denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proposal: Don't include AEAD algorithms in the default proposal

Browse Source 
According to RFC 5996 3.3 we should use a separate proposal for AEAD algorithms.
This was not clear in RFC 5282, hence we previously included both AEAD and
non-AEAD algorithms in a single proposal.
This commit is contained in:
Martin Willi
2014-05-16 16:01:21 +02:00
parent 9612db648a
commit 0fc4dd429d
1 changed files with 69 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/config/proposal.c
+69 -64
View File
@@ -627,7 +627,7 @@ proposal_t *proposal_create(protocol_id_t protocol, u_int number)
/** /**
* Add supported IKE algorithms to proposal * Add supported IKE algorithms to proposal
*/ */
static void proposal_add_supported_ike(private_proposal_t *this) static void proposal_add_supported_ike(private_proposal_t *this, bool aead)
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
encryption_algorithm_t encryption; encryption_algorithm_t encryption;
@@ -636,76 +636,81 @@ static void proposal_add_supported_ike(private_proposal_t *this)
diffie_hellman_group_t group; diffie_hellman_group_t group;
const char *plugin_name; const char *plugin_name;
enumerator = lib->crypto->create_crypter_enumerator(lib->crypto); if (aead)
while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
{ {
switch (encryption) enumerator = lib->crypto->create_aead_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
{ {
case ENCR_AES_CBC: switch (encryption)
case ENCR_AES_CTR: {
case ENCR_CAMELLIA_CBC: case ENCR_AES_CCM_ICV8:
case ENCR_CAMELLIA_CTR: case ENCR_AES_CCM_ICV12:
/* we assume that we support all AES/Camellia sizes */ case ENCR_AES_CCM_ICV16:
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 128); case ENCR_AES_GCM_ICV8:
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 192); case ENCR_AES_GCM_ICV12:
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256); case ENCR_AES_GCM_ICV16:
break; case ENCR_CAMELLIA_CCM_ICV8:
case ENCR_3DES: case ENCR_CAMELLIA_CCM_ICV12:
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 0); case ENCR_CAMELLIA_CCM_ICV16:
break; /* we assume that we support all AES/Camellia sizes */
case ENCR_DES: add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 128);
/* no, thanks */ add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 192);
break; add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256);
default: break;
break; default:
break;
}
} }
enumerator->destroy(enumerator);
} }
enumerator->destroy(enumerator); else
{
enumerator = lib->crypto->create_crypter_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &encryption, &plugin_name))
{
switch (encryption)
{
case ENCR_AES_CBC:
case ENCR_AES_CTR:
case ENCR_CAMELLIA_CBC:
case ENCR_CAMELLIA_CTR:
/* we assume that we support all AES/Camellia sizes */
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 128);
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 192);
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256);
break;
case ENCR_3DES:
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 0);
break;
case ENCR_DES:
/* no, thanks */
break;
default:
break;
}
}
enumerator->destroy(enumerator);
enumerator = lib->crypto->create_aead_enumerator(lib->crypto); enumerator = lib->crypto->create_signer_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &encryption, &plugin_name)) while (enumerator->enumerate(enumerator, &integrity, &plugin_name))
{
switch (encryption)
{ {
case ENCR_AES_CCM_ICV8: switch (integrity)
case ENCR_AES_CCM_ICV12: {
case ENCR_AES_CCM_ICV16: case AUTH_HMAC_SHA1_96:
case ENCR_AES_GCM_ICV8: case AUTH_HMAC_SHA2_256_128:
case ENCR_AES_GCM_ICV12: case AUTH_HMAC_SHA2_384_192:
case ENCR_AES_GCM_ICV16: case AUTH_HMAC_SHA2_512_256:
case ENCR_CAMELLIA_CCM_ICV8: case AUTH_HMAC_MD5_96:
case ENCR_CAMELLIA_CCM_ICV12: case AUTH_AES_XCBC_96:
case ENCR_CAMELLIA_CCM_ICV16: case AUTH_AES_CMAC_96:
/* we assume that we support all AES/Camellia sizes */ add_algorithm(this, INTEGRITY_ALGORITHM, integrity, 0);
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 128); break;
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 192); default:
add_algorithm(this, ENCRYPTION_ALGORITHM, encryption, 256); break;
break; }
default:
break;
} }
enumerator->destroy(enumerator);
} }
enumerator->destroy(enumerator);
enumerator = lib->crypto->create_signer_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &integrity, &plugin_name))
{
switch (integrity)
{
case AUTH_HMAC_SHA1_96:
case AUTH_HMAC_SHA2_256_128:
case AUTH_HMAC_SHA2_384_192:
case AUTH_HMAC_SHA2_512_256:
case AUTH_HMAC_MD5_96:
case AUTH_AES_XCBC_96:
case AUTH_AES_CMAC_96:
add_algorithm(this, INTEGRITY_ALGORITHM, integrity, 0);
break;
default:
break;
}
}
enumerator->destroy(enumerator);
enumerator = lib->crypto->create_prf_enumerator(lib->crypto); enumerator = lib->crypto->create_prf_enumerator(lib->crypto);
while (enumerator->enumerate(enumerator, &prf, &plugin_name)) while (enumerator->enumerate(enumerator, &prf, &plugin_name))
@@ -779,7 +784,7 @@ proposal_t *proposal_create_default(protocol_id_t protocol)
switch (protocol) switch (protocol)
{ {
case PROTO_IKE: case PROTO_IKE:
proposal_add_supported_ike(this); proposal_add_supported_ike(this, FALSE);
break; break;
case PROTO_ESP: case PROTO_ESP:
add_algorithm(this, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 128); add_algorithm(this, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 128);