Merge branch 'proposal-flags'

This uses flags for proposal selection and cloning that control
whether DH groups and algorithms from a private range are skipped, and
for selection whether configured or supplied proposals/algorithms are
preferred.

src/libcharon/config/child_cfg.c

@@ -209,16 +209,18 @@ METHOD(child_cfg_t, get_proposals, linked_list_t*,
 {
 	enumerator_t *enumerator;
 	proposal_t *current;
+	proposal_selection_flag_t flags = 0;
 	linked_list_t *proposals = linked_list_create();
 
+	if (strip_dh)
+	{
+		flags |= PROPOSAL_SKIP_DH;
+	}
+
 	enumerator = this->proposals->create_enumerator(this->proposals);
 	while (enumerator->enumerate(enumerator, &current))
 	{
-		current = current->clone(current);
+		current = current->clone(current, flags);
-		if (strip_dh)
-		{
-			current->strip_dh(current, MODP_NONE);
-		}
 		if (proposals->find_first(proposals, match_proposal, NULL, current))
 		{
 			current->destroy(current);
@@ -234,69 +236,10 @@ METHOD(child_cfg_t, get_proposals, linked_list_t*,
 }
 
 METHOD(child_cfg_t, select_proposal, proposal_t*,
-	private_child_cfg_t*this, linked_list_t *proposals, bool strip_dh,
+	private_child_cfg_t*this, linked_list_t *proposals,
-	bool private, bool prefer_self)
+	proposal_selection_flag_t flags)
 {
-	enumerator_t *prefer_enum, *match_enum;
+	return proposal_select(this->proposals, proposals, flags);
-	proposal_t *proposal, *match, *selected = NULL;
-
-	if (prefer_self)
-	{
-		prefer_enum = this->proposals->create_enumerator(this->proposals);
-		match_enum = proposals->create_enumerator(proposals);
-	}
-	else
-	{
-		prefer_enum = proposals->create_enumerator(proposals);
-		match_enum = this->proposals->create_enumerator(this->proposals);
-	}
-
-	while (prefer_enum->enumerate(prefer_enum, &proposal))
-	{
-		proposal = proposal->clone(proposal);
-		if (strip_dh)
-		{
-			proposal->strip_dh(proposal, MODP_NONE);
-		}
-		if (prefer_self)
-		{
-			proposals->reset_enumerator(proposals, match_enum);
-		}
-		else
-		{
-			this->proposals->reset_enumerator(this->proposals, match_enum);
-		}
-		while (match_enum->enumerate(match_enum, &match))
-		{
-			match = match->clone(match);
-			if (strip_dh)
-			{
-				match->strip_dh(match, MODP_NONE);
-			}
-			selected = proposal->select(proposal, match, prefer_self, private);
-			match->destroy(match);
-			if (selected)
-			{
-				DBG2(DBG_CFG, "received proposals: %#P", proposals);
-				DBG2(DBG_CFG, "configured proposals: %#P", this->proposals);
-				DBG1(DBG_CFG, "selected proposal: %P", selected);
-				break;
-			}
-		}
-		proposal->destroy(proposal);
-		if (selected)
-		{
-			break;
-		}
-	}
-	prefer_enum->destroy(prefer_enum);
-	match_enum->destroy(match_enum);
-	if (!selected)
-	{
-		DBG1(DBG_CFG, "received proposals: %#P", proposals);
-		DBG1(DBG_CFG, "configured proposals: %#P", this->proposals);
-	}
-	return selected;
 }
 
 METHOD(child_cfg_t, add_traffic_selector, void,

src/libcharon/config/child_cfg.h

@@ -99,14 +99,11 @@ struct child_cfg_t {
 	 * Returned propsal is newly created and must be destroyed after usage.
 	 *
 	 * @param proposals		list from which proposals are selected
-	 * @param strip_dh		TRUE strip out diffie hellman groups
+	 * @param flags			flags to consider during proposal selection
-	 * @param private		accept algorithms from a private range
-	 * @param prefer_self	whether to prefer configured or supplied proposals
 	 * @return				selected proposal, or NULL if nothing matches
 	 */
 	proposal_t* (*select_proposal)(child_cfg_t*this, linked_list_t *proposals,
-								   bool strip_dh, bool private,
+								   proposal_selection_flag_t flags);
-								   bool prefer_self);
 
 	/**
 	 * Add a traffic selector to the config.

src/libcharon/config/ike_cfg.c

@@ -310,7 +310,7 @@ METHOD(ike_cfg_t, get_proposals, linked_list_t*,
 	enumerator = this->proposals->create_enumerator(this->proposals);
 	while (enumerator->enumerate(enumerator, &current))
 	{
-		current = current->clone(current);
+		current = current->clone(current, 0);
 		proposals->insert_last(proposals, current);
 	}
 	enumerator->destroy(enumerator);
@@ -329,7 +329,8 @@ METHOD(ike_cfg_t, has_proposal, bool,
 	enumerator = this->proposals->create_enumerator(this->proposals);
 	while (enumerator->enumerate(enumerator, &proposal))
 	{
-		if (proposal->matches(proposal, match, private))
+		if (proposal->matches(proposal, match,
+							  private ? 0 : PROPOSAL_SKIP_PRIVATE))
 		{
 			enumerator->destroy(enumerator);
 			return TRUE;
@@ -340,57 +341,10 @@ METHOD(ike_cfg_t, has_proposal, bool,
 }
 
 METHOD(ike_cfg_t, select_proposal, proposal_t*,
-	private_ike_cfg_t *this, linked_list_t *proposals, bool private,
+	private_ike_cfg_t *this, linked_list_t *proposals,
-	bool prefer_self)
+	proposal_selection_flag_t flags)
 {
-	enumerator_t *prefer_enum, *match_enum;
+	return proposal_select(this->proposals, proposals, flags);
-	proposal_t *proposal, *match, *selected = NULL;
-
-	if (prefer_self)
-	{
-		prefer_enum = this->proposals->create_enumerator(this->proposals);
-		match_enum = proposals->create_enumerator(proposals);
-	}
-	else
-	{
-		prefer_enum = proposals->create_enumerator(proposals);
-		match_enum = this->proposals->create_enumerator(this->proposals);
-	}
-
-	while (prefer_enum->enumerate(prefer_enum, (void**)&proposal))
-	{
-		if (prefer_self)
-		{
-			proposals->reset_enumerator(proposals, match_enum);
-		}
-		else
-		{
-			this->proposals->reset_enumerator(this->proposals, match_enum);
-		}
-		while (match_enum->enumerate(match_enum, (void**)&match))
-		{
-			selected = proposal->select(proposal, match, prefer_self, private);
-			if (selected)
-			{
-				DBG2(DBG_CFG, "received proposals: %#P", proposals);
-				DBG2(DBG_CFG, "configured proposals: %#P", this->proposals);
-				DBG1(DBG_CFG, "selected proposal: %P", selected);
-				break;
-			}
-		}
-		if (selected)
-		{
-			break;
-		}
-	}
-	prefer_enum->destroy(prefer_enum);
-	match_enum->destroy(match_enum);
-	if (!selected)
-	{
-		DBG1(DBG_CFG, "received proposals: %#P", proposals);
-		DBG1(DBG_CFG, "configured proposals: %#P", this->proposals);
-	}
-	return selected;
 }
 
 METHOD(ike_cfg_t, get_dh_group, diffie_hellman_group_t,

src/libcharon/config/ike_cfg.h

@@ -186,12 +186,11 @@ struct ike_cfg_t {
 	 * Returned proposal must be destroyed after use.
 	 *
 	 * @param proposals		list of proposals to select from
-	 * @param private		accept algorithms from a private range
+	 * @param flags			flags to consider during proposal selection
-	 * @param prefer_self	whether to prefer configured or supplied proposals
 	 * @return				selected proposal, or NULL if none matches.
 	 */
 	proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals,
-									bool private, bool prefer_self);
+									proposal_selection_flag_t flags);
 
 	/**
 	 * Check if the config has a matching proposal.

src/libcharon/plugins/load_tester/load_tester_config.c

@@ -749,7 +749,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
 		ike.local_port = charon->socket->get_port(charon->socket, FALSE);
 	}
 	ike_cfg = ike_cfg_create(&ike);
-	ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal));
+	ike_cfg->add_proposal(ike_cfg, this->proposal->clone(this->proposal, 0));
 	peer_cfg = peer_cfg_create("load-test", ike_cfg, &peer);
 
 	if (this->vip)
@@ -784,7 +784,7 @@ static peer_cfg_t* generate_config(private_load_tester_config_t *this, uint num)
 	}
 
 	child_cfg = child_cfg_create("load-test", &child);
-	child_cfg->add_proposal(child_cfg, this->esp->clone(this->esp));
+	child_cfg->add_proposal(child_cfg, this->esp->clone(this->esp, 0));
 
 	if (num)
 	{	/* initiator */

src/libcharon/sa/child_sa.c

@@ -429,7 +429,7 @@ METHOD(child_sa_t, get_proposal, proposal_t*,
 METHOD(child_sa_t, set_proposal, void,
 	   private_child_sa_t *this, proposal_t *proposal)
 {
-	this->proposal = proposal->clone(proposal);
+	this->proposal = proposal->clone(proposal, 0);
 }
 
 METHOD(child_sa_t, create_ts_enumerator, enumerator_t*,

src/libcharon/sa/ike_sa.c

@@ -610,7 +610,7 @@ METHOD(ike_sa_t, set_proposal, void,
 	private_ike_sa_t *this, proposal_t *proposal)
 {
 	DESTROY_IF(this->proposal);
-	this->proposal = proposal->clone(proposal);
+	this->proposal = proposal->clone(proposal, 0);
 }
 
 METHOD(ike_sa_t, set_message_id, void,

src/libcharon/sa/ikev1/tasks/aggressive_mode.c

@@ -374,8 +374,8 @@ METHOD(task_t, process_r, status_t,
 			id_payload_t *id_payload;
 			identification_t *id;
 			linked_list_t *list;
+			proposal_selection_flag_t flags = PROPOSAL_SKIP_PRIVATE;
 			uint16_t group;
-			bool prefer_configured;
 
 			this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 			DBG0(DBG_IKE, "%H is initiating a Aggressive Mode IKE_SA",
@@ -399,10 +399,13 @@ METHOD(task_t, process_r, status_t,
 			}
 
 			list = sa_payload->get_proposals(sa_payload);
-			prefer_configured = lib->settings->get_bool(lib->settings,
+			if (!lib->settings->get_bool(lib->settings,
-							"%s.prefer_configured_proposals", TRUE, lib->ns);
+						"%s.prefer_configured_proposals", TRUE, lib->ns))
-			this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
+			{
-												list, FALSE, prefer_configured);
+				flags = PROPOSAL_PREFER_SUPPLIED;
+			}
+			this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, list,
+															flags);
 			list->destroy_offset(list, offsetof(proposal_t, destroy));
 			if (!this->proposal)
 			{
@@ -641,8 +644,7 @@ METHOD(task_t, process_i, status_t,
 			return send_notify(this, INVALID_PAYLOAD_TYPE);
 		}
 		list = sa_payload->get_proposals(sa_payload);
-		this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
+		this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, list, 0);
-														list, FALSE, TRUE);
 		list->destroy_offset(list, offsetof(proposal_t, destroy));
 		if (!this->proposal)
 		{

src/libcharon/sa/ikev1/tasks/main_mode.c

@@ -362,7 +362,7 @@ METHOD(task_t, process_r, status_t,
 		{
 			linked_list_t *list;
 			sa_payload_t *sa_payload;
-			bool private, prefer_configured;
+			proposal_selection_flag_t flags = 0;
 
 			this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 			DBG0(DBG_IKE, "%H is initiating a Main Mode IKE_SA",
@@ -386,12 +386,17 @@ METHOD(task_t, process_r, status_t,
 			}
 
 			list = sa_payload->get_proposals(sa_payload);
-			private = this->ike_sa->supports_extension(this->ike_sa,
+			if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
-													   EXT_STRONGSWAN);
+			{
-			prefer_configured = lib->settings->get_bool(lib->settings,
+				flags |= PROPOSAL_SKIP_PRIVATE;
-							"%s.prefer_configured_proposals", TRUE, lib->ns);
+			}
+			if (!lib->settings->get_bool(lib->settings,
+							"%s.prefer_configured_proposals", TRUE, lib->ns))
+			{
+				flags |= PROPOSAL_PREFER_SUPPLIED;
+			}
 			this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
-											list, private, prefer_configured);
+											list, flags);
 			list->destroy_offset(list, offsetof(proposal_t, destroy));
 			if (!this->proposal)
 			{
@@ -624,8 +629,8 @@ METHOD(task_t, process_i, status_t,
 			linked_list_t *list;
 			sa_payload_t *sa_payload;
 			auth_method_t method;
+			proposal_selection_flag_t flags = 0;
 			uint32_t lifetime;
-			bool private;
 
 			sa_payload = (sa_payload_t*)message->get_payload(message,
 													PLV1_SECURITY_ASSOCIATION);
@@ -635,10 +640,12 @@ METHOD(task_t, process_i, status_t,
 				return send_notify(this, INVALID_PAYLOAD_TYPE);
 			}
 			list = sa_payload->get_proposals(sa_payload);
-			private = this->ike_sa->supports_extension(this->ike_sa,
+			if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
-														   EXT_STRONGSWAN);
+			{
+				flags |= PROPOSAL_SKIP_PRIVATE;
+			}
 			this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
-															list, private, TRUE);
+															list, flags);
 			list->destroy_offset(list, offsetof(proposal_t, destroy));
 			if (!this->proposal)
 			{

src/libcharon/sa/ikev1/tasks/quick_mode.c

@@ -802,7 +802,7 @@ static linked_list_t *get_proposals(private_quick_mode_t *this,
 				proposal->destroy(proposal);
 				continue;
 			}
-			proposal->strip_dh(proposal, group);
+			proposal->promote_dh_group(proposal, group);
 		}
 		proposal->set_spi(proposal, this->spi_i);
 	}
@@ -852,7 +852,7 @@ METHOD(task_t, build_i, status_t,
 				}
 			}
 
-			list = this->config->get_proposals(this->config, MODP_NONE);
+			list = this->config->get_proposals(this->config, FALSE);
 			if (list->get_first(list, (void**)&proposal) == SUCCESS)
 			{
 				this->proto = proposal->get_protocol(proposal);
@@ -1072,7 +1072,7 @@ METHOD(task_t, process_r, status_t,
 			linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL;
 			peer_cfg_t *peer_cfg;
 			uint16_t group;
-			bool private, prefer_configured;
+			proposal_selection_flag_t flags = 0;
 
 			sa_payload = (sa_payload_t*)message->get_payload(message,
 													PLV1_SECURITY_ASSOCIATION);
@@ -1132,12 +1132,17 @@ METHOD(task_t, process_r, status_t,
 				DESTROY_IF(list);
 				list = sa_payload->get_proposals(sa_payload);
 			}
-			private = this->ike_sa->supports_extension(this->ike_sa,
+			if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
-													   EXT_STRONGSWAN);
+			{
-			prefer_configured = lib->settings->get_bool(lib->settings,
+				flags |= PROPOSAL_SKIP_PRIVATE;
-							"%s.prefer_configured_proposals", TRUE, lib->ns);
+			}
+			if (!lib->settings->get_bool(lib->settings,
+							"%s.prefer_configured_proposals", TRUE, lib->ns))
+			{
+				flags |= PROPOSAL_PREFER_SUPPLIED;
+			}
 			this->proposal = this->config->select_proposal(this->config, list,
-											FALSE, private, prefer_configured);
+														   flags);
 			list->destroy_offset(list, offsetof(proposal_t, destroy));
 
 			get_lifetimes(this);
@@ -1340,7 +1345,7 @@ METHOD(task_t, process_i, status_t,
 		{
 			sa_payload_t *sa_payload;
 			linked_list_t *list = NULL;
-			bool private;
+			proposal_selection_flag_t flags = 0;
 
 			sa_payload = (sa_payload_t*)message->get_payload(message,
 													PLV1_SECURITY_ASSOCIATION);
@@ -1365,10 +1370,12 @@ METHOD(task_t, process_i, status_t,
 				DESTROY_IF(list);
 				list = sa_payload->get_proposals(sa_payload);
 			}
-			private = this->ike_sa->supports_extension(this->ike_sa,
+			if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
-													   EXT_STRONGSWAN);
+			{
+				flags |= PROPOSAL_SKIP_PRIVATE;
+			}
 			this->proposal = this->config->select_proposal(this->config, list,
-														FALSE, private, TRUE);
+														   flags);
 			list->destroy_offset(list, offsetof(proposal_t, destroy));
 			if (!this->proposal)
 			{

src/libcharon/sa/ikev2/tasks/child_create.c

@@ -544,7 +544,7 @@ static status_t select_and_install(private_child_create_t *this,
 	chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
 	linked_list_t *my_ts, *other_ts;
 	host_t *me, *other;
-	bool private, prefer_configured;
+	proposal_selection_flag_t flags = 0;
 
 	if (this->proposals == NULL)
 	{
@@ -560,11 +560,21 @@ static status_t select_and_install(private_child_create_t *this,
 	me = this->ike_sa->get_my_host(this->ike_sa);
 	other = this->ike_sa->get_other_host(this->ike_sa);
 
-	private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
+	if (no_dh)
-	prefer_configured = lib->settings->get_bool(lib->settings,
+	{
-							"%s.prefer_configured_proposals", TRUE, lib->ns);
+		flags |= PROPOSAL_SKIP_DH;
+	}
+	if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+	{
+		flags |= PROPOSAL_SKIP_PRIVATE;
+	}
+	if (!lib->settings->get_bool(lib->settings,
+							"%s.prefer_configured_proposals", TRUE, lib->ns))
+	{
+		flags |= PROPOSAL_PREFER_SUPPLIED;
+	}
 	this->proposal = this->config->select_proposal(this->config,
-							this->proposals, no_dh, private, prefer_configured);
+												   this->proposals, flags);
 	if (this->proposal == NULL)
 	{
 		DBG1(DBG_IKE, "no acceptable proposal found");

src/libcharon/sa/ikev2/tasks/ike_init.c

@@ -453,17 +453,21 @@ static void process_sa_payload(private_ike_init_t *this, message_t *message,
 	enumerator_t *enumerator;
 	linked_list_t *proposal_list;
 	host_t *me, *other;
-	bool private, prefer_configured;
+	proposal_selection_flag_t flags = 0;
 
 	ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 
 	proposal_list = sa_payload->get_proposals(sa_payload);
-	private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
+	if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
-	prefer_configured = lib->settings->get_bool(lib->settings,
+	{
-							"%s.prefer_configured_proposals", TRUE, lib->ns);
+		flags |= PROPOSAL_SKIP_PRIVATE;
-
+	}
-	this->proposal = ike_cfg->select_proposal(ike_cfg, proposal_list, private,
+	if (!lib->settings->get_bool(lib->settings,
-											  prefer_configured);
+							"%s.prefer_configured_proposals", TRUE, lib->ns))
+	{
+		flags |= PROPOSAL_PREFER_SUPPLIED;
+	}
+	this->proposal = ike_cfg->select_proposal(ike_cfg, proposal_list, flags);
 	if (!this->proposal)
 	{
 		if (!this->initiator && !this->old_sa)
@@ -481,7 +485,7 @@ static void process_sa_payload(private_ike_init_t *this, message_t *message,
 				DBG1(DBG_IKE, "no matching proposal found, trying alternative "
 					 "config");
 				this->proposal = cfg->select_proposal(cfg, proposal_list,
-													private, prefer_configured);
+													  flags);
 				if (this->proposal)
 				{
 					alt_cfg = cfg->get_ref(cfg);

src/libstrongswan/crypto/proposal/proposal.c

@@ -302,44 +302,12 @@ METHOD(proposal_t, promote_dh_group, bool,
 	return found;
 }
 
-METHOD(proposal_t, strip_dh, void,
-	private_proposal_t *this, diffie_hellman_group_t keep)
-{
-	enumerator_t *enumerator;
-	entry_t *entry;
-	bool found = FALSE;
-
-	enumerator = array_create_enumerator(this->transforms);
-	while (enumerator->enumerate(enumerator, &entry))
-	{
-		if (entry->type == DIFFIE_HELLMAN_GROUP)
-		{
-			if (entry->alg != keep)
-			{
-				array_remove_at(this->transforms, enumerator);
-			}
-			else
-			{
-				found = TRUE;
-			}
-		}
-	}
-	enumerator->destroy(enumerator);
-	array_compress(this->transforms);
-
-	if (keep == MODP_NONE || !found)
-	{
-		remove_type(this, DIFFIE_HELLMAN_GROUP);
-		array_compress(this->types);
-	}
-}
-
 /**
  * Select a matching proposal from this and other.
  */
 static bool select_algo(private_proposal_t *this, proposal_t *other,
-						transform_type_t type, bool priv, bool log,
+						transform_type_t type, proposal_selection_flag_t flags,
-						uint16_t *alg, uint16_t *ks)
+						bool log, uint16_t *alg, uint16_t *ks)
 {
 	enumerator_t *e1, *e2;
 	uint16_t alg1, alg2, ks1, ks2;
@@ -390,7 +358,7 @@ static bool select_algo(private_proposal_t *this, proposal_t *other,
 		{
 			if (alg1 == alg2 && ks1 == ks2)
 			{
-				if (!priv && alg1 >= 1024)
+				if ((flags & PROPOSAL_SKIP_PRIVATE) && alg1 >= 1024)
 				{
 					if (log)
 					{
@@ -417,7 +385,7 @@ static bool select_algo(private_proposal_t *this, proposal_t *other,
  * is stored there and errors are logged.
  */
 static bool select_algos(private_proposal_t *this, proposal_t *other,
-						 proposal_t *selected, bool private)
+						 proposal_t *selected, proposal_selection_flag_t flags)
 {
 	transform_type_t type;
 	array_t *types;
@@ -434,7 +402,11 @@ static bool select_algos(private_proposal_t *this, proposal_t *other,
 		{
 			continue;
 		}
-		if (select_algo(this, other, type, private, selected != NULL, &alg, &ks))
+		if (type == DIFFIE_HELLMAN_GROUP && (flags & PROPOSAL_SKIP_DH))
+		{
+			continue;
+		}
+		if (select_algo(this, other, type, flags, selected != NULL, &alg, &ks))
 		{
 			if (alg == 0 && type != EXTENDED_SEQUENCE_NUMBERS)
 			{	/* 0 is "valid" for extended sequence numbers, for other
@@ -468,8 +440,8 @@ static bool select_algos(private_proposal_t *this, proposal_t *other,
 }
 
 METHOD(proposal_t, select_proposal, proposal_t*,
-	private_proposal_t *this, proposal_t *other, bool other_remote,
+	private_proposal_t *this, proposal_t *other,
-	bool private)
+	proposal_selection_flag_t flags)
 {
 	proposal_t *selected;
 
@@ -481,18 +453,18 @@ METHOD(proposal_t, select_proposal, proposal_t*,
 		return NULL;
 	}
 
-	if (other_remote)
+	if (flags & PROPOSAL_PREFER_SUPPLIED)
-	{
-		selected = proposal_create(this->protocol, other->get_number(other));
-		selected->set_spi(selected, other->get_spi(other));
-	}
-	else
 	{
 		selected = proposal_create(this->protocol, this->number);
 		selected->set_spi(selected, this->spi);
 	}
+	else
+	{
+		selected = proposal_create(this->protocol, other->get_number(other));
+		selected->set_spi(selected, other->get_spi(other));
+	}
 
-	if (!select_algos(this, other, selected, private))
+	if (!select_algos(this, other, selected, flags))
 	{
 		selected->destroy(selected);
 		return NULL;
@@ -502,13 +474,14 @@ METHOD(proposal_t, select_proposal, proposal_t*,
 }
 
 METHOD(proposal_t, matches, bool,
-	private_proposal_t *this, proposal_t *other, bool private)
+	private_proposal_t *this, proposal_t *other,
+	proposal_selection_flag_t flags)
 {
 	if (this->protocol != other->get_protocol(other))
 	{
 		return FALSE;
 	}
-	return select_algos(this, other, NULL, private);
+	return select_algos(this, other, NULL, flags);
 }
 
 METHOD(proposal_t, get_protocol, protocol_id_t,
@@ -599,25 +572,27 @@ METHOD(proposal_t, equals, bool,
 }
 
 METHOD(proposal_t, clone_, proposal_t*,
-	private_proposal_t *this)
+	private_proposal_t *this, proposal_selection_flag_t flags)
 {
 	private_proposal_t *clone;
 	enumerator_t *enumerator;
 	entry_t *entry;
-	transform_type_t *type;
 
 	clone = (private_proposal_t*)proposal_create(this->protocol, 0);
 
 	enumerator = array_create_enumerator(this->transforms);
 	while (enumerator->enumerate(enumerator, &entry))
 	{
+		if (entry->alg >= 1024 && (flags & PROPOSAL_SKIP_PRIVATE))
+		{
+			continue;
+		}
+		if (entry->type == DIFFIE_HELLMAN_GROUP && (flags & PROPOSAL_SKIP_DH))
+		{
+			continue;
+		}
 		array_insert(clone->transforms, ARRAY_TAIL, entry);
-	}
+		add_type(clone->types, entry->type);
-	enumerator->destroy(enumerator);
-	enumerator = array_create_enumerator(this->types);
-	while (enumerator->enumerate(enumerator, &type))
-	{
-		array_insert(clone->types, ARRAY_TAIL, type);
 	}
 	enumerator->destroy(enumerator);
 
@@ -954,7 +929,6 @@ proposal_t *proposal_create(protocol_id_t protocol, u_int number)
 			.get_algorithm = _get_algorithm,
 			.has_dh_group = _has_dh_group,
 			.promote_dh_group = _promote_dh_group,
-			.strip_dh = _strip_dh,
 			.select = _select_proposal,
 			.matches = _matches,
 			.get_protocol = _get_protocol,
@@ -1341,3 +1315,59 @@ proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs
 
 	return &this->public;
 }
+
+/*
+ * Described in header
+ */
+proposal_t *proposal_select(linked_list_t *configured, linked_list_t *supplied,
+							proposal_selection_flag_t flags)
+{
+	enumerator_t *prefer_enum, *match_enum;
+	proposal_t *proposal, *match, *selected = NULL;
+
+	if (flags & PROPOSAL_PREFER_SUPPLIED)
+	{
+		prefer_enum = supplied->create_enumerator(supplied);
+		match_enum = configured->create_enumerator(configured);
+	}
+	else
+	{
+		prefer_enum = configured->create_enumerator(configured);
+		match_enum = supplied->create_enumerator(supplied);
+	}
+
+	while (prefer_enum->enumerate(prefer_enum, &proposal))
+	{
+		if (flags & PROPOSAL_PREFER_SUPPLIED)
+		{
+			configured->reset_enumerator(configured, match_enum);
+		}
+		else
+		{
+			supplied->reset_enumerator(supplied, match_enum);
+		}
+		while (match_enum->enumerate(match_enum, &match))
+		{
+			selected = proposal->select(proposal, match, flags);
+			if (selected)
+			{
+				DBG2(DBG_CFG, "received proposals: %#P", supplied);
+				DBG2(DBG_CFG, "configured proposals: %#P", configured);
+				DBG1(DBG_CFG, "selected proposal: %P", selected);
+				break;
+			}
+		}
+		if (selected)
+		{
+			break;
+		}
+	}
+	prefer_enum->destroy(prefer_enum);
+	match_enum->destroy(match_enum);
+	if (!selected)
+	{
+		DBG1(DBG_CFG, "received proposals: %#P", supplied);
+		DBG1(DBG_CFG, "configured proposals: %#P", configured);
+	}
+	return selected;
+}

src/libstrongswan/crypto/proposal/proposal.h

@@ -23,6 +23,7 @@
 #define PROPOSAL_H_
 
 typedef enum protocol_id_t protocol_id_t;
+typedef enum proposal_selection_flag_t proposal_selection_flag_t;
 typedef enum extended_sequence_numbers_t extended_sequence_numbers_t;
 typedef struct proposal_t proposal_t;
 
@@ -51,6 +52,18 @@ enum protocol_id_t {
  */
 extern enum_name_t *protocol_id_names;
 
+/**
+ * Flags for selecting proposals
+ */
+enum proposal_selection_flag_t {
+	/** Whether to prefer configured (default) or supplied proposals. */
+	PROPOSAL_PREFER_SUPPLIED = (1<<0),
+	/** Whether to skip and ignore algorithms from a private range. */
+	PROPOSAL_SKIP_PRIVATE = (1<<1),
+	/** Whether to skip and ignore diffie hellman groups. */
+	PROPOSAL_SKIP_DH = (1<<2),
+};
+
 /**
  * Stores a set of algorithms used for an SA.
  *
@@ -118,13 +131,6 @@ struct proposal_t {
 	 */
 	bool (*promote_dh_group)(proposal_t *this, diffie_hellman_group_t group);
 
-	/**
-	 * Strip DH groups from proposal to use it without PFS.
-	 *
-	 * @param keep			group to keep (MODP_NONE to remove all)
-	 */
-	void (*strip_dh)(proposal_t *this, diffie_hellman_group_t keep);
-
 	/**
 	 * Compare two proposal, and select a matching subset.
 	 *
@@ -132,15 +138,16 @@ struct proposal_t {
 	 * compared. If they have at least one algorithm of each type
 	 * in common, a resulting proposal of this kind is created.
 	 *
+	 * Unless the flag PROPOSAL_PREFER_SUPPLIED is set, other is expected to be
+	 * the remote proposal from which to copy SPI and proposal number to the
+	 * result, otherwise copy from this proposal.
+	 *
 	 * @param other			proposal to compare against
-	 * @param other_remote	whether other is the remote proposal from which to
+	 * @param flags			flags to consider during proposal selection
-	 *						copy SPI and proposal number to the result,
-	 *						otherwise copy from this proposal
-	 * @param private		accepts algorithms allocated in a private range
 	 * @return				selected proposal, NULL if proposals don't match
 	 */
 	proposal_t *(*select)(proposal_t *this, proposal_t *other,
-						  bool other_remote, bool private);
+						  proposal_selection_flag_t flags);
 
 	/**
 	 * Check if the given proposal matches this proposal.
@@ -148,10 +155,11 @@ struct proposal_t {
 	 * This is similar to select, but no resulting proposal is selected.
 	 *
 	 * @param other			proposal to compare against
-	 * @param private		accepts algorithms allocated in a private range
+	 * @param flags			flags to consider during proposal selection
 	 * @return				TRUE if the proposals match
 	 */
-	bool (*matches)(proposal_t *this, proposal_t *other, bool private);
+	bool (*matches)(proposal_t *this, proposal_t *other,
+					proposal_selection_flag_t flags);
 
 	/**
 	 * Get the protocol ID of the proposal.
@@ -192,9 +200,10 @@ struct proposal_t {
 	/**
 	 * Clone a proposal.
 	 *
+	 * @param flags			flags to consider during cloning
 	 * @return				clone of proposal
 	 */
-	proposal_t *(*clone) (proposal_t *this);
+	proposal_t *(*clone)(proposal_t *this, proposal_selection_flag_t flags);
 
 	/**
 	 * Destroys the proposal object.
@@ -240,7 +249,19 @@ proposal_t *proposal_create_default_aead(protocol_id_t protocol);
  * @param algs				algorithms as string
  * @return					proposal_t object
  */
-proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs);
+proposal_t *proposal_create_from_string(protocol_id_t protocol,
+										const char *algs);
+
+/**
+ * Select a common proposal from the given lists of proposals.
+ *
+ * @param configured		list of configured/local proposals
+ * @param supplied			list of supplied/remote proposals
+ * @param flags				flags to consider during proposal selection
+ * @return					selected proposal, or NULL (allocated)
+ */
+proposal_t *proposal_select(linked_list_t *configured, linked_list_t *supplied,
+							proposal_selection_flag_t flags);
 
 /**
  * printf hook function for proposal_t.

src/libstrongswan/tests/suites/test_proposal.c

@@ -88,6 +88,7 @@ static struct {
 	char *self;
 	char *other;
 	char *expected;
+	proposal_selection_flag_t flags;
 } select_data[] = {
 	{ PROTO_ESP, "aes128", "aes128", "aes128" },
 	{ PROTO_ESP, "aes128", "aes256", NULL },
@@ -96,7 +97,11 @@ static struct {
 	{ PROTO_ESP, "aes128-aes256-sha1-sha256", "aes256-aes128-sha256-sha1", "aes128-sha1" },
 	{ PROTO_ESP, "aes256-aes128-sha256-sha1", "aes128-aes256-sha1-sha256", "aes256-sha256" },
 	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", NULL },
+	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", "aes128-sha256", PROPOSAL_SKIP_DH },
 	{ PROTO_ESP, "aes128-sha256", "aes128-sha256-modp3072", NULL },
+	{ PROTO_ESP, "aes128-sha256", "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH },
+	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH },
+	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-ecp256", "aes128-sha256", PROPOSAL_SKIP_DH },
 	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modpnone", NULL },
 	{ PROTO_ESP, "aes128-sha256-modpnone", "aes128-sha256-modp3072", NULL },
 	{ PROTO_ESP, "aes128-sha256-modp3072-modpnone", "aes128-sha256", "aes128-sha256" },
@@ -121,7 +126,7 @@ START_TEST(test_select)
 									   select_data[_i].self);
 	other = proposal_create_from_string(select_data[_i].proto,
 										select_data[_i].other);
-	selected = self->select(self, other, TRUE, FALSE);
+	selected = self->select(self, other, select_data[_i].flags);
 	if (select_data[_i].expected)
 	{
 		expected = proposal_create_from_string(select_data[_i].proto,
@@ -149,12 +154,12 @@ START_TEST(test_select_spi)
 	other = proposal_create_from_string(PROTO_ESP, "aes128-sha256-modp3072");
 	other->set_spi(other, 0x12345678);
 
-	selected = self->select(self, other, TRUE, FALSE);
+	selected = self->select(self, other, 0);
 	ck_assert(selected);
 	ck_assert_int_eq(selected->get_spi(selected), other->get_spi(other));
 	selected->destroy(selected);
 
-	selected = self->select(self, other, FALSE, FALSE);
+	selected = self->select(self, other, PROPOSAL_PREFER_SUPPLIED);
 	ck_assert(selected);
 	ck_assert_int_eq(selected->get_spi(selected), self->get_spi(self));
 	selected->destroy(selected);
@@ -174,19 +179,101 @@ START_TEST(test_matches)
 										select_data[_i].other);
 	if (select_data[_i].expected)
 	{
-		ck_assert(self->matches(self, other, FALSE));
+		ck_assert(self->matches(self, other, select_data[_i].flags));
-		ck_assert(other->matches(other, self, FALSE));
+		ck_assert(other->matches(other, self, select_data[_i].flags));
+		ck_assert(self->matches(self, other,
+				  select_data[_i].flags | PROPOSAL_PREFER_SUPPLIED));
+		ck_assert(other->matches(other, self,
+				  select_data[_i].flags | PROPOSAL_PREFER_SUPPLIED));
 	}
 	else
 	{
-		ck_assert(!self->matches(self, other, FALSE));
+		ck_assert(!self->matches(self, other, select_data[_i].flags));
-		ck_assert(!other->matches(other, self, FALSE));
+		ck_assert(!other->matches(other, self, select_data[_i].flags));
+		ck_assert(!self->matches(self, other,
+				  select_data[_i].flags | PROPOSAL_PREFER_SUPPLIED));
+		ck_assert(!other->matches(other, self,
+				  select_data[_i].flags | PROPOSAL_PREFER_SUPPLIED));
 	}
 	other->destroy(other);
 	self->destroy(self);
 }
 END_TEST
 
+static struct {
+	protocol_id_t proto;
+	char *self[5];
+	char *other[5];
+	char *expected;
+	proposal_selection_flag_t flags;
+} select_proposal_data[] = {
+	{ PROTO_ESP, {}, {}, NULL },
+	{ PROTO_ESP, { "aes128" }, {}, NULL },
+	{ PROTO_ESP, {}, { "aes128" }, NULL },
+	{ PROTO_ESP, { "aes128" }, { "aes256" }, NULL },
+	{ PROTO_ESP, { "aes128" }, { "aes128" }, "aes128" },
+	{ PROTO_ESP, { "aes128", "aes256" }, { "aes256", "aes128" }, "aes128" },
+	{ PROTO_ESP, { "aes128", "aes256" }, { "aes256", "aes128" }, "aes256",
+		PROPOSAL_PREFER_SUPPLIED },
+	{ PROTO_ESP, { "aes128-modp1024", "aes256-modp1024" },
+				 { "aes256-modp2048", "aes128-modp2048" }, NULL },
+	{ PROTO_ESP, { "aes128-modp1024", "aes256-modp1024" },
+				 { "aes256-modp2048", "aes128-modp2048" }, "aes128",
+		PROPOSAL_SKIP_DH },
+	{ PROTO_ESP, { "aes128-modp1024", "aes256-modp1024" },
+				 { "aes256-modp2048", "aes128-modp2048" }, "aes256",
+		PROPOSAL_PREFER_SUPPLIED | PROPOSAL_SKIP_DH },
+};
+
+START_TEST(test_select_proposal)
+{
+	linked_list_t *self, *other;
+	proposal_t *proposal, *selected, *expected;
+	int i;
+
+	self = linked_list_create();
+	other = linked_list_create();
+
+	for (i = 0; i < countof(select_proposal_data[_i].self); i++)
+	{
+		if (!select_proposal_data[_i].self[i])
+		{
+			break;
+		}
+		proposal = proposal_create_from_string(select_proposal_data[_i].proto,
+											select_proposal_data[_i].self[i]);
+		self->insert_last(self, proposal);
+	}
+	for (i = 0; i < countof(select_proposal_data[_i].other); i++)
+	{
+		if (!select_proposal_data[_i].other[i])
+		{
+			break;
+		}
+		proposal = proposal_create_from_string(select_proposal_data[_i].proto,
+											select_proposal_data[_i].other[i]);
+		other->insert_last(other, proposal);
+	}
+	selected = proposal_select(self, other, select_proposal_data[_i].flags);
+	if (select_proposal_data[_i].expected)
+	{
+		expected = proposal_create_from_string(select_proposal_data[_i].proto,
+											select_proposal_data[_i].expected);
+		ck_assert(selected);
+		ck_assert_msg(expected->equals(expected, selected), "proposal %P does "
+					  "not match expected %P", selected, expected);
+		expected->destroy(expected);
+	}
+	else
+	{
+		ck_assert(!selected);
+	}
+	DESTROY_IF(selected);
+	other->destroy_offset(other, offsetof(proposal_t, destroy));
+	self->destroy_offset(self, offsetof(proposal_t, destroy));
+}
+END_TEST
+
 START_TEST(test_promote_dh_group)
 {
 	proposal_t *proposal;
@@ -267,7 +354,7 @@ START_TEST(test_unknown_transform_types_select_fail)
 	other = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
 	other->add_algorithm(other, 242, 42, 0);
 
-	selected = self->select(self, other, TRUE, FALSE);
+	selected = self->select(self, other, 0);
 	ck_assert(!selected);
 	other->destroy(other);
 	self->destroy(self);
@@ -283,7 +370,7 @@ START_TEST(test_unknown_transform_types_select_fail_subtype)
 	other = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
 	other->add_algorithm(other, 242, 42, 0);
 
-	selected = self->select(self, other, TRUE, FALSE);
+	selected = self->select(self, other, 0);
 	ck_assert(!selected);
 	other->destroy(other);
 	self->destroy(self);
@@ -300,7 +387,7 @@ START_TEST(test_unknown_transform_types_select_success)
 	other->add_algorithm(other, 242, 42, 128);
 	other->add_algorithm(other, 242, 1, 0);
 
-	selected = self->select(self, other, TRUE, FALSE);
+	selected = self->select(self, other, 0);
 	ck_assert(selected);
 	assert_proposal_eq(selected, "IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256/UNKNOWN_242_42_128");
 	selected->destroy(selected);
@@ -323,6 +410,44 @@ START_TEST(test_chacha20_poly1305_key_length)
 }
 END_TEST
 
+static struct {
+	protocol_id_t proto;
+	char *orig;
+	char *expected;
+	proposal_selection_flag_t flags;
+} clone_data[] = {
+	{ PROTO_ESP, "aes128", "aes128" },
+	{ PROTO_ESP, "aes128-serpent", "aes128-serpent" },
+	{ PROTO_ESP, "aes128-serpent", "aes128", PROPOSAL_SKIP_PRIVATE },
+	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modp3072" },
+	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", PROPOSAL_SKIP_DH },
+	{ PROTO_ESP, "aes128-serpent-modp3072", "aes128-serpent",
+		PROPOSAL_SKIP_DH },
+	{ PROTO_ESP, "aes128-serpent-modp3072", "aes128",
+		PROPOSAL_SKIP_PRIVATE | PROPOSAL_SKIP_DH },
+};
+
+START_TEST(test_clone)
+{
+	proposal_t *orig, *result, *expected;
+
+	orig = proposal_create_from_string(clone_data[_i].proto,
+									   clone_data[_i].orig);
+	orig->set_spi(orig, 0x12345678);
+
+	result = orig->clone(orig, clone_data[_i].flags);
+
+	expected = proposal_create_from_string(clone_data[_i].proto,
+										   clone_data[_i].expected);
+	ck_assert_msg(expected->equals(expected, result), "proposal %P does "
+				  "not match expected %P", result, expected);
+	ck_assert_int_eq(orig->get_spi(orig), result->get_spi(result));
+
+	expected->destroy(expected);
+	result->destroy(result);
+	orig->destroy(orig);
+}
+END_TEST
 
 Suite *proposal_suite_create()
 {
@@ -344,6 +469,11 @@ Suite *proposal_suite_create()
 	tcase_add_loop_test(tc, test_matches, 0, countof(select_data));
 	suite_add_tcase(s, tc);
 
+	tc = tcase_create("select_proposal");
+	tcase_add_loop_test(tc, test_select_proposal, 0,
+						countof(select_proposal_data));
+	suite_add_tcase(s, tc);
+
 	tc = tcase_create("promote_dh_group");
 	tcase_add_test(tc, test_promote_dh_group);
 	tcase_add_test(tc, test_promote_dh_group_already_front);
@@ -362,5 +492,9 @@ Suite *proposal_suite_create()
 	tcase_add_test(tc, test_chacha20_poly1305_key_length);
 	suite_add_tcase(s, tc);
 
+	tc = tcase_create("clone");
+	tcase_add_loop_test(tc, test_clone, 0, countof(clone_data));
+	suite_add_tcase(s, tc);
+
 	return s;
 }