2 files changed, 22 insertions, 11 deletions

diff --git a/src/libstrongswan/credentials/sets/cert_cache.c b/src/libstrongswan/credentials/sets/cert_cache.c
index 92d5efdc6..0e64f0350 100644
--- a/src/libstrongswan/credentials/sets/cert_cache.c
+++ b/src/libstrongswan/credentials/sets/cert_cache.c
@@ -48,9 +48,9 @@ struct relation_t {
 	certificate_t *issuer;
 
 	/**
-	 * Signature scheme used to sign this relation
+	 * Signature scheme and parameters used to sign this relation
 	 */
-	signature_scheme_t scheme;
+	signature_params_t *scheme;
 
 	/**
 	 * Cache hits
@@ -84,7 +84,7 @@ struct private_cert_cache_t {
  */
 static void cache(private_cert_cache_t *this,
 				  certificate_t *subject, certificate_t *issuer,
-				  signature_scheme_t scheme)
+				  signature_params_t *scheme)
 {
 	relation_t *rel;
 	int i, offset, try;
@@ -118,7 +118,8 @@ static void cache(private_cert_cache_t *this,
 					{
 						rel->subject->destroy(rel->subject);
 						rel->subject = subject->get_ref(subject);
-						rel->scheme = scheme;
+						signature_params_destroy(rel->scheme);
+						rel->scheme = signature_params_clone(scheme);
 						return rel->lock->unlock(rel->lock);
 					}
 				}
@@ -139,7 +140,7 @@ static void cache(private_cert_cache_t *this,
 			{
 				rel->subject = subject->get_ref(subject);
 				rel->issuer = issuer->get_ref(issuer);
-				rel->scheme = scheme;
+				rel->scheme = signature_params_clone(scheme);
 				return rel->lock->unlock(rel->lock);
 			}
 			rel->lock->unlock(rel->lock);
@@ -165,10 +166,11 @@ static void cache(private_cert_cache_t *this,
 				{
 					rel->subject->destroy(rel->subject);
 					rel->issuer->destroy(rel->issuer);
+					signature_params_destroy(rel->scheme);
 				}
 				rel->subject = subject->get_ref(subject);
 				rel->issuer = issuer->get_ref(issuer);
-				rel->scheme = scheme;
+				rel->scheme = signature_params_clone(scheme);
 				rel->hits = 0;
 				return rel->lock->unlock(rel->lock);
 			}
@@ -180,11 +182,11 @@ static void cache(private_cert_cache_t *this,
 
 METHOD(cert_cache_t, issued_by, bool,
 	private_cert_cache_t *this, certificate_t *subject, certificate_t *issuer,
-	signature_scheme_t *schemep)
+	signature_params_t **schemep)
 {
 	certificate_t *cached_issuer = NULL;
 	relation_t *found = NULL, *current;
-	signature_scheme_t scheme;
+	signature_params_t *scheme;
 	int i;
 
 	for (i = 0; i < CACHE_SIZE; i++)
@@ -202,7 +204,7 @@ METHOD(cert_cache_t, issued_by, bool,
 					found = current;
 					if (schemep)
 					{
-						*schemep = current->scheme;
+						*schemep = signature_params_clone(current->scheme);
 					}
 				}
 				else if (!cached_issuer)
@@ -225,6 +227,10 @@ METHOD(cert_cache_t, issued_by, bool,
 		{
 			*schemep = scheme;
 		}
+		else
+		{
+			signature_params_destroy(scheme);
+		}
 		DESTROY_IF(cached_issuer);
 		return TRUE;
 	}
@@ -383,8 +389,10 @@ METHOD(cert_cache_t, flush, void,
 			{
 				rel->subject->destroy(rel->subject);
 				rel->issuer->destroy(rel->issuer);
+				signature_params_destroy(rel->scheme);
 				rel->subject = NULL;
 				rel->issuer = NULL;
+				rel->scheme = NULL;
 				rel->hits = 0;
 			}
 		}
@@ -405,6 +413,7 @@ METHOD(cert_cache_t, destroy, void,
 		{
 			rel->subject->destroy(rel->subject);
 			rel->issuer->destroy(rel->issuer);
+			signature_params_destroy(rel->scheme);
 		}
 		rel->lock->destroy(rel->lock);
 	}
@@ -438,6 +447,7 @@ cert_cache_t *cert_cache_create()
 	{
 		this->relations[i].subject = NULL;
 		this->relations[i].issuer = NULL;
+		this->relations[i].scheme = NULL;
 		this->relations[i].hits = 0;
 		this->relations[i].lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
 	}
diff --git a/src/libstrongswan/credentials/sets/cert_cache.h b/src/libstrongswan/credentials/sets/cert_cache.h
index 2bcdbe464..2235bc30d 100644
--- a/src/libstrongswan/credentials/sets/cert_cache.h
+++ b/src/libstrongswan/credentials/sets/cert_cache.h
@@ -45,12 +45,13 @@ struct cert_cache_t {
 	 *
 	 * @param subject		certificate to verify
 	 * @param issuer		issuing certificate to verify subject
-	 * @param scheme		receives used signature scheme, if given
+	 * @param scheme		receives used signature scheme and parameters, if
+	 *						given (allocated)
 	 * @return				TRUE if subject issued by issuer
 	 */
 	bool (*issued_by)(cert_cache_t *this,
 					  certificate_t *subject, certificate_t *issuer,
-					  signature_scheme_t *scheme);
+					  signature_params_t **scheme);
 
 	/**
 	 * Flush the certificate cache.