Conversation
A Fortigate that authenticates with a FortiToken sends XAUTH_TYPE 2 rather than 0, so requiring the generic type aborts the handshake with xauth packet unsupported: (ISAKMP_N_ATTRIBUTES_NOT_SUPPORTED)(13) right after the password prompt, on a gateway that is otherwise happy to talk to us. Nothing in the exchange is driven by that value: which credentials we send is decided by the attributes the server asks for, which we validate individually anyway. So check that the type is well formed and note anything unusual at debug level 2 instead of refusing to continue. Name the offending attribute when we do reject one, too. Without it an unsupported attribute and an unsupported type produce the same bare (13) and neither says which attribute was at fault.
We advertise md5, des, 3des and null in both the IKE and the quick mode proposals, and then call error(1) the moment the peer selects one of them, telling the user to pass --enable-weak-authentication or --enable-weak-encryption. Offering an algorithm we will not accept can only lose us a handshake we had already won: a Fortigate that pairs md5 with dh2 in one of its phase 1 proposals answers with IKE SA selected psk+xauth-aes256-md5 Peer has selected md5 as authentication method. and the connection dies after phase 1 completed, even though the same gateway negotiates aes256-sha1 happily once md5 is off the table. Filter the proposals through the --enable-* options that already decide whether we would accept the result. The checks on the peer's selection stay as they are; they still catch a gateway that picks something we never offered.
Owner
|
Hello @kobosko, thanks for your contribution!
Thanks :) |
Author
|
Closing this PR for now to re-evaluate it on my personal fork and will come back with a new one soon. :) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ported FortiToken support from https://github.com/falkevik/vpnc
on top of streambinder:master which is still maintained (security fixes).