proposal: Add selection flags to clone() method

This avoids having to call strip_dh() in child_cfg_t::get_proposals().
It also inverts the ALLOW_PRIVATE flag (i.e. makes it SKIP_PRIVATE) so
nothing has to be supplied to clone complete proposals.

src/libstrongswan/crypto/proposal/proposal.c

@@ -390,7 +390,7 @@ static bool select_algo(private_proposal_t *this, proposal_t *other,
 		{
 			if (alg1 == alg2 && ks1 == ks2)
 			{
-				if (!(flags & PROPOSAL_ALLOW_PRIVATE) && alg1 >= 1024)
+				if ((flags & PROPOSAL_SKIP_PRIVATE) && alg1 >= 1024)
 				{
 					if (log)
 					{
@@ -604,25 +604,27 @@ METHOD(proposal_t, equals, bool,
 }
 
 METHOD(proposal_t, clone_, proposal_t*,
-	private_proposal_t *this)
+	private_proposal_t *this, proposal_selection_flag_t flags)
 {
 	private_proposal_t *clone;
 	enumerator_t *enumerator;
 	entry_t *entry;
-	transform_type_t *type;
 
 	clone = (private_proposal_t*)proposal_create(this->protocol, 0);
 
 	enumerator = array_create_enumerator(this->transforms);
 	while (enumerator->enumerate(enumerator, &entry))
 	{
+		if (entry->alg >= 1024 && (flags & PROPOSAL_SKIP_PRIVATE))
+		{
+			continue;
+		}
+		if (entry->type == DIFFIE_HELLMAN_GROUP && (flags & PROPOSAL_SKIP_DH))
+		{
+			continue;
+		}
 		array_insert(clone->transforms, ARRAY_TAIL, entry);
-	}
-	enumerator->destroy(enumerator);
-	enumerator = array_create_enumerator(this->types);
-	while (enumerator->enumerate(enumerator, &type))
-	{
-		array_insert(clone->types, ARRAY_TAIL, type);
+		add_type(clone->types, entry->type);
 	}
 	enumerator->destroy(enumerator);
 

src/libstrongswan/crypto/proposal/proposal.h

@@ -56,10 +56,10 @@ extern enum_name_t *protocol_id_names;
  * Flags for selecting proposals
  */
 enum proposal_selection_flag_t {
-	/** Accept algorithms from a private range. */
-	PROPOSAL_ALLOW_PRIVATE = (1<<0),
 	/** Whether to prefer configured (default) or supplied proposals. */
-	PROPOSAL_PREFER_SUPPLIED = (1<<1),
+	PROPOSAL_PREFER_SUPPLIED = (1<<0),
+	/** Whether to skip and ignore algorithms from a private range. */
+	PROPOSAL_SKIP_PRIVATE = (1<<1),
 	/** Whether to skip and ignore diffie hellman groups. */
 	PROPOSAL_SKIP_DH = (1<<2),
 };
@@ -207,9 +207,10 @@ struct proposal_t {
 	/**
 	 * Clone a proposal.
 	 *
+	 * @param flags			flags to consider during cloning
 	 * @return				clone of proposal
 	 */
-	proposal_t *(*clone) (proposal_t *this);
+	proposal_t *(*clone)(proposal_t *this, proposal_selection_flag_t flags);
 
 	/**
 	 * Destroys the proposal object.

src/libstrongswan/tests/suites/test_proposal.c

@@ -410,6 +410,44 @@ START_TEST(test_chacha20_poly1305_key_length)
 }
 END_TEST
 
+static struct {
+	protocol_id_t proto;
+	char *orig;
+	char *expected;
+	proposal_selection_flag_t flags;
+} clone_data[] = {
+	{ PROTO_ESP, "aes128", "aes128" },
+	{ PROTO_ESP, "aes128-serpent", "aes128-serpent" },
+	{ PROTO_ESP, "aes128-serpent", "aes128", PROPOSAL_SKIP_PRIVATE },
+	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modp3072" },
+	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH },
+	{ PROTO_ESP, "aes128-serpent-modp3072", "aes128-serpent",
+		PROPOSAL_SKIP_DH },
+	{ PROTO_ESP, "aes128-serpent-modp3072", "aes128",
+		PROPOSAL_SKIP_PRIVATE | PROPOSAL_SKIP_DH },
+};
+
+START_TEST(test_clone)
+{
+	proposal_t *orig, *result, *expected;
+
+	orig = proposal_create_from_string(clone_data[_i].proto,
+									   clone_data[_i].orig);
+	orig->set_spi(orig, 0x12345678);
+
+	result = orig->clone(orig, clone_data[_i].flags);
+
+	expected = proposal_create_from_string(clone_data[_i].proto,
+										   clone_data[_i].expected);
+	ck_assert_msg(expected->equals(expected, result), "proposal %P does "
+				  "not match expected %P", result, expected);
+	ck_assert_int_eq(orig->get_spi(orig), result->get_spi(result));
+
+	expected->destroy(expected);
+	result->destroy(result);
+	orig->destroy(orig);
+}
+END_TEST
 
 Suite *proposal_suite_create()
 {
@@ -454,5 +492,9 @@ Suite *proposal_suite_create()
 	tcase_add_test(tc, test_chacha20_poly1305_key_length);
 	suite_add_tcase(s, tc);
 
+	tc = tcase_create("clone");
+	tcase_add_loop_test(tc, test_clone, 0, countof(clone_data));
+	suite_add_tcase(s, tc);
+
 	return s;
 }