denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add an option to disable libstrongswan certificate caching

Browse Source
This commit is contained in:
Martin Willi
2012-07-09 19:03:10 +02:00
parent ee7b7de18f
commit dfd34c5a77
1 changed files with 29 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/credential_manager.c
+29 -18
View File
@@ -450,6 +450,17 @@ METHOD(credential_manager_t, remove_local_set, void,
} }
} }
METHOD(credential_manager_t, issued_by, bool,
private_credential_manager_t *this, certificate_t *subject,
certificate_t *issuer, signature_scheme_t *scheme)
{
if (this->cache)
{
return this->cache->issued_by(this->cache, subject, issuer, scheme);
}
return subject->issued_by(subject, issuer, scheme);
}
METHOD(credential_manager_t, cache_cert, void, METHOD(credential_manager_t, cache_cert, void,
private_credential_manager_t *this, certificate_t *cert) private_credential_manager_t *this, certificate_t *cert)
{ {
@@ -579,7 +590,7 @@ static certificate_t *get_issuer_cert(private_credential_manager_t *this,
subject->get_issuer(subject), trusted); subject->get_issuer(subject), trusted);
while (enumerator->enumerate(enumerator, &candidate)) while (enumerator->enumerate(enumerator, &candidate))
{ {
if (this->cache->issued_by(this->cache, subject, candidate, scheme)) if (issued_by(this, subject, candidate, scheme))
{ {
issuer = candidate->get_ref(candidate); issuer = candidate->get_ref(candidate);
break; break;
@@ -643,7 +654,7 @@ static bool verify_trust_chain(private_credential_manager_t *this,
if (issuer) if (issuer)
{ {
/* accept only self-signed CAs as trust anchor */ /* accept only self-signed CAs as trust anchor */
if (this->cache->issued_by(this->cache, issuer, issuer, NULL)) if (issued_by(this, issuer, issuer, NULL))
{ {
auth->add(auth, AUTH_RULE_CA_CERT, issuer->get_ref(issuer)); auth->add(auth, AUTH_RULE_CA_CERT, issuer->get_ref(issuer));
DBG1(DBG_CFG, " using trusted ca certificate \"%Y\"", DBG1(DBG_CFG, " using trusted ca certificate \"%Y\"",
@@ -767,8 +778,7 @@ METHOD(enumerator_t, trusted_enumerate, bool,
/* if we find a trusted self signed certificate, we just accept it. /* if we find a trusted self signed certificate, we just accept it.
* However, in order to fulfill authorization rules, we try to build * However, in order to fulfill authorization rules, we try to build
* the trust chain if it is not self signed */ * the trust chain if it is not self signed */
if (this->this->cache->issued_by(this->this->cache, if (issued_by(this->this, this->pretrusted, this->pretrusted, NULL) ||
this->pretrusted, this->pretrusted, NULL) ||
verify_trust_chain(this->this, this->pretrusted, this->auth, verify_trust_chain(this->this, this->pretrusted, this->auth,
TRUE, this->online)) TRUE, this->online))
{ {
@@ -975,8 +985,7 @@ static auth_cfg_t *build_trustchain(private_credential_manager_t *this,
} }
else else
{ {
if (!has_anchor && if (!has_anchor && issued_by(this, current, current, NULL))
this->cache->issued_by(this->cache, current, current, NULL))
{ /* If no trust anchor specified, accept any CA */ { /* If no trust anchor specified, accept any CA */
trustchain->add(trustchain, AUTH_RULE_CA_CERT, current); trustchain->add(trustchain, AUTH_RULE_CA_CERT, current);
return trustchain; return trustchain;
@@ -1115,14 +1124,10 @@ METHOD(credential_manager_t, get_private, private_key_t*,
METHOD(credential_manager_t, flush_cache, void, METHOD(credential_manager_t, flush_cache, void,
private_credential_manager_t *this, certificate_type_t type) private_credential_manager_t *this, certificate_type_t type)
{ {
this->cache->flush(this->cache, type); if (this->cache)
} {
this->cache->flush(this->cache, type);
METHOD(credential_manager_t, issued_by, bool, }
private_credential_manager_t *this, certificate_t *subject,
certificate_t *issuer, signature_scheme_t *scheme)
{
return this->cache->issued_by(this->cache, subject, issuer, scheme);
} }
METHOD(credential_manager_t, add_set, void, METHOD(credential_manager_t, add_set, void,
@@ -1162,11 +1167,14 @@ METHOD(credential_manager_t, destroy, void,
{ {
cache_queue(this); cache_queue(this);
this->cache_queue->destroy(this->cache_queue); this->cache_queue->destroy(this->cache_queue);
this->sets->remove(this->sets, this->cache, NULL); if (this->cache)
{
this->sets->remove(this->sets, this->cache, NULL);
this->cache->destroy(this->cache);
}
this->sets->destroy(this->sets); this->sets->destroy(this->sets);
this->local_sets->destroy(this->local_sets); this->local_sets->destroy(this->local_sets);
this->exclusive_local_sets->destroy(this->exclusive_local_sets); this->exclusive_local_sets->destroy(this->exclusive_local_sets);
this->cache->destroy(this->cache);
this->validators->destroy(this->validators); this->validators->destroy(this->validators);
this->lock->destroy(this->lock); this->lock->destroy(this->lock);
this->queue_mutex->destroy(this->queue_mutex); this->queue_mutex->destroy(this->queue_mutex);
@@ -1203,7 +1211,6 @@ credential_manager_t *credential_manager_create()
}, },
.sets = linked_list_create(), .sets = linked_list_create(),
.validators = linked_list_create(), .validators = linked_list_create(),
.cache = cert_cache_create(),
.cache_queue = linked_list_create(), .cache_queue = linked_list_create(),
.lock = rwlock_create(RWLOCK_TYPE_DEFAULT), .lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
.queue_mutex = mutex_create(MUTEX_TYPE_DEFAULT), .queue_mutex = mutex_create(MUTEX_TYPE_DEFAULT),
@@ -1211,7 +1218,11 @@ credential_manager_t *credential_manager_create()
this->local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy); this->local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy);
this->exclusive_local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy); this->exclusive_local_sets = thread_value_create((thread_cleanup_t)this->sets->destroy);
this->sets->insert_first(this->sets, this->cache); if (lib->settings->get_bool(lib->settings, "libstrongswan.cert_cache", TRUE))
{
this->cache = cert_cache_create();
this->sets->insert_first(this->sets, this->cache);
}
return &this->public; return &this->public;
} }