denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: Fix documentation of pubkey constraints

Browse Source 
Hash algorithms have to be repeated for multiple key types.

References #2514.
This commit is contained in:
Tobias Brunner
2018-02-09 10:42:13 +01:00
parent bb58dfb9b5
commit e698bdea24
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/ipsec.conf.5.in
+3 -2
View File
@@ -609,9 +609,10 @@ To limit the acceptable set of hashing algorithms for trustchain validation,
append hash algorithms to append hash algorithms to
.BR pubkey .BR pubkey
or a key strength definition (for example or a key strength definition (for example
.BR pubkey-sha1-sha256 .BR pubkey-sha256-sha512 ,
.BR rsa-2048-sha256-sha384-sha512 ,
or or
.BR rsa-2048-ecdsa-256-sha256-sha384-sha512 ). .BR rsa-2048-sha256-ecdsa-256-sha256-sha384 ).
Unless disabled in Unless disabled in
.BR strongswan.conf (5), .BR strongswan.conf (5),
or explicit IKEv2 signature constraints are configured (see below), such key or explicit IKEv2 signature constraints are configured (see below), such key
src/swanctl/swanctl.opt
+3 -2
View File
@@ -587,8 +587,9 @@ connections.<conn>.remote<suffix>.auth = pubkey
key type followed by the minimum strength in bits (for example _ecdsa-384_ key type followed by the minimum strength in bits (for example _ecdsa-384_
or _rsa-2048-ecdsa-256_). To limit the acceptable set of hashing algorithms or _rsa-2048-ecdsa-256_). To limit the acceptable set of hashing algorithms
for trustchain validation, append hash algorithms to _pubkey_ or a key for trustchain validation, append hash algorithms to _pubkey_ or a key
strength definition (for example _pubkey-sha1-sha256_ or strength definition (for example _pubkey-sha256-sha512_,
_rsa-2048-ecdsa-256-sha256-sha384-sha512_). _rsa-2048-sha256-sha384-sha512_ or
_rsa-2048-sha256-ecdsa-256-sha256-sha384_).
Unless disabled in **strongswan.conf**(5), or explicit IKEv2 signature Unless disabled in **strongswan.conf**(5), or explicit IKEv2 signature
constraints are configured (refer to the description of the **local** constraints are configured (refer to the description of the **local**
section's **auth** keyword for details), such key types and hash algorithms section's **auth** keyword for details), such key types and hash algorithms