denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

eap-peap: Initiate Phase 2 immediately for TLS 1.3

Browse Source 
Before TLS 1.3, the server sent the last handshake message and had the
option to piggyback the EAP-Identity request directly onto the packet
with the TLS Finished message, or wait for the empty message by the
client that acknowledges the completion of the handshake.  With TLS 1.3,
the client finishes the handshake after the server.  So this option
is irrelevant there and we immediately start with Phase 2.
This commit is contained in:
Tobias Brunner
2023-03-02 09:31:52 +01:00
parent edd3c797b0
commit 8aa13a1797
4 changed files with 37 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/plugins/eap-peap.opt
+2 -1
View File
@@ -11,7 +11,8 @@ charon.plugins.eap-peap.phase2_method = mschapv2
Phase2 EAP client authentication method.
charon.plugins.eap-peap.phase2_piggyback = no
Phase2 EAP Identity request piggybacked by server onto TLS Finished message.
Phase2 EAP Identity request piggybacked by server onto TLS Finished message,
relevant only if TLS 1.2 or earlier is negotiated.
charon.plugins.eap-peap.phase2_tnc = no
Start phase2 EAP TNC protocol after successful client authentication.