diff options
| author | Martin Willi <martin@revosec.ch> | 2012-06-13 09:32:28 +0200 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2012-06-14 10:25:48 +0200 |
| commit | b31a56f1281f51932d945f8f6ac9dfc34a30af6d (patch) | |
| tree | efb7349a29a9cabaaa440421c51f4d81f10f3c51 | |
| parent | e49f18f74d9c4c25d841fbf34d1d8ae1666dbf9f (diff) | |
| download | strongswan-b31a56f1281f51932d945f8f6ac9dfc34a30af6d.tar.bz2 strongswan-b31a56f1281f51932d945f8f6ac9dfc34a30af6d.tar.xz | |
Require a scary option to respond to Aggressive Mode PSK requests
While Aggressive Mode PSK is widely used, it is known to be subject
to dictionary attacks by passive attackers. We don't complain as
initiator to be compatible with existing (insecure) setups, but
require a scary strongswan.conf option if someone wants to use it
as responder.
| -rw-r--r-- | src/libcharon/sa/ikev1/tasks/aggressive_mode.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c index 66e6451ea..8fa2d525e 100644 --- a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c +++ b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c @@ -380,6 +380,23 @@ METHOD(task_t, process_r, status_t, this->method = sa_payload->get_auth_method(sa_payload); this->lifetime = sa_payload->get_lifetime(sa_payload); + switch (this->method) + { + case AUTH_XAUTH_INIT_PSK: + case AUTH_XAUTH_RESP_PSK: + case AUTH_PSK: + if (!lib->settings->get_bool(lib->settings, "charon.i_dont_" + "care_about_security_and_use_aggressive_mode_psk", FALSE)) + { + DBG1(DBG_IKE, "Aggressive Mode PSK disabled for " + "security reasons"); + return send_notify(this, AUTHENTICATION_FAILED); + } + break; + default: + break; + } + if (!this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP, &group, NULL)) { |