denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'multi-cert'

Browse Source 
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
This commit is contained in:
Martin Willi
2013-03-01 11:35:32 +01:00
parent adf239abca 51dbcf6497
commit e82deaf6ce
4 changed files with 113 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_config.c
+32 -15
View File
@@ -448,25 +448,42 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
identity = identification_create_from_string(id);
if (cert)
{
certificate = this->cred->load_peer(this->cred, cert);
if (certificate)
enumerator_t *enumerator;
bool has_subject = FALSE;
certificate_t *first = NULL;
enumerator = enumerator_create_token(cert, ",", " ");
while (enumerator->enumerate(enumerator, &cert))
{
if (local)
certificate = this->cred->load_peer(this->cred, cert);
if (certificate)
{
this->ca->check_for_hash_and_url(this->ca, certificate);
}
cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
if (identity->get_type(identity) == ID_ANY ||
!certificate->has_subject(certificate, identity))
{
DBG1(DBG_CFG, " id '%Y' not confirmed by certificate, "
"defaulting to '%Y'", identity,
certificate->get_subject(certificate));
identity->destroy(identity);
identity = certificate->get_subject(certificate);
identity = identity->clone(identity);
if (local)
{
this->ca->check_for_hash_and_url(this->ca, certificate);
}
cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
if (!first)
{
first = certificate;
}
if (identity->get_type(identity) != ID_ANY &&
certificate->has_subject(certificate, identity))
{
has_subject = TRUE;
}
}
}
enumerator->destroy(enumerator);
if (first && !has_subject)
{
DBG1(DBG_CFG, " id '%Y' not confirmed by certificate, "
"defaulting to '%Y'", identity, first->get_subject(first));
identity->destroy(identity);
identity = first->get_subject(first);
identity = identity->clone(identity);
}
}
if (identity->get_type(identity) != ID_ANY)
{