credential-manager: Make online revocation checks optional for public key enumerator

diff --git a/src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.c b/src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.c
index 793e6d5c1e58e428379b403f461620ec8a276f55..eee7dd10bcbac02d05df0200c392a9cc2ba4c9ac 100644 (file)
--- a/src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.c
+++ b/src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.c
@@ -173,7 +173,7 @@ METHOD(authenticator_t, process, status_t,
        sig = sig_payload->get_hash(sig_payload);
        auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
        enumerator = lib->credmgr->create_public_enumerator(lib->credmgr, this->type,
-                                                                                                               id, auth);
+                                                                                                               id, auth, TRUE);
        while (enumerator->enumerate(enumerator, &public, &current_auth))
        {
                if (public->verify(public, scheme, hash, sig))

diff --git a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
index 110c50973482da7b7ac26e6ecaef5a7853530b90..dca80a4d80c115fc5340d7054d6078ebcfdffe41 100644 (file)
--- a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+++ b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
@@ -409,7 +409,7 @@ METHOD(authenticator_t, process, status_t,
        }
        auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
        enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
-                                                                                                               key_type, id, auth);
+                                                                                                       key_type, id, auth, TRUE);
        while (enumerator->enumerate(enumerator, &public, &current_auth))
        {
                if (public->verify(public, scheme, octets, auth_data))

diff --git a/src/libstrongswan/credentials/credential_manager.c b/src/libstrongswan/credentials/credential_manager.c
index 371e6404d1e23dc690b6800c5cbe8cde3a5fb603..736111b935afaf1c44bfb5fe652a0c93f5cb92bd 100644 (file)
--- a/src/libstrongswan/credentials/credential_manager.c
+++ b/src/libstrongswan/credentials/credential_manager.c
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2015 Tobias Brunner
  * Copyright (C) 2007 Martin Willi
  * Hochschule fuer Technik Rapperswil
  *
@@ -993,7 +994,7 @@ METHOD(enumerator_t, public_destroy, void,
 
 METHOD(credential_manager_t, create_public_enumerator, enumerator_t*,
        private_credential_manager_t *this, key_type_t type, identification_t *id,
-       auth_cfg_t *auth)
+       auth_cfg_t *auth, bool online)
 {
        public_enumerator_t *enumerator;
 
@@ -1002,7 +1003,7 @@ METHOD(credential_manager_t, create_public_enumerator, enumerator_t*,
                        .enumerate = (void*)_public_enumerate,
                        .destroy = _public_destroy,
                },
-               .inner = create_trusted_enumerator(this, type, id, TRUE),
+               .inner = create_trusted_enumerator(this, type, id, online),
                .this = this,
        );
        if (auth)

diff --git a/src/libstrongswan/credentials/credential_manager.h b/src/libstrongswan/credentials/credential_manager.h
index 445ea3f9c97bb2a4ae58e7f5906e2a9b23e70993..022ca566c42386c9542715805f4972f0b4ef5d0e 100644 (file)
--- a/src/libstrongswan/credentials/credential_manager.h
+++ b/src/libstrongswan/credentials/credential_manager.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2015 Tobias Brunner
  * Copyright (C) 2007-2009 Martin Willi
  * Hochschule fuer Technik Rapperswil
  *
@@ -202,14 +203,18 @@ struct credential_manager_t {
         * where the auth config helper contains rules for constraint checks.
         * This function is very similar to create_trusted_enumerator(), but
         * gets public keys directly.
+        * If online is set, revocations are checked online for the whole
+        * trustchain.
         *
         * @param type          type of the key to get
         * @param id            owner of the key, signer of the signature
         * @param auth          authentication infos
+        * @param online        whether revocations should be checked online
         * @return                      enumerator
         */
        enumerator_t* (*create_public_enumerator)(credential_manager_t *this,
-                                       key_type_t type, identification_t *id, auth_cfg_t *auth);
+                                       key_type_t type, identification_t *id, auth_cfg_t *auth,
+                                       bool online);
 
        /**
         * Cache a certificate by invoking cache_cert() on all registered sets.

diff --git a/src/libtls/tls_peer.c b/src/libtls/tls_peer.c
index 000dda43bd47e8ea33872892c337179909c4e4f7..8087e2e2de48501a90f5c4359145c2e9d2f593db 100644 (file)
--- a/src/libtls/tls_peer.c
+++ b/src/libtls/tls_peer.c
@@ -320,7 +320,8 @@ static public_key_t *find_public_key(private_tls_peer_t *this)
        if (cert)
        {
                enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
-                                               KEY_ANY, cert->get_subject(cert), this->server_auth);
+                                                                                       KEY_ANY, cert->get_subject(cert),
+                                                                                       this->server_auth, TRUE);
                while (enumerator->enumerate(enumerator, &current, &auth))
                {
                        found = auth->get(auth, AUTH_RULE_SUBJECT_CERT);

diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c
index f9295a1605a9ce828dfe6394f30eda031c12c1a8..cfbe0203791a9c961dd6544656cc57fc71f5c398 100644 (file)
--- a/src/libtls/tls_server.c
+++ b/src/libtls/tls_server.c
@@ -548,7 +548,7 @@ static status_t process_cert_verify(private_tls_server_t *this,
        bio_reader_t *sig;
 
        enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
-                                                                               KEY_ANY, this->peer, this->peer_auth);
+                                                                       KEY_ANY, this->peer, this->peer_auth, TRUE);
        while (enumerator->enumerate(enumerator, &public, &auth))
        {
                sig = bio_reader_create(reader->peek(reader));