denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented path length constraint checking for IKEv1

Browse Source
This commit is contained in:
Andreas Steffen
2009-11-04 18:10:31 +01:00
parent bed19335b8
commit c95671cec2
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pluto/x509.c
+16 -5
View File
@@ -344,11 +344,11 @@ chunk_t x509_build_signature(chunk_t tbs, int algorithm, private_key_t *key,
*/ */
bool verify_x509cert(const x509cert_t *cert, bool strict, time_t *until) bool verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
{ {
int pathlen; int pathlen, pathlen_constraint;
*until = 0; *until = 0;
for (pathlen = 0; pathlen < MAX_CA_PATH_LEN; pathlen++) for (pathlen = -1; pathlen < MAX_CA_PATH_LEN; pathlen++)
{ {
certificate_t *certificate = cert->cert; certificate_t *certificate = cert->cert;
identification_t *subject = certificate->get_subject(certificate); identification_t *subject = certificate->get_subject(certificate);
@@ -407,11 +407,22 @@ bool verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
) )
unlock_authcert_list("verify_x509cert"); unlock_authcert_list("verify_x509cert");
/* check path length constraint */
pathlen_constraint = x509->get_pathLenConstraint(x509);
if (pathlen_constraint != NO_PATH_LEN_CONSTRAINT &&
pathlen > pathlen_constraint)
{
plog("path length of %d violates constraint of %d",
pathlen, pathlen_constraint);
return FALSE;
}
/* check if cert is a self-signed root ca */ /* check if cert is a self-signed root ca */
if (pathlen > 0 && (x509->get_flags(x509) & X509_SELF_SIGNED)) if (pathlen >= 0 && (x509->get_flags(x509) & X509_SELF_SIGNED))
{ {
DBG(DBG_CONTROL, DBG(DBG_CONTROL,
DBG_log("reached self-signed root ca") DBG_log("reached self-signed root ca with a path length of %d",
pathlen)
) )
return TRUE; return TRUE;
} }
@@ -479,7 +490,7 @@ bool verify_x509cert(const x509cert_t *cert, bool strict, time_t *until)
/* go up one step in the trust chain */ /* go up one step in the trust chain */
cert = issuer_cert; cert = issuer_cert;
} }
plog("maximum ca path length of %d levels exceeded", MAX_CA_PATH_LEN); plog("maximum path length of %d exceeded", MAX_CA_PATH_LEN);
return FALSE; return FALSE;
} }
testing/tests/ikev1/multi-level-ca-loop/evaltest.dat
+1 -1
View File
@@ -1,3 +1,3 @@
moon::cat /var/log/auth.log::maximum ca path length of 7 levels exceeded::YES moon::cat /var/log/auth.log::maximum path length of 7 exceeded::YES
carol::ipsec status::alice.*STATE_QUICK_I2.*IPsec SA established::NO carol::ipsec status::alice.*STATE_QUICK_I2.*IPsec SA established::NO
moon::ipsec status::alice.*PH_IP_CAROL.*STATE_QUICK_R2.*IPsec SA established::NO moon::ipsec status::alice.*PH_IP_CAROL.*STATE_QUICK_R2.*IPsec SA established::NO