From 8df811146db4989349cf4b8aed576229b0f09147 Mon Sep 17 00:00:00 2001
From: Andreas Steffen <andreas.steffen@strongswan.org>
Date: Fri, 12 Jun 2009 21:04:48 +0200
Subject: [PATCH] fixed broken XAUTH authentication

---
 src/pluto/connections.c |  1 +
 src/pluto/crypto.c      | 20 ++++++++++++++++++++
 src/pluto/crypto.h      |  2 ++
 src/pluto/ipsec_doi.c   | 21 +++++++++++++++------
 4 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/src/pluto/connections.c b/src/pluto/connections.c
index 2d62c81a6..5e2ed39fa 100644
--- a/src/pluto/connections.c
+++ b/src/pluto/connections.c
@@ -3320,6 +3320,7 @@ refine_host_connection(const struct state *st, const struct id *peer_id
 	case OAKLEY_ECDSA_512:
 		auth_policy = POLICY_PUBKEY;
 		break;
+	case XAUTHInitRSA:
 	case XAUTHRespRSA:
 		auth_policy = POLICY_XAUTH_RSASIG;
 		break;
diff --git a/src/pluto/crypto.c b/src/pluto/crypto.c
index 539c28989..814003027 100644
--- a/src/pluto/crypto.c
+++ b/src/pluto/crypto.c
@@ -258,6 +258,26 @@ pseudo_random_function_t oakley_to_prf(int alg)
 	}
 }
 
+/**
+ * Maps IKEv1 authentication method to IKEv2 signature scheme
+ */
+signature_scheme_t oakley_to_signature_scheme(int method)
+{
+	switch (method)
+	{
+		case OAKLEY_RSA_SIG:
+		case XAUTHInitRSA:
+		case XAUTHRespRSA:
+			return SIGN_RSA_EMSA_PKCS1_NULL;
+		case OAKLEY_ECDSA_256:
+		case OAKLEY_ECDSA_384:
+		case OAKLEY_ECDSA_512:
+			return SIGN_ECDSA_WITH_NULL;
+		default:
+			return SIGN_UNKNOWN;
+	}
+}
+
 /**
  * Converts IKEv2 encryption to IKEv1 encryption algorithm
  */
diff --git a/src/pluto/crypto.h b/src/pluto/crypto.h
index 0c9bc8eb8..06c4e1d1a 100644
--- a/src/pluto/crypto.h
+++ b/src/pluto/crypto.h
@@ -16,6 +16,7 @@
 #include <crypto/signers/signer.h>
 #include <crypto/hashers/hasher.h>
 #include <crypto/prfs/prf.h>
+#include <credentials/keys/public_key.h>
 
 #include "ike_alg.h"
 
@@ -48,6 +49,7 @@ struct state;   /* forward declaration, dammit */
 extern encryption_algorithm_t oakley_to_encryption_algorithm(int alg);
 extern hash_algorithm_t oakley_to_hash_algorithm(int alg);
 extern pseudo_random_function_t oakley_to_prf(int alg);
+extern signature_scheme_t oakley_to_signature_scheme(int method);
 extern int oakley_from_encryption_algorithm(encryption_algorithm_t alg);
 extern int oakley_from_integrity_algorithm(integrity_algorithm_t alg);
 extern int esp_from_encryption_algorithm(encryption_algorithm_t alg);
diff --git a/src/pluto/ipsec_doi.c b/src/pluto/ipsec_doi.c
index 3d7a7433d..fd97ddde6 100644
--- a/src/pluto/ipsec_doi.c
+++ b/src/pluto/ipsec_doi.c
@@ -1498,9 +1498,8 @@ static bool take_a_crack(struct tac_state *s, pubkey_t *kr)
 	identification_t *keyid = pub_key->get_id(pub_key, ID_PUBKEY_INFO_SHA1);
 	signature_scheme_t scheme;
 
-	scheme = (s->st->st_oakley.auth == OAKLEY_RSA_SIG) ?
-					SIGN_RSA_EMSA_PKCS1_NULL : SIGN_ECDSA_WITH_NULL;
 	s->tried_cnt++;
+	scheme = oakley_to_signature_scheme(s->st->st_oakley.auth);
 
 	if (pub_key->verify(pub_key, scheme, s->hash, s->sig))
 	{
@@ -2975,17 +2974,27 @@ stf_status main_inI1_outR1(struct msg_digest *md)
 
 	/* determine how many Vendor ID payloads we will be sending */
 	if (SEND_PLUTO_VID)
+	{
 		vids_to_send++;
+	}
 	if (SEND_CISCO_UNITY_VID)
+	{
 		vids_to_send++;
+	}
 	if (md->openpgp)
+	{
 		vids_to_send++;
+	}
 	if (SEND_XAUTH_VID)
+	{
 		vids_to_send++;
+	}
 	/* always send DPD Vendor ID */
 		vids_to_send++;
 	if (md->nat_traversal_vid && nat_traversal_enabled)
+	{
 		vids_to_send++;
+	}
 
 	/* HDR out.
 	 * We can't leave this to comm_handle() because we must
@@ -3477,8 +3486,8 @@ stf_status main_inR2_outI3(struct msg_digest *md)
 			signature_scheme_t scheme;
 			size_t sig_len;
 
-			scheme = (st->st_oakley.auth == OAKLEY_RSA_SIG) ?
-							SIGN_RSA_EMSA_PKCS1_NULL : SIGN_ECDSA_WITH_NULL;
+			scheme = oakley_to_signature_scheme(st->st_oakley.auth);
+
 			sig_len = sign_hash(scheme, st->st_connection, sig_val, hash);
 			if (sig_len == 0)
 			{
@@ -3892,8 +3901,8 @@ main_inI3_outR3_tail(struct msg_digest *md
 			signature_scheme_t scheme;
 			size_t sig_len;
 
-			scheme = (st->st_oakley.auth == OAKLEY_RSA_SIG) ?
-							SIGN_RSA_EMSA_PKCS1_NULL : SIGN_ECDSA_WITH_NULL;
+			scheme = oakley_to_signature_scheme(st->st_oakley.auth);
+
 			sig_len = sign_hash(scheme, st->st_connection, sig_val, hash);
 			if (sig_len == 0)
 			{