diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2015-10-27 17:28:20 +0100 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2016-03-10 11:07:14 +0100 |
| commit | a05cff1ec0c7473bee147a5213de9dd0317cb5ec (patch) | |
| tree | 66330e03e672bc52d2fa0176ba9741113f76c15e /src | |
| parent | e19162a50964f394eab891f661963be732817330 (diff) | |
| download | strongswan-a05cff1ec0c7473bee147a5213de9dd0317cb5ec.tar.bz2 strongswan-a05cff1ec0c7473bee147a5213de9dd0317cb5ec.tar.xz | |
ikev2: Don't do online revocation checks in pubkey authenticator if requested
We also update the auth config so the constraints are not enforced.
Diffstat (limited to 'src')
| -rw-r--r-- | src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c index dca80a4d8..04ccd4f4f 100644 --- a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c +++ b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c @@ -365,6 +365,7 @@ METHOD(authenticator_t, process, status_t, status_t status = NOT_FOUND; keymat_v2_t *keymat; const char *reason = "unsupported"; + bool online; auth_payload = (auth_payload_t*)message->get_payload(message, PLV2_AUTH); if (!auth_payload) @@ -408,8 +409,10 @@ METHOD(authenticator_t, process, status_t, return FAILED; } auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE); + online = !this->ike_sa->has_condition(this->ike_sa, + COND_ONLINE_VALIDATION_SUSPENDED); enumerator = lib->credmgr->create_public_enumerator(lib->credmgr, - key_type, id, auth, TRUE); + key_type, id, auth, online); while (enumerator->enumerate(enumerator, &public, ¤t_auth)) { if (public->verify(public, scheme, octets, auth_data)) @@ -421,6 +424,10 @@ METHOD(authenticator_t, process, status_t, auth->merge(auth, current_auth, FALSE); auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY); auth->add(auth, AUTH_RULE_IKE_SIGNATURE_SCHEME, (uintptr_t)scheme); + if (!online) + { + auth->add(auth, AUTH_RULE_CERT_VALIDATION_SUSPENDED, TRUE); + } break; } else |