denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vici: Make 96-bit truncation for SHA-256 configurable

Browse Source
This commit is contained in:
Tobias Brunner
2017-05-26 11:22:28 +02:00
parent 4270c8fcb0
commit 0afe0eca67
2 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/swanctl.opt
+9
View File
@@ -651,6 +651,15 @@ connections.<conn>.children.<child>.esp_proposals = default
for interoperability. If no algorithms are specified for AH nor ESP,
the _default_ set of algorithms for ESP is included.
connections.<conn>.children.<child>.sha256_96 = no
Use incorrect 96-bit truncation for HMAC-SHA-256.
HMAC-SHA-256 is used with 128-bit truncation with IPsec. For compatibility
with implementations that incorrectly use 96-bit truncation this option may
be enabled to configure the shorter truncation length in the kernel. This
is not negotiated, so this only works with peers that use the incorrect
truncation length (or have this option enabled).
connections.<conn>.children.<child>.local_ts = dynamic
Local traffic selectors to include in CHILD_SA.