Attachment 160977 Details for Bug 251506 – This patch adds a configuration parameter for the dh group used during PHASE 1 of IPsec SA.

[patch] This patch adds a configuration parameter for the dh group used during PHASE 1 of IPsec SA.

ipsec-tools_sysconfig_add-ike-dhgroup-parameter.diff (text/plain), 1.13 KB, created by Stijn Tintel on 2007-08-09 14:23:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stijn Tintel

Created: 2007-08-09 14:23:34 UTC

Size: 1.13 KB

patch

obsolete

>RedHat's initscripts hardcode the dh group used during PHASE 1 of IPsec SA to 2. This will only work if the other side of the IPsec tunnel to be created also set this to 2.
>
>This patch adds a configuration parameter for the dh group used during PHASE 1 of IPsec SA.
>--- ifup-ipsec	2007-08-09 15:43:28.000000000 +0200
>+++ ifup-ipsec.new	2007-08-09 16:18:59.000000000 +0200
>@@ -102,6 +102,7 @@
>     [ -n "$KEY_ESP_IN" ] && SPD_ESP_IN=yes
>     [ -n "$KEY_ESP_OUT" ] && SPD_ESP_OUT=yes
> else
>+    [ -z "$IKE_DHGROUP" ] && IKE_DH=2
>     [ -z "$AH_PROTO" ] && AH_PROTO=sha1
>     [ -z "$ESP_PROTO" ] && ESP_PROTO=3des
> 
>@@ -179,7 +180,7 @@
> 	        encryption_algorithm $ESP_PROTO;
> 		hash_algorithm $AH_PROTO;
> 		authentication_method pre_shared_key;
>-		dh_group 2 ;
>+		dh_group $IKE_DHGROUP;
> 	}
> }
> EOF
>@@ -201,7 +202,7 @@
> 		encryption_algorithm $ESP_PROTO;
> 		hash_algorithm $AH_PROTO;
> 		authentication_method rsasig;
>-		dh_group 2;
>+		dh_group $IKE_DHGROUP;
> 	}
> }
> EOF
>@@ -213,7 +214,7 @@
> 	        encryption_algorithm $ESP_PROTO;
> 		hash_algorithm $AH_PROTO;
> 		authentication_method gssapi_krb;
>-		dh_group 2 ;
>+		dh_group $IKE_DHGROUP;
> 	}
> }
> EOF

Actions: View | Diff

Attachments on bug 251506: 160977 | 161044