ike: Send AEAD ESP default proposal first

We generally prefer AEAD nowadays.

References #3461.

diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
index b91c89830a45bd0f4f4dbd2dfe7b7f1e6a06a028..0481d78d42c95c7344baf2625471873f30c696bc 100644 (file)
--- a/src/charon-cmd/cmd/cmd_connection.c
+++ b/src/charon-cmd/cmd/cmd_connection.c
@@ -362,9 +362,8 @@ static child_cfg_t* create_child_cfg(private_cmd_connection_t *this,
        }
        else
        {
+               child_cfg->add_proposal(child_cfg, proposal_create_default_aead(PROTO_ESP));
                child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
-               child_cfg->add_proposal(child_cfg,
-                                                               proposal_create_default_aead(PROTO_ESP));
        }
        while (this->local_ts->remove_first(this->local_ts, (void**)&ts) == SUCCESS)
        {

diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c
index db4cf4faba888541218369ba87335b2753e7f802..4ea20f990592c9bb983ebb5476de018464f9c206 100644 (file)
--- a/src/charon-nm/nm/nm_service.c
+++ b/src/charon-nm/nm/nm_service.c
@@ -834,8 +834,8 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
        }
        else
        {
-               child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
                child_cfg->add_proposal(child_cfg, proposal_create_default_aead(PROTO_ESP));
+               child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
        }
        ts = traffic_selector_create_dynamic(0, 0, 65535);
        child_cfg->add_traffic_selector(child_cfg, TRUE, ts);

diff --git a/src/conftest/config.c b/src/conftest/config.c
index ff47a77ee0bcccc119bf2ad1ff481c7a15c0d723..7b4936737454c7dac39cfa5fc6a8afd3c964135b 100644 (file)
--- a/src/conftest/config.c
+++ b/src/conftest/config.c
@@ -192,9 +192,8 @@ static child_cfg_t *load_child_config(private_config_t *this,
        }
        else
        {
+               child_cfg->add_proposal(child_cfg, proposal_create_default_aead(PROTO_ESP));
                child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
-               child_cfg->add_proposal(child_cfg,
-                                                               proposal_create_default_aead(PROTO_ESP));
        }
 
        token = settings->get_str(settings, "configs.%s.%s.lts", NULL, config, child);

diff --git a/src/frontends/osx/charon-xpc/xpc_dispatch.c b/src/frontends/osx/charon-xpc/xpc_dispatch.c
index 51b2b5008a5052f98b107ebd42b84129192fd720..991d286f750768320d0c4d67393b80081fd7f21a 100644 (file)
--- a/src/frontends/osx/charon-xpc/xpc_dispatch.c
+++ b/src/frontends/osx/charon-xpc/xpc_dispatch.c
@@ -150,8 +150,8 @@ static child_cfg_t* create_child_cfg(char *name)
        child_cfg->add_proposal(child_cfg, proposal_create_from_string(PROTO_ESP,
                                                                                "aes128gcm8-aes128gcm12-aes128gcm16-"
                                                                                "aes256gcm8-aes256gcm12-aes256gcm16"));
-       child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
        child_cfg->add_proposal(child_cfg, proposal_create_default_aead(PROTO_ESP));
+       child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
        ts = traffic_selector_create_dynamic(0, 0, 65535);
        child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
        ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE,

diff --git a/src/libcharon/plugins/ha/ha_tunnel.c b/src/libcharon/plugins/ha/ha_tunnel.c
index f94291505484f98355eaecfd1b66bd94cdfdcc64..ce9505c2b01919a5c07f78ff1f8bf85f464582fa 100644 (file)
--- a/src/libcharon/plugins/ha/ha_tunnel.c
+++ b/src/libcharon/plugins/ha/ha_tunnel.c
@@ -256,8 +256,8 @@ static void setup_tunnel(private_ha_tunnel_t *this,
        child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
        ts = traffic_selector_create_dynamic(IPPROTO_ICMP, 0, 65535);
        child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
-       child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
        child_cfg->add_proposal(child_cfg, proposal_create_default_aead(PROTO_ESP));
+       child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
        peer_cfg->add_child_cfg(peer_cfg, child_cfg);
 
        this->backend.cfg = peer_cfg;

diff --git a/src/libcharon/plugins/medcli/medcli_config.c b/src/libcharon/plugins/medcli/medcli_config.c
index be42d7d7d01c6d2ede38376c7f94a723038d5d15..e88c11d3a03c309c8e05110e0d5ea26550902e89 100644 (file)
--- a/src/libcharon/plugins/medcli/medcli_config.c
+++ b/src/libcharon/plugins/medcli/medcli_config.c
@@ -196,8 +196,8 @@ METHOD(backend_t, get_peer_cfg_by_name, peer_cfg_t*,
        peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
 
        child_cfg = child_cfg_create(name, &child);
-       child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
        child_cfg->add_proposal(child_cfg, proposal_create_default_aead(PROTO_ESP));
+       child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
        child_cfg->add_traffic_selector(child_cfg, TRUE, ts_from_string(local_net));
        child_cfg->add_traffic_selector(child_cfg, FALSE, ts_from_string(remote_net));
        peer_cfg->add_child_cfg(peer_cfg, child_cfg);
@@ -277,8 +277,8 @@ METHOD(enumerator_t, peer_enumerator_enumerate, bool,
        this->current->add_auth_cfg(this->current, auth, FALSE);
 
        child_cfg = child_cfg_create(name, &child);
-       child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
        child_cfg->add_proposal(child_cfg, proposal_create_default_aead(PROTO_ESP));
+       child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
        child_cfg->add_traffic_selector(child_cfg, TRUE, ts_from_string(local_net));
        child_cfg->add_traffic_selector(child_cfg, FALSE, ts_from_string(remote_net));
        this->current->add_child_cfg(this->current, child_cfg);

diff --git a/src/libcharon/plugins/sql/sql_config.c b/src/libcharon/plugins/sql/sql_config.c
index fb8ea8c5ef1e43b5e8d6d65171a68bf7835a13e9..dff6b6442d15b27c25224c811e4be69097333acf 100644 (file)
--- a/src/libcharon/plugins/sql/sql_config.c
+++ b/src/libcharon/plugins/sql/sql_config.c
@@ -153,8 +153,8 @@ static void add_esp_proposals(private_sql_config_t *this,
        }
        if (use_default)
        {
-               child->add_proposal(child, proposal_create_default(PROTO_ESP));
                child->add_proposal(child, proposal_create_default_aead(PROTO_ESP));
+               child->add_proposal(child, proposal_create_default(PROTO_ESP));
        }
 }
 

diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index eb679290de51703741b05ba41ea357ba7043ad56..3ce1e36192560d70da1c2138d7a770072eed531d 100644 (file)
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -2006,12 +2006,12 @@ CALLBACK(children_sn, bool,
        }
        if (child.proposals->get_count(child.proposals) == 0)
        {
-               proposal = proposal_create_default(PROTO_ESP);
+               proposal = proposal_create_default_aead(PROTO_ESP);
                if (proposal)
                {
                        child.proposals->insert_last(child.proposals, proposal);
                }
-               proposal = proposal_create_default_aead(PROTO_ESP);
+               proposal = proposal_create_default(PROTO_ESP);
                if (proposal)
                {
                        child.proposals->insert_last(child.proposals, proposal);