New upstream version 5.6.2

3 files changed, 61 insertions, 171 deletions

diff --git a/src/libcharon/tests/suites/test_child_rekey.c b/src/libcharon/tests/suites/test_child_rekey.c
index ac169723f..44d004ab7 100644
--- a/src/libcharon/tests/suites/test_child_rekey.c
+++ b/src/libcharon/tests/suites/test_child_rekey.c
@@ -231,6 +231,61 @@ START_TEST(test_regular_ke_invalid)
 	/* child_updown */
 	assert_hook();
 
+	/* because the DH group should get reused another rekeying should complete
+	 * without additional exchange */
+	initiate_rekey(a, 5);
+	/* this should never get called as this results in a successful rekeying */
+	assert_hook_not_called(child_updown);
+
+	/* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */
+	assert_hook_called(child_rekey);
+	assert_notify(IN, REKEY_SA);
+	exchange_test_helper->process_message(exchange_test_helper, b, NULL);
+	assert_child_sa_state(b, 6, CHILD_REKEYED, CHILD_OUTBOUND_INSTALLED);
+	assert_child_sa_state(b, 8, CHILD_INSTALLED, CHILD_OUTBOUND_REGISTERED);
+	assert_ipsec_sas_installed(b, 5, 6, 8);
+	assert_hook();
+
+	/* <-- CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } */
+	assert_hook_called(child_rekey);
+	assert_no_notify(IN, REKEY_SA);
+	exchange_test_helper->process_message(exchange_test_helper, a, NULL);
+	assert_child_sa_state(a, 5, CHILD_DELETING, CHILD_OUTBOUND_INSTALLED);
+	assert_child_sa_state(a, 7, CHILD_INSTALLED, CHILD_OUTBOUND_INSTALLED);
+	assert_ipsec_sas_installed(a, 5, 6, 7, 8);
+	assert_hook();
+
+	/* INFORMATIONAL { D } --> */
+	assert_hook_not_called(child_rekey);
+	assert_single_payload(IN, PLV2_DELETE);
+	exchange_test_helper->process_message(exchange_test_helper, b, NULL);
+	assert_child_sa_state(b, 6, CHILD_DELETING, CHILD_OUTBOUND_NONE);
+	assert_child_sa_state(b, 8, CHILD_INSTALLED, CHILD_OUTBOUND_INSTALLED);
+	assert_child_sa_count(b, 2);
+	assert_ipsec_sas_installed(b, 6, 7, 8);
+	assert_hook();
+
+	/* <-- INFORMATIONAL { D } */
+	assert_hook_not_called(child_rekey);
+	assert_single_payload(IN, PLV2_DELETE);
+	exchange_test_helper->process_message(exchange_test_helper, a, NULL);
+	assert_child_sa_state(a, 5, CHILD_DELETING, CHILD_OUTBOUND_NONE);
+	assert_child_sa_state(a, 7, CHILD_INSTALLED);
+	assert_child_sa_count(a, 2);
+	assert_ipsec_sas_installed(a, 5, 7, 8);
+	assert_hook();
+
+	/* simulate the execution of the scheduled jobs */
+	destroy_rekeyed(a, 5);
+	assert_child_sa_count(a, 1);
+	assert_ipsec_sas_installed(a, 7, 8);
+	destroy_rekeyed(b, 6);
+	assert_child_sa_count(b, 1);
+	assert_ipsec_sas_installed(b, 7, 8);
+
+	/* child_updown */
+	assert_hook();
+
 	call_ikesa(a, destroy);
 	call_ikesa(b, destroy);
 }
diff --git a/src/libcharon/tests/suites/test_ike_rekey.c b/src/libcharon/tests/suites/test_ike_rekey.c
index ba39657a4..e22a0c288 100644
--- a/src/libcharon/tests/suites/test_ike_rekey.c
+++ b/src/libcharon/tests/suites/test_ike_rekey.c
@@ -138,6 +138,8 @@ START_TEST(test_regular_ke_invalid)
 
 	lib->settings->set_bool(lib->settings, "%s.prefer_configured_proposals",
 							TRUE, lib->ns);
+	lib->settings->set_bool(lib->settings, "%s.prefer_previous_dh_group",
+							FALSE, lib->ns);
 
 	initiate_rekey(a);
 
@@ -382,6 +384,8 @@ START_TEST(test_collision_ke_invalid)
 
 	lib->settings->set_bool(lib->settings, "%s.prefer_configured_proposals",
 							TRUE, lib->ns);
+	lib->settings->set_bool(lib->settings, "%s.prefer_previous_dh_group",
+							FALSE, lib->ns);
 
 	/* Six nonces and SPIs are needed (SPI 1 and 2 are used for the initial
 	 * IKE_SA):
@@ -591,6 +595,8 @@ START_TEST(test_collision_ke_invalid_delayed_retry)
 
 	lib->settings->set_bool(lib->settings, "%s.prefer_configured_proposals",
 							TRUE, lib->ns);
+	lib->settings->set_bool(lib->settings, "%s.prefer_previous_dh_group",
+							FALSE, lib->ns);
 
 	/* Five nonces and SPIs are needed (SPI 1 and 2 are used for the initial
 	 * IKE_SA):
diff --git a/src/libcharon/tests/suites/test_proposal.c b/src/libcharon/tests/suites/test_proposal.c
deleted file mode 100644
index f1591794a..000000000
--- a/src/libcharon/tests/suites/test_proposal.c
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- * Copyright (C) 2016 Tobias Brunner
- * HSR Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include "test_suite.h"
-
-#include <config/proposal.h>
-
-static struct {
-	protocol_id_t proto;
-	char *proposal;
-	char *expected;
-} create_data[] = {
-	{ PROTO_IKE, "", NULL },
-	{ PROTO_IKE, "sha256", NULL },
-	{ PROTO_IKE, "sha256-modp3072", NULL },
-	{ PROTO_IKE, "null-sha256-modp3072", "IKE:NULL/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072" },
-	{ PROTO_IKE, "aes128", NULL },
-	{ PROTO_IKE, "aes128-sha256", NULL },
-	{ PROTO_IKE, "aes128-sha256-modpnone", NULL },
-	{ PROTO_IKE, "aes128-sha256-modp3072", "IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072" },
-	{ PROTO_IKE, "aes128-sha256-prfsha384-modp3072", "IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_384/MODP_3072" },
-	{ PROTO_IKE, "aes128gcm16-modp3072", NULL },
-	{ PROTO_IKE, "aes128gcm16-prfsha256-modp3072", "IKE:AES_GCM_16_128/PRF_HMAC_SHA2_256/MODP_3072" },
-	{ PROTO_IKE, "aes128gcm16-sha256-modp3072", "IKE:AES_GCM_16_128/PRF_HMAC_SHA2_256/MODP_3072" },
-	{ PROTO_IKE, "aes128gcm16-aes128-modp3072", NULL },
-	{ PROTO_IKE, "aes128gcm16-aes128-sha256-modp3072", NULL },
-	{ PROTO_ESP, "", NULL },
-	{ PROTO_ESP, "sha256", NULL },
-	{ PROTO_ESP, "aes128-sha256", "ESP:AES_CBC_128/HMAC_SHA2_256_128/NO_EXT_SEQ" },
-	{ PROTO_ESP, "aes128-sha256-esn", "ESP:AES_CBC_128/HMAC_SHA2_256_128/EXT_SEQ" },
-	{ PROTO_ESP, "aes128-sha256-noesn", "ESP:AES_CBC_128/HMAC_SHA2_256_128/NO_EXT_SEQ" },
-	{ PROTO_ESP, "aes128-sha256-esn-noesn", "ESP:AES_CBC_128/HMAC_SHA2_256_128/EXT_SEQ/NO_EXT_SEQ" },
-	{ PROTO_ESP, "aes128-sha256-prfsha256-modp3072", "ESP:AES_CBC_128/HMAC_SHA2_256_128/MODP_3072/NO_EXT_SEQ" },
-	{ PROTO_ESP, "aes128gcm16-aes128-sha256-modp3072", NULL },
-	{ PROTO_ESP, "aes128gmac", "ESP:NULL_AES_GMAC_128/NO_EXT_SEQ" },
-	{ PROTO_AH,  "", NULL },
-	{ PROTO_AH,  "aes128", NULL },
-	{ PROTO_AH,  "aes128-sha256", "AH:HMAC_SHA2_256_128/NO_EXT_SEQ" },
-	{ PROTO_AH,  "sha256-sha1", "AH:HMAC_SHA2_256_128/HMAC_SHA1_96/NO_EXT_SEQ" },
-	{ PROTO_AH,  "aes128gmac-sha256", "AH:AES_128_GMAC/HMAC_SHA2_256_128/NO_EXT_SEQ" },
-	{ PROTO_AH,  "aes128gmac-sha256-prfsha256", "AH:AES_128_GMAC/HMAC_SHA2_256_128/NO_EXT_SEQ" },
-	{ PROTO_AH,  "aes128gmac-aes256gmac-aes128-sha256", "AH:AES_128_GMAC/AES_256_GMAC/HMAC_SHA2_256_128/NO_EXT_SEQ" },
-	{ PROTO_AH,  "sha256-esn", "AH:HMAC_SHA2_256_128/EXT_SEQ" },
-	{ PROTO_AH,  "sha256-noesn", "AH:HMAC_SHA2_256_128/NO_EXT_SEQ" },
-	{ PROTO_AH,  "sha256-esn-noesn", "AH:HMAC_SHA2_256_128/EXT_SEQ/NO_EXT_SEQ" },
-};
-
-START_TEST(test_create_from_string)
-{
-	proposal_t *proposal;
-	char str[BUF_LEN];
-
-	proposal = proposal_create_from_string(create_data[_i].proto,
-										   create_data[_i].proposal);
-	if (!create_data[_i].expected)
-	{
-		ck_assert(!proposal);
-		return;
-	}
-	snprintf(str, sizeof(str), "%P", proposal);
-	ck_assert_str_eq(create_data[_i].expected, str);
-	proposal->destroy(proposal);
-}
-END_TEST
-
-static struct {
-	protocol_id_t proto;
-	char *self;
-	char *other;
-	char *expected;
-} select_data[] = {
-	{ PROTO_ESP, "aes128", "aes128", "aes128" },
-	{ PROTO_ESP, "aes128", "aes256", NULL },
-	{ PROTO_ESP, "aes128-aes256", "aes256-aes128", "aes128" },
-	{ PROTO_ESP, "aes256-aes128", "aes128-aes256", "aes256" },
-	{ PROTO_ESP, "aes128-aes256-sha1-sha256", "aes256-aes128-sha256-sha1", "aes128-sha1" },
-	{ PROTO_ESP, "aes256-aes128-sha256-sha1", "aes128-aes256-sha1-sha256", "aes256-sha256" },
-	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256", NULL },
-	{ PROTO_ESP, "aes128-sha256", "aes128-sha256-modp3072", NULL },
-	{ PROTO_ESP, "aes128-sha256-modp3072", "aes128-sha256-modpnone", NULL },
-	{ PROTO_ESP, "aes128-sha256-modpnone", "aes128-sha256-modp3072", NULL },
-	{ PROTO_ESP, "aes128-sha256-modp3072-modpnone", "aes128-sha256", "aes128-sha256" },
-	{ PROTO_ESP, "aes128-sha256", "aes128-sha256-modp3072-modpnone", "aes128-sha256" },
-	{ PROTO_ESP, "aes128-sha256-modp3072-modpnone", "aes128-sha256-modpnone-modp3072", "aes128-sha256-modp3072" },
-	{ PROTO_ESP, "aes128-sha256-modpnone-modp3072", "aes128-sha256-modp3072-modpnone", "aes128-sha256-modpnone" },
-	{ PROTO_IKE, "aes128-sha256-modp3072", "aes128-sha256-modp3072", "aes128-sha256-modp3072" },
-	{ PROTO_IKE, "aes128-sha256-modp3072", "aes128-sha256-modp3072-modpnone", "aes128-sha256-modp3072" },
-	{ PROTO_IKE, "aes128-sha256-modp3072-modpnone", "aes128-sha256-modp3072", "aes128-sha256-modp3072" },
-};
-
-START_TEST(test_select)
-{
-	proposal_t *self, *other, *selected, *expected;
-
-	self = proposal_create_from_string(select_data[_i].proto,
-									   select_data[_i].self);
-	other = proposal_create_from_string(select_data[_i].proto,
-										select_data[_i].other);
-	selected = self->select(self, other, TRUE, FALSE);
-	if (select_data[_i].expected)
-	{
-		expected = proposal_create_from_string(select_data[_i].proto,
-											   select_data[_i].expected);
-		ck_assert(selected);
-		ck_assert_msg(expected->equals(expected, selected), "proposal %P does "
-					  "not match expected %P", selected, expected);
-		expected->destroy(expected);
-	}
-	else
-	{
-		ck_assert(!selected);
-	}
-	DESTROY_IF(selected);
-	other->destroy(other);
-	self->destroy(self);
-}
-END_TEST
-
-START_TEST(test_select_spi)
-{
-	proposal_t *self, *other, *selected;
-
-	self = proposal_create_from_string(PROTO_ESP, "aes128-sha256-modp3072");
-	other = proposal_create_from_string(PROTO_ESP, "aes128-sha256-modp3072");
-	other->set_spi(other, 0x12345678);
-
-	selected = self->select(self, other, TRUE, FALSE);
-	ck_assert(selected);
-	ck_assert_int_eq(selected->get_spi(selected), other->get_spi(other));
-	selected->destroy(selected);
-
-	selected = self->select(self, other, FALSE, FALSE);
-	ck_assert(selected);
-	ck_assert_int_eq(selected->get_spi(selected), self->get_spi(self));
-	selected->destroy(selected);
-
-	other->destroy(other);
-	self->destroy(self);
-}
-END_TEST
-
-Suite *proposal_suite_create()
-{
-	Suite *s;
-	TCase *tc;
-
-	s = suite_create("proposal");
-
-	tc = tcase_create("create_from_string");
-	tcase_add_loop_test(tc, test_create_from_string, 0, countof(create_data));
-	suite_add_tcase(s, tc);
-
-	tc = tcase_create("select");
-	tcase_add_loop_test(tc, test_select, 0, countof(select_data));
-	tcase_add_test(tc, test_select_spi);
-	suite_add_tcase(s, tc);
-
-	return s;
-}