diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2016-02-01 18:16:16 +0100 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2016-03-04 16:19:54 +0100 |
| commit | 3c23a75120c5b548383da439537cab956b15dafd (patch) | |
| tree | 54d3815f724b65a2e1dbebc0b80b5563613b507f /src/libcharon/plugins/stroke | |
| parent | e37e6d6dcaee842b6d8a5be2d271f560f86fabcc (diff) | |
| download | strongswan-3c23a75120c5b548383da439537cab956b15dafd.tar.bz2 strongswan-3c23a75120c5b548383da439537cab956b15dafd.tar.xz | |
auth-cfg: Make IKE signature schemes configurable
This also restores the charon.signature_authentication_constraints
functionality, that is, if no explicit IKE signature schemes are
configured we apply all regular signature constraints as IKE constraints.
Diffstat (limited to 'src/libcharon/plugins/stroke')
| -rw-r--r-- | src/libcharon/plugins/stroke/stroke_config.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c index 134abb955..d0eb2aac3 100644 --- a/src/libcharon/plugins/stroke/stroke_config.c +++ b/src/libcharon/plugins/stroke/stroke_config.c @@ -506,14 +506,15 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this, } /* authentication metod (class, actually) */ - if (strpfx(auth, "pubkey") || + if (strpfx(auth, "ike:") || + strpfx(auth, "pubkey") || strpfx(auth, "rsa") || strpfx(auth, "ecdsa") || strpfx(auth, "bliss")) { cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY); build_crl_policy(cfg, local, msg->add_conn.crl_policy); - cfg->add_pubkey_constraints(cfg, auth); + cfg->add_pubkey_constraints(cfg, auth, TRUE); } else if (streq(auth, "psk") || streq(auth, "secret")) { @@ -546,7 +547,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this, if (pos) { *pos = 0; - cfg->add_pubkey_constraints(cfg, pos + 1); + cfg->add_pubkey_constraints(cfg, pos + 1, FALSE); } type = eap_vendor_type_from_string(auth); if (type) |