denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proposal: Make sure to consider all transform types when selecting proposals

Browse Source 
This way there will be a mismatch if one of the proposals contains
transform types not contained in the other (the fix list of transform
types used previously resulted in a match if unknown transform types
were contained in one of the proposals).  Merging the sets of types
makes comparing proposals with optional transform types easier (e.g.
DH for ESP with MODP_NONE).
This commit is contained in:
Tobias Brunner
2018-03-05 12:23:59 +01:00
parent 5eb094df11
commit 76c7c951e1
2 changed files with 103 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/tests/suites/test_proposal.c
+57 -2
View File
@@ -204,14 +204,66 @@ START_TEST(test_unknown_transform_types_print)
proposal->destroy(proposal);
proposal = proposal_create_from_string(PROTO_IKE,
"aes128-sha256-modp3072-ecp256");
"aes128-sha256-ecp256");
proposal->add_algorithm(proposal, 242, 42, 128);
proposal->add_algorithm(proposal, 243, 1, 0);
assert_proposal_eq(proposal, "IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072/ECP_256/UNKNOWN_242_42_128/UNKNOWN_243_1");
assert_proposal_eq(proposal, "IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256/UNKNOWN_242_42_128/UNKNOWN_243_1");
proposal->destroy(proposal);
}
END_TEST
START_TEST(test_unknown_transform_types_select_fail)
{
proposal_t *self, *other, *selected;
self = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
other = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
other->add_algorithm(other, 242, 42, 0);
selected = self->select(self, other, TRUE, FALSE);
ck_assert(!selected);
other->destroy(other);
self->destroy(self);
}
END_TEST
START_TEST(test_unknown_transform_types_select_fail_subtype)
{
proposal_t *self, *other, *selected;
self = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
self->add_algorithm(self, 242, 8, 0);
other = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
other->add_algorithm(other, 242, 42, 0);
selected = self->select(self, other, TRUE, FALSE);
ck_assert(!selected);
other->destroy(other);
self->destroy(self);
}
END_TEST
START_TEST(test_unknown_transform_types_select_success)
{
proposal_t *self, *other, *selected;
self = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
self->add_algorithm(self, 242, 42, 128);
other = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
other->add_algorithm(other, 242, 42, 128);
other->add_algorithm(other, 242, 1, 0);
selected = self->select(self, other, TRUE, FALSE);
ck_assert(selected);
assert_proposal_eq(selected, "IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256/UNKNOWN_242_42_128");
selected->destroy(selected);
other->destroy(other);
self->destroy(self);
}
END_TEST
Suite *proposal_suite_create()
{
Suite *s;
@@ -236,6 +288,9 @@ Suite *proposal_suite_create()
tc = tcase_create("unknown transform types");
tcase_add_test(tc, test_unknown_transform_types_print);
tcase_add_test(tc, test_unknown_transform_types_select_fail);
tcase_add_test(tc, test_unknown_transform_types_select_fail_subtype);
tcase_add_test(tc, test_unknown_transform_types_select_success);
suite_add_tcase(s, tc);
return s;