denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proposal: Use flags to select/match proposals

Browse Source 
During proposal selection with ike/child_cfgs a couple of boolean
variables can be set (e.g. private, prefer_self, strip_dh). To simplify
the addition of new parameters, these functions now use a set of flags
instead of indiviual boolean values.

Signed-off-by: Thomas Egerer <[email protected]>
This commit is contained in:
Thomas Egerer
2019-10-24 17:22:53 +02:00
committed by Tobias Brunner
parent 8346db09dd
commit f930b732c4
12 changed files with 130 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev1/tasks/aggressive_mode.c
+10 -7
View File
@@ -374,8 +374,8 @@ METHOD(task_t, process_r, status_t,
id_payload_t *id_payload;
identification_t *id;
linked_list_t *list;
proposal_selection_flag_t flags = 0;
uint16_t group;
bool prefer_configured;
this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
DBG0(DBG_IKE, "%H is initiating a Aggressive Mode IKE_SA",
@@ -399,10 +399,13 @@ METHOD(task_t, process_r, status_t,
}
list = sa_payload->get_proposals(sa_payload);
prefer_configured = lib->settings->get_bool(lib->settings,
"%s.prefer_configured_proposals", TRUE, lib->ns);
this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
list, FALSE, prefer_configured);
if (lib->settings->get_bool(lib->settings,
"%s.prefer_configured_proposals", TRUE, lib->ns))
{
flags = PROPOSAL_PREFER_CONFIGURED;
}
this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, list,
flags);
list->destroy_offset(list, offsetof(proposal_t, destroy));
if (!this->proposal)
{
@@ -641,8 +644,8 @@ METHOD(task_t, process_i, status_t,
return send_notify(this, INVALID_PAYLOAD_TYPE);
}
list = sa_payload->get_proposals(sa_payload);
this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
list, FALSE, TRUE);
this->proposal = this->ike_cfg->select_proposal(this->ike_cfg, list,
PROPOSAL_PREFER_CONFIGURED);
list->destroy_offset(list, offsetof(proposal_t, destroy));
if (!this->proposal)
{
src/libcharon/sa/ikev1/tasks/main_mode.c
+17 -10
View File
@@ -362,7 +362,7 @@ METHOD(task_t, process_r, status_t,
{
linked_list_t *list;
sa_payload_t *sa_payload;
bool private, prefer_configured;
proposal_selection_flag_t flags = 0;
this->ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
DBG0(DBG_IKE, "%H is initiating a Main Mode IKE_SA",
@@ -386,12 +386,17 @@ METHOD(task_t, process_r, status_t,
}
list = sa_payload->get_proposals(sa_payload);
private = this->ike_sa->supports_extension(this->ike_sa,
EXT_STRONGSWAN);
prefer_configured = lib->settings->get_bool(lib->settings,
"%s.prefer_configured_proposals", TRUE, lib->ns);
if (this->ike_sa->supports_extension(this->ike_sa , EXT_STRONGSWAN))
{
flags |= PROPOSAL_ALLOW_PRIVATE;
}
if (lib->settings->get_bool(lib->settings,
"%s.prefer_configured_proposals", TRUE, lib->ns))
{
flags |= PROPOSAL_PREFER_CONFIGURED;
}
this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
list, private, prefer_configured);
list, flags);
list->destroy_offset(list, offsetof(proposal_t, destroy));
if (!this->proposal)
{
@@ -624,8 +629,8 @@ METHOD(task_t, process_i, status_t,
linked_list_t *list;
sa_payload_t *sa_payload;
auth_method_t method;
proposal_selection_flag_t flags = PROPOSAL_PREFER_CONFIGURED;
uint32_t lifetime;
bool private;
sa_payload = (sa_payload_t*)message->get_payload(message,
PLV1_SECURITY_ASSOCIATION);
@@ -635,10 +640,12 @@ METHOD(task_t, process_i, status_t,
return send_notify(this, INVALID_PAYLOAD_TYPE);
}
list = sa_payload->get_proposals(sa_payload);
private = this->ike_sa->supports_extension(this->ike_sa,
EXT_STRONGSWAN);
if (this->ike_sa->supports_extension(this->ike_sa , EXT_STRONGSWAN))
{
flags |= PROPOSAL_ALLOW_PRIVATE;
}
this->proposal = this->ike_cfg->select_proposal(this->ike_cfg,
list, private, TRUE);
list, flags);
list->destroy_offset(list, offsetof(proposal_t, destroy));
if (!this->proposal)
{
src/libcharon/sa/ikev1/tasks/quick_mode.c
+18 -11
View File
@@ -852,7 +852,7 @@ METHOD(task_t, build_i, status_t,
}
}
list = this->config->get_proposals(this->config, MODP_NONE);
list = this->config->get_proposals(this->config, FALSE);
if (list->get_first(list, (void**)&proposal) == SUCCESS)
{
this->proto = proposal->get_protocol(proposal);
@@ -1072,7 +1072,7 @@ METHOD(task_t, process_r, status_t,
linked_list_t *tsi, *tsr, *hostsi, *hostsr, *list = NULL;
peer_cfg_t *peer_cfg;
uint16_t group;
bool private, prefer_configured;
proposal_selection_flag_t flags = 0;
sa_payload = (sa_payload_t*)message->get_payload(message,
PLV1_SECURITY_ASSOCIATION);
@@ -1132,12 +1132,17 @@ METHOD(task_t, process_r, status_t,
DESTROY_IF(list);
list = sa_payload->get_proposals(sa_payload);
}
private = this->ike_sa->supports_extension(this->ike_sa,
EXT_STRONGSWAN);
prefer_configured = lib->settings->get_bool(lib->settings,
"%s.prefer_configured_proposals", TRUE, lib->ns);
if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
{
flags |= PROPOSAL_ALLOW_PRIVATE;
}
if (lib->settings->get_bool(lib->settings,
"%s.prefer_configured_proposals", TRUE, lib->ns))
{
flags |= PROPOSAL_PREFER_CONFIGURED;
}
this->proposal = this->config->select_proposal(this->config, list,
FALSE, private, prefer_configured);
flags);
list->destroy_offset(list, offsetof(proposal_t, destroy));
get_lifetimes(this);
@@ -1340,7 +1345,7 @@ METHOD(task_t, process_i, status_t,
{
sa_payload_t *sa_payload;
linked_list_t *list = NULL;
bool private;
proposal_selection_flag_t flags = PROPOSAL_PREFER_CONFIGURED;
sa_payload = (sa_payload_t*)message->get_payload(message,
PLV1_SECURITY_ASSOCIATION);
@@ -1365,10 +1370,12 @@ METHOD(task_t, process_i, status_t,
DESTROY_IF(list);
list = sa_payload->get_proposals(sa_payload);
}
private = this->ike_sa->supports_extension(this->ike_sa,
EXT_STRONGSWAN);
if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
{
flags |= PROPOSAL_ALLOW_PRIVATE;
}
this->proposal = this->config->select_proposal(this->config, list,
FALSE, private, TRUE);
flags);
list->destroy_offset(list, offsetof(proposal_t, destroy));
if (!this->proposal)
{
src/libcharon/sa/ikev2/tasks/child_create.c
+15 -5
View File
@@ -544,7 +544,7 @@ static status_t select_and_install(private_child_create_t *this,
chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
linked_list_t *my_ts, *other_ts;
host_t *me, *other;
bool private, prefer_configured;
proposal_selection_flag_t flags = 0;
if (this->proposals == NULL)
{
@@ -560,11 +560,21 @@ static status_t select_and_install(private_child_create_t *this,
me = this->ike_sa->get_my_host(this->ike_sa);
other = this->ike_sa->get_other_host(this->ike_sa);
private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
prefer_configured = lib->settings->get_bool(lib->settings,
"%s.prefer_configured_proposals", TRUE, lib->ns);
if (no_dh)
{
flags |= PROPOSAL_STRIP_DH;
}
if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
{
flags |= PROPOSAL_ALLOW_PRIVATE;
}
if (lib->settings->get_bool(lib->settings, "%s.prefer_configured_proposals",
TRUE, lib->ns))
{
flags |= PROPOSAL_PREFER_CONFIGURED;
}
this->proposal = this->config->select_proposal(this->config,
this->proposals, no_dh, private, prefer_configured);
this->proposals, flags);
if (this->proposal == NULL)
{
DBG1(DBG_IKE, "no acceptable proposal found");
src/libcharon/sa/ikev2/tasks/ike_init.c
+12 -8
View File
@@ -453,17 +453,21 @@ static void process_sa_payload(private_ike_init_t *this, message_t *message,
enumerator_t *enumerator;
linked_list_t *proposal_list;
host_t *me, *other;
bool private, prefer_configured;
proposal_selection_flag_t flags = 0;
ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
proposal_list = sa_payload->get_proposals(sa_payload);
private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
prefer_configured = lib->settings->get_bool(lib->settings,
"%s.prefer_configured_proposals", TRUE, lib->ns);
this->proposal = ike_cfg->select_proposal(ike_cfg, proposal_list, private,
prefer_configured);
if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
{
flags |= PROPOSAL_ALLOW_PRIVATE;
}
if (lib->settings->get_bool(lib->settings, "%s.prefer_configured_proposals",
TRUE, lib->ns))
{
flags |= PROPOSAL_PREFER_CONFIGURED;
}
this->proposal = ike_cfg->select_proposal(ike_cfg, proposal_list, flags);
if (!this->proposal)
{
if (!this->initiator && !this->old_sa)
@@ -481,7 +485,7 @@ static void process_sa_payload(private_ike_init_t *this, message_t *message,
DBG1(DBG_IKE, "no matching proposal found, trying alternative "
"config");
this->proposal = cfg->select_proposal(cfg, proposal_list,
private, prefer_configured);
flags);
if (this->proposal)
{
alt_cfg = cfg->get_ref(cfg);