(racoon 528) How to prevent racoon from accepting unknown self-signed certificates?

[HMeyer <list-999-exp@sblk.de>]

abstract:
- racoon accepts unknown self-signed certificates
- how can racoon be configured to deny those?


hi

i have the following setup:
- 3 vpn gateways with dynamic ips
- scripts which will check for ip changes of any vpn partner and will 
rewrite the kernel rules
- each vpn gateway has his own x509 self-signed certificate and the public 
parts are stored
and symlinked by hash on all other partners.

that works, HOWEVER, _anyone_ can infiltrate that setup using any 
selfsigned certificate
because racoon will only display a warning message if the partners 
certificate is not present
locally and will still setup the connection.
that means:
a) anyone can establish a vpn connection to any of the gateways
b) a man in the middle attack is possible

i am pretty sure that this is not the way it's intended to work :o)

as i don't want to restart racoon everytime the ip changes i'd like to have 
a setup where the only
place the ips appear is in the kernels spd rules.

basically an option which makes racoon deny all unknown certificates would 
already be enough for me.
(although it think that should really be the default, shouldn't it?)

is it possible to have multiple anonymous blocks each having a 
peers_certfile setting so that
racoon will automatically choose the block with the matching peers_certfile 
entry and deny all
other requests?
is there any way to disable send_cert and send_cr if i am not using a 
peers_certfile parameter?

thanks.

mfg
h. meyer

PS: comments on the security and other aspects of my configuration are welcome.
btw. is there any way to use a 512bit sha as authentication mechanism?
and which keysize does "encryption_algorithm aes" use?



>>>racoon.conf (exactly the same on all 3 vpn gateways, only using 
different local keys)
path certificate "/etc/racoon/certs";
remote anonymous
{
    exchange_mode aggressive,main;
    my_identifier asn1dn;
    peers_identifier asn1dn;
    verify_identifier on;
    certificate_type x509 "local.public" "local.private";
    send_cert on;
    send_cr on;
    verify_cert on;
    passive off;
    generate_policy off;
    nat_traversal on;
    lifetime time 3 min;
    proposal {
	encryption_algorithm aes;
	hash_algorithm sha1;
	authentication_method rsasig;
	dh_group modp1024;
    }
}
sainfo anonymous
{
	lifetime time 1 hour;
        pfs_group modp1024;
        encryption_algorithm aes;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}


>>>spd setup (for only 2 vpn gateways)
#!/usr/sbin/setkey -f
flush;
spdflush;
spdadd $MYIP $OTHERIP any -P out ipsec
    esp/transport//require
    ah/transport//require;
spdadd $OTHERIP $MYIP any -P in ipsec
    esp/transport//require
    ah/transport//require;