denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-sa-manager: Extract IKE SPI labeling feature from charon-tkm

Browse Source 
Might be useful for users of other daemons too. Note that compared to the
previous implementation in charon-tkm, the mask/label are applied in
network order.

Closes strongswan/strongswan#134.
This commit is contained in:
Tobias Brunner
2019-04-11 09:51:02 +02:00
parent f5ad3cf491
commit 62d43ea694
5 changed files with 37 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
+7
View File
@@ -370,6 +370,13 @@ charon.signature_authentication_constraints = yes
certificate chain, are also used as constraints against the signature scheme
used by peers during IKEv2.
charon.spi_label = 0x0000000000000000
Value mixed into the local IKE SPIs after applying _spi_mask_.
charon.spi_mask = 0x0000000000000000
Mask applied to local IKE SPIs before mixing in _spi_label_ (bits set will
be replaced with _spi_label_).
charon.spi_min = 0xc0000000
The lower limit for SPIs requested from the kernel for IPsec SAs.