denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pluto supports ECDSA authentication

Browse Source
This commit is contained in:
Andreas Steffen
2009-06-12 19:59:49 +02:00
parent eca36f44de
commit 11e6d28533
25 changed files with 310 additions and 234 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starter/confread.c
+7 -9
View File
@@ -32,8 +32,8 @@
/* strings containing a colon are interpreted as an IPv6 address */
#define ip_version(string) (strchr(string, '.') ? AF_INET : AF_INET6)
static const char ike_defaults[] = "aes128-sha-modp2048";
static const char esp_defaults[] = "aes128-sha1, 3des-md5";
static const char ike_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
static const char esp_defaults[] = "aes128-sha1,3des-sha1";
static const char firewall_defaults[] = "ipsec _updown iptables";
@@ -70,7 +70,7 @@ static void default_values(starter_config_t *cfg)
cfg->conn_default.seen = LEMPTY;
cfg->conn_default.startup = STARTUP_NO;
cfg->conn_default.state = STATE_IGNORE;
cfg->conn_default.policy = POLICY_ENCRYPT | POLICY_TUNNEL | POLICY_RSASIG |
cfg->conn_default.policy = POLICY_ENCRYPT | POLICY_TUNNEL | POLICY_PUBKEY |
POLICY_PFS | POLICY_MOBIKE;
cfg->conn_default.ike = clone_str(ike_defaults);
@@ -555,18 +555,16 @@ load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg)
/* also handles the cases secret|rsasig and rsasig|secret */
for (;;)
{
if (streq(value, "rsa") || streq(value, "rsasig"))
if (streq(value, "rsa") || streq(value, "rsasig") ||
streq(value, "ecdsa") || streq(value, "ecdsasig") ||
streq(value, "pubkey"))
{
conn->policy |= POLICY_RSASIG | POLICY_ENCRYPT;
conn->policy |= POLICY_PUBKEY | POLICY_ENCRYPT;
}
else if (streq(value, "secret") || streq(value, "psk"))
{
conn->policy |= POLICY_PSK | POLICY_ENCRYPT;
}
else if (streq(value, "ecdsa") || streq(value, "ecdsasig"))
{
conn->policy |= POLICY_ECDSASIG | POLICY_ENCRYPT;
}
else if (streq(value, "xauthrsasig"))
{
conn->policy |= POLICY_XAUTH_RSASIG | POLICY_ENCRYPT;
src/starter/starterstroke.c
+1 -1
View File
@@ -239,7 +239,7 @@ int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn)
msg.add_conn.name = push_string(&msg, connection_name(conn));
/* PUBKEY is preferred to PSK and EAP */
if (conn->policy & POLICY_RSASIG || conn->policy & POLICY_ECDSASIG)
if (conn->policy & POLICY_PUBKEY)
{
msg.add_conn.auth_method = AUTH_PUBKEY;
}
src/starter/starterwhack.c
+1 -1
View File
@@ -323,7 +323,7 @@ starter_whack_add_conn(starter_conn_t *conn)
r = send_whack_msg(&msg);
if (r == 0 && (conn->policy & POLICY_RSASIG))
if (r == 0 && (conn->policy & POLICY_PUBKEY))
{
r += starter_whack_add_pubkey (conn, &conn->left, "left");
r += starter_whack_add_pubkey (conn, &conn->right, "right");