strongSwan: Be lenient about downstream encryption
strongSwan has an "encryption" flag for each payload type.
It uses this flag both to signal whether it should encrypt
these payloads and whether to accept such payloads in an
unencrypted form. Some VPN endpoints do not encrypt their
ID_V1 and HASH_V1 during ID_PROT during an XAUTH
authentication flow. This doesn't expose a lot of
information and does not induce the client to expose
anything either. This CL whitelists these specific payloads
from being rejected if they are not encrypted, but preserves
the client behavior of encrypting these payloads when they
are sent.
BUG=chromium:334620,chromium:267647
TEST=Perform XAUTH based L2TP/IPSec with a SonicWall
network_VPNConnect.l2tpipsec_cert
network_VPNConnect.l2tpipsec_psk
network_VPNConnect.l2tpipsec_xauth
Change-Id: Ie06ea3ca90dca96abf8451160c08736af17f0c41
Reviewed-on: https://chromium-review.googlesource.com/191108
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Paul Stewart <pstew@chromium.org>
Commit-Queue: Paul Stewart <pstew@chromium.org>
3 files changed
