ha: Add DH group to IKE_ADD message

It is required for IKEv1 to determine the DH group of the CHILD SAs
during rekeying. It also fixes the status output for HA SAs, which so
far haven't shown the DH group on the passive side.

Fixes #1267.

diff --git a/src/libcharon/plugins/ha/ha_dispatcher.c b/src/libcharon/plugins/ha/ha_dispatcher.c
index 07ef607c684ee3af31d0023f27428f16f37a0dd4..8ea28a454223668af1cf4cf5ed7e5da8621cf2b3 100644 (file)
--- a/src/libcharon/plugins/ha/ha_dispatcher.c
+++ b/src/libcharon/plugins/ha/ha_dispatcher.c
@@ -132,6 +132,7 @@ static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message
        ike_sa_t *ike_sa = NULL, *old_sa = NULL;
        ike_version_t version = IKEV2;
        u_int16_t encr = 0, len = 0, integ = 0, prf = 0, old_prf = PRF_UNDEFINED;
+       u_int16_t dh_grp = 0;
        chunk_t nonce_i = chunk_empty, nonce_r = chunk_empty;
        chunk_t secret = chunk_empty, old_skd = chunk_empty;
        chunk_t dh_local = chunk_empty, dh_remote = chunk_empty, psk = chunk_empty;
@@ -193,6 +194,9 @@ static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message
                        case HA_ALG_OLD_PRF:
                                old_prf = value.u16;
                                break;
+                       case HA_ALG_DH:
+                               dh_grp = value.u16;
+                               break;
                        default:
                                break;
                }
@@ -217,6 +221,10 @@ static void process_ike_add(private_ha_dispatcher_t *this, ha_message_t *message
                {
                        proposal->add_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, prf, 0);
                }
+               if (dh_grp)
+               {
+                       proposal->add_algorithm(proposal, DIFFIE_HELLMAN_GROUP, dh_grp, 0);
+               }
                charon->bus->set_sa(charon->bus, ike_sa);
                dh = ha_diffie_hellman_create(secret, dh_local);
                if (ike_sa->get_version(ike_sa) == IKEV2)

diff --git a/src/libcharon/plugins/ha/ha_ike.c b/src/libcharon/plugins/ha/ha_ike.c
index 7492dd06e865701f68268f07edd71e770f693f2f..f0671c5bf6dc79de81c6fb2cbe3be98d417b112e 100644 (file)
--- a/src/libcharon/plugins/ha/ha_ike.c
+++ b/src/libcharon/plugins/ha/ha_ike.c
@@ -121,6 +121,10 @@ METHOD(listener_t, ike_keys, bool,
        {
                m->add_attribute(m, HA_ALG_PRF, alg);
        }
+       if (proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP, &alg, NULL))
+       {
+               m->add_attribute(m, HA_ALG_DH, alg);
+       }
        m->add_attribute(m, HA_NONCE_I, nonce_i);
        m->add_attribute(m, HA_NONCE_R, nonce_r);
        m->add_attribute(m, HA_SECRET, secret);

diff --git a/src/libcharon/plugins/ha/ha_message.c b/src/libcharon/plugins/ha/ha_message.c
index 6b00ed83fa1f71a0fa1c42c4cb5ff01a7d8df64c..b40219ce1473af183c33a84292fcd4477cf530f1 100644 (file)
--- a/src/libcharon/plugins/ha/ha_message.c
+++ b/src/libcharon/plugins/ha/ha_message.c
@@ -230,6 +230,7 @@ METHOD(ha_message_t, add_attribute, void,
                        break;
                }
                /* u_int16_t */
+               case HA_ALG_DH:
                case HA_ALG_PRF:
                case HA_ALG_OLD_PRF:
                case HA_ALG_ENCR:
@@ -450,6 +451,7 @@ METHOD(enumerator_t, attribute_enumerate, bool,
                        return TRUE;
                }
                /** u_int16_t */
+               case HA_ALG_DH:
                case HA_ALG_PRF:
                case HA_ALG_OLD_PRF:
                case HA_ALG_ENCR:

diff --git a/src/libcharon/plugins/ha/ha_message.h b/src/libcharon/plugins/ha/ha_message.h
index 2ccb1fc55ef90e2c62e1da3c2fa5719c208582d4..fe1786edf66bea77005f907753066feea4b4c7e4 100644 (file)
--- a/src/libcharon/plugins/ha/ha_message.h
+++ b/src/libcharon/plugins/ha/ha_message.h
@@ -122,6 +122,8 @@ enum ha_message_attribute_t {
        HA_ALG_ENCR_LEN,
        /** u_int16_t, integrity protection algorithm */
        HA_ALG_INTEG,
+       /** u_int16_t, DH group */
+       HA_ALG_DH,
        /** u_int8_t, IPsec mode, TUNNEL|TRANSPORT|... */
        HA_IPSEC_MODE,
        /** u_int8_t, IPComp protocol */