sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-08 00:02:03 -04:00
Code Issues Projects Releases Wiki Activity

vici: Support pinning end entity and CA certificates to connections

Browse Source
This commit is contained in:
Martin Willi 2014-02-19 15:45:24 +01:00
parent e6e975ff9d
commit b57739f721
2 changed files with 62 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
src/libcharon/plugins/vici/vici_config.c
View File

@ -961,6 +961,41 @@ CALLBACK(parse_group, bool,
return parse_id(cfg, AUTH_RULE_GROUP, v); return parse_id(cfg, AUTH_RULE_GROUP, v);
} }
/**
* Parse a certificate; add as auth rule to config
*/
static bool parse_cert(auth_cfg_t *cfg, auth_rule_t rule, chunk_t v)
{
certificate_t *cert;
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_BLOB_PEM, v, BUILD_END);
if (cert)
{
cfg->add(cfg, rule, cert);
return TRUE;
}
return FALSE;
}
/**
* Parse subject certificates
*/
CALLBACK(parse_certs, bool,
auth_cfg_t *cfg, chunk_t v)
{
return parse_cert(cfg, AUTH_RULE_SUBJECT_CERT, v);
}
/**
* Parse CA certificates
*/
CALLBACK(parse_cacerts, bool,
auth_cfg_t *cfg, chunk_t v)
{
return parse_cert(cfg, AUTH_RULE_CA_CERT, v);
}
/** /**
* Parse revocation status * Parse revocation status
*/ */
@ -1146,6 +1181,8 @@ CALLBACK(auth_li, bool,
{ {
parse_rule_t rules[] = { parse_rule_t rules[] = {
{ "groups", parse_group, auth->cfg }, { "groups", parse_group, auth->cfg },
{ "certs", parse_certs, auth->cfg },
{ "cacerts", parse_cacerts, auth->cfg },
}; };
return parse_rules(rules, countof(rules), name, value, return parse_rules(rules, countof(rules), name, value,

25
src/libcharon/plugins/vici/vici_query.c
View File

@ -493,6 +493,7 @@ static void build_auth_cfgs(peer_cfg_t *peer_cfg, bool local, vici_builder_t *b)
union { union {
uintptr_t u; uintptr_t u;
identification_t *id; identification_t *id;
certificate_t *cert;
char *str; char *str;
} v; } v;
@ -551,6 +552,30 @@ static void build_auth_cfgs(peer_cfg_t *peer_cfg, bool local, vici_builder_t *b)
rules->destroy(rules); rules->destroy(rules);
b->end_list(b); b->end_list(b);
b->begin_list(b, "certs");
rules = auth->create_enumerator(auth);
while (rules->enumerate(rules, &rule, &v))
{
if (rule == AUTH_RULE_SUBJECT_CERT)
{
b->add_li(b, "%Y", v.cert->get_subject(v.cert));
}
}
rules->destroy(rules);
b->end_list(b);
b->begin_list(b, "cacerts");
rules = auth->create_enumerator(auth);
while (rules->enumerate(rules, &rule, &v))
{
if (rule == AUTH_RULE_CA_CERT)
{
b->add_li(b, "%Y", v.cert->get_subject(v.cert));
}
}
rules->destroy(rules);
b->end_list(b);
b->end_section(b); b->end_section(b);
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);