denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

android: Use %any as AAA identity, but disable EAP-only authentication

Browse Source 
Without verification of the identity we can't prevent a malicious user
with a valid certificate from impersonating the AAA server and thus the
VPN gateway.  So unless we make the AAA identity configurable we have to
prevent EAP-only authentication.
This commit is contained in:
Tobias Brunner
2014-11-06 16:28:40 +01:00
parent 4b39a4117a
commit 0e44999867
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/frontends/android/jni/libandroidbridge/backend/android_service.c
+3 -5
View File
@@ -657,6 +657,8 @@ static bool add_auth_cfg_cert(private_android_service_t *this,
{ {
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP); auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
auth->add(auth, AUTH_RULE_EAP_TYPE, EAP_TLS); auth->add(auth, AUTH_RULE_EAP_TYPE, EAP_TLS);
id = identification_create_from_string("%any");
auth->add(auth, AUTH_RULE_AAA_IDENTITY, id);
} }
else else
{ {
@@ -729,11 +731,7 @@ static job_requeue_t initiate(private_android_service_t *this)
gateway = identification_create_from_string(this->gateway); gateway = identification_create_from_string(this->gateway);
auth->add(auth, AUTH_RULE_IDENTITY, gateway); auth->add(auth, AUTH_RULE_IDENTITY, gateway);
auth->add(auth, AUTH_RULE_IDENTITY_LOOSE, TRUE); auth->add(auth, AUTH_RULE_IDENTITY_LOOSE, TRUE);
/* for EAP-TLS we don't add an auth class to allow pubkey and EAP-only */ auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
if (!streq("ikev2-eap-tls", this->type))
{
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
}
peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE); peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
child_cfg = child_cfg_create("android", &lifetime, NULL, TRUE, MODE_TUNNEL, child_cfg = child_cfg_create("android", &lifetime, NULL, TRUE, MODE_TUNNEL,