denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

detect trusted self-signed before trust chain verification

Browse Source
This commit is contained in:
Andreas Steffen
2008-03-21 19:10:55 +00:00
parent ffce5db1b7
commit 02fd225ea5
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/credentials/credential_manager.c
+14 -4
View File
@@ -993,11 +993,21 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
subject = get_pretrusted_cert(this, type, id);
if (subject)
{
/* if we find a trusted certificate, we accept it. However, to fulfill
* authorization rules, we try to build the trust chain anyway. */
if (subject->issued_by(subject, subject, TRUE))
{
DBG1(DBG_CFG, " using trusted self-signed certificate \"%D\"",
subject->get_subject(subject));
return subject;
}
/* if we find a trusted certificate, we accept it. However, in order
* to fulfill authorization rules, we try to build the trust chain
* anyway.
*/
if (verify_trust_chain(this, subject, auth, TRUE, crl, ocsp))
{
DBG1(DBG_CFG, " using pre-trusted certificate \"%D\"",
DBG1(DBG_CFG, " using trusted certificate \"%D\"",
subject->get_subject(subject));
return subject;
}
@@ -1005,7 +1015,7 @@ static certificate_t *get_trusted_cert(private_credential_manager_t *this,
}
subject = NULL;
/* try to verify the trustchain for each certificate found */
/* try to verify the trust chain for each certificate found */
enumerator = create_cert_enumerator(this, CERT_ANY, type, id, FALSE);
while (enumerator->enumerate(enumerator, &current))
{