diff options
| author | Andreas Steffen <andreas.steffen@strongswan.org> | 2013-08-12 11:53:46 +0200 |
|---|---|---|
| committer | Andreas Steffen <andreas.steffen@strongswan.org> | 2013-08-15 23:34:23 +0200 |
| commit | 0a09b02dcf6d08f652fc0ec7410f84f77338cfe0 (patch) | |
| tree | 1711d3e74b23a51335829f9cbeb7f18a84390710 /src | |
| parent | 9cc606d22a479c0ee055cb848b762e3604b497bc (diff) | |
| download | strongswan-0a09b02dcf6d08f652fc0ec7410f84f77338cfe0.tar.bz2 strongswan-0a09b02dcf6d08f652fc0ec7410f84f77338cfe0.tar.xz | |
Set client identity with TLS certificate authentication
Diffstat (limited to 'src')
| -rw-r--r-- | src/libpttls/pt_tls_server.c | 25 |
1 files changed, 18 insertions, 7 deletions
diff --git a/src/libpttls/pt_tls_server.c b/src/libpttls/pt_tls_server.c index 78937b18c..32b50739e 100644 --- a/src/libpttls/pt_tls_server.c +++ b/src/libpttls/pt_tls_server.c @@ -321,34 +321,45 @@ static status_t read_sasl_mech_selection(private_pt_tls_server_t *this, static bool do_sasl(private_pt_tls_server_t *this) { sasl_mechanism_t *sasl; + identification_t *client_id; + tnccs_t *tnccs; status_t status; + client_id = this->tls->get_peer_id(this->tls); + tnccs = (tnccs_t*)this->tnccs; + switch (this->auth) { case PT_TLS_AUTH_NONE: return TRUE; case PT_TLS_AUTH_TLS: - if (this->tls->get_peer_id(this->tls)) + if (client_id) { + this->tnccs->set_peer_id(this->tnccs, client_id); + tnccs->set_auth_type(tnccs, TNC_AUTH_X509_CERT); return TRUE; } - DBG1(DBG_TNC, "requiring TLS certificate client authentication"); + DBG1(DBG_TNC, "requiring TLS certificate-based " + "client authentication"); return FALSE; case PT_TLS_AUTH_SASL: break; case PT_TLS_AUTH_TLS_OR_SASL: - if (this->tls->get_peer_id(this->tls)) + if (client_id) { - DBG1(DBG_TNC, "skipping SASL, client authenticated with TLS " - "certificate"); + this->tnccs->set_peer_id(this->tnccs, client_id); + tnccs->set_auth_type(tnccs, TNC_AUTH_X509_CERT); + DBG1(DBG_TNC, "skipping SASL, client already authenticated by " + "TLS certificate"); return TRUE; } break; case PT_TLS_AUTH_TLS_AND_SASL: default: - if (!this->tls->get_peer_id(this->tls)) + if (!client_id) { - DBG1(DBG_TNC, "requiring TLS certificate client authentication"); + DBG1(DBG_TNC, "requiring TLS certificate-based " + "client authentication"); return FALSE; } break; |