denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

swanctl: Document how DH groups in CHILD_SA proposals are applied

Browse Source 
References #1039.
This commit is contained in:
Tobias Brunner
2016-08-31 11:47:25 +02:00
parent bbd4620777
commit f883cd6df6
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/swanctl.opt
+13 -6
View File
@@ -472,7 +472,7 @@ connections.<conn>.children.<child>.ah_proposals =
For AH, this includes an integrity algorithm and an optional Diffie-Hellman For AH, this includes an integrity algorithm and an optional Diffie-Hellman
group. If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial group. If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
negotiation uses a separate Diffie-Hellman exchange using the specified negotiation uses a separate Diffie-Hellman exchange using the specified
group. group (refer to _esp_proposals_ for details).
In IKEv2, multiple algorithms of the same kind can be specified in a single In IKEv2, multiple algorithms of the same kind can be specified in a single
proposal, from which one gets selected. In IKEv1, only one algorithm per proposal, from which one gets selected. In IKEv1, only one algorithm per
@@ -495,11 +495,18 @@ connections.<conn>.children.<child>.esp_proposals = default
mode algorithm is used instead of the separate encryption/integrity mode algorithm is used instead of the separate encryption/integrity
algorithms. algorithms.
If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial (non If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
IKE_AUTH piggybacked) negotiation uses a separate Diffie-Hellman exchange negotiation use a separate Diffie-Hellman exchange using the specified
using the specified group. Extended Sequence Number support may be indicated group. However, for IKEv2, the keys of the CHILD_SA created implicitly with
with the _esn_ and _noesn_ values, both may be included to indicate support the IKE_SA will always be derived from the IKE_SA's key material. So any DH
for both modes. If omitted, _noesn_ is assumed. group specified here will only apply when the CHILD_SA is later rekeyed or
is created with a separate CREATE_CHILD_SA exchange. A proposal mismatch
might, therefore, not immediately be noticed when the SA is established, but
may later cause rekeying to fail.
Extended Sequence Number support may be indicated with the _esn_ and _noesn_
values, both may be included to indicate support for both modes. If omitted,
_noesn_ is assumed.
In IKEv2, multiple algorithms of the same kind can be specified in a single In IKEv2, multiple algorithms of the same kind can be specified in a single
proposal, from which one gets selected. In IKEv1, only one algorithm per proposal, from which one gets selected. In IKEv1, only one algorithm per