Added strongswan.conf options to filter cipher suites by specific algorithms

diff --git a/src/libtls/tls_crypto.c b/src/libtls/tls_crypto.c
index 495b8cb850b72c48f5f4d5499454600ffc45ad61..7c70cb405011688549483f7108a49c1f163deade 100644 (file)
--- a/src/libtls/tls_crypto.c
+++ b/src/libtls/tls_crypto.c
@@ -686,6 +686,174 @@ static void filter_key_suites(private_tls_crypto_t *this,
        *count = remaining;
 }
 
+/**
+ * Filter suites by key exchange user config
+ */
+static void filter_key_exchange_config_suites(private_tls_crypto_t *this,
+                                                                                         suite_algs_t suites[], int *count)
+{
+       enumerator_t *enumerator;
+       int i, remaining = 0;
+       char *token, *config;
+
+       config = lib->settings->get_str(lib->settings, "libtls.key_exchange", NULL);
+       if (config)
+       {
+               for (i = 0; i < *count; i++)
+               {
+                       enumerator = enumerator_create_token(config, ",", " ");
+                       while (enumerator->enumerate(enumerator, &token))
+                       {
+                               if (strcaseeq(token, "ecdhe-ecdsa") &&
+                                       diffie_hellman_group_is_ec(suites[i].dh) &&
+                                       suites[i].key == KEY_ECDSA)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "ecdhe-rsa") &&
+                                       diffie_hellman_group_is_ec(suites[i].dh) &&
+                                       suites[i].key == KEY_RSA)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "dhe-rsa") &&
+                                       !diffie_hellman_group_is_ec(suites[i].dh) &&
+                                       suites[i].dh != MODP_NONE &&
+                                       suites[i].key == KEY_RSA)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "rsa") &&
+                                       suites[i].dh == MODP_NONE &&
+                                       suites[i].key == KEY_RSA)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                       }
+                       enumerator->destroy(enumerator);
+               }
+               *count = remaining;
+       }
+}
+
+/**
+ * Filter suites by cipher user config
+ */
+static void filter_cipher_config_suites(private_tls_crypto_t *this,
+                                                                               suite_algs_t suites[], int *count)
+{
+       enumerator_t *enumerator;
+       int i, remaining = 0;
+       char *token, *config;
+
+       config = lib->settings->get_str(lib->settings, "libtls.cipher", NULL);
+       if (config)
+       {
+               for (i = 0; i < *count; i++)
+               {
+                       enumerator = enumerator_create_token(config, ",", " ");
+                       while (enumerator->enumerate(enumerator, &token))
+                       {
+                               if (strcaseeq(token, "aes128") &&
+                                       suites[i].encr == ENCR_AES_CBC &&
+                                       suites[i].encr_size == 16)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "aes256") &&
+                                       suites[i].encr == ENCR_AES_CBC &&
+                                       suites[i].encr_size == 32)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "camellia128") &&
+                                       suites[i].encr == ENCR_CAMELLIA_CBC &&
+                                       suites[i].encr_size == 16)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "camellia256") &&
+                                       suites[i].encr == ENCR_CAMELLIA_CBC &&
+                                       suites[i].encr_size == 32)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "3des") &&
+                                       suites[i].encr == ENCR_3DES)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "null") &&
+                                       suites[i].encr == ENCR_NULL)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                       }
+                       enumerator->destroy(enumerator);
+               }
+               *count = remaining;
+       }
+}
+
+/**
+ * Filter suites by mac user config
+ */
+static void filter_mac_config_suites(private_tls_crypto_t *this,
+                                                                        suite_algs_t suites[], int *count)
+{
+       enumerator_t *enumerator;
+       int i, remaining = 0;
+       char *token, *config;
+
+       config = lib->settings->get_str(lib->settings, "libtls.mac", NULL);
+       if (config)
+       {
+               for (i = 0; i < *count; i++)
+               {
+                       enumerator = enumerator_create_token(config, ",", " ");
+                       while (enumerator->enumerate(enumerator, &token))
+                       {
+                               if (strcaseeq(token, "md5") &&
+                                       suites[i].hash == HASH_MD5)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "sha1") &&
+                                       suites[i].hash == HASH_SHA1)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "sha256") &&
+                                       suites[i].hash == HASH_SHA256)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                               if (strcaseeq(token, "sha384") &&
+                                       suites[i].hash == HASH_SHA384)
+                               {
+                                       suites[remaining++] = suites[i];
+                                       break;
+                               }
+                       }
+                       enumerator->destroy(enumerator);
+               }
+               *count = remaining;
+       }
+}
+
 /**
  * Initialize the cipher suite list
  */
@@ -725,6 +893,11 @@ static void build_cipher_suite_list(private_tls_crypto_t *this,
        filter_suite(this, suites, &count, offsetof(suite_algs_t, dh),
                                 lib->crypto->create_dh_enumerator);
 
+       /* filter suites with strongswan.conf options */
+       filter_key_exchange_config_suites(this, suites, &count);
+       filter_cipher_config_suites(this, suites, &count);
+       filter_mac_config_suites(this, suites, &count);
+
        free(this->suites);
        this->suite_count = count;
        this->suites = malloc(sizeof(tls_cipher_suite_t) * count);