denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

keymat: Check for aes256-sha512 in derive_ike_keys

Browse Source 
Return FALSE if peers try to use other algorithm combinations.
This commit is contained in:
Reto Buerki
2013-03-19 15:23:46 +01:00
committed by Tobias Brunner
parent 51fdbd0429
commit e7a497c307
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon-tkm/src/tkm/tkm_keymat.c
+8
View File
@@ -179,6 +179,14 @@ METHOD(tkm_keymat_t, derive_ike_keys, bool,
INTEGRITY_ALGORITHM); INTEGRITY_ALGORITHM);
return FALSE; return FALSE;
} }
if (!(enc_alg == ENCR_AES_CBC && key_size == 256 &&
int_alg == AUTH_HMAC_SHA2_512_256))
{
DBG1(DBG_IKE, "the TKM only supports aes256-sha512 at the moment, please"
" update your configuration");
return FALSE;
}
DBG2(DBG_IKE, "using %N for encryption, %N for integrity", DBG2(DBG_IKE, "using %N for encryption, %N for integrity",
encryption_algorithm_names, enc_alg, encryption_algorithm_names, enc_alg,
integrity_algorithm_names, int_alg); integrity_algorithm_names, int_alg);