denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-auth: Add option to use EAP-only authentication without notify

Browse Source 
Some peers apparently don't send the notify and still expect to
authenticate with EAP-only authentication.  This option allows forcing
the configured use of EAP-only authentication in that scenario.
This commit is contained in:
Tobias Brunner
2020-05-07 15:05:55 +02:00
parent 0184a69b7b
commit 066fa42fcb
2 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_auth.c
+13 -3
View File
@@ -1009,9 +1009,19 @@ METHOD(task_t, build_r, status_t,
if (!this->ike_sa->supports_extension(this->ike_sa,
EXT_EAP_ONLY_AUTHENTICATION))
{
DBG1(DBG_IKE, "configured EAP-only authentication, but peer "
"does not support it");
goto peer_auth_failed;
if (lib->settings->get_bool(lib->settings,
"%s.force_eap_only_authentication", FALSE, lib->ns))
{
DBG1(DBG_IKE, "ignore missing %N notify and use EAP-only "
"authentication", notify_type_names,
EAP_ONLY_AUTHENTICATION);
}
else
{
DBG1(DBG_IKE, "configured EAP-only authentication, but "
"peer does not support it");
goto peer_auth_failed;
}
}
}
else