Remove MODP groups from default ESP proposal

This now actually makes pfs=no the default and it equals the default
listed in ipsec.conf.5. efc69e9f preserved the default of pfs=yes.

diff --git a/src/starter/confread.c b/src/starter/confread.c
index 6e3ac17d901de2d16ab5fd1d971a6e53e9cdbf75..fecb998df654df95daceb447d52926e6de67e685 100644 (file)
--- a/src/starter/confread.c
+++ b/src/starter/confread.c
@@ -36,7 +36,7 @@
 #define SA_REPLACEMENT_RETRIES_DEFAULT   3
 
 static const char ike_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
-static const char esp_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
+static const char esp_defaults[] = "aes128-sha1,3des-sha1";
 
 static const char firewall_defaults[] = "ipsec _updown iptables";