diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2015-02-27 18:45:56 +0100 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2015-03-04 13:54:11 +0100 |
| commit | b67ae0f89cbbbbbef1af1bdf93e4b59d2c5c37a0 (patch) | |
| tree | 4ad4243af391fe774eb506c3c53d8ce2fb96d782 /src | |
| parent | 31bccf4ba155964a238e9c88e1d38f41b82f7183 (diff) | |
| download | strongswan-b67ae0f89cbbbbbef1af1bdf93e4b59d2c5c37a0.tar.bz2 strongswan-b67ae0f89cbbbbbef1af1bdf93e4b59d2c5c37a0.tar.xz | |
ikev2: Add an option to disable constraints against signature schemes
If this is disabled the schemes configured in `rightauth` are only
checked against signature schemes used in the certificate chain and
signature schemes used during IKEv2 are ignored.
Disabling this could be helpful if existing connections with peers that
don't support RFC 7427 use signature schemes in `rightauth` to verify
certificate chains.
Diffstat (limited to 'src')
| -rw-r--r-- | src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c index d8c4570dc..52539456e 100644 --- a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c +++ b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c @@ -54,6 +54,11 @@ struct private_pubkey_authenticator_t { * Reserved bytes of ID payload */ char reserved[3]; + + /** + * Whether to store signature schemes on remote auth configs. + */ + bool store_signature_scheme; }; /** @@ -325,8 +330,11 @@ METHOD(authenticator_t, process, status_t, auth_method == AUTH_DS ? scheme : auth_method); status = SUCCESS; auth->merge(auth, current_auth, FALSE); - auth->add(auth, AUTH_RULE_SIGNATURE_SCHEME, (uintptr_t)scheme); auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY); + if (this->store_signature_scheme) + { + auth->add(auth, AUTH_RULE_SIGNATURE_SCHEME, (uintptr_t)scheme); + } break; } else @@ -399,6 +407,8 @@ pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa, .ike_sa = ike_sa, .ike_sa_init = received_init, .nonce = sent_nonce, + .store_signature_scheme = lib->settings->get_bool(lib->settings, + "%s.signature_authentication_constraints", TRUE, lib->ns), ); memcpy(this->reserved, reserved, sizeof(this->reserved)); |