From 6bafa2d346736a0b479a6d7acb623d86c2fb4cda Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 8 Feb 2018 12:15:36 +0100 Subject: [PATCH] android: Always send the client certificate In scenarios where the server accepts client certificates from dozens or even hundreds of CAs it might be necessary to omit certificate request payloads from the IKE_SA_INIT response to avoid fragmentation. As it is rarely the case in road-warrior scenarios that the server already has the client certificate installed it should not be a problem to always send it. --- .../app/src/main/jni/libandroidbridge/backend/android_service.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c index 986854cdd..d41aa2f7c 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_service.c @@ -739,7 +739,7 @@ static job_requeue_t initiate(private_android_service_t *this) ike_sa_t *ike_sa; auth_cfg_t *auth; peer_cfg_create_t peer = { - .cert_policy = CERT_SEND_IF_ASKED, + .cert_policy = CERT_ALWAYS_SEND, .unique = UNIQUE_REPLACE, .rekey_time = 36000, /* 10h */ .jitter_time = 600, /* 10min */