From ab65a3e8fc1a3ca4c6e72e11af84d2f51abf6db9 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 6 Mar 2015 16:10:41 +0100 Subject: [PATCH] tkm: Disable RFC 7427 signature authentication TKM can't verify such signatures so we'd fail in the authorize hook. Skipping the algorithm identifier doesn't help if the peer uses anything other than SHA-1, so config changes would be required. --- src/charon-tkm/src/charon-tkm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/charon-tkm/src/charon-tkm.c b/src/charon-tkm/src/charon-tkm.c index a6770fc507..7c60f0ca80 100644 --- a/src/charon-tkm/src/charon-tkm.c +++ b/src/charon-tkm/src/charon-tkm.c @@ -276,6 +276,10 @@ int main(int argc, char *argv[]) goto deinit; } + /* the authorize hook currently does not support RFC 7427 signature auth */ + lib->settings->set_bool(lib->settings, "%s.signature_authentication", FALSE, + dmn_name); + /* make sure we log to the DAEMON facility by default */ lib->settings->set_int(lib->settings, "%s.syslog.daemon.default", lib->settings->get_int(lib->settings, "%s.syslog.daemon.default", 1, -- 2.47.2