starter: Removed pfs and pfsgroup options (handled via esp option).

diff --git a/src/starter/args.c b/src/starter/args.c
index 3856c3df328e38c4b1dcee49d8335f1b6b941bd7..2f3e48b41048f04a54ddfddb868a3cd5a2cc8c06 100644 (file)
--- a/src/starter/args.c
+++ b/src/starter/args.c
@@ -103,22 +103,6 @@ static const char *LST_keyexchange[] = {
         NULL
 };
 
-static const char *LST_pfsgroup[] = {
-       "modp1024",
-       "modp1536",
-       "modp2048",
-       "modp3072",
-       "modp4096",
-       "modp6144",
-       "modp8192",
-       "ecp192",
-       "ecp224",
-       "ecp256",
-       "ecp384",
-       "ecp521",
-        NULL
-};
-
 static const char *LST_plutodebug[] = {
        "none",
        "all",
@@ -215,7 +199,6 @@ static const token_info_t token_info[] =
        { ARG_ENUM, offsetof(starter_conn_t, startup), LST_startup                     },
        { ARG_ENUM, offsetof(starter_conn_t, keyexchange), LST_keyexchange             },
        { ARG_MISC, 0, NULL  /* KW_TYPE */                                             },
-       { ARG_MISC, 0, NULL  /* KW_PFS */                                              },
        { ARG_MISC, 0, NULL  /* KW_COMPRESS */                                         },
        { ARG_ENUM, offsetof(starter_conn_t, install_policy), LST_bool                 },
        { ARG_ENUM, offsetof(starter_conn_t, aggressive), LST_bool                     },
@@ -238,7 +221,6 @@ static const token_info_t token_info[] =
        { ARG_MISC, 0, NULL  /* KW_REAUTH */                                           },
        { ARG_STR,  offsetof(starter_conn_t, ike), NULL                                },
        { ARG_STR,  offsetof(starter_conn_t, esp), NULL                                },
-       { ARG_STR,  offsetof(starter_conn_t, pfsgroup), LST_pfsgroup                   },
        { ARG_TIME, offsetof(starter_conn_t, dpd_delay), NULL                          },
        { ARG_TIME, offsetof(starter_conn_t, dpd_timeout), NULL                        },
        { ARG_ENUM, offsetof(starter_conn_t, dpd_action), LST_dpd_action               },

diff --git a/src/starter/confread.c b/src/starter/confread.c
index 3779649514067059b7e2538e7ac6a95ff9ba600c..a003a14d63f47a9f6f8b070753b84f681c19bd07 100644 (file)
--- a/src/starter/confread.c
+++ b/src/starter/confread.c
@@ -35,7 +35,7 @@
 #define ip_version(string)     (strchr(string, '.') ? AF_INET : AF_INET6)
 
 static const char ike_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
-static const char esp_defaults[] = "aes128-sha1,3des-sha1";
+static const char esp_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
 
 static const char firewall_defaults[] = "ipsec _updown iptables";
 
@@ -84,7 +84,7 @@ static void default_values(starter_config_t *cfg)
        cfg->conn_default.startup = STARTUP_NO;
        cfg->conn_default.state   = STATE_IGNORE;
        cfg->conn_default.mode    = MODE_TUNNEL;
-       cfg->conn_default.policy  = POLICY_PFS | POLICY_MOBIKE;
+       cfg->conn_default.policy  = POLICY_MOBIKE;
 
        cfg->conn_default.ike                   = strdupnull(ike_defaults);
        cfg->conn_default.esp                   = strdupnull(esp_defaults);
@@ -561,9 +561,6 @@ static void load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg
                                cfg->err++;
                        }
                        break;
-               case KW_PFS:
-                       KW_POLICY_FLAG("yes", "no", POLICY_PFS)
-                       break;
                case KW_COMPRESS:
                        KW_POLICY_FLAG("yes", "no", POLICY_COMPRESS)
                        break;

diff --git a/src/starter/confread.h b/src/starter/confread.h
index e9a77d4386bd816e6c0ac13b92be0f7368723f67..0aa6bd5157510db33dd35ae02dd6937feab695da 100644 (file)
--- a/src/starter/confread.h
+++ b/src/starter/confread.h
@@ -143,7 +143,6 @@ struct starter_conn {
 
                char            *esp;
                char            *ike;
-               char            *pfsgroup;
 
                time_t          dpd_delay;
                time_t          dpd_timeout;

diff --git a/src/starter/keywords.h b/src/starter/keywords.h
index c1b98dffc920c405582ae0488e6ce2d48884ecd6..3af235fecca04ed8c7e3967b92a279999fde2f87 100644 (file)
--- a/src/starter/keywords.h
+++ b/src/starter/keywords.h
@@ -64,7 +64,6 @@ typedef enum {
        KW_CONN_SETUP,
        KW_KEYEXCHANGE,
        KW_TYPE,
-       KW_PFS,
        KW_COMPRESS,
        KW_INSTALLPOLICY,
        KW_AGGRESSIVE,
@@ -87,7 +86,6 @@ typedef enum {
        KW_REAUTH,
        KW_IKE,
        KW_ESP,
-       KW_PFSGROUP,
        KW_DPDDELAY,
        KW_DPDTIMEOUT,
        KW_DPDACTION,

diff --git a/src/starter/keywords.txt b/src/starter/keywords.txt
index 96221778d209bc7659fcc3660679ff7c877562da..ab76eb518c9c24f7b2c1543fbcb40b1189e48f8e 100644 (file)
--- a/src/starter/keywords.txt
+++ b/src/starter/keywords.txt
@@ -57,7 +57,6 @@ pkcs11keepstate,   KW_PKCS11KEEPSTATE
 pkcs11proxy,       KW_PKCS11PROXY
 keyexchange,       KW_KEYEXCHANGE
 type,              KW_TYPE
-pfs,               KW_PFS
 compress,          KW_COMPRESS
 installpolicy,     KW_INSTALLPOLICY
 aggressive,        KW_AGGRESSIVE
@@ -78,7 +77,6 @@ rekey,             KW_REKEY
 reauth,            KW_REAUTH
 esp,               KW_ESP
 ike,               KW_IKE
-pfsgroup,          KW_PFSGROUP
 dpddelay,          KW_DPDDELAY
 dpdtimeout,        KW_DPDTIMEOUT
 dpdaction,         KW_DPDACTION