denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proposal: Use flags to select/match proposals

Browse Source 
During proposal selection with ike/child_cfgs a couple of boolean
variables can be set (e.g. private, prefer_self, strip_dh). To simplify
the addition of new parameters, these functions now use a set of flags
instead of indiviual boolean values.

Signed-off-by: Thomas Egerer <[email protected]>
This commit is contained in:
Thomas Egerer
2019-10-24 17:22:53 +02:00
committed by Tobias Brunner
parent 8346db09dd
commit f930b732c4
12 changed files with 130 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/crypto/proposal/proposal.c
+12 -11
View File
@@ -338,8 +338,8 @@ METHOD(proposal_t, strip_dh, void,
* Select a matching proposal from this and other.
*/
static bool select_algo(private_proposal_t *this, proposal_t *other,
transform_type_t type, bool priv, bool log,
uint16_t *alg, uint16_t *ks)
transform_type_t type, proposal_selection_flag_t flags,
bool log, uint16_t *alg, uint16_t *ks)
{
enumerator_t *e1, *e2;
uint16_t alg1, alg2, ks1, ks2;
@@ -390,7 +390,7 @@ static bool select_algo(private_proposal_t *this, proposal_t *other,
{
if (alg1 == alg2 && ks1 == ks2)
{
if (!priv && alg1 >= 1024)
if (!(flags & PROPOSAL_ALLOW_PRIVATE) && alg1 >= 1024)
{
if (log)
{
@@ -417,7 +417,7 @@ static bool select_algo(private_proposal_t *this, proposal_t *other,
* is stored there and errors are logged.
*/
static bool select_algos(private_proposal_t *this, proposal_t *other,
proposal_t *selected, bool private)
proposal_t *selected, proposal_selection_flag_t flags)
{
transform_type_t type;
array_t *types;
@@ -434,7 +434,7 @@ static bool select_algos(private_proposal_t *this, proposal_t *other,
{
continue;
}
if (select_algo(this, other, type, private, selected != NULL, &alg, &ks))
if (select_algo(this, other, type, flags, selected != NULL, &alg, &ks))
{
if (alg == 0 && type != EXTENDED_SEQUENCE_NUMBERS)
{ /* 0 is "valid" for extended sequence numbers, for other
@@ -468,8 +468,8 @@ static bool select_algos(private_proposal_t *this, proposal_t *other,
}
METHOD(proposal_t, select_proposal, proposal_t*,
private_proposal_t *this, proposal_t *other, bool other_remote,
bool private)
private_proposal_t *this, proposal_t *other,
proposal_selection_flag_t flags)
{
proposal_t *selected;
@@ -481,7 +481,7 @@ METHOD(proposal_t, select_proposal, proposal_t*,
return NULL;
}
if (other_remote)
if (flags & PROPOSAL_PREFER_CONFIGURED)
{
selected = proposal_create(this->protocol, other->get_number(other));
selected->set_spi(selected, other->get_spi(other));
@@ -492,7 +492,7 @@ METHOD(proposal_t, select_proposal, proposal_t*,
selected->set_spi(selected, this->spi);
}
if (!select_algos(this, other, selected, private))
if (!select_algos(this, other, selected, flags))
{
selected->destroy(selected);
return NULL;
@@ -502,13 +502,14 @@ METHOD(proposal_t, select_proposal, proposal_t*,
}
METHOD(proposal_t, matches, bool,
private_proposal_t *this, proposal_t *other, bool private)
private_proposal_t *this, proposal_t *other,
proposal_selection_flag_t flags)
{
if (this->protocol != other->get_protocol(other))
{
return FALSE;
}
return select_algos(this, other, NULL, private);
return select_algos(this, other, NULL, flags);
}
METHOD(proposal_t, get_protocol, protocol_id_t,
src/libstrongswan/crypto/proposal/proposal.h
+22 -7
View File
@@ -23,6 +23,7 @@
#define PROPOSAL_H_
typedef enum protocol_id_t protocol_id_t;
typedef enum proposal_selection_flag_t proposal_selection_flag_t;
typedef enum extended_sequence_numbers_t extended_sequence_numbers_t;
typedef struct proposal_t proposal_t;
@@ -51,6 +52,18 @@ enum protocol_id_t {
*/
extern enum_name_t *protocol_id_names;
/**
* Flags for selecting proposals
*/
enum proposal_selection_flag_t {
/** Accept algorithms from a private range. */
PROPOSAL_ALLOW_PRIVATE = (1<<0),
/** Whether to prefer configured or supplied proposals. */
PROPOSAL_PREFER_CONFIGURED = (1<<1),
/** Whether to strip out diffie hellman groups */
PROPOSAL_STRIP_DH = (1<<2),
};
/**
* Stores a set of algorithms used for an SA.
*
@@ -132,15 +145,16 @@ struct proposal_t {
* compared. If they have at least one algorithm of each type
* in common, a resulting proposal of this kind is created.
*
* If the flag PROPOSAL_PREFER_CONFIGURED is set, other is expected to be
* the remote proposal from which to copy SPI and proposal number to the
* result, otherwise copy from this proposal.
*
* @param other proposal to compare against
* @param other_remote whether other is the remote proposal from which to
* copy SPI and proposal number to the result,
* otherwise copy from this proposal
* @param private accepts algorithms allocated in a private range
* @param flags flags to consider during proposal selection
* @return selected proposal, NULL if proposals don't match
*/
proposal_t *(*select)(proposal_t *this, proposal_t *other,
bool other_remote, bool private);
proposal_selection_flag_t flags);
/**
* Check if the given proposal matches this proposal.
@@ -148,10 +162,11 @@ struct proposal_t {
* This is similar to select, but no resulting proposal is selected.
*
* @param other proposal to compare against
* @param private accepts algorithms allocated in a private range
* @param flags flags to consider during proposal selection
* @return TRUE if the proposals match
*/
bool (*matches)(proposal_t *this, proposal_t *other, bool private);
bool (*matches)(proposal_t *this, proposal_t *other,
proposal_selection_flag_t flags);
/**
* Get the protocol ID of the proposal.
src/libstrongswan/tests/suites/test_proposal.c
+6 -6
View File
@@ -121,7 +121,7 @@ START_TEST(test_select)
select_data[_i].self);
other = proposal_create_from_string(select_data[_i].proto,
select_data[_i].other);
selected = self->select(self, other, TRUE, FALSE);
selected = self->select(self, other, PROPOSAL_PREFER_CONFIGURED);
if (select_data[_i].expected)
{
expected = proposal_create_from_string(select_data[_i].proto,
@@ -149,12 +149,12 @@ START_TEST(test_select_spi)
other = proposal_create_from_string(PROTO_ESP, "aes128-sha256-modp3072");
other->set_spi(other, 0x12345678);
selected = self->select(self, other, TRUE, FALSE);
selected = self->select(self, other, PROPOSAL_PREFER_CONFIGURED);
ck_assert(selected);
ck_assert_int_eq(selected->get_spi(selected), other->get_spi(other));
selected->destroy(selected);
selected = self->select(self, other, FALSE, FALSE);
selected = self->select(self, other, 0);
ck_assert(selected);
ck_assert_int_eq(selected->get_spi(selected), self->get_spi(self));
selected->destroy(selected);
@@ -267,7 +267,7 @@ START_TEST(test_unknown_transform_types_select_fail)
other = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
other->add_algorithm(other, 242, 42, 0);
selected = self->select(self, other, TRUE, FALSE);
selected = self->select(self, other, PROPOSAL_PREFER_CONFIGURED);
ck_assert(!selected);
other->destroy(other);
self->destroy(self);
@@ -283,7 +283,7 @@ START_TEST(test_unknown_transform_types_select_fail_subtype)
other = proposal_create_from_string(PROTO_IKE, "aes128-sha256-ecp256");
other->add_algorithm(other, 242, 42, 0);
selected = self->select(self, other, TRUE, FALSE);
selected = self->select(self, other, PROPOSAL_PREFER_CONFIGURED);
ck_assert(!selected);
other->destroy(other);
self->destroy(self);
@@ -300,7 +300,7 @@ START_TEST(test_unknown_transform_types_select_success)
other->add_algorithm(other, 242, 42, 128);
other->add_algorithm(other, 242, 1, 0);
selected = self->select(self, other, TRUE, FALSE);
selected = self->select(self, other, PROPOSAL_PREFER_CONFIGURED);
ck_assert(selected);
assert_proposal_eq(selected, "IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256/UNKNOWN_242_42_128");
selected->destroy(selected);