Key strength checking stores all key sizes in auth_cfg, verifies all in complies()
[strongswan.git] / src / libstrongswan / credentials / credential_manager.c
index 97e8d88..f437bbf 100644 (file)
@@ -551,6 +551,37 @@ static certificate_t *get_issuer_cert(private_credential_manager_t *this,
 }
 
 /**
+ * Get the strength of certificate, add it to auth
+ */
+static void get_key_strength(certificate_t *cert, auth_cfg_t *auth)
+{
+       uintptr_t strength;
+       public_key_t *key;
+       key_type_t type;
+
+       key = cert->get_public_key(cert);
+       if (key)
+       {
+               type = key->get_type(key);
+               strength = key->get_keysize(key);
+               DBG2(DBG_CFG, "  certificate \"%Y\" key: %d bit %N",
+                        cert->get_subject(cert), strength, key_type_names, type);
+               switch (type)
+               {
+                       case KEY_RSA:
+                               auth->add(auth, AUTH_RULE_RSA_STRENGTH, strength);
+                               break;
+                       case KEY_ECDSA:
+                               auth->add(auth, AUTH_RULE_ECDSA_STRENGTH, strength);
+                               break;
+                       default:
+                               break;
+               }
+               key->destroy(key);
+       }
+}
+
+/**
  * try to verify the trust chain of subject, return TRUE if trusted
  */
 static bool verify_trust_chain(private_credential_manager_t *this,
@@ -562,6 +593,7 @@ static bool verify_trust_chain(private_credential_manager_t *this,
        int pathlen;
 
        auth = auth_cfg_create();
+       get_key_strength(subject, auth);
        current = subject->get_ref(subject);
 
        for (pathlen = 0; pathlen <= MAX_TRUST_PATH_LEN; pathlen++)
@@ -614,6 +646,10 @@ static bool verify_trust_chain(private_credential_manager_t *this,
                        issuer->destroy(issuer);
                        break;
                }
+               if (issuer)
+               {
+                       get_key_strength(issuer, auth);
+               }
                current->destroy(current);
                current = issuer;
                if (trusted)
@@ -710,6 +746,8 @@ METHOD(enumerator_t, trusted_enumerate, bool,
                if (verify_trust_chain(this->this, current, this->auth, FALSE,
                                                           this->online))
                {
+                       this->auth->add(this->auth, AUTH_RULE_SUBJECT_CERT,
+                                                       current->get_ref(current));
                        *cert = current;
                        if (auth)
                        {