strongSwan

Hi

As mentioned in Bug 2301, comment 9 :

Via XFRM the truncation length can be set explicitly to an arbitrary value (source:src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c#L1485)

Can you tell how to set truncation length in strongswan.conf ?

As mentioned earlier in the bug 2301, Now am not using kernel-pfkey plugin.

But, using custom netxfrm module and i retrieve icv length as below:

x = xfrm_state_lookup(net, mark, xaddr, c->spi, p->id.proto, p->family);
    aalg_desc    = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
    if(aalg_desc){
            c->icv_len = aalg_desc->uinfo.auth.icv_truncbits/8; /* icv trunc len in bytes */
            debug_print("XFRM icv_len=%d, alg_name=%s\n", (int) c->icv_len, x->aalg->alg_name);
    }

Below is the strongswan.conf i use.

1. /etc/strongswan.conf - strongSwan configuration file

charon {

load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
#plugins {

1. kernel-netlink {
2. trunc_len=128;
3. }
4. }
   }

As mentioned in Bug 2301, comment #7, doing kernel changes, i get the truncation length as 128bits and this is fine.

I tried to set netlink parameter as below:

1. kernel-netlink {
2. trunc_len=128;
3. }
4. }

The parameter i tried might be wrong. Is there any such similar option ?

Thanks
Sudheer