denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proposal: Handle skipping DH groups directly in select() and matches()

Browse Source 
Also renames the flag.
This commit is contained in:
Tobias Brunner
2019-10-24 17:33:57 +02:00
parent f930b732c4
commit a406bc60c5
5 changed files with 26 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/crypto/proposal/proposal.c
+4
View File
@@ -434,6 +434,10 @@ static bool select_algos(private_proposal_t *this, proposal_t *other,
{
continue;
}
if (type == DIFFIE_HELLMAN_GROUP && (flags & PROPOSAL_SKIP_DH))
{
continue;
}
if (select_algo(this, other, type, flags, selected != NULL, &alg, &ks))
{
if (alg == 0 && type != EXTENDED_SEQUENCE_NUMBERS)
src/libstrongswan/crypto/proposal/proposal.h
+2 -2
View File
@@ -60,8 +60,8 @@ enum proposal_selection_flag_t {
PROPOSAL_ALLOW_PRIVATE = (1<<0),
/** Whether to prefer configured or supplied proposals. */
PROPOSAL_PREFER_CONFIGURED = (1<<1),
/** Whether to strip out diffie hellman groups */
PROPOSAL_STRIP_DH = (1<<2),
/** Whether to skip and ignore diffie hellman groups. */
PROPOSAL_SKIP_DH = (1<<2),
};
/**
src/libstrongswan/tests/suites/test_proposal.c
+19 -5
View File
@@ -88,6 +88,7 @@ static struct {
char *self;
char *other;
char *expected;
proposal_selection_flag_t flags;
} select_data[] = {
{ PROTO_ESP, "aes128", "aes128", "aes128" },
{ PROTO_ESP, "aes128", "aes256", NULL },
@@ -96,7 +97,11 @@ static struct {
{ PROTO_ESP, "aes128-aes256-sha1-sha256", "aes256-aes128-sha256-sha1", "aes128-sha1" },
{ PROTO_ESP, "aes256-aes128-sha256-sha1", "aes128-aes256-sha1-sha256", "aes256-sha256" },
{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", NULL },
{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", "aes128-sha256", PROPOSAL_SKIP_DH },
{ PROTO_ESP, "aes128-sha256", "aes128-sha256-modp3072", NULL },
{ PROTO_ESP, "aes128-sha256", "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH },
{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH },
{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-ecp256", "aes128-sha256", PROPOSAL_SKIP_DH },
{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modpnone", NULL },
{ PROTO_ESP, "aes128-sha256-modpnone", "aes128-sha256-modp3072", NULL },
{ PROTO_ESP, "aes128-sha256-modp3072-modpnone", "aes128-sha256", "aes128-sha256" },
@@ -121,7 +126,8 @@ START_TEST(test_select)
select_data[_i].self);
other = proposal_create_from_string(select_data[_i].proto,
select_data[_i].other);
selected = self->select(self, other, PROPOSAL_PREFER_CONFIGURED);
selected = self->select(self, other,
select_data[_i].flags | PROPOSAL_PREFER_CONFIGURED);
if (select_data[_i].expected)
{
expected = proposal_create_from_string(select_data[_i].proto,
@@ -174,13 +180,21 @@ START_TEST(test_matches)
select_data[_i].other);
if (select_data[_i].expected)
{
ck_assert(self->matches(self, other, FALSE));
ck_assert(other->matches(other, self, FALSE));
ck_assert(self->matches(self, other, select_data[_i].flags));
ck_assert(other->matches(other, self, select_data[_i].flags));
ck_assert(self->matches(self, other,
select_data[_i].flags | PROPOSAL_PREFER_CONFIGURED));
ck_assert(other->matches(other, self,
select_data[_i].flags | PROPOSAL_PREFER_CONFIGURED));
}
else
{
ck_assert(!self->matches(self, other, FALSE));
ck_assert(!other->matches(other, self, FALSE));
ck_assert(!self->matches(self, other, select_data[_i].flags));
ck_assert(!other->matches(other, self, select_data[_i].flags));
ck_assert(!self->matches(self, other,
select_data[_i].flags | PROPOSAL_PREFER_CONFIGURED));
ck_assert(!other->matches(other, self,
select_data[_i].flags | PROPOSAL_PREFER_CONFIGURED));
}
other->destroy(other);
self->destroy(self);