denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proposal: Remove MD5 from default IKE proposal

Browse Source 
RFC 8247 demoted MD5 to MUST NOT.

References #2427.
This commit is contained in:
Tobias Brunner
2017-11-08 16:47:04 +01:00
parent 2294606aa5
commit 10da451fc3
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/config/proposal.c
+5 -2
View File
@@ -872,9 +872,10 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
case AUTH_AES_XCBC_96: case AUTH_AES_XCBC_96:
case AUTH_AES_CMAC_96: case AUTH_AES_CMAC_96:
case AUTH_HMAC_SHA1_96: case AUTH_HMAC_SHA1_96:
case AUTH_HMAC_MD5_96:
add_algorithm(this, INTEGRITY_ALGORITHM, integrity, 0); add_algorithm(this, INTEGRITY_ALGORITHM, integrity, 0);
break; break;
case AUTH_HMAC_MD5_96:
/* no, thanks */
default: default:
break; break;
} }
@@ -908,9 +909,11 @@ static bool proposal_add_supported_ike(private_proposal_t *this, bool aead)
switch (prf) switch (prf)
{ {
case PRF_HMAC_SHA1: case PRF_HMAC_SHA1:
case PRF_HMAC_MD5:
add_algorithm(this, PSEUDO_RANDOM_FUNCTION, prf, 0); add_algorithm(this, PSEUDO_RANDOM_FUNCTION, prf, 0);
break; break;
case PRF_HMAC_MD5:
/* no, thanks */
break;
default: default:
break; break;
} }