proposal: Add selection flags to clone() method

This avoids having to call strip_dh() in child_cfg_t::get_proposals().
It also inverts the ALLOW_PRIVATE flag (i.e. makes it SKIP_PRIVATE) so
nothing has to be supplied to clone complete proposals.

diff --git a/src/libcharon/config/child_cfg.c b/src/libcharon/config/child_cfg.c
index fcc0efc25a37246df1bdee38daf60af3a4956d81..e0aee8b6a5c8f62b79c57cf74e14be09357545e9 100644 (file)
--- a/src/libcharon/config/child_cfg.c
+++ b/src/libcharon/config/child_cfg.c
@@ -209,16 +209,18 @@ METHOD(child_cfg_t, get_proposals, linked_list_t*,
 {
        enumerator_t *enumerator;
        proposal_t *current;
+       proposal_selection_flag_t flags = 0;
        linked_list_t *proposals = linked_list_create();
 
+       if (strip_dh)
+       {
+               flags |= PROPOSAL_SKIP_DH;
+       }
+
        enumerator = this->proposals->create_enumerator(this->proposals);
        while (enumerator->enumerate(enumerator, &current))
        {
-               current = current->clone(current);
-               if (strip_dh)
-               {
-                       current->strip_dh(current, MODP_NONE);
-               }
+               current = current->clone(current, flags);
                if (proposals->find_first(proposals, match_proposal, NULL, current))
                {
                        current->destroy(current);

diff --git a/src/libcharon/config/ike_cfg.c b/src/libcharon/config/ike_cfg.c
index c9971882df5ec8a18174eb7687dcf0160f8c5481..79a344e450727d32b1d0664ad41189b1f43abc10 100644 (file)
--- a/src/libcharon/config/ike_cfg.c
+++ b/src/libcharon/config/ike_cfg.c
@@ -310,7 +310,7 @@ METHOD(ike_cfg_t, get_proposals, linked_list_t*,
        enumerator = this->proposals->create_enumerator(this->proposals);
        while (enumerator->enumerate(enumerator, &current))
        {
-               current = current->clone(current);
+               current = current->clone(current, 0);
                proposals->insert_last(proposals, current);
        }
        enumerator->destroy(enumerator);
@@ -330,7 +330,7 @@ METHOD(ike_cfg_t, has_proposal, bool,
        while (enumerator->enumerate(enumerator, &proposal))
        {
                if (proposal->matches(proposal, match,
-                                                         private ? PROPOSAL_ALLOW_PRIVATE : 0))
+                                                         private ? 0 : PROPOSAL_SKIP_PRIVATE))
                {
                        enumerator->destroy(enumerator);
                        return TRUE;

diff --git a/src/libcharon/plugins/load_tester/load_tester_config.c b/src/libcharon/plugins/load_tester/load_tester_config.c
index 6fb6673751386d8792428aacc6eab9d3732a0380..77c9630ca577b31ea1a7bd3d959f9b282da135e9 100644 (file)
--- a/src/libcharon/plugins/load_tester/load_tester_config.c
+++ b/src/libcharon/plugins/load_tester/load_tester_config.c
@@ -749,7 +749,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
                ike.local_port = charon->socket->get_port(charon->socket, FALSE);
        }
        ike_cfg = ike_cfg_create(&ike);
-       ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
+       ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal, 0));
        peer_cfg = peer_cfg_create("load-test", ike_cfg, &peer);
 
        if (this->vip)
@@ -784,7 +784,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
        }
 
        child_cfg = child_cfg_create("load-test", &child);
-       child_cfg->add_proposal(child_cfg, this->esp->clone(this->esp));
+       child_cfg->add_proposal(child_cfg, this->esp->clone(this->esp, 0));
 
        if (num)
        {       /* initiator */

diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c
index fc60b413f174fc927e5384ee12461aa0f30a1ef0..b11236b8f9fa2287746f73579fe549ec656b3a97 100644 (file)
--- a/src/libcharon/sa/child_sa.c
+++ b/src/libcharon/sa/child_sa.c
@@ -429,7 +429,7 @@ METHOD(child_sa_t, get_proposal, proposal_t*,
 METHOD(child_sa_t, set_proposal, void,
           private_child_sa_t *this, proposal_t *proposal)
 {
-       this->proposal = proposal->clone(proposal);
+       this->proposal = proposal->clone(proposal, 0);
 }
 
 METHOD(child_sa_t, create_ts_enumerator, enumerator_t*,

diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c
index 4e60ed8e230f674f7ae7b90072260c755485c433..d6cc4e5a75f6f01cb333d8ca82df12d5cae3b845 100644 (file)
--- a/src/libcharon/sa/ike_sa.c
+++ b/src/libcharon/sa/ike_sa.c
@@ -610,7 +610,7 @@ METHOD(ike_sa_t, set_proposal, void,
        private_ike_sa_t *this, proposal_t *proposal)
 {
        DESTROY_IF(this->proposal);
-       this->proposal = proposal->clone(proposal);
+       this->proposal = proposal->clone(proposal, 0);
 }
 
 METHOD(ike_sa_t, set_message_id, void,

diff --git a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c
index 6ad4a0f4b4578a993b08c5c47a4d02d739e67f34..94c3b7682183aaa1279e646bc9ba17d9b58e0177 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/aggressive_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/aggressive_mode.c
@@ -374,7 +374,7 @@ METHOD(task_t, process_r, status_t,
                        id_payload_t *id_payload;
                        identification_t *id;
                        linked_list_t *list;
-                       proposal_selection_flag_t flags = 0;
+                       proposal_selection_flag_t flags = PROPOSAL_SKIP_PRIVATE;
                        uint16_t group;
 
                        this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);

diff --git a/src/libcharon/sa/ikev1/tasks/main_mode.c b/src/libcharon/sa/ikev1/tasks/main_mode.c
index 2678a1b4a303543f87bdd1d34af646150e601f20..43848ad1a49058214c8c35c983877dbaed2f3a29 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/main_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/main_mode.c
@@ -386,9 +386,9 @@ METHOD(task_t, process_r, status_t,
                        }
 
                        list = sa_payload->get_proposals(sa_payload);
-                       if (this->ike_sa->supports_extension(this->ike_sa , EXT_STRONGSWAN))
+                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
                        {
-                               flags |= PROPOSAL_ALLOW_PRIVATE;
+                               flags |= PROPOSAL_SKIP_PRIVATE;
                        }
                        if (!lib->settings->get_bool(lib->settings,
                                                        "%s.prefer_configured_proposals", TRUE, lib->ns))
@@ -640,9 +640,9 @@ METHOD(task_t, process_i, status_t,
                                return send_notify(this, INVALID_PAYLOAD_TYPE);
                        }
                        list = sa_payload->get_proposals(sa_payload);
-                       if (this->ike_sa->supports_extension(this->ike_sa , EXT_STRONGSWAN))
+                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
                        {
-                               flags |= PROPOSAL_ALLOW_PRIVATE;
+                               flags |= PROPOSAL_SKIP_PRIVATE;
                        }
                        this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
                                                                                                                        list, flags);

diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c
index 00c9edd711cf8aa76a2f571d73095775be7884b8..9ded2dd5392e9653080893a5221409227c712e3d 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/quick_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c
@@ -1132,9 +1132,9 @@ METHOD(task_t, process_r, status_t,
                                DESTROY_IF(list);
                                list = sa_payload->get_proposals(sa_payload);
                        }
-                       if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
                        {
-                               flags |= PROPOSAL_ALLOW_PRIVATE;
+                               flags |= PROPOSAL_SKIP_PRIVATE;
                        }
                        if (!lib->settings->get_bool(lib->settings,
                                                        "%s.prefer_configured_proposals", TRUE, lib->ns))
@@ -1370,9 +1370,9 @@ METHOD(task_t, process_i, status_t,
                                DESTROY_IF(list);
                                list = sa_payload->get_proposals(sa_payload);
                        }
-                       if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+                       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
                        {
-                               flags |= PROPOSAL_ALLOW_PRIVATE;
+                               flags |= PROPOSAL_SKIP_PRIVATE;
                        }
                        this->proposal = this->config->select_proposal(this->config, list,
                                                                                                                   flags);

diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c
index 533cf82c0f87ce3521c1045ca59400c308a3191a..e98c1dbcc43392058634f4fb02342d86636c564d 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/child_create.c
+++ b/src/libcharon/sa/ikev2/tasks/child_create.c
@@ -564,9 +564,9 @@ static status_t select_and_install(private_child_create_t *this,
        {
                flags |= PROPOSAL_SKIP_DH;
        }
-       if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
        {
-               flags |= PROPOSAL_ALLOW_PRIVATE;
+               flags |= PROPOSAL_SKIP_PRIVATE;
        }
        if (!lib->settings->get_bool(lib->settings,
                                                        "%s.prefer_configured_proposals", TRUE, lib->ns))

diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c
index 143ae7bcf5d0ba32ab63db8b9b31fed4fa654ae8..d15b5b107ac2831875fefa472b5c87762fc9ca91 100644 (file)
--- a/src/libcharon/sa/ikev2/tasks/ike_init.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_init.c
@@ -458,9 +458,9 @@ static void process_sa_payload(private_ike_init_t *this, message_t *message,
        ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 
        proposal_list = sa_payload->get_proposals(sa_payload);
-       if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+       if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
        {
-               flags |= PROPOSAL_ALLOW_PRIVATE;
+               flags |= PROPOSAL_SKIP_PRIVATE;
        }
        if (!lib->settings->get_bool(lib->settings,
                                                        "%s.prefer_configured_proposals", TRUE, lib->ns))

diff --git a/src/libstrongswan/crypto/proposal/proposal.c b/src/libstrongswan/crypto/proposal/proposal.c
index c880020de80267df1dd17b64d62cf79fc174c678..3b05b3b5308246f44bb71e0b8c81900c3f116779 100644 (file)
--- a/src/libstrongswan/crypto/proposal/proposal.c
+++ b/src/libstrongswan/crypto/proposal/proposal.c
@@ -390,7 +390,7 @@ static bool select_algo(private_proposal_t *this, proposal_t *other,
                {
                        if (alg1 == alg2 && ks1 == ks2)
                        {
-                               if (!(flags & PROPOSAL_ALLOW_PRIVATE) && alg1 >= 1024)
+                               if ((flags & PROPOSAL_SKIP_PRIVATE) && alg1 >= 1024)
                                {
                                        if (log)
                                        {
@@ -604,25 +604,27 @@ METHOD(proposal_t, equals, bool,
 }
 
 METHOD(proposal_t, clone_, proposal_t*,
-       private_proposal_t *this)
+       private_proposal_t *this, proposal_selection_flag_t flags)
 {
        private_proposal_t *clone;
        enumerator_t *enumerator;
        entry_t *entry;
-       transform_type_t *type;
 
        clone = (private_proposal_t*)proposal_create(this->protocol, 0);
 
        enumerator = array_create_enumerator(this->transforms);
        while (enumerator->enumerate(enumerator, &entry))
        {
+               if (entry->alg >= 1024 && (flags & PROPOSAL_SKIP_PRIVATE))
+               {
+                       continue;
+               }
+               if (entry->type == DIFFIE_HELLMAN_GROUP && (flags & PROPOSAL_SKIP_DH))
+               {
+                       continue;
+               }
                array_insert(clone->transforms, ARRAY_TAIL, entry);
-       }
-       enumerator->destroy(enumerator);
-       enumerator = array_create_enumerator(this->types);
-       while (enumerator->enumerate(enumerator, &type))
-       {
-               array_insert(clone->types, ARRAY_TAIL, type);
+               add_type(clone->types, entry->type);
        }
        enumerator->destroy(enumerator);
 

diff --git a/src/libstrongswan/crypto/proposal/proposal.h b/src/libstrongswan/crypto/proposal/proposal.h
index 8e952dd4f04937a97663c082263300b6af0d7020..f05669e1c77fc0cd7e78bfe34edba19cfdcf39e4 100644 (file)
--- a/src/libstrongswan/crypto/proposal/proposal.h
+++ b/src/libstrongswan/crypto/proposal/proposal.h
@@ -56,10 +56,10 @@ extern enum_name_t *protocol_id_names;
  * Flags for selecting proposals
  */
 enum proposal_selection_flag_t {
-       /** Accept algorithms from a private range. */
-       PROPOSAL_ALLOW_PRIVATE = (1<<0),
        /** Whether to prefer configured (default) or supplied proposals. */
-       PROPOSAL_PREFER_SUPPLIED = (1<<1),
+       PROPOSAL_PREFER_SUPPLIED = (1<<0),
+       /** Whether to skip and ignore algorithms from a private range. */
+       PROPOSAL_SKIP_PRIVATE = (1<<1),
        /** Whether to skip and ignore diffie hellman groups. */
        PROPOSAL_SKIP_DH = (1<<2),
 };
@@ -207,9 +207,10 @@ struct proposal_t {
        /**
         * Clone a proposal.
         *
+        * @param flags                 flags to consider during cloning
         * @return                              clone of proposal
         */
-       proposal_t *(*clone) (proposal_t *this);
+       proposal_t *(*clone)(proposal_t *this, proposal_selection_flag_t flags);
 
        /**
         * Destroys the proposal object.

diff --git a/src/libstrongswan/tests/suites/test_proposal.c b/src/libstrongswan/tests/suites/test_proposal.c
index 68116d92cd414d168dec7ecfd9b7d3a93bb98ced..c323119ea78b732b566cb4baa3875a3a143e8883 100644 (file)
--- a/src/libstrongswan/tests/suites/test_proposal.c
+++ b/src/libstrongswan/tests/suites/test_proposal.c
@@ -410,6 +410,44 @@ START_TEST(test_chacha20_poly1305_key_length)
 }
 END_TEST
 
+static struct {
+       protocol_id_t proto;
+       char *orig;
+       char *expected;
+       proposal_selection_flag_t flags;
+} clone_data[] = {
+       { PROTO_ESP, "aes128", "aes128" },
+       { PROTO_ESP, "aes128-serpent", "aes128-serpent" },
+       { PROTO_ESP, "aes128-serpent", "aes128", PROPOSAL_SKIP_PRIVATE },
+       { PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modp3072" },
+       { PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH },
+       { PROTO_ESP, "aes128-serpent-modp3072", "aes128-serpent",
+               PROPOSAL_SKIP_DH },
+       { PROTO_ESP, "aes128-serpent-modp3072", "aes128",
+               PROPOSAL_SKIP_PRIVATE | PROPOSAL_SKIP_DH },
+};
+
+START_TEST(test_clone)
+{
+       proposal_t *orig, *result, *expected;
+
+       orig = proposal_create_from_string(clone_data[_i].proto,
+                                                                          clone_data[_i].orig);
+       orig->set_spi(orig, 0x12345678);
+
+       result = orig->clone(orig, clone_data[_i].flags);
+
+       expected = proposal_create_from_string(clone_data[_i].proto,
+                                                                                  clone_data[_i].expected);
+       ck_assert_msg(expected->equals(expected, result), "proposal %P does "
+                                 "not match expected %P", result, expected);
+       ck_assert_int_eq(orig->get_spi(orig), result->get_spi(result));
+
+       expected->destroy(expected);
+       result->destroy(result);
+       orig->destroy(orig);
+}
+END_TEST
 
 Suite *proposal_suite_create()
 {
@@ -454,5 +492,9 @@ Suite *proposal_suite_create()
        tcase_add_test(tc, test_chacha20_poly1305_key_length);
        suite_add_tcase(s, tc);
 
+       tc = tcase_create("clone");
+       tcase_add_loop_test(tc, test_clone, 0, countof(clone_data));
+       suite_add_tcase(s, tc);
+
        return s;
 }