denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x509: Make length of nonces in OCSP requests configurable

Browse Source 
Some servers might not support a length of 32 and return a malformed
request error. Lowering the value to the previous default of 16 could
help in that case.
This commit is contained in:
Tobias Brunner
2023-11-24 17:41:18 +01:00
parent 945be4ece5
commit f3af1704d9
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/x509/x509_ocsp_request.c
+5 -1
View File
@@ -205,9 +205,13 @@ static chunk_t build_requestList(private_x509_ocsp_request_t *this)
static chunk_t build_nonce(private_x509_ocsp_request_t *this)
{
rng_t *rng;
int nonce_len;
nonce_len = lib->settings->get_int(lib->settings, "%s.ocsp_nonce_len",
NONCE_LEN, lib->ns);
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng || !rng->allocate_bytes(rng, NONCE_LEN, &this->nonce))
if (!rng || !rng->allocate_bytes(rng, max(1, nonce_len), &this->nonce))
{
DBG1(DBG_LIB, "failed to create RNG");
DESTROY_IF(rng);