From b4e815354c5b225e718dca4beb59656fdac98875 Mon Sep 17 00:00:00 2001
From: Martin Willi <martin@revosec.ch>
Date: Thu, 24 Nov 2011 16:07:13 +0100
Subject: [PATCH] Map auth_class to auth method and IKEv1 proposal attribute

---
 .../encoding/payloads/proposal_substructure.c        | 12 ++++++++++--
 src/libcharon/plugins/stroke/stroke_config.c         |  4 ++++
 src/libcharon/sa/authenticators/authenticator.h      | 10 ++++++++++
 src/libcharon/sa/tasks/main_mode.c                   |  5 +++++
 src/libstrongswan/credentials/auth_cfg.h             |  2 ++
 5 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/src/libcharon/encoding/payloads/proposal_substructure.c b/src/libcharon/encoding/payloads/proposal_substructure.c
index ca19ba700..7f075f103 100644
--- a/src/libcharon/encoding/payloads/proposal_substructure.c
+++ b/src/libcharon/encoding/payloads/proposal_substructure.c
@@ -583,8 +583,12 @@ static u_int16_t get_ikev1_auth(auth_method_t method)
 			return IKEV1_AUTH_RSA_SIG;
 		case AUTH_DSS:
 			return IKEV1_AUTH_DSS_SIG;
+		case AUTH_XAUTH_INIT_PSK:
+			return IKEV1_AUTH_XAUTH_INIT_PSK;
+		case AUTH_XAUTH_INIT_RSA:
+			return IKEV1_AUTH_XAUTH_INIT_RSA;
 		default:
-			/* TODO-IKEv1: Handle XAUTH methods */
+			/* TODO-IKEv1: Handle other XAUTH methods */
 			/* TODO-IKEv1: Handle ECDSA methods */
 		case AUTH_PSK:
 			return IKEV1_AUTH_PSK;
@@ -877,8 +881,12 @@ METHOD(proposal_substructure_t, get_auth_method, auth_method_t,
 			return AUTH_RSA;
 		case IKEV1_AUTH_DSS_SIG:
 			return AUTH_DSS;
+		case IKEV1_AUTH_XAUTH_INIT_PSK:
+			return AUTH_XAUTH_INIT_PSK;
+		case IKEV1_AUTH_XAUTH_INIT_RSA:
+			return AUTH_XAUTH_INIT_RSA;
 		default:
-			/* TODO-IKEv1: XAUTH, ECDSA sigs */
+			/* TODO-IKEv1: other XAUTH, ECDSA sigs */
 			return AUTH_NONE;
 	}
 }
diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index 97d2a7836..0d612f10e 100644
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -473,6 +473,10 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 	{
 		cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_XAUTH_PSK);
 	}
+	else if (streq(auth, "xauthrsasig"))
+	{
+		cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_XAUTH_PUBKEY);
+	}
 	else if (strneq(auth, "eap", 3))
 	{
 		enumerator_t *enumerator;
diff --git a/src/libcharon/sa/authenticators/authenticator.h b/src/libcharon/sa/authenticators/authenticator.h
index a3850bb7f..81164772d 100644
--- a/src/libcharon/sa/authenticators/authenticator.h
+++ b/src/libcharon/sa/authenticators/authenticator.h
@@ -73,6 +73,16 @@ enum auth_method_t {
 	 * ECDSA with SHA-512 on the P-521 curve as specified in RFC 4754
 	 */
 	AUTH_ECDSA_521 = 11,
+
+	/**
+	 * IKEv1 initiator XAUTH with PSK, outside of IANA range
+	 */
+	AUTH_XAUTH_INIT_PSK = 256,
+
+	/**
+	 * IKEv1 initiator XAUTH with RSA, outside of IANA range
+	 */
+	AUTH_XAUTH_INIT_RSA,
 };
 
 /**
diff --git a/src/libcharon/sa/tasks/main_mode.c b/src/libcharon/sa/tasks/main_mode.c
index 263439b00..8a1ac6c9a 100644
--- a/src/libcharon/sa/tasks/main_mode.c
+++ b/src/libcharon/sa/tasks/main_mode.c
@@ -298,6 +298,10 @@ static auth_method_t get_auth_method(private_main_mode_t *this)
 	{
 		case AUTH_CLASS_PSK:
 			return AUTH_PSK;
+		case AUTH_CLASS_XAUTH_PSK:
+			return AUTH_XAUTH_INIT_PSK;
+		case AUTH_CLASS_XAUTH_PUBKEY:
+			return AUTH_XAUTH_INIT_RSA;
 		case AUTH_CLASS_PUBKEY:
 			/* TODO-IKEv1: look for a key, return RSA or ECDSA */
 		default:
@@ -586,6 +590,7 @@ static bool derive_keys(private_main_mode_t *this, chunk_t nonce_i,
 	switch (auth)
 	{
 		case AUTH_CLASS_PSK:
+		case AUTH_CLASS_XAUTH_PSK:
 			shared_key = lookup_shared_key(this);
 			break;
 		default:
diff --git a/src/libstrongswan/credentials/auth_cfg.h b/src/libstrongswan/credentials/auth_cfg.h
index 2554b3f2e..ea98470fe 100644
--- a/src/libstrongswan/credentials/auth_cfg.h
+++ b/src/libstrongswan/credentials/auth_cfg.h
@@ -44,6 +44,8 @@ enum auth_class_t {
 	AUTH_CLASS_EAP = 3,
 	/** authentication using pre-shared secrets in combination with XAuth */
 	AUTH_CLASS_XAUTH_PSK = 4,
+	/** authentication using public keys in combination with XAuth */
+	AUTH_CLASS_XAUTH_PUBKEY = 5,
 };
 
 /**