[Swan-commit] Changes to ref refs/heads/main

[Andrew Cagney]

New commits:
commit 18f40759e1e38da8ba6b86564f7733f4c93bb69a
Author: Andrew Cagney <cagney at gnu.org>
Date:   Thu Nov 23 20:47:52 2023 -0500

    ikev2: merge pre and post v4.6 DH strategies
    
    fix #1265
    
    First, is unchanged from v4.x:
    
    - when pfs=no, no proposal can specify DH, else the conn is rejected
    
    - when pfs=yes, the proposal must either fully specify or not specify
      DH, else the conn is rejected
    
    Then there are two cases:
    
    1. Do the right thing:
    
    When pfs=yes and the proposal does not specify DH, IKE DH is assumed.
    Hence:
    
    - a create Child SA uses the (DH-less) proposal with IKE DH added
    
    - an IKE AUTH Child SA rekey uses the previously accepted crypto with
      IKE DH added
    
      (in v4.5- the full proposal + IKE DH was used)
    
    - a normal rekey uses the previously accepted crypto and DH
    
      (here, since IKE DH was the only thing previously offered, the DH
      must match IKE)
    
    2. User knows best:
    
    Wen pfs=yes and the proposal (fully) specifies DH then that proposal
    is used unchanged.  Hence:
    
    - a create Child SA uses the proposal as is
    
    - an IKE AUTH Child SA rekey sends the proposal as is
    
      (in v4.6+ the accepted crypt with forced IKE DH was used; i.e., the
      end user's configuration was ignored)
    
    - a normal rekey sends the previously accepted crypto and DH