proposal: Don't include AEAD algorithms in the default proposal

According to RFC 5996 3.3 we should use a separate proposal for AEAD algorithms.
This was not clear in RFC 5282, hence we previously included both AEAD and
non-AEAD algorithms in a single proposal.

diff --git a/src/libcharon/config/proposal.c b/src/libcharon/config/proposal.c
index 2ecdb4f2e4c916ebf76017b0175700a0ba985de8..fcfaebeb4cb42cd493db87364e21a3d9879ead45 100644 (file)
--- a/src/libcharon/config/proposal.c
+++ b/src/libcharon/config/proposal.c
@@ -627,7 +627,7 @@ proposal_t *proposal_create(protocol_id_t protocol, u_int number)
 /**
  * Add supported IKE algorithms to proposal
  */
-static void proposal_add_supported_ike(private_proposal_t *this)
+static void proposal_add_supported_ike(private_proposal_t *this, bool aead)
 {
        enumerator_t *enumerator;
        encryption_algorithm_t encryption;
@@ -636,76 +636,81 @@ static void proposal_add_supported_ike(private_proposal_t *this)
        diffie_hellman_group_t group;
        const char *plugin_name;
 
-       enumerator = lib->crypto->create_crypter_enumerator(lib->crypto);
-       while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
+       if (aead)
        {
-               switch (encryption)
+               enumerator = lib->crypto->create_aead_enumerator(lib->crypto);
+               while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
                {
-                       case ENCR_AES_CBC:
-                       case ENCR_AES_CTR:
-                       case ENCR_CAMELLIA_CBC:
-                       case ENCR_CAMELLIA_CTR:
-                               /* we assume that we support all AES/Camellia sizes */
-                               add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 128);
-                               add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 192);
-                               add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256);
-                               break;
-                       case ENCR_3DES:
-                               add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 0);
-                               break;
-                       case ENCR_DES:
-                               /* no, thanks */
-                               break;
-                       default:
-                               break;
+                       switch (encryption)
+                       {
+                               case ENCR_AES_CCM_ICV8:
+                               case ENCR_AES_CCM_ICV12:
+                               case ENCR_AES_CCM_ICV16:
+                               case ENCR_AES_GCM_ICV8:
+                               case ENCR_AES_GCM_ICV12:
+                               case ENCR_AES_GCM_ICV16:
+                               case ENCR_CAMELLIA_CCM_ICV8:
+                               case ENCR_CAMELLIA_CCM_ICV12:
+                               case ENCR_CAMELLIA_CCM_ICV16:
+                                       /* we assume that we support all AES/Camellia sizes */
+                                       add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 128);
+                                       add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 192);
+                                       add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256);
+                                       break;
+                               default:
+                                       break;
+                       }
                }
+               enumerator->destroy(enumerator);
        }
-       enumerator->destroy(enumerator);
-
-       enumerator = lib->crypto->create_aead_enumerator(lib->crypto);
-       while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
+       else
        {
-               switch (encryption)
+               enumerator = lib->crypto->create_crypter_enumerator(lib->crypto);
+               while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
                {
-                       case ENCR_AES_CCM_ICV8:
-                       case ENCR_AES_CCM_ICV12:
-                       case ENCR_AES_CCM_ICV16:
-                       case ENCR_AES_GCM_ICV8:
-                       case ENCR_AES_GCM_ICV12:
-                       case ENCR_AES_GCM_ICV16:
-                       case ENCR_CAMELLIA_CCM_ICV8:
-                       case ENCR_CAMELLIA_CCM_ICV12:
-                       case ENCR_CAMELLIA_CCM_ICV16:
-                               /* we assume that we support all AES/Camellia sizes */
-                               add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 128);
-                               add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 192);
-                               add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256);
-                               break;
-                       default:
-                               break;
+                       switch (encryption)
+                       {
+                               case ENCR_AES_CBC:
+                               case ENCR_AES_CTR:
+                               case ENCR_CAMELLIA_CBC:
+                               case ENCR_CAMELLIA_CTR:
+                                       /* we assume that we support all AES/Camellia sizes */
+                                       add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 128);
+                                       add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 192);
+                                       add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256);
+                                       break;
+                               case ENCR_3DES:
+                                       add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 0);
+                                       break;
+                               case ENCR_DES:
+                                       /* no, thanks */
+                                       break;
+                               default:
+                                       break;
+                       }
                }
-       }
-       enumerator->destroy(enumerator);
+               enumerator->destroy(enumerator);
 
-       enumerator = lib->crypto->create_signer_enumerator(lib->crypto);
-       while (enumerator->enumerate(enumerator, &integrity, &plugin_name))
-       {
-               switch (integrity)
+               enumerator = lib->crypto->create_signer_enumerator(lib->crypto);
+               while (enumerator->enumerate(enumerator, &integrity, &plugin_name))
                {
-                       case AUTH_HMAC_SHA1_96:
-                       case AUTH_HMAC_SHA2_256_128:
-                       case AUTH_HMAC_SHA2_384_192:
-                       case AUTH_HMAC_SHA2_512_256:
-                       case AUTH_HMAC_MD5_96:
-                       case AUTH_AES_XCBC_96:
-                       case AUTH_AES_CMAC_96:
-                               add_algorithm(this, INTEGRITY_ALGORITHM, integrity, 0);
-                               break;
-                       default:
-                               break;
+                       switch (integrity)
+                       {
+                               case AUTH_HMAC_SHA1_96:
+                               case AUTH_HMAC_SHA2_256_128:
+                               case AUTH_HMAC_SHA2_384_192:
+                               case AUTH_HMAC_SHA2_512_256:
+                               case AUTH_HMAC_MD5_96:
+                               case AUTH_AES_XCBC_96:
+                               case AUTH_AES_CMAC_96:
+                                       add_algorithm(this, INTEGRITY_ALGORITHM, integrity, 0);
+                                       break;
+                               default:
+                                       break;
+                       }
                }
+               enumerator->destroy(enumerator);
        }
-       enumerator->destroy(enumerator);
 
        enumerator = lib->crypto->create_prf_enumerator(lib->crypto);
        while (enumerator->enumerate(enumerator, &prf, &plugin_name))
@@ -779,7 +784,7 @@ proposal_t *proposal_create_default(protocol_id_t protocol)
        switch (protocol)
        {
                case PROTO_IKE:
-                       proposal_add_supported_ike(this);
+                       proposal_add_supported_ike(this, FALSE);
                        break;
                case PROTO_ESP:
                        add_algorithm(this, ENCRYPTION_ALGORITHM,   ENCR_AES_CBC,         128);