Avoid enumerating certificates with non-matching key type

If the key type was specified but the ID was NULL or matched a subject, it
was possible that a certificate was returned that didn't actually match
the requested key type.

Closes strongswan/strongswan#141.

diff --git a/src/libcharon/plugins/stroke/stroke_ca.c b/src/libcharon/plugins/stroke/stroke_ca.c
index 0432ee573e2584ebd879efd57dd897b0ebe1b5c2..2c0df8fb2b55fb1d3bfbff72be04dccba9a1b2d6 100644 (file)
--- a/src/libcharon/plugins/stroke/stroke_ca.c
+++ b/src/libcharon/plugins/stroke/stroke_ca.c
@@ -208,6 +208,11 @@ CALLBACK(certs_filter, bool,
                                        return TRUE;
                                }
                        }
+                       else
+                       {
+                               public->destroy(public);
+                               continue;
+                       }
                        public->destroy(public);
                }
                else if (data->key != KEY_ANY)

diff --git a/src/libstrongswan/credentials/sets/mem_cred.c b/src/libstrongswan/credentials/sets/mem_cred.c
index b0f77be984797dec8fb97bf1b1cd113bcabf4bcd..86b232a3ed62794cf648595729781dc5e0812eb5 100644 (file)
--- a/src/libstrongswan/credentials/sets/mem_cred.c
+++ b/src/libstrongswan/credentials/sets/mem_cred.c
@@ -108,6 +108,11 @@ CALLBACK(certs_filter, bool,
                                        return TRUE;
                                }
                        }
+                       else
+                       {
+                               public->destroy(public);
+                               continue;
+                       }
                        public->destroy(public);
                }
                else if (data->key != KEY_ANY)