From: Tobias Brunner <tobias@strongswan.org>
Date: Mon, 1 Apr 2013 11:46:23 +0000 (+0200)
Subject: Load raw keys before possibly destroying the identity
X-Git-Tag: 5.0.3~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eca499f3d9431a14d0aabe02288246318e23ec98;p=thirdparty%2Fstrongswan.git

Load raw keys before possibly destroying the identity

If no identity (or %any) is configured the identification_t object is
destroyed and an invalid object was associated with the created pubkey
certificate.
Actually using %any does not work as the certificate would not match
when the client later provides an identity.
---

diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index 5970e7cf36..86f0fe431a 100644
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -485,6 +485,17 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 			identity = identity->clone(identity);
 		}
 	}
+	/* add raw RSA public key */
+	pubkey = end->rsakey;
+	if (pubkey && !streq(pubkey, "") && !streq(pubkey, "%cert"))
+	{
+		certificate = this->cred->load_pubkey(this->cred, KEY_RSA, pubkey,
+											  identity);
+		if (certificate)
+		{
+			cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
+		}
+	}
 	if (identity->get_type(identity) != ID_ANY)
 	{
 		cfg->add(cfg, AUTH_RULE_IDENTITY, identity);
@@ -498,18 +509,6 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 		identity->destroy(identity);
 	}
 
-	/* add raw RSA public key */
-	pubkey = end->rsakey;
-	if (pubkey && !streq(pubkey, "") && !streq(pubkey, "%cert"))
-	{
-		certificate = this->cred->load_pubkey(this->cred, KEY_RSA, pubkey,
-											  identity);
-		if (certificate)
-		{
-			cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
-		}
-	}
-
 	/* CA constraint */
 	if (ca)
 	{