denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

addrblock: Support an optional non-strict mode accepting certs without addrblock

Browse Source 
This allows a gateway to enforce the addrblock policy on certificates that
actually have the extension only. For (legacy) certificates not having the
extension, traffic selectors are validated/narrowed by other means, most
likely by the configuration.
This commit is contained in:
Martin Willi
2017-03-02 08:24:02 +01:00
parent da82786b2d
commit d1317adb9a
3 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/plugins/addrblock.opt
+8
View File
@@ -0,0 +1,8 @@
charon.plugins.addrblock.strict = yes
Whether to strictly require addrblock extension in subject certificates.
If set to yes, a subject certificate without an addrblock extension is
rejected if the issuer certificate has such an addrblock extension. If set
to no, subject certificates issued without the addrblock extension are
accepted without any traffic selector checks and no policy is enforced
by the plugin.