ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity

ike-auth: Add option to use EAP-only authentication without notify 

Some peers apparently don't send the notify and still expect to
authenticate with EAP-only authentication.  This option allows forcing
the configured use of EAP-only authentication in that scenario.
This commit is contained in:
Tobias Brunner 2020-04-07 18:49:00 +02:00
parent 0184a69b7b
commit 066fa42fcb
2 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
conf/options/charon.opt
View File

@ -120,6 +120,10 @@ charon.flush_auth_cfg = no
charon.follow_redirects = yes
Whether to follow IKEv2 redirects (RFC 5685).
charon.force_eap_only_authentication = no
Violate RFC 5998 and use EAP-only authentication even if the peer did not
send an EAP_ONLY_AUTHENTICATION notify during IKE_AUTH.
charon.fragment_size = 1280
Maximum size (complete IP datagram size in bytes) of a sent IKE fragment
when using proprietary IKEv1 or standardized IKEv2 fragmentation, defaults

16
src/libcharon/sa/ikev2/tasks/ike_auth.c
View File

@ -1009,9 +1009,19 @@ METHOD(task_t, build_r, status_t,
if (!this->ike_sa->supports_extension(this->ike_sa,
EXT_EAP_ONLY_AUTHENTICATION))
{
DBG1(DBG_IKE, "configured EAP-only authentication, but peer "
"does not support it");
goto peer_auth_failed;
if (lib->settings->get_bool(lib->settings,
"%s.force_eap_only_authentication", FALSE, lib->ns))
{
DBG1(DBG_IKE, "ignore missing %N notify and use EAP-only "
"authentication", notify_type_names,
EAP_ONLY_AUTHENTICATION);
}
else
{
DBG1(DBG_IKE, "configured EAP-only authentication, but "
"peer does not support it");
goto peer_auth_failed;
}
}
}
else