(hash_enum);
return enumerator;
}
src/libcharon/plugins/vici/vici_authority.c
+5 -19
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2016 Tobias Brunner
* Copyright (C) 2016-2019 Tobias Brunner
* Copyright (C) 2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
@@ -694,32 +694,18 @@ static enumerator_t *create_inner_cdp(authority_t *authority, cdp_data_t *data)
static enumerator_t *create_inner_cdp_hashandurl(authority_t *authority,
cdp_data_t *data)
{
enumerator_t *enumerator = NULL, *hash_enum;
identification_t *current;
enumerator_t *enumerator = NULL;
if (!data->id || !authority->cert_uri_base)
{
return NULL;
}
hash_enum = authority->hashes->create_enumerator(authority->hashes);
while (hash_enum->enumerate(hash_enum, &current))
if (authority->cert->has_subject(authority->cert, data->id) != ID_MATCH_NONE)
{
if (current->matches(current, data->id))
{
char *url, *hash;
url = malloc(strlen(authority->cert_uri_base) + 40 + 1);
strcpy(url, authority->cert_uri_base);
hash = chunk_to_hex(current->get_encoding(current), NULL, FALSE).ptr;
strncat(url, hash, 40);
free(hash);
enumerator = enumerator_create_single(url, free);
break;
}
enumerator = enumerator_create_single(strdup(authority->cert_uri_base),
free);
}
hash_enum->destroy(hash_enum);
return enumerator;
}