From d058fd3c32b78b3e5b3a885ed66273803c187565 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 22 Jan 2018 14:33:40 +0100 Subject: [PATCH] child-cfg: Strip DH groups from both compared proposals This fixes two issues, one is a bug if a DH group is configured for the local ESP proposals and charon.prefer_configured_proposals is disabled. This would cause the DH groups to get stripped not from the configured but from the supplied proposal, which usually already has them stripped. So the proposals wouldn't match. We'd have to always strip them from the local proposal. Since there are apparently implementations that, incorrectly, don't remove the DH groups in the IKE_AUTH exchange (e.g. WatchGuard XTM25 appliances) we just strip them from both proposals. It's a bit more lenient that way and we don't have to complicate the code to only clone and strip the local proposal, which would depend on a flag. References #2503. --- src/libcharon/config/child_cfg.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/libcharon/config/child_cfg.c b/src/libcharon/config/child_cfg.c index ec2a12431..3d110e9a2 100644 --- a/src/libcharon/config/child_cfg.c +++ b/src/libcharon/config/child_cfg.c @@ -224,6 +224,10 @@ METHOD(child_cfg_t, select_proposal, proposal_t*, while (prefer_enum->enumerate(prefer_enum, &proposal)) { proposal = proposal->clone(proposal); + if (strip_dh) + { + proposal->strip_dh(proposal, MODP_NONE); + } if (prefer_self) { proposals->reset_enumerator(proposals, match_enum); @@ -234,11 +238,13 @@ METHOD(child_cfg_t, select_proposal, proposal_t*, } while (match_enum->enumerate(match_enum, &match)) { + match = match->clone(match); if (strip_dh) { - proposal->strip_dh(proposal, MODP_NONE); + match->strip_dh(match, MODP_NONE); } selected = proposal->select(proposal, match, prefer_self, private); + match->destroy(match); if (selected) { DBG2(DBG_CFG, "received proposals: %#P", proposals);