denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-cfg: Change how OCSP certificate requests are enabled

Browse Source 
The previous option caused such requests to be enabled if not explicitly
disabled, which only the vici plugin did, for all other backends requests
would have been sent.

References strongswan/strongswan#2016
This commit is contained in:
Tobias Brunner
2024-03-15 15:38:19 +01:00
parent cfc7be004d
commit 9acd90575a
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/config/ike_cfg.c
+1 -1
View File
@@ -624,7 +624,7 @@ ike_cfg_t *ike_cfg_create(ike_cfg_create_t *data)
.refcount = 1, .refcount = 1,
.version = data->version, .version = data->version,
.certreq = !data->no_certreq, .certreq = !data->no_certreq,
.ocsp_certreq = !data->no_ocsp_certreq, .ocsp_certreq = data->ocsp_certreq,
.force_encap = data->force_encap, .force_encap = data->force_encap,
.fragmentation = data->fragmentation, .fragmentation = data->fragmentation,
.childless = data->childless, .childless = data->childless,
src/libcharon/config/ike_cfg.h
+2 -2
View File
@@ -295,8 +295,8 @@ struct ike_cfg_create_t {
uint16_t remote_port; uint16_t remote_port;
/** TRUE to not send any certificate requests */ /** TRUE to not send any certificate requests */
bool no_certreq; bool no_certreq;
/** TRUE to not send OCSP status requests */ /** TRUE to send OCSP status requests */
bool no_ocsp_certreq; bool ocsp_certreq;
/** Enforce UDP encapsulation by faking NATD notify */ /** Enforce UDP encapsulation by faking NATD notify */
bool force_encap; bool force_encap;
/** Use IKE fragmentation */ /** Use IKE fragmentation */
src/libcharon/plugins/vici/vici_config.c
+2 -2
View File
@@ -2672,8 +2672,8 @@ CALLBACK(config_sn, bool,
.remote = peer.remote_addrs, .remote = peer.remote_addrs,
.remote_port = peer.remote_port, .remote_port = peer.remote_port,
.no_certreq = !peer.send_certreq, .no_certreq = !peer.send_certreq,
.no_ocsp_certreq = peer.ocsp != OCSP_SEND_BOTH && .ocsp_certreq = peer.ocsp == OCSP_SEND_BOTH ||
peer.ocsp != OCSP_SEND_REQUEST, peer.ocsp == OCSP_SEND_REQUEST,
.force_encap = peer.encap, .force_encap = peer.encap,
.fragmentation = peer.fragmentation, .fragmentation = peer.fragmentation,
.childless = peer.childless, .childless = peer.childless,