denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stroke: Make 96-bit truncation for SHA-256 configurable

Browse Source
This commit is contained in:
Tobias Brunner
2017-05-26 11:22:28 +02:00
parent 7637633bb9
commit 4270c8fcb0
9 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/ipsec.conf.5.in
+7
View File
@@ -1141,6 +1141,13 @@ a value of 0 disables IPsec replay protection.
.BR reqid " = <number>"
sets the reqid for a given connection to a pre-configured fixed value.
.TP
.BR sha256_96 " = " no " | yes"
HMAC-SHA-256 is used with 128-bit truncation with IPsec. For compatibility
with implementations that incorrectly use 96-bit truncation this option may be
enabled to configure the shorter truncation length in the kernel. This is not
negotiated, so this only works with peers that use the incorrect truncation
length (or have this option enabled).
.TP
.BR tfc " = <value>"
number of bytes to pad ESP payload data to. Traffic Flow Confidentiality
is currently supported in IKEv2 and applies to outgoing packets only. The