From e74f184cb4b08328640551ff81a197dbffb74055 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 18 Oct 2012 16:38:22 +0200 Subject: [PATCH] Remove MODP groups from default ESP proposal This now actually makes pfs=no the default and it equals the default listed in ipsec.conf.5. efc69e9f preserved the default of pfs=yes. --- src/starter/confread.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/starter/confread.c b/src/starter/confread.c index 6e3ac17d9..fecb998df 100644 --- a/src/starter/confread.c +++ b/src/starter/confread.c @@ -36,7 +36,7 @@ #define SA_REPLACEMENT_RETRIES_DEFAULT 3 static const char ike_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536"; -static const char esp_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536"; +static const char esp_defaults[] = "aes128-sha1,3des-sha1"; static const char firewall_defaults[] = "ipsec _updown iptables";