denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make AUTH_RULE_SUBJECT cert multi-valued

Browse Source 
Constraints having multiple subject certs defined are fulfilled if
authentication used one of the listed certificates.
This commit is contained in:
Martin Willi
2013-01-18 09:33:15 +01:00
parent d82372fab8
commit f29783af8c
1 changed files with 24 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/auth_cfg.c
+24 -11
View File
@@ -76,7 +76,6 @@ static inline bool is_multi_value_rule(auth_rule_t type)
case AUTH_RULE_AAA_IDENTITY: case AUTH_RULE_AAA_IDENTITY:
case AUTH_RULE_XAUTH_IDENTITY: case AUTH_RULE_XAUTH_IDENTITY:
case AUTH_RULE_XAUTH_BACKEND: case AUTH_RULE_XAUTH_BACKEND:
case AUTH_RULE_SUBJECT_CERT:
case AUTH_HELPER_SUBJECT_CERT: case AUTH_HELPER_SUBJECT_CERT:
case AUTH_HELPER_SUBJECT_HASH_URL: case AUTH_HELPER_SUBJECT_HASH_URL:
case AUTH_RULE_MAX: case AUTH_RULE_MAX:
@@ -84,6 +83,7 @@ static inline bool is_multi_value_rule(auth_rule_t type)
case AUTH_RULE_OCSP_VALIDATION: case AUTH_RULE_OCSP_VALIDATION:
case AUTH_RULE_CRL_VALIDATION: case AUTH_RULE_CRL_VALIDATION:
case AUTH_RULE_GROUP: case AUTH_RULE_GROUP:
case AUTH_RULE_SUBJECT_CERT:
case AUTH_RULE_CA_CERT: case AUTH_RULE_CA_CERT:
case AUTH_RULE_IM_CERT: case AUTH_RULE_IM_CERT:
case AUTH_RULE_CERT_POLICY: case AUTH_RULE_CERT_POLICY:
@@ -503,8 +503,9 @@ METHOD(auth_cfg_t, complies, bool,
private_auth_cfg_t *this, auth_cfg_t *constraints, bool log_error) private_auth_cfg_t *this, auth_cfg_t *constraints, bool log_error)
{ {
enumerator_t *e1, *e2; enumerator_t *e1, *e2;
bool success = TRUE, group_match = FALSE; bool success = TRUE, group_match = FALSE, cert_match = FALSE;
identification_t *require_group = NULL; identification_t *require_group = NULL;
certificate_t *require_cert = NULL;
signature_scheme_t scheme = SIGN_UNKNOWN; signature_scheme_t scheme = SIGN_UNKNOWN;
u_int strength = 0; u_int strength = 0;
auth_rule_t t1, t2; auth_rule_t t1, t2;
@@ -542,20 +543,21 @@ METHOD(auth_cfg_t, complies, bool,
} }
case AUTH_RULE_SUBJECT_CERT: case AUTH_RULE_SUBJECT_CERT:
{ {
certificate_t *c1, *c2; certificate_t *cert;
c1 = (certificate_t*)value; /* for certs, a match of a single cert is sufficient */
c2 = get(this, AUTH_RULE_SUBJECT_CERT); require_cert = (certificate_t*)value;
if (!c2 || !c1->equals(c1, c2))
e2 = create_enumerator(this);
while (e2->enumerate(e2, &t2, &cert))
{ {
success = FALSE; if (t2 == AUTH_RULE_SUBJECT_CERT &&
if (log_error) cert->equals(cert, require_cert))
{ {
DBG1(DBG_CFG, "constraint check failed: peer not " cert_match = TRUE;
"authenticated with peer cert '%Y'.",
c1->get_subject(c1));
} }
} }
e2->destroy(e2);
break; break;
} }
case AUTH_RULE_CRL_VALIDATION: case AUTH_RULE_CRL_VALIDATION:
@@ -828,6 +830,17 @@ METHOD(auth_cfg_t, complies, bool,
} }
return FALSE; return FALSE;
} }
if (require_cert && !cert_match)
{
if (log_error)
{
DBG1(DBG_CFG, "constraint check failed: peer not "
"authenticated with peer cert '%Y'.",
require_cert->get_subject(require_cert));
}
return FALSE;
}
return success; return success;
} }