rpms-fedora-extras/strongswan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Patch vici for NHRP

Browse Source
This commit is contained in:
Zoran Peričić
2019-12-30 22:14:53 +01:00
parent be375bffce
commit 74beab1284
7 changed files with 1563 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

104
0001-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch Normal file
View File

@@ -0,0 +1,104 @@
From 4904344754c2884e36b40532a8b65229c3355ff6 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 17 Jul 2015 11:53:58 +0200
Subject: [PATCH 1/6] ike: Adhere to IKE_SA limit when checking out by config
This prevents new SAs from getting created if we hit the global IKE_SA
limit (we still allow checkout_new(), which is used for rekeying).
---
src/libcharon/sa/ike_sa_manager.c | 71 ++++++++++++++++---------------
1 file changed, 37 insertions(+), 34 deletions(-)
diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
index 3bac4b109..8a3178674 100644
--- a/src/libcharon/sa/ike_sa_manager.c
+++ b/src/libcharon/sa/ike_sa_manager.c
@@ -1419,48 +1419,51 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
DBG2(DBG_MGR, "checkout IKE_SA by config");
- if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1)
- { /* IKE_SA reuse disabled by config (not possible for IKEv1) */
- ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
- charon->bus->set_sa(charon->bus, ike_sa);
- goto out;
- }
-
- enumerator = create_table_enumerator(this);
- while (enumerator->enumerate(enumerator, &entry, &segment))
+ if (this->reuse_ikesa || peer_cfg->get_ike_version(peer_cfg) == IKEV1)
{
- if (!wait_for_entry(this, entry, segment))
+ enumerator = create_table_enumerator(this);
+ while (enumerator->enumerate(enumerator, &entry, &segment))
{
- continue;
- }
- if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING ||
- entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED)
- { /* skip IKE_SAs which are not usable, wake other waiting threads */
- entry->condvar->signal(entry->condvar);
- continue;
- }
-
- current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
- if (current_peer && current_peer->equals(current_peer, peer_cfg))
- {
- current_ike = current_peer->get_ike_cfg(current_peer);
- if (current_ike->equals(current_ike, peer_cfg->get_ike_cfg(peer_cfg)))
+ if (!wait_for_entry(this, entry, segment))
{
- entry->checked_out = thread_current();
- ike_sa = entry->ike_sa;
- DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config",
- ike_sa->get_unique_id(ike_sa),
- current_peer->get_name(current_peer));
- break;
+ continue;
}
+ if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING ||
+ entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED)
+ { /* skip IKE_SAs which are not usable, wake other waiting threads */
+ entry->condvar->signal(entry->condvar);
+ continue;
+ }
+ current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
+ if (current_peer && current_peer->equals(current_peer, peer_cfg))
+ {
+ current_ike = current_peer->get_ike_cfg(current_peer);
+ if (current_ike->equals(current_ike,
+ peer_cfg->get_ike_cfg(peer_cfg)))
+ {
+ entry->checked_out = thread_current();
+ ike_sa = entry->ike_sa;
+ DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config",
+ ike_sa->get_unique_id(ike_sa),
+ current_peer->get_name(current_peer));
+ break;
+ }
+ }
+ /* other threads might be waiting for this entry */
+ entry->condvar->signal(entry->condvar);
}
- /* other threads might be waiting for this entry */
- entry->condvar->signal(entry->condvar);
+ enumerator->destroy(enumerator);
}
- enumerator->destroy(enumerator);
if (!ike_sa)
- { /* no IKE_SA using such a config, hand out a new */
+ { /* no IKE_SA using such a config, or reuse disabled, hand out a new */
+ if (this->ikesa_limit &&
+ this->public.get_count(&this->public) >= this->ikesa_limit)
+ {
+ DBG1(DBG_MGR, "IKE_SA creation failed, hitting IKE_SA limit (%u)",
+ this->ikesa_limit);
+ return NULL;
+ }
ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
}
charon->bus->set_sa(charon->bus, ike_sa);
--
2.24.1

598
0002-charon-add-optional-source-and-remote-overrides-for-.patch Normal file
View File

@@ -0,0 +1,598 @@
From bc5cee05ee42b7566ed3539546757c3183aa7053 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:41:58 +0300
Subject: [PATCH 2/6] charon: add optional source and remote overrides for
initiate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This introduces support for specifying optional IKE SA specific
source and remote address for child sa initiation. This allows
to initiate wildcard connection for known address via vici.
In addition this allows impler implementation of trap-any patches
and is a prerequisite for dmvpn support.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
---
src/charon-cmd/cmd/cmd_connection.c | 2 +-
src/charon-nm/nm/nm_service.c | 2 +-
src/libcharon/control/controller.c | 43 ++++++++++++-
src/libcharon/control/controller.h | 3 +
src/libcharon/plugins/stroke/stroke_control.c | 5 +-
src/libcharon/plugins/vici/vici_config.c | 2 +-
src/libcharon/plugins/vici/vici_control.c | 63 ++++++++++++++++---
.../processing/jobs/start_action_job.c | 2 +-
src/libcharon/sa/ike_sa_manager.c | 51 ++++++++++++++-
src/libcharon/sa/ike_sa_manager.h | 8 ++-
src/libcharon/sa/trap_manager.c | 45 ++++++-------
src/swanctl/commands/initiate.c | 40 +++++++++++-
12 files changed, 218 insertions(+), 48 deletions(-)
diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
index 1cf431ff2..ae406393f 100644
--- a/src/charon-cmd/cmd/cmd_connection.c
+++ b/src/charon-cmd/cmd/cmd_connection.c
@@ -436,7 +436,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
child_cfg = create_child_cfg(this, peer_cfg);
if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
- controller_cb_empty, NULL, 0, FALSE) != SUCCESS)
+ NULL, NULL, controller_cb_empty, NULL, 0, FALSE) != SUCCESS)
{
terminate(pid);
}
diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c
index fb9044d29..b47a0c7f5 100644
--- a/src/charon-nm/nm/nm_service.c
+++ b/src/charon-nm/nm/nm_service.c
@@ -622,7 +622,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
* Prepare IKE_SA
*/
ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
- peer_cfg);
+ peer_cfg, NULL, NULL);
if (!ike_sa)
{
peer_cfg->destroy(peer_cfg);
diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c
index 589c536d2..037e6a72d 100644
--- a/src/libcharon/control/controller.c
+++ b/src/libcharon/control/controller.c
@@ -15,6 +15,28 @@
* for more details.
*/
+/*
+ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
#include "controller.h"
#include <sys/types.h>
@@ -102,6 +124,16 @@ struct interface_listener_t {
*/
ike_sa_t *ike_sa;
+ /**
+ * Our host hint.
+ */
+ host_t *my_host;
+
+ /**
+ * Other host hint.
+ */
+ host_t *other_host;
+
/**
* unique ID, used for various methods
*/
@@ -409,9 +441,14 @@ METHOD(job_t, initiate_execute, job_requeue_t,
ike_sa_t *ike_sa;
interface_listener_t *listener = &job->listener;
peer_cfg_t *peer_cfg = listener->peer_cfg;
+ host_t *my_host = listener->my_host;
+ host_t *other_host = listener->other_host;
ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
- peer_cfg);
+ peer_cfg, my_host, other_host);
+ DESTROY_IF(my_host);
+ DESTROY_IF(other_host);
+
if (!ike_sa)
{
listener->child_cfg->destroy(listener->child_cfg);
@@ -420,6 +457,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
listener_done(listener);
return JOB_REQUEUE_NONE;
}
+
listener->lock->lock(listener->lock);
listener->ike_sa = ike_sa;
listener->lock->unlock(listener->lock);
@@ -492,6 +530,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
METHOD(controller_t, initiate, status_t,
private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
+ host_t *my_host, host_t *other_host,
controller_cb_t callback, void *param, u_int timeout, bool limits)
{
interface_job_t *job;
@@ -514,6 +553,8 @@ METHOD(controller_t, initiate, status_t,
.status = FAILED,
.child_cfg = child_cfg,
.peer_cfg = peer_cfg,
+ .my_host = my_host ? my_host->clone(my_host) : NULL,
+ .other_host = other_host ? other_host->clone(other_host) : NULL,
.lock = spinlock_create(),
.options.limits = limits,
},
diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h
index af9baca01..02f17a8e3 100644
--- a/src/libcharon/control/controller.h
+++ b/src/libcharon/control/controller.h
@@ -79,6 +79,8 @@ struct controller_t {
*
* @param peer_cfg peer_cfg to use for IKE_SA setup
* @param child_cfg child_cfg to set up CHILD_SA from
+ * @param my_host optional address hint for source
+ * @param other_host optional address hint for destination
* @param cb logging callback
* @param param parameter to include in each call of cb
* @param timeout timeout in ms to wait for callbacks, 0 to disable
@@ -92,6 +94,7 @@ struct controller_t {
*/
status_t (*initiate)(controller_t *this,
peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
+ host_t *my_host, host_t *other_host,
controller_cb_t callback, void *param, u_int timeout,
bool limits);
diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c
index 8d84b934e..b00d0e62d 100644
--- a/src/libcharon/plugins/stroke/stroke_control.c
+++ b/src/libcharon/plugins/stroke/stroke_control.c
@@ -108,7 +108,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg
if (msg->output_verbosity < 0)
{
charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
- NULL, NULL, 0, FALSE);
+ NULL, NULL, NULL, NULL, 0, FALSE);
}
else
{
@@ -116,7 +116,8 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg
status_t status;
status = charon->controller->initiate(charon->controller,
- peer_cfg, child_cfg, (controller_cb_t)stroke_log,
+ peer_cfg, child_cfg, NULL, NULL,
+ (controller_cb_t)stroke_log,
&info, this->timeout, FALSE);
switch (status)
{
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index ace7a4528..f0fd8a989 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -2057,7 +2057,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
charon->controller->initiate(charon->controller,
peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg),
- NULL, NULL, 0, FALSE);
+ NULL, NULL, NULL, NULL, 0, FALSE);
break;
case ACTION_ROUTE:
DBG1(DBG_CFG, "installing '%s'", child_cfg->get_name(child_cfg));
diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
index 16e49fdbc..9c6b86741 100644
--- a/src/libcharon/plugins/vici/vici_control.c
+++ b/src/libcharon/plugins/vici/vici_control.c
@@ -16,6 +16,28 @@
* for more details.
*/
+/*
+ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
#include "vici_control.h"
#include "vici_builder.h"
@@ -169,9 +191,11 @@ static child_cfg_t* find_child_cfg(char *name, char *pname, peer_cfg_t **out)
CALLBACK(initiate, vici_message_t*,
private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
{
+ vici_message_t* msg;
child_cfg_t *child_cfg = NULL;
peer_cfg_t *peer_cfg;
- char *child, *ike;
+ host_t *my_host = NULL, *other_host = NULL;
+ char *child, *ike, *my_host_str, *other_host_str;
int timeout;
bool limits;
controller_cb_t log_cb = NULL;
@@ -185,6 +209,8 @@ CALLBACK(initiate, vici_message_t*,
timeout = request->get_int(request, 0, "timeout");
limits = request->get_bool(request, FALSE, "init-limits");
log.level = request->get_int(request, 1, "loglevel");
+ my_host_str = request->get_str(request, NULL, "my-host");
+ other_host_str = request->get_str(request, NULL, "other-host");
if (!child)
{
@@ -195,28 +221,47 @@ CALLBACK(initiate, vici_message_t*,
log_cb = (controller_cb_t)log_vici;
}
- DBG1(DBG_CFG, "vici initiate '%s'", child);
+ if (my_host_str)
+ {
+ my_host = host_create_from_string(my_host_str, 0);
+ }
+ if (other_host_str)
+ {
+ other_host = host_create_from_string(other_host_str, 0);
+ }
+
+ DBG1(DBG_CFG, "vici initiate '%s', me %H, other %H, limits %d", child, my_host, other_host, limits);
child_cfg = find_child_cfg(child, ike, &peer_cfg);
if (!child_cfg)
{
- return send_reply(this, "CHILD_SA config '%s' not found", child);
+ msg = send_reply(this, "CHILD_SA config '%s' not found", child);
+ goto ret;
}
- switch (charon->controller->initiate(charon->controller, peer_cfg,
- child_cfg, log_cb, &log, timeout, limits))
+ switch (charon->controller->initiate(charon->controller,
+ peer_cfg, child_cfg, my_host, other_host,
+ log_cb, &log, timeout, limits))
{
case SUCCESS:
- return send_reply(this, NULL);
+ msg = send_reply(this, NULL);
+ break;
case OUT_OF_RES:
- return send_reply(this, "CHILD_SA '%s' not established after %dms",
+ msg = send_reply(this, "CHILD_SA '%s' not established after %dms",
child, timeout);
+ break;
case INVALID_STATE:
- return send_reply(this, "establishing CHILD_SA '%s' not possible "
+ msg = send_reply(this, "establishing CHILD_SA '%s' not possible "
"at the moment due to limits", child);
+ break;
case FAILED:
default:
- return send_reply(this, "establishing CHILD_SA '%s' failed", child);
+ msg = send_reply(this, "establishing CHILD_SA '%s' failed", child);
+ break;
}
+ret:
+ if (my_host) my_host->destroy(my_host);
+ if (other_host) other_host->destroy(other_host);
+ return msg;
}
CALLBACK(terminate, vici_message_t*,
diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c
index 3a0ed879f..e3399007b 100644
--- a/src/libcharon/processing/jobs/start_action_job.c
+++ b/src/libcharon/processing/jobs/start_action_job.c
@@ -61,7 +61,7 @@ METHOD(job_t, execute, job_requeue_t,
charon->controller->initiate(charon->controller,
peer_cfg->get_ref(peer_cfg),
child_cfg->get_ref(child_cfg),
- NULL, NULL, 0, FALSE);
+ NULL, NULL, NULL, NULL, 0, FALSE);
break;
case ACTION_ROUTE:
DBG1(DBG_JOB, "start action: route '%s'", name);
diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
index 8a3178674..ad338b04c 100644
--- a/src/libcharon/sa/ike_sa_manager.c
+++ b/src/libcharon/sa/ike_sa_manager.c
@@ -17,6 +17,28 @@
* for more details.
*/
+/*
+ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
#include <string.h>
#include <inttypes.h>
@@ -1408,7 +1430,8 @@ out:
}
METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
- private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg)
+ private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg,
+ host_t *my_host, host_t *other_host)
{
enumerator_t *enumerator;
entry_t *entry;
@@ -1417,7 +1440,17 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
ike_cfg_t *current_ike;
u_int segment;
- DBG2(DBG_MGR, "checkout IKE_SA by config");
+ if (my_host && my_host->get_port(my_host) == 0)
+ {
+ my_host->set_port(my_host, IKEV2_UDP_PORT);
+ }
+ if (other_host && other_host->get_port(other_host) == 0)
+ {
+ other_host->set_port(other_host, IKEV2_UDP_PORT);
+ }
+
+ DBG2(DBG_MGR, "checkout IKE_SA by config '%s', me %H, other %H",
+ peer_cfg->get_name(peer_cfg), my_host, other_host);
if (this->reuse_ikesa || peer_cfg->get_ike_version(peer_cfg) == IKEV1)
{
@@ -1434,6 +1467,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
entry->condvar->signal(entry->condvar);
continue;
}
+
+ if (my_host && !my_host->ip_equals(my_host, entry->ike_sa->get_my_host(entry->ike_sa)))
+ {
+ continue;
+ }
+ if (other_host && !other_host->ip_equals(other_host, entry->ike_sa->get_other_host(entry->ike_sa)))
+ {
+ continue;
+ }
+
current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
if (current_peer && current_peer->equals(current_peer, peer_cfg))
{
@@ -1465,6 +1508,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
return NULL;
}
ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
+ if (my_host || other_host)
+ {
+ ike_sa->update_hosts(ike_sa, my_host, other_host, TRUE);
+ }
}
charon->bus->set_sa(charon->bus, ike_sa);
diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h
index efad2e4d6..c43edabbb 100644
--- a/src/libcharon/sa/ike_sa_manager.h
+++ b/src/libcharon/sa/ike_sa_manager.h
@@ -93,7 +93,8 @@ struct ike_sa_manager_t {
ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message);
/**
- * Checkout an IKE_SA for initiation by a peer_config.
+ * Checkout an IKE_SA for initiation by a peer_config and optional
+ * source and remote host addresses.
*
* To initiate, a CHILD_SA may be established within an existing IKE_SA.
* This call checks for an existing IKE_SA by comparing the configuration.
@@ -103,10 +104,13 @@ struct ike_sa_manager_t {
* the found IKE_SA is in the DELETING state.
*
* @param peer_cfg configuration used to find an existing IKE_SA
+ * @param my_host source host address for wildcard peer_cfg
+ * @param other_host remote host address for wildcard peer_cfg
* @return checked out/created IKE_SA
*/
ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this,
- peer_cfg_t *peer_cfg);
+ peer_cfg_t *peer_cfg,
+ host_t *my_host, host_t *other_host);
/**
* Reset initiator SPI.
diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
index 148df3923..901a8ba10 100644
--- a/src/libcharon/sa/trap_manager.c
+++ b/src/libcharon/sa/trap_manager.c
@@ -421,7 +421,7 @@ METHOD(trap_manager_t, acquire, void,
peer_cfg_t *peer;
child_cfg_t *child;
ike_sa_t *ike_sa;
- host_t *host;
+ host_t *host, *my_host = NULL, *other_host = NULL;
bool wildcard, ignore = FALSE;
this->lock->read_lock(this->lock);
@@ -497,36 +497,27 @@ METHOD(trap_manager_t, acquire, void,
this->lock->unlock(this->lock);
if (wildcard)
- { /* the peer config would match IKE_SAs with other peers */
- ike_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
- peer->get_ike_version(peer), TRUE);
- if (ike_sa)
- {
- ike_cfg_t *ike_cfg;
- uint16_t port;
- uint8_t mask;
-
- ike_sa->set_peer_cfg(ike_sa, peer);
- ike_cfg = ike_sa->get_ike_cfg(ike_sa);
+ {
+ ike_cfg_t *ike_cfg;
+ uint16_t port;
+ uint8_t mask;
- port = ike_cfg->get_other_port(ike_cfg);
- dst->to_subnet(dst, &host, &mask);
- host->set_port(host, port);
- ike_sa->set_other_host(ike_sa, host);
+ ike_cfg = peer->get_ike_cfg(peer);
- port = ike_cfg->get_my_port(ike_cfg);
- src->to_subnet(src, &host, &mask);
- host->set_port(host, port);
- ike_sa->set_my_host(ike_sa, host);
+ port = ike_cfg->get_other_port(ike_cfg);
+ dst->to_subnet(dst, &other_host, &mask);
+ other_host->set_port(other_host, port);
- charon->bus->set_sa(charon->bus, ike_sa);
- }
- }
- else
- {
- ike_sa = charon->ike_sa_manager->checkout_by_config(
- charon->ike_sa_manager, peer);
+ port = ike_cfg->get_my_port(ike_cfg);
+ src->to_subnet(src, &my_host, &mask);
+ my_host->set_port(my_host, port);
}
+ ike_sa = charon->ike_sa_manager->checkout_by_config(
+ charon->ike_sa_manager, peer,
+ my_host, other_host);
+ DESTROY_IF(my_host);
+ DESTROY_IF(other_host);
+
if (ike_sa)
{
if (ike_sa->get_peer_cfg(ike_sa) == NULL)
diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c
index bf8d2cd79..29d95d85c 100644
--- a/src/swanctl/commands/initiate.c
+++ b/src/swanctl/commands/initiate.c
@@ -13,6 +13,28 @@
* for more details.
*/
+/*
+ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
#include "command.h"
#include <errno.h>
@@ -37,7 +59,7 @@ static int initiate(vici_conn_t *conn)
vici_req_t *req;
vici_res_t *res;
command_format_options_t format = COMMAND_FORMAT_NONE;
- char *arg, *child = NULL, *ike = NULL;
+ char *arg, *child = NULL, *ike = NULL, *my_host = NULL, *other_host = NULL;
int ret = 0, timeout = 0, level = 1;
while (TRUE)
@@ -64,6 +86,12 @@ static int initiate(vici_conn_t *conn)
case 'l':
level = atoi(arg);
continue;
+ case 'S':
+ my_host = arg;
+ continue;
+ case 'R':
+ other_host = arg;
+ continue;
case EOF:
break;
default:
@@ -87,6 +115,14 @@ static int initiate(vici_conn_t *conn)
{
vici_add_key_valuef(req, "ike", "%s", ike);
}
+ if (my_host)
+ {
+ vici_add_key_valuef(req, "my-host", "%s", my_host);
+ }
+ if (other_host)
+ {
+ vici_add_key_valuef(req, "other-host", "%s", other_host);
+ }
if (timeout)
{
vici_add_key_valuef(req, "timeout", "%d", timeout * 1000);
@@ -133,6 +169,8 @@ static void __attribute__ ((constructor))reg()
{"help", 'h', 0, "show usage information"},
{"child", 'c', 1, "initiate a CHILD_SA configuration"},
{"ike", 'i', 1, "name of the connection to which the child belongs"},
+ {"source", 'S', 1, "override source address"},
+ {"remote", 'R', 1, "override remote address"},
{"timeout", 't', 1, "timeout in seconds before detaching"},
{"raw", 'r', 0, "dump raw response message"},
{"pretty", 'P', 0, "dump raw response message in pretty print"},
--
2.24.1

131
0003-vici-send-certificates-for-ike-sa-events.patch Normal file
View File

@@ -0,0 +1,131 @@
From 0220ba579f8df26f90a1152f115f2a339a755708 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:42:05 +0300
Subject: [PATCH 3/6] vici: send certificates for ike-sa events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
---
src/libcharon/plugins/vici/vici_query.c | 48 +++++++++++++++++++++----
1 file changed, 41 insertions(+), 7 deletions(-)
diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
index d7b61ca72..f986ef8ab 100644
--- a/src/libcharon/plugins/vici/vici_query.c
+++ b/src/libcharon/plugins/vici/vici_query.c
@@ -337,7 +337,7 @@ static void list_vips(private_vici_query_t *this, vici_builder_t *b,
* List details of an IKE_SA
*/
static void list_ike(private_vici_query_t *this, vici_builder_t *b,
- ike_sa_t *ike_sa, time_t now)
+ ike_sa_t *ike_sa, time_t now, bool add_certs)
{
time_t t;
ike_sa_id_t *id;
@@ -345,6 +345,8 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
proposal_t *proposal;
uint16_t alg, ks;
host_t *host;
+ auth_cfg_t *auth_cfg;
+ enumerator_t *enumerator;
b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa));
b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa));
@@ -354,11 +356,43 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
b->add_kv(b, "local-host", "%H", host);
b->add_kv(b, "local-port", "%d", host->get_port(host));
b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa));
+ if (add_certs)
+ {
+ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, TRUE);
+ if (enumerator->enumerate(enumerator, &auth_cfg))
+ {
+ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
+ chunk_t encoding;
+
+ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
+ {
+ b->add(b, VICI_KEY_VALUE, "local-cert-data", encoding);
+ free(encoding.ptr);
+ }
+ }
+ enumerator->destroy(enumerator);
+ }
host = ike_sa->get_other_host(ike_sa);
b->add_kv(b, "remote-host", "%H", host);
b->add_kv(b, "remote-port", "%d", host->get_port(host));
b->add_kv(b, "remote-id", "%Y", ike_sa->get_other_id(ike_sa));
+ if (add_certs)
+ {
+ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
+ if (enumerator->enumerate(enumerator, &auth_cfg))
+ {
+ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
+ chunk_t encoding;
+
+ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
+ {
+ b->add(b, VICI_KEY_VALUE, "remote-cert-data", encoding);
+ free(encoding.ptr);
+ }
+ }
+ enumerator->destroy(enumerator);
+ }
eap = ike_sa->get_other_eap_id(ike_sa);
@@ -477,7 +511,7 @@ CALLBACK(list_sas, vici_message_t*,
b = vici_builder_create();
b->begin_section(b, ike_sa->get_name(ike_sa));
- list_ike(this, b, ike_sa, now);
+ list_ike(this, b, ike_sa, now, TRUE);
b->begin_section(b, "child-sas");
csas = ike_sa->create_child_sa_enumerator(ike_sa);
@@ -1650,7 +1684,7 @@ METHOD(listener_t, ike_updown, bool,
}
b->begin_section(b, ike_sa->get_name(ike_sa));
- list_ike(this, b, ike_sa, now);
+ list_ike(this, b, ike_sa, now, up);
b->end_section(b);
this->dispatcher->raise_event(this->dispatcher,
@@ -1675,10 +1709,10 @@ METHOD(listener_t, ike_rekey, bool,
b = vici_builder_create();
b->begin_section(b, old->get_name(old));
b->begin_section(b, "old");
- list_ike(this, b, old, now);
+ list_ike(this, b, old, now, TRUE);
b->end_section(b);
b->begin_section(b, "new");
- list_ike(this, b, new, now);
+ list_ike(this, b, new, now, TRUE);
b->end_section(b);
b->end_section(b);
@@ -1708,7 +1742,7 @@ METHOD(listener_t, child_updown, bool,
}
b->begin_section(b, ike_sa->get_name(ike_sa));
- list_ike(this, b, ike_sa, now);
+ list_ike(this, b, ike_sa, now, up);
b->begin_section(b, "child-sas");
b->begin_section(b, child_sa->get_name(child_sa));
@@ -1740,7 +1774,7 @@ METHOD(listener_t, child_rekey, bool,
b = vici_builder_create();
b->begin_section(b, ike_sa->get_name(ike_sa));
- list_ike(this, b, ike_sa, now);
+ list_ike(this, b, ike_sa, now, TRUE);
b->begin_section(b, "child-sas");
b->begin_section(b, old->get_name(old));
--
2.24.1

159
0004-vici-add-support-for-individual-sa-state-changes.patch Normal file
View File

@@ -0,0 +1,159 @@
From 5ad4fd199b718d8281021a6e31d682872b59a34c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:42:11 +0300
Subject: [PATCH 4/6] vici: add support for individual sa state changes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Useful for monitoring and tracking full SA.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
---
src/libcharon/plugins/vici/vici_query.c | 105 ++++++++++++++++++++++++
1 file changed, 105 insertions(+)
diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
index f986ef8ab..c7b07fca0 100644
--- a/src/libcharon/plugins/vici/vici_query.c
+++ b/src/libcharon/plugins/vici/vici_query.c
@@ -1650,8 +1650,16 @@ static void manage_commands(private_vici_query_t *this, bool reg)
this->dispatcher->manage_event(this->dispatcher, "list-cert", reg);
this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg);
this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg);
+ this->dispatcher->manage_event(this->dispatcher, "ike-state-established", reg);
+ this->dispatcher->manage_event(this->dispatcher, "ike-state-destroying", reg);
this->dispatcher->manage_event(this->dispatcher, "child-updown", reg);
this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg);
+ this->dispatcher->manage_event(this->dispatcher, "child-state-installing", reg);
+ this->dispatcher->manage_event(this->dispatcher, "child-state-installed", reg);
+ this->dispatcher->manage_event(this->dispatcher, "child-state-updating", reg);
+ this->dispatcher->manage_event(this->dispatcher, "child-state-rekeying", reg);
+ this->dispatcher->manage_event(this->dispatcher, "child-state-rekeyed", reg);
+ this->dispatcher->manage_event(this->dispatcher, "child-state-destroying", reg);
manage_command(this, "list-sas", list_sas, reg);
manage_command(this, "list-policies", list_policies, reg);
manage_command(this, "list-conns", list_conns, reg);
@@ -1722,6 +1730,45 @@ METHOD(listener_t, ike_rekey, bool,
return TRUE;
}
+METHOD(listener_t, ike_state_change, bool,
+ private_vici_query_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
+{
+ char *event;
+ vici_builder_t *b;
+ time_t now;
+
+ switch (state)
+ {
+ case IKE_ESTABLISHED:
+ event = "ike-state-established";
+ break;
+ case IKE_DESTROYING:
+ event = "ike-state-destroying";
+ break;
+ default:
+ return TRUE;
+ }
+
+ if (!this->dispatcher->has_event_listeners(this->dispatcher, event))
+ {
+ return TRUE;
+ }
+
+ now = time_monotonic(NULL);
+
+ b = vici_builder_create();
+ b->begin_section(b, ike_sa->get_name(ike_sa));
+ list_ike(this, b, ike_sa, now, state != IKE_DESTROYING);
+ b->begin_section(b, "child-sas");
+ b->end_section(b);
+ b->end_section(b);
+
+ this->dispatcher->raise_event(this->dispatcher,
+ event, 0, b->finalize(b));
+
+ return TRUE;
+}
+
METHOD(listener_t, child_updown, bool,
private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up)
{
@@ -1797,6 +1844,62 @@ METHOD(listener_t, child_rekey, bool,
return TRUE;
}
+METHOD(listener_t, child_state_change, bool,
+ private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state)
+{
+ char *event;
+ vici_builder_t *b;
+ time_t now;
+
+ switch (state)
+ {
+ case CHILD_INSTALLING:
+ event = "child-state-installing";
+ break;
+ case CHILD_INSTALLED:
+ event = "child-state-installed";
+ break;
+ case CHILD_UPDATING:
+ event = "child-state-updating";
+ break;
+ case CHILD_REKEYING:
+ event = "child-state-rekeying";
+ break;
+ case CHILD_REKEYED:
+ event = "child-state-rekeyed";
+ break;
+ case CHILD_DESTROYING:
+ event = "child-state-destroying";
+ break;
+ default:
+ return TRUE;
+ }
+
+ if (!this->dispatcher->has_event_listeners(this->dispatcher, event))
+ {
+ return TRUE;
+ }
+
+ now = time_monotonic(NULL);
+
+ b = vici_builder_create();
+ b->begin_section(b, ike_sa->get_name(ike_sa));
+ list_ike(this, b, ike_sa, now, state != CHILD_DESTROYING);
+ b->begin_section(b, "child-sas");
+
+ b->begin_section(b, child_sa->get_name(child_sa));
+ list_child(this, b, child_sa, now);
+ b->end_section(b);
+
+ b->end_section(b);
+ b->end_section(b);
+
+ this->dispatcher->raise_event(this->dispatcher,
+ event, 0, b->finalize(b));
+
+ return TRUE;
+}
+
METHOD(vici_query_t, destroy, void,
private_vici_query_t *this)
{
@@ -1816,8 +1919,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
.listener = {
.ike_updown = _ike_updown,
.ike_rekey = _ike_rekey,
+ .ike_state_change = _ike_state_change,
.child_updown = _child_updown,
.child_rekey = _child_rekey,
+ .child_state_change = _child_state_change,
},
.destroy = _destroy,
},
--
2.24.1

49
0005-vici-add-deprecated-async-parameter.patch Normal file
View File

@@ -0,0 +1,49 @@
From b251c17bfba838ee565a4f4af35b249024e35e77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:42:15 +0300
Subject: [PATCH 5/6] vici: add (deprecated) async parameter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This is obsoleted by the new "timeout=-1" option that achieves
the same. Only for compatibility with old versions of quagga-nhrp.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
---
src/libcharon/plugins/vici/vici_control.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
index 9c6b86741..718d14b3c 100644
--- a/src/libcharon/plugins/vici/vici_control.c
+++ b/src/libcharon/plugins/vici/vici_control.c
@@ -197,7 +197,7 @@ CALLBACK(initiate, vici_message_t*,
host_t *my_host = NULL, *other_host = NULL;
char *child, *ike, *my_host_str, *other_host_str;
int timeout;
- bool limits;
+ bool limits, async;
controller_cb_t log_cb = NULL;
log_info_t log = {
.dispatcher = this->dispatcher,
@@ -208,6 +208,7 @@ CALLBACK(initiate, vici_message_t*,
ike = request->get_str(request, NULL, "ike");
timeout = request->get_int(request, 0, "timeout");
limits = request->get_bool(request, FALSE, "init-limits");
+ async = request->get_bool(request, FALSE, "async");
log.level = request->get_int(request, 1, "loglevel");
my_host_str = request->get_str(request, NULL, "my-host");
other_host_str = request->get_str(request, NULL, "other-host");
@@ -216,7 +217,7 @@ CALLBACK(initiate, vici_message_t*,
{
return send_reply(this, "missing configuration name");
}
- if (timeout >= 0)
+ if (timeout >= 0 && !async)
{
log_cb = (controller_cb_t)log_vici;
}
--
2.24.1

507
0006-support-gre-key-in-ikev1.patch Normal file
View File

@@ -0,0 +1,507 @@
From b2e130f8ce765d5bd0f12ad16ef2434c820c11b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:42:18 +0300
Subject: [PATCH 6/6] support gre key in ikev1
this implements gre key negotiation in ikev1 similarly to the
ipsec-tools patch in alpine.
the from/to port pair is internally used as gre key for gre
protocol traffic selectors. since from/to pairs 0/0xffff and
0xffff/0 have special meaning, the gre keys 0xffff and 0xffff0000
will not work.
this is not standard compliant, and should probably not be upstreamed
or used widely, but it is applied for interoperability with alpine
racoon for the time being.
---
src/libcharon/encoding/payloads/id_payload.c | 68 ++++++++++++++-----
src/libcharon/encoding/payloads/id_payload.h | 6 +-
.../kernel_netlink/kernel_netlink_ipsec.c | 40 ++++++++---
src/libcharon/plugins/stroke/stroke_config.c | 5 ++
src/libcharon/plugins/unity/unity_narrow.c | 2 +-
src/libcharon/plugins/vici/vici_config.c | 9 ++-
src/libcharon/sa/ikev1/tasks/quick_mode.c | 16 +++--
.../selectors/traffic_selector.c | 33 ++++++++-
.../selectors/traffic_selector.h | 31 +++++++++
9 files changed, 171 insertions(+), 39 deletions(-)
diff --git a/src/libcharon/encoding/payloads/id_payload.c b/src/libcharon/encoding/payloads/id_payload.c
index b2f1adbbc..6b44d0cf6 100644
--- a/src/libcharon/encoding/payloads/id_payload.c
+++ b/src/libcharon/encoding/payloads/id_payload.c
@@ -245,18 +245,20 @@ METHOD(id_payload_t, get_identification, identification_t*,
* Create a traffic selector from an range ID
*/
static traffic_selector_t *get_ts_from_range(private_id_payload_t *this,
- ts_type_t type)
+ ts_type_t type,
+ uint16_t from_port, uint16_t to_port)
{
return traffic_selector_create_from_bytes(this->protocol_id, type,
- chunk_create(this->id_data.ptr, this->id_data.len / 2), this->port,
- chunk_skip(this->id_data, this->id_data.len / 2), this->port ?: 65535);
+ chunk_create(this->id_data.ptr, this->id_data.len / 2), from_port,
+ chunk_skip(this->id_data, this->id_data.len / 2), to_port);
}
/**
* Create a traffic selector from an subnet ID
*/
static traffic_selector_t *get_ts_from_subnet(private_id_payload_t *this,
- ts_type_t type)
+ ts_type_t type,
+ uint16_t from_port, uint16_t to_port)
{
traffic_selector_t *ts;
chunk_t net, netmask;
@@ -269,7 +271,7 @@ static traffic_selector_t *get_ts_from_subnet(private_id_payload_t *this,
netmask.ptr[i] = (netmask.ptr[i] ^ 0xFF) | net.ptr[i];
}
ts = traffic_selector_create_from_bytes(this->protocol_id, type,
- net, this->port, netmask, this->port ?: 65535);
+ net, from_port, netmask, to_port);
chunk_free(&netmask);
return ts;
}
@@ -278,51 +280,76 @@ static traffic_selector_t *get_ts_from_subnet(private_id_payload_t *this,
* Create a traffic selector from an IP ID
*/
static traffic_selector_t *get_ts_from_ip(private_id_payload_t *this,
- ts_type_t type)
+ ts_type_t type,
+ uint16_t from_port, uint16_t to_port)
{
return traffic_selector_create_from_bytes(this->protocol_id, type,
- this->id_data, this->port, this->id_data, this->port ?: 65535);
+ this->id_data, from_port, this->id_data, to_port);
}
METHOD(id_payload_t, get_ts, traffic_selector_t*,
- private_id_payload_t *this)
+ private_id_payload_t *this, id_payload_t *other_, bool initiator)
{
+ private_id_payload_t *other = (private_id_payload_t *) other_;
+ uint16_t from_port, to_port;
+
+ if (other && this->protocol_id == IPPROTO_GRE && other->protocol_id == IPPROTO_GRE)
+ {
+ if (initiator)
+ {
+ from_port = this->port;
+ to_port = other->port;
+ }
+ else
+ {
+ from_port = other->port;
+ to_port = this->port;
+ }
+ if (from_port == 0 && to_port == 0)
+ to_port = 0xffff;
+ }
+ else
+ {
+ from_port = this->port;
+ to_port = this->port ?: 0xffff;
+ }
+
switch (this->id_type)
{
case ID_IPV4_ADDR_SUBNET:
if (this->id_data.len == 8)
{
- return get_ts_from_subnet(this, TS_IPV4_ADDR_RANGE);
+ return get_ts_from_subnet(this, TS_IPV4_ADDR_RANGE, from_port, to_port);
}
break;
case ID_IPV6_ADDR_SUBNET:
if (this->id_data.len == 32)
{
- return get_ts_from_subnet(this, TS_IPV6_ADDR_RANGE);
+ return get_ts_from_subnet(this, TS_IPV6_ADDR_RANGE, from_port, to_port);
}
break;
case ID_IPV4_ADDR_RANGE:
if (this->id_data.len == 8)
{
- return get_ts_from_range(this, TS_IPV4_ADDR_RANGE);
+ return get_ts_from_range(this, TS_IPV4_ADDR_RANGE, from_port, to_port);
}
break;
case ID_IPV6_ADDR_RANGE:
if (this->id_data.len == 32)
{
- return get_ts_from_range(this, TS_IPV6_ADDR_RANGE);
+ return get_ts_from_range(this, TS_IPV6_ADDR_RANGE, from_port, to_port);
}
break;
case ID_IPV4_ADDR:
if (this->id_data.len == 4)
{
- return get_ts_from_ip(this, TS_IPV4_ADDR_RANGE);
+ return get_ts_from_ip(this, TS_IPV4_ADDR_RANGE, from_port, to_port);
}
break;
case ID_IPV6_ADDR:
if (this->id_data.len == 16)
{
- return get_ts_from_ip(this, TS_IPV6_ADDR_RANGE);
+ return get_ts_from_ip(this, TS_IPV6_ADDR_RANGE, from_port, to_port);
}
break;
default:
@@ -397,7 +424,7 @@ id_payload_t *id_payload_create_from_identification(payload_type_t type,
/*
* Described in header.
*/
-id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts)
+id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts, bool initiator)
{
private_id_payload_t *this;
uint8_t mask;
@@ -460,8 +487,17 @@ id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts)
ts->get_from_address(ts), ts->get_to_address(ts));
net->destroy(net);
}
- this->port = ts->get_from_port(ts);
this->protocol_id = ts->get_protocol(ts);
+ if (initiator || this->protocol_id != IPPROTO_GRE)
+ {
+ this->port = ts->get_from_port(ts);
+ }
+ else
+ {
+ this->port = ts->get_to_port(ts);
+ if (this->port == 0xffff && ts->get_from_port(ts) == 0)
+ this->port = 0;
+ }
this->payload_length += this->id_data.len;
return &this->public;
diff --git a/src/libcharon/encoding/payloads/id_payload.h b/src/libcharon/encoding/payloads/id_payload.h
index 283780624..fafeca8bc 100644
--- a/src/libcharon/encoding/payloads/id_payload.h
+++ b/src/libcharon/encoding/payloads/id_payload.h
@@ -48,11 +48,11 @@ struct id_payload_t {
identification_t *(*get_identification) (id_payload_t *this);
/**
- * Creates a traffic selector form a ID_ADDR_SUBNET/RANGE identity.
+ * Creates a traffic selector form a ID_ADDR_SUBNET/RANGE identity pair.
*
* @return traffic selector, NULL on failure
*/
- traffic_selector_t* (*get_ts)(id_payload_t *this);
+ traffic_selector_t* (*get_ts)(id_payload_t *this, id_payload_t *other, bool initiator);
/**
* Get encoded payload without fixed payload header (used for IKEv1).
@@ -91,6 +91,6 @@ id_payload_t *id_payload_create_from_identification(payload_type_t type,
* @param ts traffic selector
* @return PLV1_ID id_paylad_t object.
*/
-id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts);
+id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts, bool initiator);
#endif /** ID_PAYLOAD_H_ @}*/
diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
index 40fff7e05..0743f7a95 100644
--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -869,7 +869,18 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
ts2subnet(src, &sel.saddr, &sel.prefixlen_s);
ts2ports(dst, &sel.dport, &sel.dport_mask);
ts2ports(src, &sel.sport, &sel.sport_mask);
- if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) &&
+ if (sel.proto == IPPROTO_GRE)
+ {
+ sel.sport = htons(src->get_from_port(src));
+ sel.dport = htons(src->get_to_port(src));
+ sel.sport_mask = ~0;
+ sel.dport_mask = ~0;
+ if (sel.sport == htons(0) && sel.dport == htons(0xffff))
+ {
+ sel.sport = sel.dport = sel.sport_mask = sel.dport_mask = 0;
+ }
+ }
+ else if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) &&
(sel.dport || sel.sport))
{
/* the kernel expects the ICMP type and code in the source and
@@ -893,7 +904,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
{
u_char *addr;
uint8_t prefixlen;
- uint16_t port = 0;
+ uint16_t from_port = 0, to_port = 65535;
host_t *host = NULL;
if (src)
@@ -902,7 +913,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
prefixlen = sel->prefixlen_s;
if (sel->sport_mask)
{
- port = ntohs(sel->sport);
+ from_port = to_port = ntohs(sel->sport);
}
}
else
@@ -911,14 +922,27 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
prefixlen = sel->prefixlen_d;
if (sel->dport_mask)
{
- port = ntohs(sel->dport);
+ from_port = to_port = ntohs(sel->dport);
+ }
+ }
+ if (sel->proto == IPPROTO_GRE)
+ {
+ if (sel->sport_mask)
+ {
+ from_port = ntohs(sel->sport);
+ to_port = ntohs(sel->dport);
+ }
+ else
+ {
+ from_port = 0;
+ to_port = 0xffff;
}
}
- if (sel->proto == IPPROTO_ICMP || sel->proto == IPPROTO_ICMPV6)
+ else if (sel->proto == IPPROTO_ICMP || sel->proto == IPPROTO_ICMPV6)
{ /* convert ICMP[v6] message type and code as supplied by the kernel in
* source and destination ports (both in network order) */
- port = (sel->sport >> 8) | (sel->dport & 0xff00);
- port = ntohs(port);
+ from_port = (sel->sport >> 8) | (sel->dport & 0xff00);
+ from_port = to_port = ntohs(from_port);
}
/* The Linux 2.6 kernel does not set the selector's family field,
* so as a kludge we additionally test the prefix length.
@@ -935,7 +959,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
if (host)
{
return traffic_selector_create_from_subnet(host, prefixlen,
- sel->proto, port, port ?: 65535);
+ sel->proto, from_port, to_port);
}
return NULL;
}
diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index 8cdb5ef48..a81949c09 100644
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -936,6 +936,11 @@ static bool parse_protoport(char *token, uint16_t *from_port,
*from_port = 0xffff;
*to_port = 0;
}
+ else if (*port && *protocol == IPPROTO_GRE)
+ {
+ p = strtol(port, &endptr, 0);
+ traffic_selector_split_grekey(p, from_port, to_port);
+ }
else if (*port)
{
svc = getservbyname(port, NULL);
diff --git a/src/libcharon/plugins/unity/unity_narrow.c b/src/libcharon/plugins/unity/unity_narrow.c
index afbd6cc7e..911fe70c6 100644
--- a/src/libcharon/plugins/unity/unity_narrow.c
+++ b/src/libcharon/plugins/unity/unity_narrow.c
@@ -248,7 +248,7 @@ METHOD(listener_t, message, bool,
if (!first)
{
id_payload = (id_payload_t*)payload;
- tsr = id_payload->get_ts(id_payload);
+ tsr = id_payload->get_ts(id_payload, NULL, FALSE);
break;
}
first = FALSE;
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index f0fd8a989..9f9dcfa45 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -691,8 +691,13 @@ CALLBACK(parse_ts, bool,
}
else if (*port && !streq(port, "any"))
{
- svc = getservbyname(port, NULL);
- if (svc)
+ if (proto == IPPROTO_GRE)
+ {
+ p = strtol(port, &end, 0);
+ if (*end) return FALSE;
+ traffic_selector_split_grekey(p, &from, &to);
+ }
+ else if ((svc = getservbyname(port, NULL)) != NULL)
{
from = to = ntohs(svc->s_port);
}
diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c
index b0a42b8bd..4ef4bf324 100644
--- a/src/libcharon/sa/ikev1/tasks/quick_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c
@@ -567,9 +567,9 @@ static void add_ts(private_quick_mode_t *this, message_t *message)
{
id_payload_t *id_payload;
- id_payload = id_payload_create_from_ts(this->tsi);
+ id_payload = id_payload_create_from_ts(this->tsi, TRUE);
message->add_payload(message, &id_payload->payload_interface);
- id_payload = id_payload_create_from_ts(this->tsr);
+ id_payload = id_payload_create_from_ts(this->tsr, FALSE);
message->add_payload(message, &id_payload->payload_interface);
}
@@ -580,7 +580,7 @@ static bool get_ts(private_quick_mode_t *this, message_t *message)
{
traffic_selector_t *tsi = NULL, *tsr = NULL;
enumerator_t *enumerator;
- id_payload_t *id_payload;
+ id_payload_t *idi = NULL, *idr = NULL;
payload_t *payload;
host_t *hsi, *hsr;
bool first = TRUE;
@@ -590,20 +590,22 @@ static bool get_ts(private_quick_mode_t *this, message_t *message)
{
if (payload->get_type(payload) == PLV1_ID)
{
- id_payload = (id_payload_t*)payload;
-
if (first)
{
- tsi = id_payload->get_ts(id_payload);
+ idi = (id_payload_t*)payload;
first = FALSE;
}
else
{
- tsr = id_payload->get_ts(id_payload);
+ idr = (id_payload_t*)payload;
break;
}
}
}
+ if (idi && idr) {
+ tsi = idi->get_ts(idi, idr, TRUE);
+ tsr = idr->get_ts(idr, idi, FALSE);
+ }
enumerator->destroy(enumerator);
/* create host2host selectors if ID payloads missing */
diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c
index cfd2b029d..d01e2ccec 100644
--- a/src/libstrongswan/selectors/traffic_selector.c
+++ b/src/libstrongswan/selectors/traffic_selector.c
@@ -198,6 +198,14 @@ static int print_icmp(printf_hook_data_t *data, uint16_t port)
return print_in_hook(data, "%d", type);
}
+/**
+ * Print GRE key
+ */
+static int print_grekey(printf_hook_data_t *data, uint16_t from_port, uint16_t to_port)
+{
+ return print_in_hook(data, "%d", traffic_selector_grekey(from_port, to_port));
+}
+
/**
* Described in header.
*/
@@ -303,7 +311,11 @@ int traffic_selector_printf_hook(printf_hook_data_t *data,
{
written += print_in_hook(data, "/");
- if (this->from_port == this->to_port)
+ if (this->protocol == IPPROTO_GRE)
+ {
+ written += print_grekey(data, this->from_port, this->to_port);
+ }
+ else if (this->from_port == this->to_port)
{
struct servent *serv;
@@ -377,7 +389,24 @@ METHOD(traffic_selector_t, get_subset, traffic_selector_t*,
/* select protocol, which is not zero */
protocol = max(this->protocol, other->protocol);
- if ((is_opaque(this) && is_opaque(other)) ||
+ if (this->protocol == IPPROTO_GRE)
+ {
+ if (is_any(this))
+ {
+ from_port = other->from_port;
+ to_port = other->to_port;
+ }
+ else if (is_any(other) ||
+ (this->from_port == other->from_port &&
+ this->to_port == other->to_port))
+ {
+ from_port = this->from_port;
+ to_port = this->to_port;
+ }
+ else
+ return NULL;
+ }
+ else if ((is_opaque(this) && is_opaque(other)) ||
(is_opaque(this) && is_any(other)) ||
(is_opaque(other) && is_any(this)))
{
diff --git a/src/libstrongswan/selectors/traffic_selector.h b/src/libstrongswan/selectors/traffic_selector.h
index 03f7a6d8c..b27ca4ad1 100644
--- a/src/libstrongswan/selectors/traffic_selector.h
+++ b/src/libstrongswan/selectors/traffic_selector.h
@@ -120,6 +120,9 @@ struct traffic_selector_t {
* 8 bits and the code in the least significant 8 bits. Use the utility
* functions to extract them.
*
+ * If the protocol is GRE, the high 16-bits of the 32-bit GRE key is stored
+ * in the from port. Use the utility function to merge and split them.
+ *
* @return port
*/
uint16_t (*get_from_port)(traffic_selector_t *this);
@@ -134,6 +137,9 @@ struct traffic_selector_t {
* 8 bits and the code in the least significant 8 bits. Use the utility
* functions to extract them.
*
+ * If the protocol is GRE, the low 16-bits of the 32-bit GRE key is stored
+ * in the to port. Use the utility function to merge and split them.
+ *
* @return port
*/
uint16_t (*get_to_port)(traffic_selector_t *this);
@@ -277,6 +283,31 @@ static inline uint8_t traffic_selector_icmp_code(uint16_t port)
int traffic_selector_cmp(traffic_selector_t *a, traffic_selector_t *b,
void *opts);
+/**
+ * Reconstruct the 32-bit GRE KEY in host order from a from/to ports.
+ *
+ * @param from_port port number in host order
+ * @param to_port port number in host order
+ * @return GRE KEY in host order
+ */
+static inline uint32_t traffic_selector_grekey(uint16_t from_port, uint16_t to_port)
+{
+ return (from_port << 16) | to_port;
+}
+
+/**
+ * Split 32-bit GRE KEY in host order to from/to ports.
+ *
+ * @param grekey grekey in host order
+ * @param from_port from port in host order
+ * @param to_port to port in host order
+ */
+static inline void traffic_selector_split_grekey(uint32_t grekey, uint16_t *from_port, uint16_t *to_port)
+{
+ *from_port = grekey >> 16;
+ *to_port = grekey & 0xffff;
+}
+
/**
* Create a new traffic selector using human readable params.
*
--
2.24.1

15
strongswan.spec
View File

@@ -11,6 +11,13 @@ Source0: http://download.strongswan.org/%{name}-%{version}%{?prerelease}.
Patch1: strongswan-5.6.0-uintptr_t.patch
Patch3: strongswan-5.6.2-CVE-2018-5388.patch
Patch10: 0001-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch
Patch11: 0002-charon-add-optional-source-and-remote-overrides-for-.patch
Patch12: 0003-vici-send-certificates-for-ike-sa-events.patch
Patch13: 0004-vici-add-support-for-individual-sa-state-changes.patch
Patch14: 0005-vici-add-deprecated-async-parameter.patch
Patch15: 0006-support-gre-key-in-ikev1.patch
# only needed for pre-release versions
#BuildRequires: autoconf automake
@@ -81,6 +88,14 @@ PT-TLS to support TNC over TLS.
%patch1 -p1
%patch3 -p1
%patch10 -p1
%patch11 -p1
%patch12 -p1
%patch13 -p1
%patch14 -p1
%patch15 -p1
%build
# only for snapshots
#autoreconf