From 73ab7a1e36bf96f52352f6f83927c3da90f114fd Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Thu, 10 Jan 2008 19:32:53 +0000 Subject: add support for overriding IKE dh group (#251506, ) --- sysconfig/network-scripts/ifup-ipsec | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'sysconfig') diff --git a/sysconfig/network-scripts/ifup-ipsec b/sysconfig/network-scripts/ifup-ipsec index ebad848c..13a883b7 100755 --- a/sysconfig/network-scripts/ifup-ipsec +++ b/sysconfig/network-scripts/ifup-ipsec @@ -102,6 +102,7 @@ if [ "$KEYING" = "manual" ]; then [ -n "$KEY_ESP_IN" ] && SPD_ESP_IN=yes [ -n "$KEY_ESP_OUT" ] && SPD_ESP_OUT=yes else + [ -z "$IKE_DHGROUP" ] && IKE_DHGROUP=2 [ -z "$AH_PROTO" ] && AH_PROTO=sha1 [ -z "$ESP_PROTO" ] && ESP_PROTO=3des @@ -179,7 +180,7 @@ EOF encryption_algorithm $ESP_PROTO; hash_algorithm $AH_PROTO; authentication_method pre_shared_key; - dh_group 2 ; + dh_group $IKE_DHGROUP; } } EOF @@ -201,7 +202,7 @@ EOF encryption_algorithm $ESP_PROTO; hash_algorithm $AH_PROTO; authentication_method rsasig; - dh_group 2; + dh_group $IKE_DHGROUP; } } EOF @@ -213,7 +214,7 @@ EOF encryption_algorithm $ESP_PROTO; hash_algorithm $AH_PROTO; authentication_method gssapi_krb; - dh_group 2 ; + dh_group $IKE_DHGROUP; } } EOF -- cgit v1.2.1