denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revocation: OCSP and/or CRL fetching can be disabled

Browse Source
This commit is contained in:
Andreas Steffen
2016-12-30 18:12:53 +01:00
parent 08253bbba3
commit e3f63c6469
3 changed files with 79 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/Makefile.am
+1
View File
@@ -80,6 +80,7 @@ plugins = \
plugins/radattr.opt \ plugins/radattr.opt \
plugins/random.opt \ plugins/random.opt \
plugins/resolve.opt \ plugins/resolve.opt \
plugins/revocation.opt \
plugins/socket-default.opt \ plugins/socket-default.opt \
plugins/sql.opt \ plugins/sql.opt \
plugins/stroke.opt \ plugins/stroke.opt \
conf/plugins/revocation.opt
+7
View File
@@ -0,0 +1,7 @@
charon.plugins.revocation.enable_ocsp = yes
Whether OCSP fetching should be enabled.
charon.plugins.revocation.enable_crl = yes
Whether CRL fetching should be enabled.
src/libstrongswan/plugins/revocation/revocation_validator.c
+71 -38
View File
@@ -36,6 +36,17 @@ struct private_revocation_validator_t {
* Public revocation_validator_t interface. * Public revocation_validator_t interface.
*/ */
revocation_validator_t public; revocation_validator_t public;
/**
* Enable OCSP fetching
*/
bool enable_ocsp;
/**
* Enable CRL fetching
*/
bool enable_crl;
}; };
/** /**
@@ -738,48 +749,57 @@ METHOD(cert_validator_t, validate, bool,
{ {
DBG1(DBG_CFG, "checking certificate status of \"%Y\"", DBG1(DBG_CFG, "checking certificate status of \"%Y\"",
subject->get_subject(subject)); subject->get_subject(subject));
switch (check_ocsp((x509_t*)subject, (x509_t*)issuer,
pathlen ? NULL : auth)) if (this->enable_ocsp)
{ {
case VALIDATION_GOOD: switch (check_ocsp((x509_t*)subject, (x509_t*)issuer,
DBG1(DBG_CFG, "certificate status is good"); pathlen ? NULL : auth))
return TRUE; {
case VALIDATION_REVOKED: case VALIDATION_GOOD:
case VALIDATION_ON_HOLD: DBG1(DBG_CFG, "certificate status is good");
/* has already been logged */ return TRUE;
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED, case VALIDATION_REVOKED:
subject); case VALIDATION_ON_HOLD:
return FALSE; /* has already been logged */
case VALIDATION_SKIPPED: lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
DBG2(DBG_CFG, "ocsp check skipped, no ocsp found"); subject);
break; return FALSE;
case VALIDATION_STALE: case VALIDATION_SKIPPED:
DBG1(DBG_CFG, "ocsp information stale, fallback to crl"); DBG2(DBG_CFG, "ocsp check skipped, no ocsp found");
break; break;
case VALIDATION_FAILED: case VALIDATION_STALE:
DBG1(DBG_CFG, "ocsp check failed, fallback to crl"); DBG1(DBG_CFG, "ocsp information stale, fallback to crl");
break; break;
case VALIDATION_FAILED:
DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
break;
}
} }
switch (check_crl((x509_t*)subject, (x509_t*)issuer,
pathlen ? NULL : auth)) if (this->enable_crl)
{ {
case VALIDATION_GOOD: switch (check_crl((x509_t*)subject, (x509_t*)issuer,
DBG1(DBG_CFG, "certificate status is good"); pathlen ? NULL : auth))
return TRUE; {
case VALIDATION_REVOKED: case VALIDATION_GOOD:
case VALIDATION_ON_HOLD: DBG1(DBG_CFG, "certificate status is good");
/* has already been logged */ return TRUE;
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED, case VALIDATION_REVOKED:
subject); case VALIDATION_ON_HOLD:
return FALSE; /* has already been logged */
case VALIDATION_FAILED: lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_REVOKED,
case VALIDATION_SKIPPED: subject);
DBG1(DBG_CFG, "certificate status is not available"); return FALSE;
break; case VALIDATION_FAILED:
case VALIDATION_STALE: case VALIDATION_SKIPPED:
DBG1(DBG_CFG, "certificate status is unknown, crl is stale"); DBG1(DBG_CFG, "certificate status is not available");
break; break;
case VALIDATION_STALE:
DBG1(DBG_CFG, "certificate status is unknown, crl is stale");
break;
}
} }
lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_VALIDATION_FAILED, lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_VALIDATION_FAILED,
subject); subject);
} }
@@ -804,7 +824,20 @@ revocation_validator_t *revocation_validator_create()
.validator.validate = _validate, .validator.validate = _validate,
.destroy = _destroy, .destroy = _destroy,
}, },
.enable_ocsp = lib->settings->get_bool(lib->settings,
"%s.plugins.revocation.enable_ocsp", TRUE, lib->ns),
.enable_crl = lib->settings->get_bool(lib->settings,
"%s.plugins.revocation.enable_crl", TRUE, lib->ns),
); );
if (!this->enable_ocsp)
{
DBG1(DBG_LIB, "all OCSP fetching disabled");
}
if (!this->enable_crl)
{
DBG1(DBG_LIB, "all CRL fetching disabled");
}
return &this->public; return &this->public;
} }