diff options
| author | Martin Willi <martin@revosec.ch> | 2010-08-16 09:19:29 +0200 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2010-08-16 09:20:19 +0200 |
| commit | 714d0bfd378b6a9f0544dda011855846d0ba8379 (patch) | |
| tree | c7988c702262614e11497701b29a69ab155ff4f8 /src/libtls/tls_server.c | |
| parent | b51ac45c484b4fb08153fe2075b8899d48d36862 (diff) | |
| download | strongswan-714d0bfd378b6a9f0544dda011855846d0ba8379.tar.bz2 strongswan-714d0bfd378b6a9f0544dda011855846d0ba8379.tar.xz | |
Only include certificates with CA flag in TLS cert request
Diffstat (limited to 'src/libtls/tls_server.c')
| -rw-r--r-- | src/libtls/tls_server.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c index 2b2845ea1..faaecb5a0 100644 --- a/src/libtls/tls_server.c +++ b/src/libtls/tls_server.c @@ -18,6 +18,7 @@ #include <time.h> #include <debug.h> +#include <credentials/certificates/x509.h> typedef struct private_tls_server_t private_tls_server_t; @@ -489,6 +490,7 @@ static status_t send_certificate_request(private_tls_server_t *this, tls_writer_t *authorities; enumerator_t *enumerator; certificate_t *cert; + x509_t *x509; identification_t *id; /* currently only RSA signatures are supported */ @@ -504,8 +506,12 @@ static status_t send_certificate_request(private_tls_server_t *this, CERT_X509, KEY_RSA, NULL, TRUE); while (enumerator->enumerate(enumerator, &cert)) { - id = cert->get_subject(cert); - authorities->write_data16(authorities, id->get_encoding(id)); + x509 = (x509_t*)cert; + if (x509->get_flags(x509) & X509_CA) + { + id = cert->get_subject(cert); + authorities->write_data16(authorities, id->get_encoding(id)); + } } enumerator->destroy(enumerator); writer->write_data16(writer, authorities->get_buf(authorities)); |