[Swan-dev] Storing of cert chains

[Matt Rogers]

I'm using the spd "end" structures 'this' and 'that' (ie
c->spd.that.ca_path) to store the chain of CA certs. The 'this' end is
loaded with the local cert path of the end certificate on a connection
add, and the 'that' end is a list of CA certs received from the peer
(which are all validated as a group down to the root and placed into
the global x509authcert list). 

The 'that' chain is only used for freeing the certs from the global
list when deleted. 'this' makes sense for the local authcert chain,
but I'm not sure about using 'that' for the received chain since the
connection can be refined right after processing it. I don't know if
that would affect it - Would there be a better spot?

I noticed get_peer_ca uses pluto_pubkeys to look for the peer CA's
key. Are local CA cert keys put into pluto_pubkeys at some point? If
so, I'm guessing I will also need to have that happen for CA certs
that come in through the exchange. Otherwise it needs to be changed to
use the authcert list. 

Any input is welcome.

Thanks,
Matt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.libreswan.org/pipermail/swan-dev/attachments/20140803/0a3234e5/attachment.html>