denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proposal: Make sure there is a PRF defined in IKE proposals

Browse Source 
But filter PRFs from ESP proposals.
This commit is contained in:
Tobias Brunner
2016-10-05 14:27:04 +02:00
parent 9b191d5975
commit e98414ea9c
1 changed files with 34 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/config/proposal.c
+34 -14
View File
@@ -419,6 +419,25 @@ static const struct {
{AUTH_AES_CMAC_96, PRF_AES128_CMAC }, {AUTH_AES_CMAC_96, PRF_AES128_CMAC },
}; };
/**
* Remove all entries of the given transform type
*/
static void remove_transform(private_proposal_t *this, transform_type_t type)
{
enumerator_t *e;
entry_t *entry;
e = array_create_enumerator(this->transforms);
while (e->enumerate(e, &entry))
{
if (entry->type == type)
{
array_remove_at(this->transforms, e);
}
}
e->destroy(e);
}
/** /**
* Checks the proposal read from a string. * Checks the proposal read from a string.
*/ */
@@ -432,12 +451,9 @@ static bool check_proposal(private_proposal_t *this)
if (this->protocol == PROTO_IKE) if (this->protocol == PROTO_IKE)
{ {
e = create_enumerator(this, PSEUDO_RANDOM_FUNCTION); if (!get_algorithm(this, PSEUDO_RANDOM_FUNCTION, NULL, NULL))
if (!e->enumerate(e, &alg, &ks)) { /* No explicit PRF found. We assume the same algorithm as used
{ * for integrity checking. */
/* No explicit PRF found. We assume the same algorithm as used
* for integrity checking */
e->destroy(e);
e = create_enumerator(this, INTEGRITY_ALGORITHM); e = create_enumerator(this, INTEGRITY_ALGORITHM);
while (e->enumerate(e, &alg, &ks)) while (e->enumerate(e, &alg, &ks))
{ {
@@ -451,8 +467,13 @@ static bool check_proposal(private_proposal_t *this)
} }
} }
} }
e->destroy(e);
}
if (!get_algorithm(this, PSEUDO_RANDOM_FUNCTION, NULL, NULL))
{
DBG1(DBG_CFG, "a PRF algorithm is mandatory in IKE proposals");
return FALSE;
} }
e->destroy(e);
/* remove MODP_NONE from IKE proposal */ /* remove MODP_NONE from IKE proposal */
e = array_create_enumerator(this->transforms); e = array_create_enumerator(this->transforms);
while (e->enumerate(e, &entry)) while (e->enumerate(e, &entry))
@@ -463,14 +484,15 @@ static bool check_proposal(private_proposal_t *this)
} }
} }
e->destroy(e); e->destroy(e);
e = create_enumerator(this, DIFFIE_HELLMAN_GROUP); if (!get_algorithm(this, DIFFIE_HELLMAN_GROUP, NULL, NULL))
if (!e->enumerate(e, &alg, &ks))
{ {
DBG1(DBG_CFG, "a DH group is mandatory in IKE proposals"); DBG1(DBG_CFG, "a DH group is mandatory in IKE proposals");
e->destroy(e);
return FALSE; return FALSE;
} }
e->destroy(e); }
else
{ /* remove PRFs from ESP/AH proposals */
remove_transform(this, PSEUDO_RANDOM_FUNCTION);
} }
if (this->protocol == PROTO_ESP) if (this->protocol == PROTO_ESP)
@@ -504,12 +526,10 @@ static bool check_proposal(private_proposal_t *this)
if (this->protocol == PROTO_AH || this->protocol == PROTO_ESP) if (this->protocol == PROTO_AH || this->protocol == PROTO_ESP)
{ {
e = create_enumerator(this, EXTENDED_SEQUENCE_NUMBERS); if (!get_algorithm(this, EXTENDED_SEQUENCE_NUMBERS, NULL, NULL))
if (!e->enumerate(e, NULL, NULL))
{ /* ESN not specified, assume not supported */ { /* ESN not specified, assume not supported */
add_algorithm(this, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0); add_algorithm(this, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
} }
e->destroy(e);
} }
array_compress(this->transforms); array_compress(this->transforms);