ike: Optionally allow private algorithms for IKE/CHILD_SAs

Charon refuses to make use of algorithms IDs from the private space
for unknown peer implementations [1]. If you chose to ignore and violate
that section of the RFC since you *know* your peers *must* support those
private IDs, there's no way to disable that behavior.

With this commit a strongswan.conf option is introduced which allows to
deliberately ignore parts of section 3.12 from the standard.

[1] http://tools.ietf.org/html/rfc7296#section-3.12

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>

diff --git a/conf/options/charon.opt b/conf/options/charon.opt
index cc58afda83b6064671401f034cc9e85fa8c4ac00..d9d98ef9c913fee14726a4883e6b9d8b2b70f439 100644 (file)
--- a/conf/options/charon.opt
+++ b/conf/options/charon.opt
@@ -8,6 +8,10 @@ charon {}
        **charon-cmd** instead of **charon**). For many options defaults can be
        defined in the **libstrongswan** section.
 
+charon.accept_private_algs = no
+       Deliberately violate the IKE standard's requirement and allow the use of
+       private algorithm identifiers, even if the peer implementation is unknown.
+
 charon.accept_unencrypted_mainmode_messages = no
        Accept unencrypted ID and HASH payloads in IKEv1 Main Mode.
 

diff --git a/src/libcharon/sa/ikev1/tasks/main_mode.c b/src/libcharon/sa/ikev1/tasks/main_mode.c
index eb77f5cb8cf3cb9bd5c58cb131f54dbca57d0a11..24b2f24d17e5da200018e5fa7564b6f02f2a1276 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/main_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/main_mode.c
@@ -386,7 +386,9 @@ METHOD(task_t, process_r, status_t,
                        }
 
                        list = sa_payload->get_proposals(sa_payload);
-                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)
+                               && !lib->settings->get_bool(lib->settings,
+                                                                       "%s.accept_private_algs", FALSE, lib->ns))
                        {
                                flags |= PROPOSAL_SKIP_PRIVATE;
                        }
@@ -641,7 +643,9 @@ METHOD(task_t, process_i, status_t,
                                return send_notify(this, INVALID_PAYLOAD_TYPE);
                        }
                        list = sa_payload->get_proposals(sa_payload);
-                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)
+                               && !lib->settings->get_bool(lib->settings,
+                                                                       "%s.accept_private_algs", FALSE, lib->ns))
                        {
                                flags |= PROPOSAL_SKIP_PRIVATE;
                        }

diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c
index 89d74442501b6eb230276cfe945b4742284e1b8b..f494e48c83ddb175b4e65141d4868abef1286285 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/quick_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c
@@ -1132,7 +1132,9 @@ METHOD(task_t, process_r, status_t,
                                DESTROY_IF(list);
                                list = sa_payload->get_proposals(sa_payload);
                        }
-                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)
+                               && !lib->settings->get_bool(lib->settings,
+                                                                       "%s.accept_private_algs", FALSE, lib->ns))
                        {
                                flags |= PROPOSAL_SKIP_PRIVATE;
                        }
@@ -1370,7 +1372,9 @@ METHOD(task_t, process_i, status_t,
                                DESTROY_IF(list);
                                list = sa_payload->get_proposals(sa_payload);
                        }
-                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN)
+                               && !lib->settings->get_bool(lib->settings,
+                                                                       "%s.accept_private_algs", FALSE, lib->ns))
                        {
                                flags |= PROPOSAL_SKIP_PRIVATE;
                        }

diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c
index e98c1dbcc43392058634f4fb02342d86636c564d..a642a76861b044efcbc8816d362f5689c471628e 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/child_create.c
+++ b/src/libcharon/sa/ikev2/tasks/child_create.c
@@ -564,7 +564,9 @@ static status_t select_and_install(private_child_create_t *this,
        {
                flags |= PROPOSAL_SKIP_DH;
        }
-       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN) &&
+               !lib->settings->get_bool(lib->settings, "%s.accept_private_algs",
+                                                                FALSE, lib->ns))
        {
                flags |= PROPOSAL_SKIP_PRIVATE;
        }

diff --git a/src/libcharon/sa/ikev2/tasks/ike_auth.c b/src/libcharon/sa/ikev2/tasks/ike_auth.c
index f95ec5c55bf9249c203d4b5c8eb1a4019af1f337..6448d8baa9ce165be12491f46dadf80e9aa251a3 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_auth.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_auth.c
@@ -330,7 +330,9 @@ static bool load_cfg_candidates(private_ike_auth_t *this)
        my_id = this->ike_sa->get_my_id(this->ike_sa);
        other_id = this->ike_sa->get_other_id(this->ike_sa);
        ike_proposal = this->ike_sa->get_proposal(this->ike_sa);
-       private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
+       private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN) ||
+                         lib->settings->get_bool(lib->settings, "%s.accept_private_algs",
+                                                                         FALSE, lib->ns);
 
        DBG1(DBG_CFG, "looking for peer configs matching %H[%Y]...%H[%Y]",
                 me, my_id, other, other_id);

diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c
index d15b5b107ac2831875fefa472b5c87762fc9ca91..477d2caae5ac9560fe4211aa67aeb85db28d124e 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_init.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_init.c
@@ -458,7 +458,9 @@ static void process_sa_payload(private_ike_init_t *this, message_t *message,
        ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 
        proposal_list = sa_payload->get_proposals(sa_payload);
-       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN) &&
+               !lib->settings->get_bool(lib->settings, "%s.accept_private_algs",
+                                                                FALSE, lib->ns))
        {
                flags |= PROPOSAL_SKIP_PRIVATE;
        }