denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth-cfg: Make IKE signature schemes configurable

Browse Source 
This also restores the charon.signature_authentication_constraints
functionality, that is, if no explicit IKE signature schemes are
configured we apply all regular signature constraints as IKE constraints.
This commit is contained in:
Tobias Brunner
2016-03-04 16:19:54 +01:00
parent e37e6d6dca
commit 3c23a75120
8 changed files with 203 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/stroke/stroke_config.c
+4 -3
View File
@@ -506,14 +506,15 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
}
/* authentication metod (class, actually) */
if (strpfx(auth, "pubkey") ||
if (strpfx(auth, "ike:") ||
strpfx(auth, "pubkey") ||
strpfx(auth, "rsa") ||
strpfx(auth, "ecdsa") ||
strpfx(auth, "bliss"))
{
cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
build_crl_policy(cfg, local, msg->add_conn.crl_policy);
cfg->add_pubkey_constraints(cfg, auth);
cfg->add_pubkey_constraints(cfg, auth, TRUE);
}
else if (streq(auth, "psk") || streq(auth, "secret"))
{
@@ -546,7 +547,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
if (pos)
{
*pos = 0;
cfg->add_pubkey_constraints(cfg, pos + 1);
cfg->add_pubkey_constraints(cfg, pos + 1, FALSE);
}
type = eap_vendor_type_from_string(auth);
if (type)
src/libcharon/plugins/vici/vici_config.c
+3 -2
View File
@@ -955,13 +955,14 @@ CALLBACK(parse_auth, bool,
{
return FALSE;
}
if (strpfx(buf, "pubkey") ||
if (strpfx(buf, "ike:") ||
strpfx(buf, "pubkey") ||
strpfx(buf, "rsa") ||
strpfx(buf, "ecdsa") ||
strpfx(buf, "bliss"))
{
cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
cfg->add_pubkey_constraints(cfg, buf);
cfg->add_pubkey_constraints(cfg, buf, TRUE);
return TRUE;
}
if (strcaseeq(buf, "psk"))