denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

allow retrieval of private keys from other credential sets

Browse Source
This commit is contained in:
Andreas Steffen
2013-04-02 08:55:40 +02:00
parent c2c4125cde
commit d4a1ae3af1
2 changed files with 26 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/tnc_ifmap/tnc_ifmap_plugin.c
+1
View File
@@ -76,6 +76,7 @@ METHOD(plugin_t, get_features, int,
PLUGIN_PROVIDE(CUSTOM, "tnc-ifmap-2.1"), PLUGIN_PROVIDE(CUSTOM, "tnc-ifmap-2.1"),
PLUGIN_SDEPEND(CERT_DECODE, CERT_X509), PLUGIN_SDEPEND(CERT_DECODE, CERT_X509),
PLUGIN_SDEPEND(PRIVKEY, KEY_RSA), PLUGIN_SDEPEND(PRIVKEY, KEY_RSA),
PLUGIN_SDEPEND(CUSTOM, "stroke"),
}; };
*features = f; *features = f;
return countof(f); return countof(f);
src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c
+25 -9
View File
@@ -626,6 +626,7 @@ static bool soap_init(private_tnc_ifmap_soap_t *this)
char *server_uri, *server_str, *port_str, *uri_str; char *server_uri, *server_str, *port_str, *uri_str;
char *server_cert, *client_cert, *client_key, *user_pass; char *server_cert, *client_cert, *client_key, *user_pass;
int port; int port;
auth_cfg_t *auth;
certificate_t *cert; certificate_t *cert;
private_key_t *key; private_key_t *key;
identification_t *server_id, *client_id = NULL; identification_t *server_id, *client_id = NULL;
@@ -661,9 +662,9 @@ static bool soap_init(private_tnc_ifmap_soap_t *this)
this->creds->add_cert(this->creds, TRUE, cert); this->creds->add_cert(this->creds, TRUE, cert);
/* check availability of client credentials */ /* check availability of client credentials */
if (!((client_cert && client_key) || user_pass)) if (!client_cert && !user_pass)
{ {
DBG1(DBG_TNC, "neither MAP client certificate and private key " DBG1(DBG_TNC, "neither MAP client certificate "
"nor username:password defined"); "nor username:password defined");
return FALSE; return FALSE;
} }
@@ -683,19 +684,34 @@ static bool soap_init(private_tnc_ifmap_soap_t *this)
this->creds->add_cert(this->creds, TRUE, cert); this->creds->add_cert(this->creds, TRUE, cert);
/* load MAP client private key */ /* load MAP client private key */
key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA, if (client_key)
BUILD_FROM_FILE, client_key, BUILD_END);
if (!key)
{ {
DBG1(DBG_TNC, "loading MAP client private key from '%s' failed", key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
BUILD_FROM_FILE, client_key, BUILD_END);
if (!key)
{
DBG1(DBG_TNC, "loading MAP client private key from '%s' failed",
client_key);
return FALSE;
}
DBG1(DBG_TNC, "loaded MAP client RSA private key from '%s'",
client_key); client_key);
return FALSE; this->creds->add_key(this->creds, key);
} }
DBG1(DBG_TNC, "loaded MAP client RSA private key from '%s'", client_key);
this->creds->add_key(this->creds, key);
/* set client ID to certificate distinguished name */ /* set client ID to certificate distinguished name */
client_id = cert->get_subject(cert); client_id = cert->get_subject(cert);
/* check if we have a private key matching the certificate */
auth = auth_cfg_create();
auth->add(auth, AUTH_RULE_SUBJECT_CERT, cert);
key = lib->credmgr->get_private(lib->credmgr, KEY_RSA, client_id, auth);
auth->destroy(auth);
if (!key)
{
DBG1(DBG_TNC, "no RSA private key matching MAP client certificate");
return FALSE;
}
} }
else else
{ {