- refactored ike proposal

- uses now proposal_t, wich is also used by child proposals
- ike key derivation refactored
- crypter_t api has get_key_size now
- some other improvements here and there

Source/charon/config/Makefile.config

@@ -31,6 +31,6 @@ OBJS+= $(BUILD_DIR)traffic_selector.o
 $(BUILD_DIR)traffic_selector.o :			$(CONFIG_DIR)traffic_selector.c $(CONFIG_DIR)traffic_selector.h
 											$(CC) $(CFLAGS) -c -o $@ $<
 
-OBJS+= $(BUILD_DIR)child_proposal.o
-$(BUILD_DIR)child_proposal.o :				$(CONFIG_DIR)child_proposal.c $(CONFIG_DIR)child_proposal.h
+OBJS+= $(BUILD_DIR)proposal.o
+$(BUILD_DIR)proposal.o :					$(CONFIG_DIR)proposal.c $(CONFIG_DIR)proposal.h
 											$(CC) $(CFLAGS) -c -o $@ $<

Source/charon/config/configuration_manager.c

@@ -275,27 +275,32 @@ u_int8_t private_key_2[];
 static void load_default_config (private_configuration_manager_t *this)
 {
 	init_config_t *init_config_a, *init_config_b;
-	ike_proposal_t proposals;
-	child_proposal_t *child_proposal;
+	proposal_t *proposal;
 	sa_config_t *sa_config_a, *sa_config_b;
 	traffic_selector_t *ts;
 	
 	init_config_a = init_config_create("0.0.0.0","192.168.0.3",IKEV2_UDP_PORT,IKEV2_UDP_PORT);
 	init_config_b = init_config_create("0.0.0.0","192.168.0.2",IKEV2_UDP_PORT,IKEV2_UDP_PORT);
 	
-	ts = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535);
+	/* IKE proposals for alice */
+	proposal = proposal_create(1);
+	proposal->add_algorithm(proposal, IKE, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
+	POS;
+	proposal->add_algorithm(proposal, IKE, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 16);
+	POS;
+	proposal->add_algorithm(proposal, IKE, PSEUDO_RANDOM_FUNCTION, PRF_HMAC_MD5, 16);
+	proposal->add_algorithm(proposal, IKE, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
+	proposal->add_algorithm(proposal, IKE, DIFFIE_HELLMAN_GROUP, MODP_2048_BIT, 0);
+	init_config_a->add_proposal(init_config_a, proposal);
 	
-	proposals.encryption_algorithm = ENCR_AES_CBC;
-	proposals.encryption_algorithm_key_length = 16;
-	proposals.integrity_algorithm = AUTH_HMAC_MD5_96;
-	proposals.integrity_algorithm_key_length = 16;
-	proposals.pseudo_random_function = PRF_HMAC_MD5;
-	proposals.pseudo_random_function_key_length = 16;
-	proposals.diffie_hellman_group = MODP_1024_BIT;
-
-	init_config_a->add_proposal(init_config_a,1,proposals);
-	init_config_b->add_proposal(init_config_b,1,proposals);
-								  
+	/* IKE proposals for bob */
+	proposal = proposal_create(1);
+	proposal->add_algorithm(proposal, IKE, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
+	proposal->add_algorithm(proposal, IKE, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 16);
+	proposal->add_algorithm(proposal, IKE, PSEUDO_RANDOM_FUNCTION, PRF_HMAC_MD5, 16);
+	proposal->add_algorithm(proposal, IKE, DIFFIE_HELLMAN_GROUP, MODP_2048_BIT, 0);
+	init_config_b->add_proposal(init_config_b, proposal);
+ 	
 	sa_config_a = sa_config_create(ID_IPV4_ADDR, "192.168.0.2", 
 								 ID_IPV4_ADDR, "192.168.0.3",
 								 RSA_DIGITAL_SIGNATURE,
@@ -305,46 +310,46 @@ static void load_default_config (private_configuration_manager_t *this)
 								 ID_IPV4_ADDR, "192.168.0.2",
 								 RSA_DIGITAL_SIGNATURE,
 								 30000);
-
+	
+	/* traffic selectors */
+	ts = traffic_selector_create_from_string(1, TS_IPV4_ADDR_RANGE, "0.0.0.0", 0, "255.255.255.255", 65535);
 	sa_config_a->add_traffic_selector_initiator(sa_config_a,ts);
 	sa_config_a->add_traffic_selector_responder(sa_config_a,ts);
-	
 	sa_config_b->add_traffic_selector_initiator(sa_config_b,ts);
 	sa_config_b->add_traffic_selector_responder(sa_config_b,ts);
-	
 	ts->destroy(ts);
 	
 	/* child proposal for alice */
-	child_proposal = child_proposal_create(1);
+	proposal = proposal_create(1);
 	
-	child_proposal->add_algorithm(child_proposal, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
-	child_proposal->add_algorithm(child_proposal, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
-	child_proposal->add_algorithm(child_proposal, AH, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
-	child_proposal->add_algorithm(child_proposal, AH, DIFFIE_HELLMAN_GROUP, MODP_2048_BIT, 0);
-	child_proposal->add_algorithm(child_proposal, AH, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
+	proposal->add_algorithm(proposal, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
+	proposal->add_algorithm(proposal, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
+	proposal->add_algorithm(proposal, AH, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
+	proposal->add_algorithm(proposal, AH, DIFFIE_HELLMAN_GROUP, MODP_2048_BIT, 0);
+	proposal->add_algorithm(proposal, AH, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
 
-	child_proposal->add_algorithm(child_proposal, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
-	child_proposal->add_algorithm(child_proposal, ESP, ENCRYPTION_ALGORITHM, ENCR_3DES, 32);
-	child_proposal->add_algorithm(child_proposal, ESP, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
-	child_proposal->add_algorithm(child_proposal, ESP, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
-	child_proposal->add_algorithm(child_proposal, ESP, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
-	child_proposal->add_algorithm(child_proposal, ESP, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
+	proposal->add_algorithm(proposal, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
+	proposal->add_algorithm(proposal, ESP, ENCRYPTION_ALGORITHM, ENCR_3DES, 32);
+	proposal->add_algorithm(proposal, ESP, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
+	proposal->add_algorithm(proposal, ESP, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
+	proposal->add_algorithm(proposal, ESP, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
+	proposal->add_algorithm(proposal, ESP, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
 	
-	sa_config_a->add_proposal(sa_config_a, child_proposal);
+	sa_config_a->add_proposal(sa_config_a, proposal);
 	
 	/* child proposal for bob */
-	child_proposal = child_proposal_create(1);
+	proposal = proposal_create(1);
 	
-	child_proposal->add_algorithm(child_proposal, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
-	child_proposal->add_algorithm(child_proposal, AH, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
-	child_proposal->add_algorithm(child_proposal, AH, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
+	proposal->add_algorithm(proposal, AH, INTEGRITY_ALGORITHM, AUTH_HMAC_SHA1_96, 20);
+	proposal->add_algorithm(proposal, AH, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
+	proposal->add_algorithm(proposal, AH, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
 
-	child_proposal->add_algorithm(child_proposal, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
-	child_proposal->add_algorithm(child_proposal, ESP, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
-	child_proposal->add_algorithm(child_proposal, ESP, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
-	child_proposal->add_algorithm(child_proposal, ESP, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
+	proposal->add_algorithm(proposal, ESP, ENCRYPTION_ALGORITHM, ENCR_AES_CBC, 16);
+	proposal->add_algorithm(proposal, ESP, INTEGRITY_ALGORITHM, AUTH_HMAC_MD5_96, 20);
+	proposal->add_algorithm(proposal, ESP, DIFFIE_HELLMAN_GROUP, MODP_1024_BIT, 0);
+	proposal->add_algorithm(proposal, ESP, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
 	
-	sa_config_b->add_proposal(sa_config_b, child_proposal);
+	sa_config_b->add_proposal(sa_config_b, proposal);
 	
 	
 	

Source/charon/config/init_config.c

@@ -86,109 +86,112 @@ static host_t * get_other_host_clone (private_init_config_t *this)
 	return this->other_host->clone(this->other_host);
 }
 
-/**
- * Implementation of init_config_t.get_dh_group_number.
- */
-static diffie_hellman_group_t get_dh_group_number (private_init_config_t *this,size_t priority)
-{
-	ike_proposal_t *ike_proposal;
-	
-	if ((this->proposals->get_count(this->proposals) == 0) || (this->proposals->get_count(this->proposals) < priority))
-	{
-		return MODP_UNDEFINED;
-	}
-	
-	this->proposals->get_at_position(this->proposals,(priority -1),(void **) &ike_proposal);
-	
-	return (ike_proposal->diffie_hellman_group);
-}
-
 /**
  * Implementation of init_config_t.get_proposals.
  */
-static size_t get_proposals (private_init_config_t *this,ike_proposal_t **proposals)
+static linked_list_t* get_proposals (private_init_config_t *this)
 {
-	iterator_t *iterator;
-	ike_proposal_t *current_proposal;
-	int i = 0;
-	ike_proposal_t *proposal_array;
-	
-	proposal_array = allocator_alloc(this->proposals->get_count(this->proposals) * sizeof(ike_proposal_t));
-		
-	iterator = this->proposals->create_iterator(this->proposals,TRUE);
-	
-	while (iterator->has_next(iterator))
-	{
-		iterator->current(iterator,(void **) &current_proposal);
-		proposal_array[i] = (*current_proposal);
-		i++;
-	}
-	iterator->destroy(iterator);
-	
-	*proposals = proposal_array;
-	return this->proposals->get_count(this->proposals);
+	return this->proposals;
 }
 	
 /**
  * Implementation of init_config_t.select_proposal.
  */
-static status_t select_proposal (private_init_config_t *this, ike_proposal_t *proposals, size_t proposal_count, ike_proposal_t *selected_proposal)
+static proposal_t *select_proposal(private_init_config_t *this, linked_list_t *proposals)
 {
-	iterator_t * my_iterator;
-	int i;
-	ike_proposal_t *my_current_proposal;
-
-	my_iterator = this->proposals->create_iterator(this->proposals,TRUE);
-
+	iterator_t *stored_iter, *supplied_iter;
+	proposal_t *stored, *supplied, *selected;
 	
-	for (i = 0; i < proposal_count; i++)
+	stored_iter = this->proposals->create_iterator(this->proposals, TRUE);
+	supplied_iter = proposals->create_iterator(proposals, TRUE);
+	
+	/* compare all stored proposals with all supplied. Stored ones are preferred. */
+	while (stored_iter->has_next(stored_iter))
 	{
-		my_iterator->reset(my_iterator);
-		while (my_iterator->has_next(my_iterator))
+		supplied_iter->reset(supplied_iter);
+		stored_iter->current(stored_iter, (void**)&stored);
+
+		while (supplied_iter->has_next(supplied_iter))
 		{
-			my_iterator->current(my_iterator,(void **) &my_current_proposal);
-		
-			/* memcmp doesn't work here */
-			if ((proposals[i].encryption_algorithm == my_current_proposal->encryption_algorithm) &&
-				(proposals[i].encryption_algorithm_key_length == my_current_proposal->encryption_algorithm_key_length) &&
-				(proposals[i].integrity_algorithm == my_current_proposal->integrity_algorithm) &&
-				(proposals[i].integrity_algorithm_key_length == my_current_proposal->integrity_algorithm_key_length) &&
-				(proposals[i].pseudo_random_function == my_current_proposal->pseudo_random_function) &&
-				(proposals[i].pseudo_random_function_key_length == my_current_proposal->pseudo_random_function_key_length) &&
-				(proposals[i].diffie_hellman_group == my_current_proposal->diffie_hellman_group))
+			supplied_iter->current(supplied_iter, (void**)&supplied);
+			selected = stored->select(stored, supplied);
+			if (selected)
 			{
-				/* found a matching proposal */
-				*selected_proposal = *my_current_proposal;
-				my_iterator->destroy(my_iterator);
-				return SUCCESS;
+				/* they match, return */
+				stored_iter->destroy(stored_iter);
+				supplied_iter->destroy(supplied_iter);
+				return selected;
 			}
-			
-		}				
+		}
 	}
 	
-	my_iterator->destroy(my_iterator);
-	return NOT_FOUND;
+	/* no proposal match :-(, will result in a NO_PROPOSAL_CHOSEN... */
+	stored_iter->destroy(stored_iter);
+	supplied_iter->destroy(supplied_iter);
+	
+	return NULL;
 }
 
 /**
- * Implementation of init_config_t.destroy.
+ * Implementation of init_config_t.add_proposal.
  */
-static void add_proposal (private_init_config_t *this,size_t priority, ike_proposal_t proposal)
+static void add_proposal (private_init_config_t *this, proposal_t *proposal)
 {
-	ike_proposal_t * new_proposal = allocator_alloc(sizeof(ike_proposal_t));
-	status_t status;
-	
-	*new_proposal = proposal;
-	 
-	
-	if (priority > this->proposals->get_count(this->proposals))
-	{
-		this->proposals->insert_last(this->proposals,new_proposal);
-		return;
-	}
-	
-	status = this->proposals->insert_at_position(this->proposals,(priority - 1),new_proposal);
+	this->proposals->insert_last(this->proposals, proposal);
+}
 
+/**
+ * Implementation of init_config_t.get_dh_group.
+ */
+static diffie_hellman_group_t get_dh_group(private_init_config_t *this)
+{
+	iterator_t *iterator;
+	proposal_t *proposal;
+	algorithm_t *algo;
+	
+	iterator = this->proposals->create_iterator(this->proposals, TRUE);
+	while (iterator->has_next(iterator))
+	{
+		iterator->current(iterator, (void**)&proposal);
+		proposal->get_algorithm(proposal, IKE, DIFFIE_HELLMAN_GROUP, &algo);
+		if (algo)
+		{
+			iterator->destroy(iterator);
+			return algo->algorithm;
+		}
+	}
+	iterator->destroy(iterator);
+	return MODP_UNDEFINED;
+}
+
+/**
+ * Implementation of init_config_t.check_dh_group.
+ */
+static bool check_dh_group(private_init_config_t *this, diffie_hellman_group_t dh_group)
+{
+	iterator_t *prop_iter, *alg_iter;
+	proposal_t *proposal;
+	algorithm_t *algo;
+	
+	prop_iter = this->proposals->create_iterator(this->proposals, TRUE);
+	while (prop_iter->has_next(prop_iter))
+	{
+		prop_iter->current(prop_iter, (void**)&proposal);
+		alg_iter = proposal->create_algorithm_iterator(proposal, IKE, DIFFIE_HELLMAN_GROUP);
+		while (alg_iter->has_next(alg_iter))
+		{
+			alg_iter->current(alg_iter, (void**)&algo);
+			if (algo->algorithm == dh_group)
+			{
+				prop_iter->destroy(prop_iter);
+				alg_iter->destroy(alg_iter);
+				return TRUE;
+			}
+		}
+	}
+	prop_iter->destroy(prop_iter);
+	alg_iter->destroy(alg_iter);
+	return FALSE;
 }
 
 /**
@@ -196,12 +199,11 @@ static void add_proposal (private_init_config_t *this,size_t priority, ike_propo
  */
 static void destroy (private_init_config_t *this)
 {
-	ike_proposal_t *proposal;
+	proposal_t *proposal;
 	
-	while (this->proposals->get_count(this->proposals) > 0)
+	while (this->proposals->remove_last(this->proposals, (void**)&proposal) == SUCCESS)
 	{
-		this->proposals->remove_first(this->proposals,(void **) &proposal);
-		allocator_free(proposal);
+		proposal->destroy(proposal);
 	}
 	this->proposals->destroy(this->proposals);
 	
@@ -222,10 +224,11 @@ init_config_t * init_config_create(char * my_ip, char *other_ip, u_int16_t my_po
 	this->public.get_other_host = (host_t*(*)(init_config_t*))get_other_host;
 	this->public.get_my_host_clone = (host_t*(*)(init_config_t*))get_my_host_clone;
 	this->public.get_other_host_clone = (host_t*(*)(init_config_t*))get_other_host_clone;
-	this->public.get_dh_group_number = (diffie_hellman_group_t (*)(init_config_t*,size_t))get_dh_group_number;
-	this->public.get_proposals = (size_t(*)(init_config_t*,ike_proposal_t**))get_proposals;
-	this->public.select_proposal = (status_t(*)(init_config_t*,ike_proposal_t*,size_t,ike_proposal_t*))select_proposal;
-	this->public.add_proposal = (void(*)(init_config_t*, size_t, ike_proposal_t)) add_proposal;
+	this->public.get_proposals = (linked_list_t*(*)(init_config_t*))get_proposals;
+	this->public.select_proposal = (proposal_t*(*)(init_config_t*,linked_list_t*))select_proposal;
+	this->public.add_proposal = (void(*)(init_config_t*, proposal_t*)) add_proposal;
+	this->public.get_dh_group = (diffie_hellman_group_t(*)(init_config_t*)) get_dh_group;
+	this->public.check_dh_group = (bool(*)(init_config_t*,diffie_hellman_group_t)) check_dh_group;
 	this->public.destroy = (void(*)(init_config_t*))destroy;
 	
 	/* private variables */

Source/charon/config/init_config.h

@@ -25,60 +25,14 @@
 
 #include <types.h>
 #include <network/host.h>
-#include <utils/iterator.h>
+#include <utils/linked_list.h>
+#include <config/proposal.h>
 #include <transforms/crypters/crypter.h>
 #include <transforms/prfs/prf.h>
 #include <transforms/signers/signer.h>
 #include <transforms/diffie_hellman.h>
 
 
-typedef struct ike_proposal_t ike_proposal_t;
-
-/**
- * @brief Represents a Proposal used in IKE_SA_INIT phase.
- * 
- * @todo Currently the amount of tranforms with same type in a IKE proposal is limited to 1.
- * 		 Support of more transforms with same type has to be added.
- * 
- * @ingroup config
- */
-struct ike_proposal_t {
-	/**
-	 * Encryption algorithm.
-	 */
-	encryption_algorithm_t encryption_algorithm;
-	
-	/**
-	 * Key length of encryption algorithm in bytes.
-	 */
-	u_int16_t encryption_algorithm_key_length;
-	
-	/**
-	 * Integrity algorithm.
-	 */
-	integrity_algorithm_t integrity_algorithm;
-	
-	/**
-	 * Key length of integrity algorithm.
-	 */
-	u_int16_t integrity_algorithm_key_length;
-	
-	/**
-	 * Pseudo random function (prf).
-	 */
-	pseudo_random_function_t pseudo_random_function;
-	
-	/**
-	 * Key length of prf.
-	 */
-	u_int16_t pseudo_random_function_key_length;
-	
-	/**
-	 * Diffie hellman group.
-	 */
-	diffie_hellman_group_t diffie_hellman_group;
-};
-
 
 typedef struct init_config_t init_config_t;
 
@@ -100,7 +54,7 @@ struct init_config_t {
 	 * @param this	calling object
 	 * @return		host information as host_t object
 	 */
-	host_t * (*get_my_host) (init_config_t *this);
+	host_t *(*get_my_host) (init_config_t *this);
 
 	/**
 	 * @brief Get other host information as host_t object.
@@ -110,7 +64,7 @@ struct init_config_t {
 	 * @param this	calling object
 	 * @return		host information as host_t object
 	 */
-	host_t * (*get_other_host) (init_config_t *this);
+	host_t *(*get_other_host) (init_config_t *this);
 	
 	/**
 	 * @brief Get my host information as host_t object.
@@ -120,7 +74,7 @@ struct init_config_t {
 	 * @param this	calling object
 	 * @return		host information as host_t object
 	 */
-	host_t * (*get_my_host_clone) (init_config_t *this);
+	host_t *(*get_my_host_clone) (init_config_t *this);
 
 	/**
 	 * @brief Get other host information as host_t object.
@@ -130,54 +84,60 @@ struct init_config_t {
 	 * @param this	calling object
 	 * @return		host information as host_t object
 	 */
-	host_t * (*get_other_host_clone) (init_config_t *this);
+	host_t *(*get_other_host_clone) (init_config_t *this);
 	
 	/**
-	 * @brief Get the diffie hellman group to use as initiator with given priority.
+	 * @brief Returns a list of all supported proposals.
 	 * 
-	 * @param this		calling object
-	 * @param priority 	priority of dh group number (starting at 1)
-	 * @return			diffie hellman group number for given priority or 
-	 * 					MODP_UNDEFINED for not supported priorities
-	 */
-	diffie_hellman_group_t (*get_dh_group_number) (init_config_t *this,size_t priority);
-	
-	/**
-	 * @brief Returns a list of all supported ike_proposals of type ike_proposal_t *.
-	 * 
-	 * Returned array of ike_proposal_t has to get destroyed by the caller.
+	 * Returned list is still owned by init_config and MUST NOT
+	 * modified or destroyed.
 	 * 
 	 * @param this				calling object
-	 * @param proposals			first proposal in a array
-	 * @return 					number of proposals in array
+	 * @return 					list containing all the proposals
 	 */
-	size_t (*get_proposals) (init_config_t *this,ike_proposal_t **proposals);
+	linked_list_t *(*get_proposals) (init_config_t *this);
 	
 	/**
-	 * @brief Adds a proposal with given priority to the current stored proposals.
+	 * @brief Adds a proposal to the list..
 	 * 
-	 * If allready a proposal with given priority is stored the other one is 
-	 * moved one priority back. If priority is higher then all other stored 
-	 * proposals, it is inserted as last one.
+	 * The first added proposal has the highest priority, the last
+	 * added the lowest.
 	 * 
 	 * @param this				calling object
 	 * @param priority			priority of adding proposal
 	 * @param proposal			proposal to add
 	 */
-	void (*add_proposal) (init_config_t *this,size_t priority, ike_proposal_t proposal);
+	void (*add_proposal) (init_config_t *this, proposal_t *proposal);
 	
 	/**
 	 * @brief Select a proposed from suggested proposals.
 	 * 
+	 * Returned proposal must be destroyed after usage.
+	 * 
 	 * @param this					calling object
-	 * @param suggested_proposals	first proposal in a array
-	 * @param proposal_count		number of suggested proposals in array
-	 * @param selected_proposal		the ike_proposal_t pointing to is set
-	 * @return						
-	 * 								- SUCCESS if a proposal was selected
-	 * 								- NOT_FOUND if none of suggested proposals is supported
+	 * @param proposals				list of proposals to select from
+	 * @return						selected proposal, or NULL if none matches.
 	 */
-	status_t (*select_proposal) (init_config_t *this, ike_proposal_t *proposals, size_t proposal_count, ike_proposal_t *selected_proposal);
+	proposal_t *(*select_proposal) (init_config_t *this, linked_list_t *proposals);
+	
+	/**
+	 * @brief Get the DH group to use for connection initialization.
+	 * 
+	 * @param this					calling object
+	 * @return						dh group to use for initialization
+	 */
+	diffie_hellman_group_t (*get_dh_group) (init_config_t *this);
+	
+	/**
+	 * @brief Check if a suggested dh group is acceptable.
+	 * 
+	 * If we guess a wrong DH group for IKE_SA_INIT, the other
+	 * peer will send us a offer. But is this acceptable for us?
+	 * 
+	 * @param this					calling object
+	 * @return						dh group to use for initialization
+	 */
+	bool (*check_dh_group) (init_config_t *this, diffie_hellman_group_t dh_group);
 	
 	/**
 	 * @brief Destroys a init_config_t object.
@@ -194,6 +154,6 @@ struct init_config_t {
  * 
  * @ingroup config
  */
-init_config_t * init_config_create(char * my_ip, char *other_ip, u_int16_t my_port, u_int16_t other_port);
+init_config_t * init_config_create(char *my_ip, char *other_ip, u_int16_t my_port, u_int16_t other_port);
 
 #endif //_INIT_CONFIG_H_

Source/charon/config/proposal.c

@@ -1,7 +1,7 @@
 /**
- * @file child_proposal.c
+ * @file proposal.c
  * 
- * @brief Implementation of child_proposal_t.
+ * @brief Implementation of proposal_t.
  * 
  */
 
@@ -20,7 +20,7 @@
  * for more details.
  */
 
-#include "child_proposal.h"
+#include "proposal.h"
 
 #include <utils/linked_list.h>
 #include <utils/allocator.h>
@@ -105,17 +105,17 @@ struct protocol_proposal_t {
 };
 
 
-typedef struct private_child_proposal_t private_child_proposal_t;
+typedef struct private_proposal_t private_proposal_t;
 
 /**
- * Private data of an child_proposal_t object
+ * Private data of an proposal_t object
  */
-struct private_child_proposal_t {
+struct private_proposal_t {
 
 	/**
 	 * Public part
 	 */
-	child_proposal_t public;
+	proposal_t public;
 	
 	/**
 	 * number of this proposal, as used in the payload
@@ -131,7 +131,7 @@ struct private_child_proposal_t {
 /**
  * Look up a protocol_proposal, or create one if necessary...
  */
-static protocol_proposal_t *get_protocol_proposal(private_child_proposal_t *this, protocol_id_t proto, bool create)
+static protocol_proposal_t *get_protocol_proposal(private_proposal_t *this, protocol_id_t proto, bool create)
 {
 	protocol_proposal_t *proto_proposal = NULL, *current_proto_proposal;;
 	iterator_t *iterator;
@@ -187,9 +187,9 @@ static void add_algo(linked_list_t *list, u_int8_t algo, size_t key_size)
 }
 
 /**
- * Implements child_proposal_t.add_algorithm
+ * Implements proposal_t.add_algorithm
  */
-static void add_algorithm(private_child_proposal_t *this, protocol_id_t proto, transform_type_t type, u_int16_t algo, size_t key_size)
+static void add_algorithm(private_proposal_t *this, protocol_id_t proto, transform_type_t type, u_int16_t algo, size_t key_size)
 {
 	protocol_proposal_t *proto_proposal = get_protocol_proposal(this, proto, TRUE);
 	
@@ -216,9 +216,9 @@ static void add_algorithm(private_child_proposal_t *this, protocol_id_t proto, t
 }
 
 /**
- * Implements child_proposal_t.get_algorithm.
+ * Implements proposal_t.get_algorithm.
  */
-static bool get_algorithm(private_child_proposal_t *this, protocol_id_t proto, transform_type_t type, algorithm_t** algo)
+static bool get_algorithm(private_proposal_t *this, protocol_id_t proto, transform_type_t type, algorithm_t** algo)
 {
 	linked_list_t * list;
 	protocol_proposal_t *proto_proposal = get_protocol_proposal(this, proto, FALSE);
@@ -255,9 +255,9 @@ static bool get_algorithm(private_child_proposal_t *this, protocol_id_t proto, t
 }
 
 /**
- * Implements child_proposal_t.create_algorithm_iterator.
+ * Implements proposal_t.create_algorithm_iterator.
  */
-static iterator_t *create_algorithm_iterator(private_child_proposal_t *this, protocol_id_t proto, transform_type_t type)
+static iterator_t *create_algorithm_iterator(private_proposal_t *this, protocol_id_t proto, transform_type_t type)
 {
 	protocol_proposal_t *proto_proposal = get_protocol_proposal(this, proto, FALSE);
 	if (proto_proposal == NULL)
@@ -328,11 +328,11 @@ static bool select_algo(linked_list_t *first, linked_list_t *second, bool *add,
 }
 
 /**
- * Implements child_proposal_t.select.
+ * Implements proposal_t.select.
  */
-static child_proposal_t *select_proposal(private_child_proposal_t *this, private_child_proposal_t *other)
+static proposal_t *select_proposal(private_proposal_t *this, private_proposal_t *other)
 {
-	child_proposal_t *selected;
+	proposal_t *selected;
 	u_int16_t algo;
 	size_t key_size;
 	iterator_t *iterator;
@@ -353,7 +353,7 @@ static child_proposal_t *select_proposal(private_child_proposal_t *this, private
 		return NULL;
 	}
 	
-	selected = child_proposal_create(this->number);
+	selected = proposal_create(this->number);
 	
 	/* iterate over supplied proposals */
 	iterator = other->protocol_proposals->create_iterator(other->protocol_proposals, TRUE);
@@ -448,17 +448,17 @@ static child_proposal_t *select_proposal(private_child_proposal_t *this, private
 }
 
 /**
- * Implements child_proposal_t.get_number.
+ * Implements proposal_t.get_number.
  */
-static u_int8_t get_number(private_child_proposal_t *this)
+static u_int8_t get_number(private_proposal_t *this)
 {
 	return this->number;
 }
 
 /**
- * Implements child_proposal_t.get_protocols.
+ * Implements proposal_t.get_protocols.
  */
-static void get_protocols(private_child_proposal_t *this, protocol_id_t ids[2])
+static void get_protocols(private_proposal_t *this, protocol_id_t ids[2])
 {
 	iterator_t *iterator = this->protocol_proposals->create_iterator(this->protocol_proposals, TRUE);
 	u_int i = 0;
@@ -480,9 +480,9 @@ static void get_protocols(private_child_proposal_t *this, protocol_id_t ids[2])
 }
 
 /**
- * Implements child_proposal_t.set_spi.
+ * Implements proposal_t.set_spi.
  */
-static void set_spi(private_child_proposal_t *this, protocol_id_t proto, u_int64_t spi)
+static void set_spi(private_proposal_t *this, protocol_id_t proto, u_int64_t spi)
 {
 	protocol_proposal_t *proto_proposal = get_protocol_proposal(this, proto, FALSE);
 	if (proto_proposal)
@@ -500,9 +500,9 @@ static void set_spi(private_child_proposal_t *this, protocol_id_t proto, u_int64
 }
 
 /**
- * Implements child_proposal_t.get_spi.
+ * Implements proposal_t.get_spi.
  */
-static u_int64_t get_spi(private_child_proposal_t *this, protocol_id_t proto)
+static u_int64_t get_spi(private_proposal_t *this, protocol_id_t proto)
 {
 	protocol_proposal_t *proto_proposal = get_protocol_proposal(this, proto, FALSE);
 	if (proto_proposal)
@@ -535,9 +535,9 @@ static void free_algo_list(linked_list_t *list)
 }
 
 /**
- * Implements child_proposal_t.destroy.
+ * Implements proposal_t.destroy.
  */
-static void destroy(private_child_proposal_t *this)
+static void destroy(private_proposal_t *this)
 {
 	while(this->protocol_proposals->get_count(this->protocol_proposals) > 0)
 	{
@@ -561,19 +561,19 @@ static void destroy(private_child_proposal_t *this)
 /*
  * Describtion in header-file
  */
-child_proposal_t *child_proposal_create(u_int8_t number)
+proposal_t *proposal_create(u_int8_t number)
 {
-	private_child_proposal_t *this = allocator_alloc_thing(private_child_proposal_t);
+	private_proposal_t *this = allocator_alloc_thing(private_proposal_t);
 	
-	this->public.add_algorithm = (void (*)(child_proposal_t*,protocol_id_t,transform_type_t,u_int16_t,size_t))add_algorithm;
-	this->public.create_algorithm_iterator = (iterator_t* (*)(child_proposal_t*,protocol_id_t,transform_type_t))create_algorithm_iterator;
-	this->public.get_algorithm = (bool (*)(child_proposal_t*,protocol_id_t,transform_type_t,algorithm_t**))get_algorithm;
-	this->public.select = (child_proposal_t* (*)(child_proposal_t*,child_proposal_t*))select_proposal;
-	this->public.get_number = (u_int8_t (*)(child_proposal_t*))get_number;
-	this->public.get_protocols = (void(*)(child_proposal_t *this, protocol_id_t ids[2]))get_protocols;
-	this->public.set_spi = (void(*)(child_proposal_t*,protocol_id_t,u_int64_t spi))set_spi;
-	this->public.get_spi = (u_int64_t(*)(child_proposal_t*,protocol_id_t))get_spi;
-	this->public.destroy = (void(*)(child_proposal_t*))destroy;
+	this->public.add_algorithm = (void (*)(proposal_t*,protocol_id_t,transform_type_t,u_int16_t,size_t))add_algorithm;
+	this->public.create_algorithm_iterator = (iterator_t* (*)(proposal_t*,protocol_id_t,transform_type_t))create_algorithm_iterator;
+	this->public.get_algorithm = (bool (*)(proposal_t*,protocol_id_t,transform_type_t,algorithm_t**))get_algorithm;
+	this->public.select = (proposal_t* (*)(proposal_t*,proposal_t*))select_proposal;
+	this->public.get_number = (u_int8_t (*)(proposal_t*))get_number;
+	this->public.get_protocols = (void(*)(proposal_t *this, protocol_id_t ids[2]))get_protocols;
+	this->public.set_spi = (void(*)(proposal_t*,protocol_id_t,u_int64_t spi))set_spi;
+	this->public.get_spi = (u_int64_t(*)(proposal_t*,protocol_id_t))get_spi;
+	this->public.destroy = (void(*)(proposal_t*))destroy;
 	
 	/* init private members*/
 	this->number = number;

Source/charon/config/proposal.h

@@ -1,7 +1,7 @@
 /**
- * @file child_proposal.h
+ * @file proposal.h
  * 
- * @brief Interface of child_proposal_t.
+ * @brief Interface of proposal_t.
  *
  */
 
@@ -20,8 +20,8 @@
  * for more details.
  */
 
-#ifndef _CHILD_PROPOSAL_H_
-#define _CHILD_PROPOSAL_H_
+#ifndef _PROPOSAL_H_
+#define _PROPOSAL_H_
 
 #include <types.h>
 #include <utils/identification.h>
@@ -117,22 +117,22 @@ struct algorithm_t {
 	u_int16_t key_size;
 };
 
-typedef struct child_proposal_t child_proposal_t;
+typedef struct proposal_t proposal_t;
 
 /**
  * @brief Stores a proposal for a child SA.
  * 
- * A child_proposal may contain more than one algorithm
+ * A proposal may contain more than one algorithm
  * of the same kind. ONE of them can be selected.
  *
  * @warning This class is NOT thread-save!
  * 
  * @b Constructors:
- *   - child_proposal_create()
+ *   - proposal_create()
  * 
  * @ingroup config
  */
-struct child_proposal_t {
+struct proposal_t {
 	
 	/**
 	 * @brief Add an algorithm to the proposal.
@@ -154,7 +154,7 @@ struct child_proposal_t {
 	 * @param alg					identifier for algorithm
 	 * @param key_size				key size to use
 	 */
-	void (*add_algorithm) (child_proposal_t *this, protocol_id_t proto, transform_type_t type, u_int16_t alg, size_t key_size);
+	void (*add_algorithm) (proposal_t *this, protocol_id_t proto, transform_type_t type, u_int16_t alg, size_t key_size);
 	
 	/**
 	 * @brief Get an iterator over algorithms for a specifc protocol/algo type.
@@ -164,13 +164,13 @@ struct child_proposal_t {
 	 * @param type					kind of algorithm
 	 * @return						iterator over algorithms
 	 */
-	iterator_t *(*create_algorithm_iterator) (child_proposal_t *this, protocol_id_t proto, transform_type_t type);
+	iterator_t *(*create_algorithm_iterator) (proposal_t *this, protocol_id_t proto, transform_type_t type);
 	
 	/**
 	 * @brief Get the algorithm for a type to use.
 	 * 
 	 * If there are multiple algorithms, only the first is returned.
-	 * Result is still owned by child_proposal, do not modify!
+	 * Result is still owned by proposal, do not modify!
 	 * 
 	 * @param this					calling object
 	 * @param proto					desired protocol
@@ -178,7 +178,7 @@ struct child_proposal_t {
 	 * @param[out] algo				pointer which receives algorithm and key size
 	 * @return						TRUE if algorithm of this kind available
 	 */
-	bool (*get_algorithm) (child_proposal_t *this, protocol_id_t proto, transform_type_t type, algorithm_t** algo);
+	bool (*get_algorithm) (proposal_t *this, protocol_id_t proto, transform_type_t type, algorithm_t** algo);
 
 	/**
 	 * @brief Compare two proposal, and select a matching subset.
@@ -193,7 +193,7 @@ struct child_proposal_t {
 	 * 								- selected proposal, if possible
 	 * 								- NULL, if proposals don't match
 	 */
-	child_proposal_t *(*select) (child_proposal_t *this, child_proposal_t *other);
+	proposal_t *(*select) (proposal_t *this, proposal_t *other);
 	
 	/**
 	 * @brief Get the number set on construction.
@@ -201,7 +201,7 @@ struct child_proposal_t {
 	 * @param this				calling object
 	 * @return 					number
 	 */
-	u_int8_t (*get_number) (child_proposal_t *this);
+	u_int8_t (*get_number) (proposal_t *this);
 	
 	/**
 	 * @brief Get the protocol ids in the proposals.
@@ -212,7 +212,7 @@ struct child_proposal_t {
 	 * @param this				calling object
 	 * @param ids 				array of protocol ids, 
 	 */
-	void (*get_protocols) (child_proposal_t *this, protocol_id_t ids[2]);
+	void (*get_protocols) (proposal_t *this, protocol_id_t ids[2]);
 	
 	/**
 	 * @brief Get the spi for a specific protocol.
@@ -221,7 +221,7 @@ struct child_proposal_t {
 	 * @param proto				AH/ESP
 	 * @return					spi for proto
 	 */
-	u_int64_t (*get_spi) (child_proposal_t *this, protocol_id_t proto);
+	u_int64_t (*get_spi) (proposal_t *this, protocol_id_t proto);
 	
 	/**
 	 * @brief Set the spi for a specific protocol.
@@ -230,24 +230,24 @@ struct child_proposal_t {
 	 * @param proto 			AH/ESP
 	 * @param spi				spi to set for proto
 	 */
-	void (*set_spi) (child_proposal_t *this, protocol_id_t proto, u_int64_t spi);
+	void (*set_spi) (proposal_t *this, protocol_id_t proto, u_int64_t spi);
 	
 	/**
 	 * @brief Destroys the proposal object.
 	 * 
 	 * @param this				calling object
 	 */
-	void (*destroy) (child_proposal_t *this);
+	void (*destroy) (proposal_t *this);
 };
 
 /**
  * @brief Create a child proposal for AH and/or ESP.
  * 
  * @param number			number of the proposal, as in the payload
- * @return 					child_proposal_t object
+ * @return 					proposal_t object
  * 
  * @ingroup config
  */
-child_proposal_t *child_proposal_create(u_int8_t number);
+proposal_t *proposal_create(u_int8_t number);
 
-#endif //_CHILD_PROPOSAL_H_
+#endif //_PROPOSAL_H_

Source/charon/config/sa_config.c

@@ -216,10 +216,10 @@ static linked_list_t *get_proposals(private_sa_config_t *this)
 /**
  * Implementation of sa_config_t.select_proposal
  */
-static child_proposal_t *select_proposal(private_sa_config_t *this, linked_list_t *proposals)
+static proposal_t *select_proposal(private_sa_config_t *this, linked_list_t *proposals)
 {
 	iterator_t *stored_iter, *supplied_iter;
-	child_proposal_t *stored, *supplied, *selected;
+	proposal_t *stored, *supplied, *selected;
 	
 	stored_iter = this->proposals->create_iterator(this->proposals, TRUE);
 	supplied_iter = proposals->create_iterator(proposals, TRUE);
@@ -272,7 +272,7 @@ static void add_traffic_selector_responder(private_sa_config_t *this, traffic_se
 /**
  * Implementation of sa_config_t.add_proposal
  */
-static void add_proposal(private_sa_config_t *this, child_proposal_t *proposal)
+static void add_proposal(private_sa_config_t *this, proposal_t *proposal)
 {
 	this->proposals->insert_last(this->proposals, (void*)proposal);
 }
@@ -282,7 +282,7 @@ static void add_proposal(private_sa_config_t *this, child_proposal_t *proposal)
  */
 static status_t destroy(private_sa_config_t *this)
 {	
-	child_proposal_t *proposal;
+	proposal_t *proposal;
 	traffic_selector_t *traffic_selector;
 	
 	
@@ -332,10 +332,10 @@ sa_config_t *sa_config_create(id_type_t my_id_type, char *my_id, id_type_t other
 	this->public.get_traffic_selectors_responder = (size_t(*)(sa_config_t*,traffic_selector_t**[]))get_traffic_selectors_responder;
 	this->public.select_traffic_selectors_responder = (size_t(*)(sa_config_t*,traffic_selector_t*[],size_t,traffic_selector_t**[]))select_traffic_selectors_responder;
 	this->public.get_proposals = (linked_list_t*(*)(sa_config_t*))get_proposals;
-	this->public.select_proposal = (child_proposal_t*(*)(sa_config_t*,linked_list_t*))select_proposal;
+	this->public.select_proposal = (proposal_t*(*)(sa_config_t*,linked_list_t*))select_proposal;
 	this->public.add_traffic_selector_initiator = (void(*)(sa_config_t*,traffic_selector_t*))add_traffic_selector_initiator;
 	this->public.add_traffic_selector_responder = (void(*)(sa_config_t*,traffic_selector_t*))add_traffic_selector_responder;
-	this->public.add_proposal = (void(*)(sa_config_t*,child_proposal_t*))add_proposal;
+	this->public.add_proposal = (void(*)(sa_config_t*,proposal_t*))add_proposal;
 	this->public.destroy = (void(*)(sa_config_t*))destroy;
 	
 	/* apply init values */

Source/charon/config/sa_config.h

@@ -32,7 +32,7 @@
 #include <transforms/signers/signer.h>
 #include <transforms/diffie_hellman.h>
 #include <config/traffic_selector.h>
-#include <config/child_proposal.h>
+#include <config/proposal.h>
 
 
 
@@ -174,7 +174,7 @@ struct sa_config_t {
 	 * @param proposals				list from from wich proposals are selected
 	 * @return						selected proposal, or NULL if nothing matches
 	 */
-	child_proposal_t *(*select_proposal) (sa_config_t *this, linked_list_t *proposals);
+	proposal_t *(*select_proposal) (sa_config_t *this, linked_list_t *proposals);
 	
 	/**
 	 * @brief Add a traffic selector to the list for initiator.
@@ -211,7 +211,7 @@ struct sa_config_t {
 	 * @param this					calling object
 	 * @param proposal				proposal to add
 	 */
-	void (*add_proposal) (sa_config_t *this, child_proposal_t *proposal);
+	void (*add_proposal) (sa_config_t *this, proposal_t *proposal);
 	
 	/**
 	 * @brief Destroys the config object