denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Add support to load CA certificates from tokens and paths in authority sections

Browse Source
This commit is contained in:
Tobias Brunner
2017-02-16 19:24:08 +01:00
parent 2f8354ca6c
commit bd6ef6be7e
3 changed files with 130 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/commands/load_authorities.c
+4 -4
View File
@@ -86,18 +86,18 @@ static bool add_key_values(vici_req_t *req, settings_t *cfg, char *section)
enumerator = cfg->create_key_value_enumerator(cfg, section);
while (enumerator->enumerate(enumerator, &key, &value))
{
/* pool subnet is encoded as key/value, all other attributes as list */
if (streq(key, "cacert"))
{
ret = add_file_key_value(req, key, value);
}
else if (streq(key, "cert_uri_base"))
else if (streq(key, "crl_uris") ||
streq(key, "ocsp_uris"))
{
vici_add_key_valuef(req, key, "%s", value);
add_list_key(req, key, value);
}
else
{
add_list_key(req, key, value);
vici_add_key_valuef(req, key, "%s", value);
}
if (!ret)
{
src/swanctl/swanctl.opt
+29 -7
View File
@@ -1054,18 +1054,40 @@ authorities.<name> { # }
authorities.<name>.cacert =
CA certificate belonging to the certification authority.
The certificates may use a relative path from the **swanctl** _x509ca_
directory or an absolute path.
CA certificate belonging to the certification authority. The certificates
may use a relative path from the **swanctl** _x509ca_ directory or an
absolute path.
Configure one of _cacert_, _file_, or _handle_ per section.
authorities.<name>.file =
Absolute path to the certificate to load.
Absolute path to the certificate to load. Passed as-is to the daemon, so it
must be readable by it.
Configure one of _cacert_, _file_, or _handle_ per section.
authorities.<name>.handle =
Hex-encoded CKA_ID of the CA certificate on a token.
Hex-encoded CKA_ID of the CA certificate on a token.
Configure one of _cacert_, _file_, or _handle_ per section.
authorities.<name>.slot =
Optional slot number of the token that stores the CA certificate.
authorities.<name>.module =
Optional PKCS#11 module name.
authorities.<name>.crl_uris =
Comma-separated list of CRL distribution points
Comma-separated list of CRL distribution points.
Comma-separated list of CRL distribution points (ldap, http, or file URI)
Comma-separated list of CRL distribution points (ldap, http, or file URI).
authorities.<name>.ocsp_uris =
Comma-separated list of OCSP URIs
Comma-separated list of OCSP URIs
Comma-separated list of OCSP URIs.
authorities.<name>.cert_uri_base =
Defines the base URI for the Hash and URL feature supported by IKEv2.