iterate certinfos linked list for matching serialNumber

diff --git a/src/libstrongswan/crypto/ca.c b/src/libstrongswan/crypto/ca.c
index 1a53021b6b69f9fe8bbaded3d49dc4411c4096af..e35a2044df43caa5ebeb98c42d53ac525ad90961 100644 (file)
--- a/src/libstrongswan/crypto/ca.c
+++ b/src/libstrongswan/crypto/ca.c
@@ -372,8 +372,32 @@ err:
 static cert_status_t verify_by_ocsp(private_ca_info_t* this, const x509_t *cert,
                                                                        certinfo_t *certinfo)
 {
-       /* TODO implement function */
-       return CERT_UNDEFINED;
+       pthread_mutex_lock(&(this->mutex));
+
+       /* do we have a valid certinfo record for this serial number in our cache? */
+       {
+               iterator_t *iterator = this->certinfos->create_iterator(this->certinfos, TRUE);
+               certinfo_t *current_certinfo;
+               bool found = FALSE;
+
+               while(iterator->iterate(iterator, (void**)&current_certinfo))
+               {
+                       if (certinfo->equals_serialNumber(certinfo, current_certinfo))
+                       {
+                               found = TRUE;
+                               DBG2("ocsp status found");
+                               break;
+                       }
+               }
+               iterator->destroy(iterator);
+               if (!found)
+               {
+                       DBG2("ocsp status is not in cache");
+               }
+       }
+       
+       pthread_mutex_unlock(&(this->mutex));
+       return certinfo->get_status(certinfo);
 }
 
 /**

diff --git a/src/libstrongswan/crypto/certinfo.c b/src/libstrongswan/crypto/certinfo.c
index 29f2c5fcc56540a0d721dab36a7b23fbed42a1b4..1ba5bf2f62d79c13c66be9cc264023e8df7595e3 100644 (file)
--- a/src/libstrongswan/crypto/certinfo.c
+++ b/src/libstrongswan/crypto/certinfo.c
@@ -93,6 +93,14 @@ ENUM(crl_reason_names, REASON_UNSPECIFIED, REASON_REMOVE_FROM_CRL,
        "remove from crl",
 );
 
+/**
+ * Implements certinfo_t.equals_serialNumber
+ */
+static bool equals_serialNumber(const private_certinfo_t *this, const private_certinfo_t *that)
+{
+       return chunk_equals(this->serialNumber, that->serialNumber);
+}
+
 /**
  * Implements certinfo_t.get_serialNumber
  */
@@ -189,6 +197,7 @@ certinfo_t *certinfo_create(chunk_t serial)
        this->revocationReason = REASON_UNSPECIFIED;
 
        /* public functions */
+       this->public.equals_serialNumber = (bool (*) (const certinfo_t*,const certinfo_t*))equals_serialNumber;
        this->public.get_serialNumber = (chunk_t (*) (const certinfo_t*))get_serialNumber;
        this->public.set_status = (void (*) (certinfo_t*,cert_status_t))set_status;
        this->public.get_status = (cert_status_t (*) (const certinfo_t*))get_status;

diff --git a/src/libstrongswan/crypto/certinfo.h b/src/libstrongswan/crypto/certinfo.h
index 8d60e3933ddafc7cb5f3c53bd0c554797aeab0d6..3ecaacea0ec7b76e8a1c1599c1f788a32855e023 100644 (file)
--- a/src/libstrongswan/crypto/certinfo.h
+++ b/src/libstrongswan/crypto/certinfo.h
@@ -65,6 +65,16 @@ extern enum_name_t *crl_reason_names;
  */
 struct certinfo_t {
 
+       /**
+        * @brief Check if both certinfo objects have the same serialNumber.
+        * 
+        * @param this                          calling object
+        * @param that                          second certinfo_t object
+        * @return                                      TRUE if the same serialNumber
+        */
+       bool (*equals_serialNumber) (const certinfo_t *this, const certinfo_t *that);
+
+
        /**
         * @brief Get serial number.
         *