Attachment 303965 Details for Bug 442955 – Add conf-only ESP support

[patch] Add conf-only ESP support

openswan-null-auth-esp.patch (text/plain), 6.39 KB, created by Herbert Xu on 2008-04-28 12:00:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Herbert Xu

Created: 2008-04-28 12:00:01 UTC

Size: 6.39 KB

patch

obsolete

>Only in openswan-2.6.12.new: OBJ.linux.x86_64
>diff -ur openswan-2.6.12/include/ietf_constants.h openswan-2.6.12.new/include/ietf_constants.h
>--- openswan-2.6.12/include/ietf_constants.h	2008-04-28 16:13:10.000000000 +0800
>+++ openswan-2.6.12.new/include/ietf_constants.h	2008-04-28 15:22:58.000000000 +0800
>@@ -471,6 +471,7 @@
> };
> 
> enum ikev2_trans_type_integ {
>+	IKEv2_AUTH_NONE        =0,
> 	IKEv2_AUTH_HMAC_MD5_96 =1,
> 	IKEv2_AUTH_HMAC_SHA1_96=2,
> 	IKEv2_AUTH_DES_MAC     =3,
>diff -ur openswan-2.6.12/lib/libopenswan/alg_info.c openswan-2.6.12.new/lib/libopenswan/alg_info.c
>--- openswan-2.6.12/lib/libopenswan/alg_info.c	2008-04-22 11:55:38.000000000 +0800
>+++ openswan-2.6.12.new/lib/libopenswan/alg_info.c	2008-04-28 15:07:25.000000000 +0800
>@@ -56,6 +56,8 @@
> 		    return AH_SHA2_512;
> 		case AUTH_ALGORITHM_HMAC_RIPEMD:
> 		    return AH_RIPEMD;
>+		case AUTH_ALGORITHM_NONE:
>+		    return AH_NONE;
> 
> 		default:
> 		    bad_case(auth);
>@@ -193,6 +195,12 @@
> 	if (ret>=0) goto out;
> 	ret=alg_enum_search_prefix(&auth_alg_names,"AUTH_ALGORITHM_",str,len);
> 	if (ret>=0) goto out;
>+
>+	/* Special value for no authentication since zero is already used. */
>+	ret = INT_MAX;
>+	if (!strncasecmp(str, "null", len))
>+		goto out;
>+
> 	sscanf(str, "id%d%n", &ret, &num);
> 	if (ret >=0 && num!=strlen(str))
> 		ret=-1;
>@@ -267,6 +275,8 @@
> 	    if(aalg_id > 0 ||
> 	       (permit_manconn && aalg_id == 0))
> 		{
>+			if (aalg_id == INT_MAX)
>+				aalg_id = 0;
> 			__alg_info_esp_add((struct alg_info_esp *)alg_info,
> 					ealg_id, ek_bits,
> 					aalg_id, ak_bits);
>@@ -899,7 +909,7 @@
> 			    , enum_name(&esp_transformid_names, esp_info->esp_ealg_id)+sizeof("ESP")
> 			    , esp_info->esp_ealg_id
> 			    , (int)esp_info->esp_ealg_keylen
>-			    , enum_name(&auth_alg_names, esp_info->esp_aalg_id)+sizeof("AUTH_ALGORITHM_HMAC")
>+			    , enum_name(&auth_alg_names, esp_info->esp_aalg_id) + (esp_info->esp_aalg_id ? sizeof("AUTH_ALGORITHM_HMAC") : sizeof("AUTH_ALGORITHM"))
> 			    , esp_info->esp_aalg_id);
> 		ptr+=np;
> 		buflen-=np;
>diff -ur openswan-2.6.12/lib/libopenswan/constants.c openswan-2.6.12.new/lib/libopenswan/constants.c
>--- openswan-2.6.12/lib/libopenswan/constants.c	2008-04-28 16:15:09.000000000 +0800
>+++ openswan-2.6.12.new/lib/libopenswan/constants.c	2008-04-28 15:23:27.000000000 +0800
>@@ -547,7 +547,7 @@
> /* Auth Algorithm attribute */
> 
> static const char *const auth_alg_name[] = {
>-	"unspecified AUTH_ALGORITHM",
>+	"AUTH_ALGORITHM_NONE",
> 	"AUTH_ALGORITHM_HMAC_MD5",
> 	"AUTH_ALGORITHM_HMAC_SHA1",
> 	"AUTH_ALGORITHM_DES_MAC",
>@@ -567,7 +567,7 @@
> 
> enum_names
>     auth_alg_names =
>-	{ AUTH_ALGORITHM_HMAC_MD5, 15 /* AUTH_ALGORITHM_HMAC_RIPEMD */, auth_alg_name + 1, NULL },
>+	{ AUTH_ALGORITHM_NONE, 15 /* AUTH_ALGORITHM_HMAC_RIPEMD */, auth_alg_name, NULL },
>     extended_auth_alg_names =
> 	{ AUTH_ALGORITHM_NONE, AUTH_ALGORITHM_KPDK, auth_alg_name, NULL };
> 
>@@ -981,6 +981,7 @@
> 
> /* Transform-type Integrity */
> const char *const trans_type_integ_name[]={
>+    "auth-none",
>     "auth-hmac-md5-96",
>     "auth-hmac-sha1-96",
>     "auth-des-mac",
>@@ -988,7 +989,7 @@
>     "auth-aes-xcbc-96",
> };
> enum_names trans_type_integ_names =
>-{ IKEv2_AUTH_HMAC_MD5_96, IKEv2_AUTH_AES_XCBC_96, trans_type_integ_name, NULL};
>+{ IKEv2_AUTH_NONE, IKEv2_AUTH_AES_XCBC_96, trans_type_integ_name, NULL};
> 
> /* Transform-type Integrity */
> const char *const trans_type_esn_name[]={
>diff -ur openswan-2.6.12/linux/include/openswan/ipsec_policy.h openswan-2.6.12.new/linux/include/openswan/ipsec_policy.h
>--- openswan-2.6.12/linux/include/openswan/ipsec_policy.h	2008-04-22 11:55:38.000000000 +0800
>+++ openswan-2.6.12.new/linux/include/openswan/ipsec_policy.h	2008-04-28 14:38:01.000000000 +0800
>@@ -75,6 +75,7 @@
>  * and in http://www.iana.org/assignments/isakmp-registry
>  */
> enum ipsec_authentication_algo {
>+  AH_NONE=0,
>   AH_MD5=2,
>   AH_SHA=3,
>   AH_DES=4,
>Only in openswan-2.6.12.new/programs/pluto: core
>diff -ur openswan-2.6.12/programs/pluto/plutoalg.c openswan-2.6.12.new/programs/pluto/plutoalg.c
>--- openswan-2.6.12/programs/pluto/plutoalg.c	2008-04-22 11:55:38.000000000 +0800
>+++ openswan-2.6.12.new/programs/pluto/plutoalg.c	2008-04-28 15:04:52.000000000 +0800
>@@ -229,7 +229,7 @@
> 			 , sep
> 			 , enum_name(&esp_transformid_names, esp_info->esp_ealg_id)+sizeof("ESP")
> 			 , esp_info->esp_ealg_id, eklen
>-			 , enum_name(&auth_alg_names, esp_info->esp_aalg_id)+sizeof("AUTH_ALGORITHM_HMAC")
>+			 , enum_name(&auth_alg_names, esp_info->esp_aalg_id) + (esp_info->esp_aalg_id ? sizeof("AUTH_ALGORITHM_HMAC") : sizeof("AUTH_ALGORITHM"))
> 			 , esp_info->esp_aalg_id, aklen);
> 	    ptr+=ret;
> 	    buflen-=ret;
>@@ -464,9 +464,11 @@
> 	    /*	open new transformation */
> 	    db_trans_add(db_ctx, ealg_i);
> 
>-	    /* add ESP auth attr */
>-	    db_attr_add_values(db_ctx, 
>-			       AUTH_ALGORITHM, esp_info->esp_aalg_id);
>+	    /* add ESP auth attr (if present) */
>+	    if (esp_info->esp_aalg_id != AUTH_ALGORITHM_NONE) {
>+		db_attr_add_values(db_ctx, 
>+				   AUTH_ALGORITHM, esp_info->esp_aalg_id);
>+	    }
> 
> 	    /*	add keylegth if specified in esp= string */
> 	    if (esp_info->esp_ealg_keylen) {
>diff -ur openswan-2.6.12/programs/pluto/spdb_v2_struct.c openswan-2.6.12.new/programs/pluto/spdb_v2_struct.c
>--- openswan-2.6.12/programs/pluto/spdb_v2_struct.c	2008-04-28 16:16:05.000000000 +0800
>+++ openswan-2.6.12.new/programs/pluto/spdb_v2_struct.c	2008-04-28 15:30:01.000000000 +0800
>@@ -315,7 +315,7 @@
> 			    break;
> 
> 			case OAKLEY_HASH_ALGORITHM:
>-			    dtfone->prf_transid=attr->val;
>+			    dtfone->integ_transid = attr->val;
> 			    break;
> 			    
> 			case OAKLEY_GROUP_DESCRIPTION:
>@@ -332,7 +332,7 @@
> 		    } else {
> 			switch(attr->type.ipsec) {
> 			case AUTH_ALGORITHM:
>-			    dtfone->auth_method = attr->val;
>+			    dtfone->integ_transid = attr->val;
> 			    break;
> 			    
> 			case KEY_LENGTH:
>@@ -433,17 +433,14 @@
> 	}
> 	tr_pos++;
> 
>-	if(dtfone->integ_transid == 0) {
>-	    tr[tr_pos].transid        = IKEv2_AUTH_HMAC_SHA1_96;
>-	} else {
>-	    tr[tr_pos].transid        = dtfone->integ_transid;
>-	}
>+	tr[tr_pos].transid        = dtfone->integ_transid;
> 	tr[tr_pos].transform_type = IKEv2_TRANS_TYPE_INTEG;
> 	tr_pos++;
> 	
> 	if(dtfone->protoid == PROTO_ISAKMP) {
>+	    /* XXX Let the user set the PRF.*/
> 	    tr[tr_pos].transform_type = IKEv2_TRANS_TYPE_PRF;
>-	    tr[tr_pos].transid        = dtfone->prf_transid;
>+	    tr[tr_pos].transid        = IKEv2_PRF_HMAC_SHA1;
> 	    tr_pos++;
> 	    tr[tr_pos].transform_type = IKEv2_TRANS_TYPE_DH;
> 	    tr[tr_pos].transid        = dtfone->group_transid;

Actions: View | Diff

Attachments on bug 442955: 302806 | 303965