Always pass auth info to validate(), use pathlen to check for user certificate

diff --git a/src/libstrongswan/credentials/credential_manager.c b/src/libstrongswan/credentials/credential_manager.c
index cc429ce682392f2040fe40f72c164346784262ad..c32eb442222b270e0d81f41851c4c80d6765b2da 100644 (file)
--- a/src/libstrongswan/credentials/credential_manager.c
+++ b/src/libstrongswan/credentials/credential_manager.c
@@ -622,8 +622,7 @@ static bool verify_trust_chain(private_credential_manager_t *this,
                                break;
                        }
                }
-               if (!check_certificate(this, current, issuer, online, pathlen,
-                                                          current == subject ? auth : NULL))
+               if (!check_certificate(this, current, issuer, online, pathlen, auth))
                {
                        trusted = FALSE;
                        issuer->destroy(issuer);

diff --git a/src/libstrongswan/plugins/constraints/constraints_validator.c b/src/libstrongswan/plugins/constraints/constraints_validator.c
index 5c8ea7de2d06eeb2679ebff71cacffd75d82ae9e..36a622d6b053cb84105d99ee99fecd2fd381022a 100644 (file)
--- a/src/libstrongswan/plugins/constraints/constraints_validator.c
+++ b/src/libstrongswan/plugins/constraints/constraints_validator.c
@@ -293,7 +293,8 @@ static bool has_policy(x509_t *issuer, chunk_t oid)
 /**
  * Check certificatePolicies
  */
-static bool check_policy(x509_t *subject, x509_t *issuer, auth_cfg_t *auth)
+static bool check_policy(x509_t *subject, x509_t *issuer, int pathlen,
+                                                auth_cfg_t *auth)
 {
        certificate_t *cert = (certificate_t*)subject;
        x509_policy_mapping_t *mapping;
@@ -329,7 +330,7 @@ static bool check_policy(x509_t *subject, x509_t *issuer, auth_cfg_t *auth)
                        enumerator->destroy(enumerator);
                        return FALSE;
                }
-               if (auth)
+               if (pathlen == 0)
                {
                        oid = asn1_oid_to_string(policy->oid);
                        if (oid)
@@ -358,7 +359,7 @@ METHOD(cert_validator_t, validate, bool,
                {
                        return FALSE;
                }
-               if (!check_policy((x509_t*)subject, (x509_t*)issuer, auth))
+               if (!check_policy((x509_t*)subject, (x509_t*)issuer, pathlen, auth))
                {
                        return FALSE;
                }

diff --git a/src/libstrongswan/plugins/revocation/revocation_validator.c b/src/libstrongswan/plugins/revocation/revocation_validator.c
index c9a60934b042a68d6e4c426f5c7095de5a2237ea..0fe97225ff497264c4813bbf8e888331d7759b9e 100644 (file)
--- a/src/libstrongswan/plugins/revocation/revocation_validator.c
+++ b/src/libstrongswan/plugins/revocation/revocation_validator.c
@@ -576,7 +576,8 @@ METHOD(cert_validator_t, validate, bool,
        {
                DBG1(DBG_CFG, "checking certificate status of \"%Y\"",
                                           subject->get_subject(subject));
-               switch (check_ocsp((x509_t*)subject, (x509_t*)issuer, auth))
+               switch (check_ocsp((x509_t*)subject, (x509_t*)issuer,
+                                                  pathlen ? NULL : auth))
                {
                        case VALIDATION_GOOD:
                                DBG1(DBG_CFG, "certificate status is good");
@@ -594,7 +595,8 @@ METHOD(cert_validator_t, validate, bool,
                                DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
                                break;
                }
-               switch (check_crl((x509_t*)subject, (x509_t*)issuer, auth))
+               switch (check_crl((x509_t*)subject, (x509_t*)issuer,
+                                                 pathlen ? NULL : auth))
                {
                        case VALIDATION_GOOD:
                                DBG1(DBG_CFG, "certificate status is good");