denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ikev2: Add an option to disable constraints against signature schemes

Browse Source 
If this is disabled the schemes configured in `rightauth` are only
checked against signature schemes used in the certificate chain and
signature schemes used during IKEv2 are ignored.

Disabling this could be helpful if existing connections with peers that
don't support RFC 7427 use signature schemes in `rightauth` to verify
certificate chains.
This commit is contained in:
Tobias Brunner
2015-03-04 13:54:11 +01:00
parent 31bccf4ba1
commit b67ae0f89c
2 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
+8
View File
@@ -290,6 +290,14 @@ charon.send_vendor_id = no
charon.signature_authentication = yes
Whether to enable Signature Authentication as per RFC 7427.
charon.signature_authentication_constraints = yes
Whether to enable constraints against IKEv2 signature schemes.
If enabled, signature schemes configured in _rightauth_, in addition to
getting used as constraints against signature schemes employed in the
certificate chain, are also used as constraints against the signature scheme
used by peers during IKEv2.
charon.start-scripts {}
Section containing a list of scripts (name = path) that are executed when
the daemon is started.
src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+11 -1
View File
@@ -54,6 +54,11 @@ struct private_pubkey_authenticator_t {
* Reserved bytes of ID payload
*/
char reserved[3];
/**
* Whether to store signature schemes on remote auth configs.
*/
bool store_signature_scheme;
};
/**
@@ -325,8 +330,11 @@ METHOD(authenticator_t, process, status_t,
auth_method == AUTH_DS ? scheme : auth_method);
status = SUCCESS;
auth->merge(auth, current_auth, FALSE);
auth->add(auth, AUTH_RULE_SIGNATURE_SCHEME, (uintptr_t)scheme);
auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
if (this->store_signature_scheme)
{
auth->add(auth, AUTH_RULE_SIGNATURE_SCHEME, (uintptr_t)scheme);
}
break;
}
else
@@ -399,6 +407,8 @@ pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
.ike_sa = ike_sa,
.ike_sa_init = received_init,
.nonce = sent_nonce,
.store_signature_scheme = lib->settings->get_bool(lib->settings,
"%s.signature_authentication_constraints", TRUE, lib->ns),
);
memcpy(this->reserved, reserved, sizeof(this->reserved));