diff --git a/src/libcharon/config/child_cfg.c b/src/libcharon/config/child_cfg.c index 73cb02bd9..e0aee8b6a 100644 --- a/src/libcharon/config/child_cfg.c +++ b/src/libcharon/config/child_cfg.c @@ -209,16 +209,18 @@ METHOD(child_cfg_t, get_proposals, linked_list_t*, { enumerator_t *enumerator; proposal_t *current; + proposal_selection_flag_t flags = 0; linked_list_t *proposals = linked_list_create(); + if (strip_dh) + { + flags |= PROPOSAL_SKIP_DH; + } + enumerator = this->proposals->create_enumerator(this->proposals); while (enumerator->enumerate(enumerator, ¤t)) { - current = current->clone(current); - if (strip_dh) - { - current->strip_dh(current, MODP_NONE); - } + current = current->clone(current, flags); if (proposals->find_first(proposals, match_proposal, NULL, current)) { current->destroy(current); @@ -234,69 +236,10 @@ METHOD(child_cfg_t, get_proposals, linked_list_t*, } METHOD(child_cfg_t, select_proposal, proposal_t*, - private_child_cfg_t*this, linked_list_t *proposals, bool strip_dh, - bool private, bool prefer_self) + private_child_cfg_t*this, linked_list_t *proposals, + proposal_selection_flag_t flags) { - enumerator_t *prefer_enum, *match_enum; - proposal_t *proposal, *match, *selected = NULL; - - if (prefer_self) - { - prefer_enum = this->proposals->create_enumerator(this->proposals); - match_enum = proposals->create_enumerator(proposals); - } - else - { - prefer_enum = proposals->create_enumerator(proposals); - match_enum = this->proposals->create_enumerator(this->proposals); - } - - while (prefer_enum->enumerate(prefer_enum, &proposal)) - { - proposal = proposal->clone(proposal); - if (strip_dh) - { - proposal->strip_dh(proposal, MODP_NONE); - } - if (prefer_self) - { - proposals->reset_enumerator(proposals, match_enum); - } - else - { - this->proposals->reset_enumerator(this->proposals, match_enum); - } - while (match_enum->enumerate(match_enum, &match)) - { - match = match->clone(match); - if (strip_dh) - { - match->strip_dh(match, MODP_NONE); - } - selected = proposal->select(proposal, match, prefer_self, private); - match->destroy(match); - if (selected) - { - DBG2(DBG_CFG, "received proposals: %#P", proposals); - DBG2(DBG_CFG, "configured proposals: %#P", this->proposals); - DBG1(DBG_CFG, "selected proposal: %P", selected); - break; - } - } - proposal->destroy(proposal); - if (selected) - { - break; - } - } - prefer_enum->destroy(prefer_enum); - match_enum->destroy(match_enum); - if (!selected) - { - DBG1(DBG_CFG, "received proposals: %#P", proposals); - DBG1(DBG_CFG, "configured proposals: %#P", this->proposals); - } - return selected; + return proposal_select(this->proposals, proposals, flags); } METHOD(child_cfg_t, add_traffic_selector, void, diff --git a/src/libcharon/config/child_cfg.h b/src/libcharon/config/child_cfg.h index b80268513..13ec6d87b 100644 --- a/src/libcharon/config/child_cfg.h +++ b/src/libcharon/config/child_cfg.h @@ -99,14 +99,11 @@ struct child_cfg_t { * Returned propsal is newly created and must be destroyed after usage. * * @param proposals list from which proposals are selected - * @param strip_dh TRUE strip out diffie hellman groups - * @param private accept algorithms from a private range - * @param prefer_self whether to prefer configured or supplied proposals + * @param flags flags to consider during proposal selection * @return selected proposal, or NULL if nothing matches */ proposal_t* (*select_proposal)(child_cfg_t*this, linked_list_t *proposals, - bool strip_dh, bool private, - bool prefer_self); + proposal_selection_flag_t flags); /** * Add a traffic selector to the config. diff --git a/src/libcharon/config/ike_cfg.c b/src/libcharon/config/ike_cfg.c index d99abbced..79a344e45 100644 --- a/src/libcharon/config/ike_cfg.c +++ b/src/libcharon/config/ike_cfg.c @@ -310,7 +310,7 @@ METHOD(ike_cfg_t, get_proposals, linked_list_t*, enumerator = this->proposals->create_enumerator(this->proposals); while (enumerator->enumerate(enumerator, ¤t)) { - current = current->clone(current); + current = current->clone(current, 0); proposals->insert_last(proposals, current); } enumerator->destroy(enumerator); @@ -329,7 +329,8 @@ METHOD(ike_cfg_t, has_proposal, bool, enumerator = this->proposals->create_enumerator(this->proposals); while (enumerator->enumerate(enumerator, &proposal)) { - if (proposal->matches(proposal, match, private)) + if (proposal->matches(proposal, match, + private ? 0 : PROPOSAL_SKIP_PRIVATE)) { enumerator->destroy(enumerator); return TRUE; @@ -340,57 +341,10 @@ METHOD(ike_cfg_t, has_proposal, bool, } METHOD(ike_cfg_t, select_proposal, proposal_t*, - private_ike_cfg_t *this, linked_list_t *proposals, bool private, - bool prefer_self) + private_ike_cfg_t *this, linked_list_t *proposals, + proposal_selection_flag_t flags) { - enumerator_t *prefer_enum, *match_enum; - proposal_t *proposal, *match, *selected = NULL; - - if (prefer_self) - { - prefer_enum = this->proposals->create_enumerator(this->proposals); - match_enum = proposals->create_enumerator(proposals); - } - else - { - prefer_enum = proposals->create_enumerator(proposals); - match_enum = this->proposals->create_enumerator(this->proposals); - } - - while (prefer_enum->enumerate(prefer_enum, (void**)&proposal)) - { - if (prefer_self) - { - proposals->reset_enumerator(proposals, match_enum); - } - else - { - this->proposals->reset_enumerator(this->proposals, match_enum); - } - while (match_enum->enumerate(match_enum, (void**)&match)) - { - selected = proposal->select(proposal, match, prefer_self, private); - if (selected) - { - DBG2(DBG_CFG, "received proposals: %#P", proposals); - DBG2(DBG_CFG, "configured proposals: %#P", this->proposals); - DBG1(DBG_CFG, "selected proposal: %P", selected); - break; - } - } - if (selected) - { - break; - } - } - prefer_enum->destroy(prefer_enum); - match_enum->destroy(match_enum); - if (!selected) - { - DBG1(DBG_CFG, "received proposals: %#P", proposals); - DBG1(DBG_CFG, "configured proposals: %#P", this->proposals); - } - return selected; + return proposal_select(this->proposals, proposals, flags); } METHOD(ike_cfg_t, get_dh_group, diffie_hellman_group_t, diff --git a/src/libcharon/config/ike_cfg.h b/src/libcharon/config/ike_cfg.h index 9c697dadc..1e11a1e56 100644 --- a/src/libcharon/config/ike_cfg.h +++ b/src/libcharon/config/ike_cfg.h @@ -186,12 +186,11 @@ struct ike_cfg_t { * Returned proposal must be destroyed after use. * * @param proposals list of proposals to select from - * @param private accept algorithms from a private range - * @param prefer_self whether to prefer configured or supplied proposals + * @param flags flags to consider during proposal selection * @return selected proposal, or NULL if none matches. */ proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals, - bool private, bool prefer_self); + proposal_selection_flag_t flags); /** * Check if the config has a matching proposal. diff --git a/src/libcharon/plugins/load_tester/load_tester_config.c b/src/libcharon/plugins/load_tester/load_tester_config.c index 6fb667375..77c9630ca 100644 --- a/src/libcharon/plugins/load_tester/load_tester_config.c +++ b/src/libcharon/plugins/load_tester/load_tester_config.c @@ -749,7 +749,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num) ike.local_port = charon->socket->get_port(charon->socket, FALSE); } ike_cfg = ike_cfg_create(&ike); - ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal)); + ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal, 0)); peer_cfg = peer_cfg_create("load-test", ike_cfg, &peer); if (this->vip) @@ -784,7 +784,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num) } child_cfg = child_cfg_create("load-test", &child); - child_cfg->add_proposal(child_cfg, this->esp->clone(this->esp)); + child_cfg->add_proposal(child_cfg, this->esp->clone(this->esp, 0)); if (num) { /* initiator */ diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c index fc60b413f..b11236b8f 100644 --- a/src/libcharon/sa/child_sa.c +++ b/src/libcharon/sa/child_sa.c @@ -429,7 +429,7 @@ METHOD(child_sa_t, get_proposal, proposal_t*, METHOD(child_sa_t, set_proposal, void, private_child_sa_t *this, proposal_t *proposal) { - this->proposal = proposal->clone(proposal); + this->proposal = proposal->clone(proposal, 0); } METHOD(child_sa_t, create_ts_enumerator, enumerator_t*, diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c index 4e60ed8e2..d6cc4e5a7 100644 --- a/src/libcharon/sa/ike_sa.c +++ b/src/libcharon/sa/ike_sa.c @@ -610,7 +610,7 @@ METHOD(ike_sa_t, set_proposal, void, private_ike_sa_t *this, proposal_t *proposal) { DESTROY_IF(this->proposal); - this->proposal = proposal->clone(proposal); + this->proposal = proposal->clone(proposal, 0); } METHOD(ike_sa_t, set_message_id, void, diff --git a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c index 023119dd4..94c3b7682 100644 --- a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c +++ b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c @@ -374,8 +374,8 @@ METHOD(task_t, process_r, status_t, id_payload_t *id_payload; identification_t *id; linked_list_t *list; + proposal_selection_flag_t flags = PROPOSAL_SKIP_PRIVATE; uint16_t group; - bool prefer_configured; this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa); DBG0(DBG_IKE, "%H is initiating a Aggressive Mode IKE_SA", @@ -399,10 +399,13 @@ METHOD(task_t, process_r, status_t, } list = sa_payload->get_proposals(sa_payload); - prefer_configured = lib->settings->get_bool(lib->settings, - "%s.prefer_configured_proposals", TRUE, lib->ns); - this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, - list, FALSE, prefer_configured); + if (!lib->settings->get_bool(lib->settings, + "%s.prefer_configured_proposals", TRUE, lib->ns)) + { + flags = PROPOSAL_PREFER_SUPPLIED; + } + this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, list, + flags); list->destroy_offset(list, offsetof(proposal_t, destroy)); if (!this->proposal) { @@ -641,8 +644,7 @@ METHOD(task_t, process_i, status_t, return send_notify(this, INVALID_PAYLOAD_TYPE); } list = sa_payload->get_proposals(sa_payload); - this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, - list, FALSE, TRUE); + this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, list, 0); list->destroy_offset(list, offsetof(proposal_t, destroy)); if (!this->proposal) { diff --git a/src/libcharon/sa/ikev1/tasks/main_mode.c b/src/libcharon/sa/ikev1/tasks/main_mode.c index b60c84992..43848ad1a 100644 --- a/src/libcharon/sa/ikev1/tasks/main_mode.c +++ b/src/libcharon/sa/ikev1/tasks/main_mode.c @@ -362,7 +362,7 @@ METHOD(task_t, process_r, status_t, { linked_list_t *list; sa_payload_t *sa_payload; - bool private, prefer_configured; + proposal_selection_flag_t flags = 0; this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa); DBG0(DBG_IKE, "%H is initiating a Main Mode IKE_SA", @@ -386,12 +386,17 @@ METHOD(task_t, process_r, status_t, } list = sa_payload->get_proposals(sa_payload); - private = this->ike_sa->supports_extension(this->ike_sa, - EXT_STRONGSWAN); - prefer_configured = lib->settings->get_bool(lib->settings, - "%s.prefer_configured_proposals", TRUE, lib->ns); + if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)) + { + flags |= PROPOSAL_SKIP_PRIVATE; + } + if (!lib->settings->get_bool(lib->settings, + "%s.prefer_configured_proposals", TRUE, lib->ns)) + { + flags |= PROPOSAL_PREFER_SUPPLIED; + } this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, - list, private, prefer_configured); + list, flags); list->destroy_offset(list, offsetof(proposal_t, destroy)); if (!this->proposal) { @@ -624,8 +629,8 @@ METHOD(task_t, process_i, status_t, linked_list_t *list; sa_payload_t *sa_payload; auth_method_t method; + proposal_selection_flag_t flags = 0; uint32_t lifetime; - bool private; sa_payload = (sa_payload_t*)message->get_payload(message, PLV1_SECURITY_ASSOCIATION); @@ -635,10 +640,12 @@ METHOD(task_t, process_i, status_t, return send_notify(this, INVALID_PAYLOAD_TYPE); } list = sa_payload->get_proposals(sa_payload); - private = this->ike_sa->supports_extension(this->ike_sa, - EXT_STRONGSWAN); + if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)) + { + flags |= PROPOSAL_SKIP_PRIVATE; + } this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, - list, private, TRUE); + list, flags); list->destroy_offset(list, offsetof(proposal_t, destroy)); if (!this->proposal) { diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c index 128f027c8..9ded2dd53 100644 --- a/src/libcharon/sa/ikev1/tasks/quick_mode.c +++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c @@ -802,7 +802,7 @@ static linked_list_t *get_proposals(private_quick_mode_t *this, proposal->destroy(proposal); continue; } - proposal->strip_dh(proposal, group); + proposal->promote_dh_group(proposal, group); } proposal->set_spi(proposal, this->spi_i); } @@ -852,7 +852,7 @@ METHOD(task_t, build_i, status_t, } } - list = this->config->get_proposals(this->config, MODP_NONE); + list = this->config->get_proposals(this->config, FALSE); if (list->get_first(list, (void**)&proposal) == SUCCESS) { this->proto = proposal->get_protocol(proposal); @@ -1072,7 +1072,7 @@ METHOD(task_t, process_r, status_t, linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL; peer_cfg_t *peer_cfg; uint16_t group; - bool private, prefer_configured; + proposal_selection_flag_t flags = 0; sa_payload = (sa_payload_t*)message->get_payload(message, PLV1_SECURITY_ASSOCIATION); @@ -1132,12 +1132,17 @@ METHOD(task_t, process_r, status_t, DESTROY_IF(list); list = sa_payload->get_proposals(sa_payload); } - private = this->ike_sa->supports_extension(this->ike_sa, - EXT_STRONGSWAN); - prefer_configured = lib->settings->get_bool(lib->settings, - "%s.prefer_configured_proposals", TRUE, lib->ns); + if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)) + { + flags |= PROPOSAL_SKIP_PRIVATE; + } + if (!lib->settings->get_bool(lib->settings, + "%s.prefer_configured_proposals", TRUE, lib->ns)) + { + flags |= PROPOSAL_PREFER_SUPPLIED; + } this->proposal = this->config->select_proposal(this->config, list, - FALSE, private, prefer_configured); + flags); list->destroy_offset(list, offsetof(proposal_t, destroy)); get_lifetimes(this); @@ -1340,7 +1345,7 @@ METHOD(task_t, process_i, status_t, { sa_payload_t *sa_payload; linked_list_t *list = NULL; - bool private; + proposal_selection_flag_t flags = 0; sa_payload = (sa_payload_t*)message->get_payload(message, PLV1_SECURITY_ASSOCIATION); @@ -1365,10 +1370,12 @@ METHOD(task_t, process_i, status_t, DESTROY_IF(list); list = sa_payload->get_proposals(sa_payload); } - private = this->ike_sa->supports_extension(this->ike_sa, - EXT_STRONGSWAN); + if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)) + { + flags |= PROPOSAL_SKIP_PRIVATE; + } this->proposal = this->config->select_proposal(this->config, list, - FALSE, private, TRUE); + flags); list->destroy_offset(list, offsetof(proposal_t, destroy)); if (!this->proposal) { diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c index ac1f9994a..e98c1dbcc 100644 --- a/src/libcharon/sa/ikev2/tasks/child_create.c +++ b/src/libcharon/sa/ikev2/tasks/child_create.c @@ -544,7 +544,7 @@ static status_t select_and_install(private_child_create_t *this, chunk_t integ_i = chunk_empty, integ_r = chunk_empty; linked_list_t *my_ts, *other_ts; host_t *me, *other; - bool private, prefer_configured; + proposal_selection_flag_t flags = 0; if (this->proposals == NULL) { @@ -560,11 +560,21 @@ static status_t select_and_install(private_child_create_t *this, me = this->ike_sa->get_my_host(this->ike_sa); other = this->ike_sa->get_other_host(this->ike_sa); - private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN); - prefer_configured = lib->settings->get_bool(lib->settings, - "%s.prefer_configured_proposals", TRUE, lib->ns); + if (no_dh) + { + flags |= PROPOSAL_SKIP_DH; + } + if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)) + { + flags |= PROPOSAL_SKIP_PRIVATE; + } + if (!lib->settings->get_bool(lib->settings, + "%s.prefer_configured_proposals", TRUE, lib->ns)) + { + flags |= PROPOSAL_PREFER_SUPPLIED; + } this->proposal = this->config->select_proposal(this->config, - this->proposals, no_dh, private, prefer_configured); + this->proposals, flags); if (this->proposal == NULL) { DBG1(DBG_IKE, "no acceptable proposal found"); diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c index 04ce5045e..d15b5b107 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_init.c +++ b/src/libcharon/sa/ikev2/tasks/ike_init.c @@ -453,17 +453,21 @@ static void process_sa_payload(private_ike_init_t *this, message_t *message, enumerator_t *enumerator; linked_list_t *proposal_list; host_t *me, *other; - bool private, prefer_configured; + proposal_selection_flag_t flags = 0; ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa); proposal_list = sa_payload->get_proposals(sa_payload); - private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN); - prefer_configured = lib->settings->get_bool(lib->settings, - "%s.prefer_configured_proposals", TRUE, lib->ns); - - this->proposal = ike_cfg->select_proposal(ike_cfg, proposal_list, private, - prefer_configured); + if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)) + { + flags |= PROPOSAL_SKIP_PRIVATE; + } + if (!lib->settings->get_bool(lib->settings, + "%s.prefer_configured_proposals", TRUE, lib->ns)) + { + flags |= PROPOSAL_PREFER_SUPPLIED; + } + this->proposal = ike_cfg->select_proposal(ike_cfg, proposal_list, flags); if (!this->proposal) { if (!this->initiator && !this->old_sa) @@ -481,7 +485,7 @@ static void process_sa_payload(private_ike_init_t *this, message_t *message, DBG1(DBG_IKE, "no matching proposal found, trying alternative " "config"); this->proposal = cfg->select_proposal(cfg, proposal_list, - private, prefer_configured); + flags); if (this->proposal) { alt_cfg = cfg->get_ref(cfg); diff --git a/src/libstrongswan/crypto/proposal/proposal.c b/src/libstrongswan/crypto/proposal/proposal.c index 952608997..560303f78 100644 --- a/src/libstrongswan/crypto/proposal/proposal.c +++ b/src/libstrongswan/crypto/proposal/proposal.c @@ -302,44 +302,12 @@ METHOD(proposal_t, promote_dh_group, bool, return found; } -METHOD(proposal_t, strip_dh, void, - private_proposal_t *this, diffie_hellman_group_t keep) -{ - enumerator_t *enumerator; - entry_t *entry; - bool found = FALSE; - - enumerator = array_create_enumerator(this->transforms); - while (enumerator->enumerate(enumerator, &entry)) - { - if (entry->type == DIFFIE_HELLMAN_GROUP) - { - if (entry->alg != keep) - { - array_remove_at(this->transforms, enumerator); - } - else - { - found = TRUE; - } - } - } - enumerator->destroy(enumerator); - array_compress(this->transforms); - - if (keep == MODP_NONE || !found) - { - remove_type(this, DIFFIE_HELLMAN_GROUP); - array_compress(this->types); - } -} - /** * Select a matching proposal from this and other. */ static bool select_algo(private_proposal_t *this, proposal_t *other, - transform_type_t type, bool priv, bool log, - uint16_t *alg, uint16_t *ks) + transform_type_t type, proposal_selection_flag_t flags, + bool log, uint16_t *alg, uint16_t *ks) { enumerator_t *e1, *e2; uint16_t alg1, alg2, ks1, ks2; @@ -390,7 +358,7 @@ static bool select_algo(private_proposal_t *this, proposal_t *other, { if (alg1 == alg2 && ks1 == ks2) { - if (!priv && alg1 >= 1024) + if ((flags & PROPOSAL_SKIP_PRIVATE) && alg1 >= 1024) { if (log) { @@ -417,7 +385,7 @@ static bool select_algo(private_proposal_t *this, proposal_t *other, * is stored there and errors are logged. */ static bool select_algos(private_proposal_t *this, proposal_t *other, - proposal_t *selected, bool private) + proposal_t *selected, proposal_selection_flag_t flags) { transform_type_t type; array_t *types; @@ -434,7 +402,11 @@ static bool select_algos(private_proposal_t *this, proposal_t *other, { continue; } - if (select_algo(this, other, type, private, selected != NULL, &alg, &ks)) + if (type == DIFFIE_HELLMAN_GROUP && (flags & PROPOSAL_SKIP_DH)) + { + continue; + } + if (select_algo(this, other, type, flags, selected != NULL, &alg, &ks)) { if (alg == 0 && type != EXTENDED_SEQUENCE_NUMBERS) { /* 0 is "valid" for extended sequence numbers, for other @@ -468,8 +440,8 @@ static bool select_algos(private_proposal_t *this, proposal_t *other, } METHOD(proposal_t, select_proposal, proposal_t*, - private_proposal_t *this, proposal_t *other, bool other_remote, - bool private) + private_proposal_t *this, proposal_t *other, + proposal_selection_flag_t flags) { proposal_t *selected; @@ -481,18 +453,18 @@ METHOD(proposal_t, select_proposal, proposal_t*, return NULL; } - if (other_remote) - { - selected = proposal_create(this->protocol, other->get_number(other)); - selected->set_spi(selected, other->get_spi(other)); - } - else + if (flags & PROPOSAL_PREFER_SUPPLIED) { selected = proposal_create(this->protocol, this->number); selected->set_spi(selected, this->spi); } + else + { + selected = proposal_create(this->protocol, other->get_number(other)); + selected->set_spi(selected, other->get_spi(other)); + } - if (!select_algos(this, other, selected, private)) + if (!select_algos(this, other, selected, flags)) { selected->destroy(selected); return NULL; @@ -502,13 +474,14 @@ METHOD(proposal_t, select_proposal, proposal_t*, } METHOD(proposal_t, matches, bool, - private_proposal_t *this, proposal_t *other, bool private) + private_proposal_t *this, proposal_t *other, + proposal_selection_flag_t flags) { if (this->protocol != other->get_protocol(other)) { return FALSE; } - return select_algos(this, other, NULL, private); + return select_algos(this, other, NULL, flags); } METHOD(proposal_t, get_protocol, protocol_id_t, @@ -599,25 +572,27 @@ METHOD(proposal_t, equals, bool, } METHOD(proposal_t, clone_, proposal_t*, - private_proposal_t *this) + private_proposal_t *this, proposal_selection_flag_t flags) { private_proposal_t *clone; enumerator_t *enumerator; entry_t *entry; - transform_type_t *type; clone = (private_proposal_t*)proposal_create(this->protocol, 0); enumerator = array_create_enumerator(this->transforms); while (enumerator->enumerate(enumerator, &entry)) { + if (entry->alg >= 1024 && (flags & PROPOSAL_SKIP_PRIVATE)) + { + continue; + } + if (entry->type == DIFFIE_HELLMAN_GROUP && (flags & PROPOSAL_SKIP_DH)) + { + continue; + } array_insert(clone->transforms, ARRAY_TAIL, entry); - } - enumerator->destroy(enumerator); - enumerator = array_create_enumerator(this->types); - while (enumerator->enumerate(enumerator, &type)) - { - array_insert(clone->types, ARRAY_TAIL, type); + add_type(clone->types, entry->type); } enumerator->destroy(enumerator); @@ -954,7 +929,6 @@ proposal_t *proposal_create(protocol_id_t protocol, u_int number) .get_algorithm = _get_algorithm, .has_dh_group = _has_dh_group, .promote_dh_group = _promote_dh_group, - .strip_dh = _strip_dh, .select = _select_proposal, .matches = _matches, .get_protocol = _get_protocol, @@ -1341,3 +1315,59 @@ proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs return &this->public; } + +/* + * Described in header + */ +proposal_t *proposal_select(linked_list_t *configured, linked_list_t *supplied, + proposal_selection_flag_t flags) +{ + enumerator_t *prefer_enum, *match_enum; + proposal_t *proposal, *match, *selected = NULL; + + if (flags & PROPOSAL_PREFER_SUPPLIED) + { + prefer_enum = supplied->create_enumerator(supplied); + match_enum = configured->create_enumerator(configured); + } + else + { + prefer_enum = configured->create_enumerator(configured); + match_enum = supplied->create_enumerator(supplied); + } + + while (prefer_enum->enumerate(prefer_enum, &proposal)) + { + if (flags & PROPOSAL_PREFER_SUPPLIED) + { + configured->reset_enumerator(configured, match_enum); + } + else + { + supplied->reset_enumerator(supplied, match_enum); + } + while (match_enum->enumerate(match_enum, &match)) + { + selected = proposal->select(proposal, match, flags); + if (selected) + { + DBG2(DBG_CFG, "received proposals: %#P", supplied); + DBG2(DBG_CFG, "configured proposals: %#P", configured); + DBG1(DBG_CFG, "selected proposal: %P", selected); + break; + } + } + if (selected) + { + break; + } + } + prefer_enum->destroy(prefer_enum); + match_enum->destroy(match_enum); + if (!selected) + { + DBG1(DBG_CFG, "received proposals: %#P", supplied); + DBG1(DBG_CFG, "configured proposals: %#P", configured); + } + return selected; +} diff --git a/src/libstrongswan/crypto/proposal/proposal.h b/src/libstrongswan/crypto/proposal/proposal.h index 338324326..f2fc4cd6c 100644 --- a/src/libstrongswan/crypto/proposal/proposal.h +++ b/src/libstrongswan/crypto/proposal/proposal.h @@ -23,6 +23,7 @@ #define PROPOSAL_H_ typedef enum protocol_id_t protocol_id_t; +typedef enum proposal_selection_flag_t proposal_selection_flag_t; typedef enum extended_sequence_numbers_t extended_sequence_numbers_t; typedef struct proposal_t proposal_t; @@ -51,6 +52,18 @@ enum protocol_id_t { */ extern enum_name_t *protocol_id_names; +/** + * Flags for selecting proposals + */ +enum proposal_selection_flag_t { + /** Whether to prefer configured (default) or supplied proposals. */ + PROPOSAL_PREFER_SUPPLIED = (1<<0), + /** Whether to skip and ignore algorithms from a private range. */ + PROPOSAL_SKIP_PRIVATE = (1<<1), + /** Whether to skip and ignore diffie hellman groups. */ + PROPOSAL_SKIP_DH = (1<<2), +}; + /** * Stores a set of algorithms used for an SA. * @@ -118,13 +131,6 @@ struct proposal_t { */ bool (*promote_dh_group)(proposal_t *this, diffie_hellman_group_t group); - /** - * Strip DH groups from proposal to use it without PFS. - * - * @param keep group to keep (MODP_NONE to remove all) - */ - void (*strip_dh)(proposal_t *this, diffie_hellman_group_t keep); - /** * Compare two proposal, and select a matching subset. * @@ -132,15 +138,16 @@ struct proposal_t { * compared. If they have at least one algorithm of each type * in common, a resulting proposal of this kind is created. * + * Unless the flag PROPOSAL_PREFER_SUPPLIED is set, other is expected to be + * the remote proposal from which to copy SPI and proposal number to the + * result, otherwise copy from this proposal. + * * @param other proposal to compare against - * @param other_remote whether other is the remote proposal from which to - * copy SPI and proposal number to the result, - * otherwise copy from this proposal - * @param private accepts algorithms allocated in a private range + * @param flags flags to consider during proposal selection * @return selected proposal, NULL if proposals don't match */ proposal_t *(*select)(proposal_t *this, proposal_t *other, - bool other_remote, bool private); + proposal_selection_flag_t flags); /** * Check if the given proposal matches this proposal. @@ -148,10 +155,11 @@ struct proposal_t { * This is similar to select, but no resulting proposal is selected. * * @param other proposal to compare against - * @param private accepts algorithms allocated in a private range + * @param flags flags to consider during proposal selection * @return TRUE if the proposals match */ - bool (*matches)(proposal_t *this, proposal_t *other, bool private); + bool (*matches)(proposal_t *this, proposal_t *other, + proposal_selection_flag_t flags); /** * Get the protocol ID of the proposal. @@ -192,9 +200,10 @@ struct proposal_t { /** * Clone a proposal. * + * @param flags flags to consider during cloning * @return clone of proposal */ - proposal_t *(*clone) (proposal_t *this); + proposal_t *(*clone)(proposal_t *this, proposal_selection_flag_t flags); /** * Destroys the proposal object. @@ -240,7 +249,19 @@ proposal_t *proposal_create_default_aead(protocol_id_t protocol); * @param algs algorithms as string * @return proposal_t object */ -proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs); +proposal_t *proposal_create_from_string(protocol_id_t protocol, + const char *algs); + +/** + * Select a common proposal from the given lists of proposals. + * + * @param configured list of configured/local proposals + * @param supplied list of supplied/remote proposals + * @param flags flags to consider during proposal selection + * @return selected proposal, or NULL (allocated) + */ +proposal_t *proposal_select(linked_list_t *configured, linked_list_t *supplied, + proposal_selection_flag_t flags); /** * printf hook function for proposal_t. diff --git a/src/libstrongswan/tests/suites/test_proposal.c b/src/libstrongswan/tests/suites/test_proposal.c index 099cd19c7..c323119ea 100644 --- a/src/libstrongswan/tests/suites/test_proposal.c +++ b/src/libstrongswan/tests/suites/test_proposal.c @@ -88,6 +88,7 @@ static struct { char *self; char *other; char *expected; + proposal_selection_flag_t flags; } select_data[] = { { PROTO_ESP, "aes128", "aes128", "aes128" }, { PROTO_ESP, "aes128", "aes256", NULL }, @@ -96,7 +97,11 @@ static struct { { PROTO_ESP, "aes128-aes256-sha1-sha256", "aes256-aes128-sha256-sha1", "aes128-sha1" }, { PROTO_ESP, "aes256-aes128-sha256-sha1", "aes128-aes256-sha1-sha256", "aes256-sha256" }, { PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", NULL }, + { PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", "aes128-sha256", PROPOSAL_SKIP_DH }, { PROTO_ESP, "aes128-sha256", "aes128-sha256-modp3072", NULL }, + { PROTO_ESP, "aes128-sha256", "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH }, + { PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH }, + { PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-ecp256", "aes128-sha256", PROPOSAL_SKIP_DH }, { PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modpnone", NULL }, { PROTO_ESP, "aes128-sha256-modpnone", "aes128-sha256-modp3072", NULL }, { PROTO_ESP, "aes128-sha256-modp3072-modpnone", "aes128-sha256", "aes128-sha256" }, @@ -121,7 +126,7 @@ START_TEST(test_select) select_data[_i].self); other = proposal_create_from_string(select_data[_i].proto, select_data[_i].other); - selected = self->select(self, other, TRUE, FALSE); + selected = self->select(self, other, select_data[_i].flags); if (select_data[_i].expected) { expected = proposal_create_from_string(select_data[_i].proto, @@ -149,12 +154,12 @@ START_TEST(test_select_spi) other = proposal_create_from_string(PROTO_ESP, "aes128-sha256-modp3072"); other->set_spi(other, 0x12345678); - selected = self->select(self, other, TRUE, FALSE); + selected = self->select(self, other, 0); ck_assert(selected); ck_assert_int_eq(selected->get_spi(selected), other->get_spi(other)); selected->destroy(selected); - selected = self->select(self, other, FALSE, FALSE); + selected = self->select(self, other, PROPOSAL_PREFER_SUPPLIED); ck_assert(selected); ck_assert_int_eq(selected->get_spi(selected), self->get_spi(self)); selected->destroy(selected); @@ -174,19 +179,101 @@ START_TEST(test_matches) select_data[_i].other); if (select_data[_i].expected) { - ck_assert(self->matches(self, other, FALSE)); - ck_assert(other->matches(other, self, FALSE)); + ck_assert(self->matches(self, other, select_data[_i].flags)); + ck_assert(other->matches(other, self, select_data[_i].flags)); + ck_assert(self->matches(self, other, + select_data[_i].flags | PROPOSAL_PREFER_SUPPLIED)); + ck_assert(other->matches(other, self, + select_data[_i].flags | PROPOSAL_PREFER_SUPPLIED)); } else { - ck_assert(!self->matches(self, other, FALSE)); - ck_assert(!other->matches(other, self, FALSE)); + ck_assert(!self->matches(self, other, select_data[_i].flags)); + ck_assert(!other->matches(other, self, select_data[_i].flags)); + ck_assert(!self->matches(self, other, + select_data[_i].flags | PROPOSAL_PREFER_SUPPLIED)); + ck_assert(!other->matches(other, self, + select_data[_i].flags | PROPOSAL_PREFER_SUPPLIED)); } other->destroy(other); self->destroy(self); } END_TEST +static struct { + protocol_id_t proto; + char *self[5]; + char *other[5]; + char *expected; + proposal_selection_flag_t flags; +} select_proposal_data[] = { + { PROTO_ESP, {}, {}, NULL }, + { PROTO_ESP, { "aes128" }, {}, NULL }, + { PROTO_ESP, {}, { "aes128" }, NULL }, + { PROTO_ESP, { "aes128" }, { "aes256" }, NULL }, + { PROTO_ESP, { "aes128" }, { "aes128" }, "aes128" }, + { PROTO_ESP, { "aes128", "aes256" }, { "aes256", "aes128" }, "aes128" }, + { PROTO_ESP, { "aes128", "aes256" }, { "aes256", "aes128" }, "aes256", + PROPOSAL_PREFER_SUPPLIED }, + { PROTO_ESP, { "aes128-modp1024", "aes256-modp1024" }, + { "aes256-modp2048", "aes128-modp2048" }, NULL }, + { PROTO_ESP, { "aes128-modp1024", "aes256-modp1024" }, + { "aes256-modp2048", "aes128-modp2048" }, "aes128", + PROPOSAL_SKIP_DH }, + { PROTO_ESP, { "aes128-modp1024", "aes256-modp1024" }, + { "aes256-modp2048", "aes128-modp2048" }, "aes256", + PROPOSAL_PREFER_SUPPLIED | PROPOSAL_SKIP_DH }, +}; + +START_TEST(test_select_proposal) +{ + linked_list_t *self, *other; + proposal_t *proposal, *selected, *expected; + int i; + + self = linked_list_create(); + other = linked_list_create(); + + for (i = 0; i < countof(select_proposal_data[_i].self); i++) + { + if (!select_proposal_data[_i].self[i]) + { + break; + } + proposal = proposal_create_from_string(select_proposal_data[_i].proto, + select_proposal_data[_i].self[i]); + self->insert_last(self, proposal); + } + for (i = 0; i < countof(select_proposal_data[_i].other); i++) + { + if (!select_proposal_data[_i].other[i]) + { + break; + } + proposal = proposal_create_from_string(select_proposal_data[_i].proto, + select_proposal_data[_i].other[i]); + other->insert_last(other, proposal); + } + selected = proposal_select(self, other, select_proposal_data[_i].flags); + if (select_proposal_data[_i].expected) + { + expected = proposal_create_from_string(select_proposal_data[_i].proto, + select_proposal_data[_i].expected); + ck_assert(selected); + ck_assert_msg(expected->equals(expected, selected), "proposal %P does " + "not match expected %P", selected, expected); + expected->destroy(expected); + } + else + { + ck_assert(!selected); + } + DESTROY_IF(selected); + other->destroy_offset(other, offsetof(proposal_t, destroy)); + self->destroy_offset(self, offsetof(proposal_t, destroy)); +} +END_TEST + START_TEST(test_promote_dh_group) { proposal_t *proposal; @@ -267,7 +354,7 @@ START_TEST(test_unknown_transform_types_select_fail) other = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256"); other->add_algorithm(other, 242, 42, 0); - selected = self->select(self, other, TRUE, FALSE); + selected = self->select(self, other, 0); ck_assert(!selected); other->destroy(other); self->destroy(self); @@ -283,7 +370,7 @@ START_TEST(test_unknown_transform_types_select_fail_subtype) other = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256"); other->add_algorithm(other, 242, 42, 0); - selected = self->select(self, other, TRUE, FALSE); + selected = self->select(self, other, 0); ck_assert(!selected); other->destroy(other); self->destroy(self); @@ -300,7 +387,7 @@ START_TEST(test_unknown_transform_types_select_success) other->add_algorithm(other, 242, 42, 128); other->add_algorithm(other, 242, 1, 0); - selected = self->select(self, other, TRUE, FALSE); + selected = self->select(self, other, 0); ck_assert(selected); assert_proposal_eq(selected, "IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256/UNKNOWN_242_42_128"); selected->destroy(selected); @@ -323,6 +410,44 @@ START_TEST(test_chacha20_poly1305_key_length) } END_TEST +static struct { + protocol_id_t proto; + char *orig; + char *expected; + proposal_selection_flag_t flags; +} clone_data[] = { + { PROTO_ESP, "aes128", "aes128" }, + { PROTO_ESP, "aes128-serpent", "aes128-serpent" }, + { PROTO_ESP, "aes128-serpent", "aes128", PROPOSAL_SKIP_PRIVATE }, + { PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modp3072" }, + { PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH }, + { PROTO_ESP, "aes128-serpent-modp3072", "aes128-serpent", + PROPOSAL_SKIP_DH }, + { PROTO_ESP, "aes128-serpent-modp3072", "aes128", + PROPOSAL_SKIP_PRIVATE | PROPOSAL_SKIP_DH }, +}; + +START_TEST(test_clone) +{ + proposal_t *orig, *result, *expected; + + orig = proposal_create_from_string(clone_data[_i].proto, + clone_data[_i].orig); + orig->set_spi(orig, 0x12345678); + + result = orig->clone(orig, clone_data[_i].flags); + + expected = proposal_create_from_string(clone_data[_i].proto, + clone_data[_i].expected); + ck_assert_msg(expected->equals(expected, result), "proposal %P does " + "not match expected %P", result, expected); + ck_assert_int_eq(orig->get_spi(orig), result->get_spi(result)); + + expected->destroy(expected); + result->destroy(result); + orig->destroy(orig); +} +END_TEST Suite *proposal_suite_create() { @@ -344,6 +469,11 @@ Suite *proposal_suite_create() tcase_add_loop_test(tc, test_matches, 0, countof(select_data)); suite_add_tcase(s, tc); + tc = tcase_create("select_proposal"); + tcase_add_loop_test(tc, test_select_proposal, 0, + countof(select_proposal_data)); + suite_add_tcase(s, tc); + tc = tcase_create("promote_dh_group"); tcase_add_test(tc, test_promote_dh_group); tcase_add_test(tc, test_promote_dh_group_already_front); @@ -362,5 +492,9 @@ Suite *proposal_suite_create() tcase_add_test(tc, test_chacha20_poly1305_key_length); suite_add_tcase(s, tc); + tc = tcase_create("clone"); + tcase_add_loop_test(tc, test_clone, 0, countof(clone_data)); + suite_add_tcase(s, tc); + return s; }