denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-init: Simplify adding extension notifies to IKE_SA_INIT

Browse Source
This commit is contained in:
Tobias Brunner
2026-01-28 12:03:18 +01:00
parent b8deb618ef
commit 8388904cbe
1 changed files with 32 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_init.c
+32 -30
View File
@@ -335,6 +335,17 @@ static bool send_use_ppk(private_ike_init_t *this)
return use_ppk; return use_ppk;
} }
/**
* Check that we are either initiator or we respond to one that supports the
* given extension.
*/
static inline bool initiator_or_extension(private_ike_init_t *this,
ike_extension_t ext)
{
return this->initiator ||
this->ike_sa->supports_extension(this->ike_sa, ext);
}
/** /**
* build the payloads for the message * build the payloads for the message
*/ */
@@ -414,30 +425,26 @@ static bool build_payloads(private_ike_init_t *this, message_t *message)
nonce_payload->set_nonce(nonce_payload, this->my_nonce); nonce_payload->set_nonce(nonce_payload, this->my_nonce);
message->add_payload(message, (payload_t*)nonce_payload); message->add_payload(message, (payload_t*)nonce_payload);
/* negotiate fragmentation if we are not rekeying */ /* if we are rekeying, we are done as we don't negotiate any extensions */
if (!this->old_sa && if (this->old_sa)
ike_cfg->fragmentation(ike_cfg) != FRAGMENTATION_NO)
{ {
if (this->initiator || return TRUE;
this->ike_sa->supports_extension(this->ike_sa, }
EXT_IKE_FRAGMENTATION))
{ if (ike_cfg->fragmentation(ike_cfg) != FRAGMENTATION_NO &&
message->add_notify(message, FALSE, FRAGMENTATION_SUPPORTED, initiator_or_extension(this, EXT_IKE_FRAGMENTATION))
chunk_empty); {
} message->add_notify(message, FALSE, FRAGMENTATION_SUPPORTED,
chunk_empty);
} }
/* submit supported hash algorithms for signature authentication */ /* submit supported hash algorithms for signature authentication */
if (!this->old_sa && this->signature_authentication) if (this->signature_authentication &&
initiator_or_extension(this, EXT_SIGNATURE_AUTH))
{ {
if (this->initiator || send_supported_hash_algorithms(this, message);
this->ike_sa->supports_extension(this->ike_sa,
EXT_SIGNATURE_AUTH))
{
send_supported_hash_algorithms(this, message);
}
} }
/* notify other peer if we support redirection */ /* notify other peer if we support redirection */
if (!this->old_sa && this->initiator && this->follow_redirects) if (this->initiator && this->follow_redirects)
{ {
identification_t *gateway; identification_t *gateway;
host_t *from; host_t *from;
@@ -460,26 +467,21 @@ static bool build_payloads(private_ike_init_t *this, message_t *message)
} }
} }
/* notify the peer if we want to use/support PPK */ /* notify the peer if we want to use/support PPK */
if (!this->old_sa && send_use_ppk(this)) if (send_use_ppk(this))
{ {
message->add_notify(message, FALSE, USE_PPK, chunk_empty); message->add_notify(message, FALSE, USE_PPK, chunk_empty);
} }
/* notify the peer if we accept childless IKE_SAs */ /* notify the initiator if we accept childless IKE_SAs */
if (!this->old_sa && !this->initiator && if (!this->initiator && ike_cfg->childless(ike_cfg) != CHILDLESS_NEVER)
ike_cfg->childless(ike_cfg) != CHILDLESS_NEVER)
{ {
message->add_notify(message, FALSE, CHILDLESS_IKEV2_SUPPORTED, message->add_notify(message, FALSE, CHILDLESS_IKEV2_SUPPORTED,
chunk_empty); chunk_empty);
} }
if (!this->old_sa && additional_ke) if (additional_ke &&
initiator_or_extension(this, EXT_IKE_INTERMEDIATE))
{ {
if (this->initiator || message->add_notify(message, FALSE, INTERMEDIATE_EXCHANGE_SUPPORTED,
this->ike_sa->supports_extension(this->ike_sa, chunk_empty);
EXT_IKE_INTERMEDIATE))
{
message->add_notify(message, FALSE, INTERMEDIATE_EXCHANGE_SUPPORTED,
chunk_empty);
}
} }
return TRUE; return TRUE;
} }