diff --git a/0001-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch b/0001-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch new file mode 100644 index 0000000..e6f9b29 --- /dev/null +++ b/0001-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch @@ -0,0 +1,105 @@ +From 2ac05d5d77446a518d808a41ed628fbe66966335 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 17 Jul 2015 11:53:58 +0200 +Subject: [PATCH 1/7] ike: Adhere to IKE_SA limit when checking out by config + +This prevents new SAs from getting created if we hit the global IKE_SA +limit (we still allow checkout_new(), which is used for rekeying). +--- + src/libcharon/sa/ike_sa_manager.c | 73 ++++++++++++++++--------------- + 1 file changed, 38 insertions(+), 35 deletions(-) + +diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c +index f95ff19af..1e0ae42fe 100644 +--- a/src/libcharon/sa/ike_sa_manager.c ++++ b/src/libcharon/sa/ike_sa_manager.c +@@ -1434,48 +1434,51 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + + DBG2(DBG_MGR, "checkout IKE_SA by config"); + +- if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1) +- { /* IKE_SA reuse disabled by config (not possible for IKEv1) */ +- ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE); +- charon->bus->set_sa(charon->bus, ike_sa); +- goto out; +- } +- +- enumerator = create_table_enumerator(this); +- while (enumerator->enumerate(enumerator, &entry, &segment)) ++ if (this->reuse_ikesa || peer_cfg->get_ike_version(peer_cfg) == IKEV1) + { +- if (!wait_for_entry(this, entry, segment)) ++ enumerator = create_table_enumerator(this); ++ while (enumerator->enumerate(enumerator, &entry, &segment)) + { +- continue; +- } +- if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING || +- entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED) +- { /* skip IKE_SAs which are not usable, wake other waiting threads */ ++ if (!wait_for_entry(this, entry, segment)) ++ { ++ continue; ++ } ++ if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING || ++ entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED) ++ { /* skip IKE_SAs which are not usable, wake other waiting threads */ ++ entry->condvar->signal(entry->condvar); ++ continue; ++ } ++ current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); ++ if (current_peer && current_peer->equals(current_peer, peer_cfg)) ++ { ++ current_ike = current_peer->get_ike_cfg(current_peer); ++ if (current_ike->equals(current_ike, ++ peer_cfg->get_ike_cfg(peer_cfg))) ++ { ++ entry->checked_out = thread_current(); ++ ike_sa = entry->ike_sa; ++ DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config", ++ ike_sa->get_unique_id(ike_sa), ++ current_peer->get_name(current_peer)); ++ break; ++ } ++ } ++ /* other threads might be waiting for this entry */ + entry->condvar->signal(entry->condvar); +- continue; + } +- +- current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); +- if (current_peer && current_peer->equals(current_peer, peer_cfg)) +- { +- current_ike = current_peer->get_ike_cfg(current_peer); +- if (current_ike->equals(current_ike, peer_cfg->get_ike_cfg(peer_cfg))) +- { +- entry->checked_out = thread_current(); +- ike_sa = entry->ike_sa; +- DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config", +- ike_sa->get_unique_id(ike_sa), +- current_peer->get_name(current_peer)); +- break; +- } +- } +- /* other threads might be waiting for this entry */ +- entry->condvar->signal(entry->condvar); ++ enumerator->destroy(enumerator); + } +- enumerator->destroy(enumerator); + + if (!ike_sa) +- { /* no IKE_SA using such a config, hand out a new */ ++ { /* no IKE_SA using such a config, or reuse disabled, hand out a new */ ++ if (this->ikesa_limit && ++ this->public.get_count(&this->public) >= this->ikesa_limit) ++ { ++ DBG1(DBG_MGR, "IKE_SA creation failed, hitting IKE_SA limit (%u)", ++ this->ikesa_limit); ++ return NULL; ++ } + ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE); + } + charon->bus->set_sa(charon->bus, ike_sa); +-- +2.25.4 + diff --git a/0002-charon-add-optional-source-and-remote-overrides-for-.patch b/0002-charon-add-optional-source-and-remote-overrides-for-.patch new file mode 100644 index 0000000..b47682e --- /dev/null +++ b/0002-charon-add-optional-source-and-remote-overrides-for-.patch @@ -0,0 +1,596 @@ +From caa6f2744717e3c3bd9b0e0fa4feff449a780ccf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= +Date: Mon, 21 Sep 2015 13:41:58 +0300 +Subject: [PATCH 2/7] charon: add optional source and remote overrides for + initiate +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This introduces support for specifying optional IKE SA specific +source and remote address for child sa initiation. This allows +to initiate wildcard connection for known address via vici. + +In addition this allows impler implementation of trap-any patches +and is a prerequisite for dmvpn support. + +Signed-off-by: Timo Teräs +--- + src/charon-cmd/cmd/cmd_connection.c | 2 +- + src/charon-nm/nm/nm_service.c | 2 +- + src/libcharon/control/controller.c | 43 +++++++++++++- + src/libcharon/control/controller.h | 3 + + src/libcharon/plugins/stroke/stroke_control.c | 5 +- + src/libcharon/plugins/vici/vici_config.c | 2 +- + src/libcharon/plugins/vici/vici_control.c | 59 +++++++++++++++++-- + .../processing/jobs/start_action_job.c | 2 +- + src/libcharon/sa/ike_sa_manager.c | 51 +++++++++++++++- + src/libcharon/sa/ike_sa_manager.h | 8 ++- + src/libcharon/sa/trap_manager.c | 49 +++++++-------- + src/swanctl/commands/initiate.c | 40 ++++++++++++- + 12 files changed, 219 insertions(+), 47 deletions(-) + +diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c +index b91c89830..55f8d224f 100644 +--- a/src/charon-cmd/cmd/cmd_connection.c ++++ b/src/charon-cmd/cmd/cmd_connection.c +@@ -439,7 +439,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this) + child_cfg = create_child_cfg(this, peer_cfg); + + if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg, +- controller_cb_empty, NULL, 0, FALSE) != SUCCESS) ++ NULL, NULL, controller_cb_empty, NULL, 0, FALSE) != SUCCESS) + { + terminate(pid); + } +diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c +index dba12764d..8b27e61e4 100644 +--- a/src/charon-nm/nm/nm_service.c ++++ b/src/charon-nm/nm/nm_service.c +@@ -849,7 +849,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection, + * Prepare IKE_SA + */ + ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, +- peer_cfg); ++ peer_cfg, NULL, NULL); + if (!ike_sa) + { + peer_cfg->destroy(peer_cfg); +diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c +index 0c86275e2..baa83f440 100644 +--- a/src/libcharon/control/controller.c ++++ b/src/libcharon/control/controller.c +@@ -15,6 +15,28 @@ + * for more details. + */ + ++/* ++ * Copyright (C) 2014 Timo Teräs ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a copy ++ * of this software and associated documentation files (the "Software"), to deal ++ * in the Software without restriction, including without limitation the rights ++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell ++ * copies of the Software, and to permit persons to whom the Software is ++ * furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, ++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN ++ * THE SOFTWARE. ++ */ ++ + #include "controller.h" + + #include +@@ -102,6 +124,16 @@ struct interface_listener_t { + */ + ike_sa_t *ike_sa; + ++ /** ++ * Our host hint. ++ */ ++ host_t *my_host; ++ ++ /** ++ * Other host hint. ++ */ ++ host_t *other_host; ++ + /** + * unique ID, used for various methods + */ +@@ -414,9 +446,14 @@ METHOD(job_t, initiate_execute, job_requeue_t, + ike_sa_t *ike_sa; + interface_listener_t *listener = &job->listener; + peer_cfg_t *peer_cfg = listener->peer_cfg; ++ host_t *my_host = listener->my_host; ++ host_t *other_host = listener->other_host; + + ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, +- peer_cfg); ++ peer_cfg, my_host, other_host); ++ DESTROY_IF(my_host); ++ DESTROY_IF(other_host); ++ + if (!ike_sa) + { + DESTROY_IF(listener->child_cfg); +@@ -425,6 +462,7 @@ METHOD(job_t, initiate_execute, job_requeue_t, + listener_done(listener); + return JOB_REQUEUE_NONE; + } ++ + listener->lock->lock(listener->lock); + listener->ike_sa = ike_sa; + listener->lock->unlock(listener->lock); +@@ -497,6 +535,7 @@ METHOD(job_t, initiate_execute, job_requeue_t, + + METHOD(controller_t, initiate, status_t, + private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, ++ host_t *my_host, host_t *other_host, + controller_cb_t callback, void *param, u_int timeout, bool limits) + { + interface_job_t *job; +@@ -519,6 +558,8 @@ METHOD(controller_t, initiate, status_t, + .status = FAILED, + .child_cfg = child_cfg, + .peer_cfg = peer_cfg, ++ .my_host = my_host ? my_host->clone(my_host) : NULL, ++ .other_host = other_host ? other_host->clone(other_host) : NULL, + .lock = spinlock_create(), + .options.limits = limits, + }, +diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h +index b4ccfced2..9945b78ad 100644 +--- a/src/libcharon/control/controller.h ++++ b/src/libcharon/control/controller.h +@@ -79,6 +79,8 @@ struct controller_t { + * + * @param peer_cfg peer_cfg to use for IKE_SA setup + * @param child_cfg optional child_cfg to set up CHILD_SA from ++ * @param my_host optional address hint for source ++ * @param other_host optional address hint for destination + * @param cb logging callback + * @param param parameter to include in each call of cb + * @param timeout timeout in ms to wait for callbacks, 0 to disable +@@ -92,6 +94,7 @@ struct controller_t { + */ + status_t (*initiate)(controller_t *this, + peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, ++ host_t *my_host, host_t *other_host, + controller_cb_t callback, void *param, u_int timeout, + bool limits); + +diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c +index 8d84b934e..b00d0e62d 100644 +--- a/src/libcharon/plugins/stroke/stroke_control.c ++++ b/src/libcharon/plugins/stroke/stroke_control.c +@@ -108,7 +108,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg + if (msg->output_verbosity < 0) + { + charon->controller->initiate(charon->controller, peer_cfg, child_cfg, +- NULL, NULL, 0, FALSE); ++ NULL, NULL, NULL, NULL, 0, FALSE); + } + else + { +@@ -116,7 +116,8 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg + status_t status; + + status = charon->controller->initiate(charon->controller, +- peer_cfg, child_cfg, (controller_cb_t)stroke_log, ++ peer_cfg, child_cfg, NULL, NULL, ++ (controller_cb_t)stroke_log, + &info, this->timeout, FALSE); + switch (status) + { +diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c +index eb679290d..81f2970ae 100644 +--- a/src/libcharon/plugins/vici/vici_config.c ++++ b/src/libcharon/plugins/vici/vici_config.c +@@ -2136,7 +2136,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg, + DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg)); + charon->controller->initiate(charon->controller, + peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg), +- NULL, NULL, 0, FALSE); ++ NULL, NULL, NULL, NULL, 0, FALSE); + break; + case ACTION_ROUTE: + DBG1(DBG_CFG, "installing '%s'", child_cfg->get_name(child_cfg)); +diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c +index 4c09b578d..1e8e788c3 100644 +--- a/src/libcharon/plugins/vici/vici_control.c ++++ b/src/libcharon/plugins/vici/vici_control.c +@@ -16,6 +16,28 @@ + * for more details. + */ + ++/* ++ * Copyright (C) 2014 Timo Teräs ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a copy ++ * of this software and associated documentation files (the "Software"), to deal ++ * in the Software without restriction, including without limitation the rights ++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell ++ * copies of the Software, and to permit persons to whom the Software is ++ * furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, ++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN ++ * THE SOFTWARE. ++ */ ++ + #include "vici_control.h" + #include "vici_builder.h" + +@@ -177,6 +199,9 @@ CALLBACK(initiate, vici_message_t*, + peer_cfg_t *peer_cfg = NULL; + child_cfg_t *child_cfg; + char *child, *ike, *type, *sa; ++ char *my_host_str, *other_host_str; ++ vici_message_t* msg; ++ host_t *my_host = NULL, *other_host = NULL; + int timeout; + bool limits; + controller_cb_t log_cb = NULL; +@@ -190,6 +215,8 @@ CALLBACK(initiate, vici_message_t*, + timeout = request->get_int(request, 0, "timeout"); + limits = request->get_bool(request, FALSE, "init-limits"); + log.level = request->get_int(request, 1, "loglevel"); ++ my_host_str = request->get_str(request, NULL, "my-host"); ++ other_host_str = request->get_str(request, NULL, "other-host"); + + if (!child && !ike) + { +@@ -203,6 +230,17 @@ CALLBACK(initiate, vici_message_t*, + type = child ? "CHILD_SA" : "IKE_SA"; + sa = child ?: ike; + ++ if (my_host_str) ++ { ++ my_host = host_create_from_string(my_host_str, 0); ++ } ++ if (other_host_str) ++ { ++ other_host = host_create_from_string(other_host_str, 0); ++ } ++ ++ DBG1(DBG_CFG, "vici initiate '%s', me %H, other %H, limits %d", child, my_host, other_host, limits); ++ + child_cfg = find_child_cfg(child, ike, &peer_cfg); + + DBG1(DBG_CFG, "vici initiate %s '%s'", type, sa); +@@ -210,21 +248,30 @@ CALLBACK(initiate, vici_message_t*, + { + return send_reply(this, "%s config '%s' not found", type, sa); + } +- switch (charon->controller->initiate(charon->controller, peer_cfg, +- child_cfg, log_cb, &log, timeout, limits)) ++ switch (charon->controller->initiate(charon->controller, ++ peer_cfg, child_cfg, my_host, other_host, ++ log_cb, &log, timeout, limits)) + { + case SUCCESS: +- return send_reply(this, NULL); ++ msg = send_reply(this, NULL); ++ break; + case OUT_OF_RES: +- return send_reply(this, "%s '%s' not established after %dms", type, ++ msg = send_reply(this, "%s '%s' not established after %dms", type, + sa, timeout); ++ break; + case INVALID_STATE: +- return send_reply(this, "establishing %s '%s' not possible at the " ++ msg = send_reply(this, "establishing %s '%s' not possible at the " + "moment due to limits", type, sa); ++ break; + case FAILED: + default: +- return send_reply(this, "establishing %s '%s' failed", type, sa); ++ msg = send_reply(this, "establishing %s '%s' failed", type, sa); ++ break; + } ++ ++ if (my_host) my_host->destroy(my_host); ++ if (other_host) other_host->destroy(other_host); ++ return msg; + } + + CALLBACK(terminate, vici_message_t*, +diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c +index 3a0ed879f..e3399007b 100644 +--- a/src/libcharon/processing/jobs/start_action_job.c ++++ b/src/libcharon/processing/jobs/start_action_job.c +@@ -61,7 +61,7 @@ METHOD(job_t, execute, job_requeue_t, + charon->controller->initiate(charon->controller, + peer_cfg->get_ref(peer_cfg), + child_cfg->get_ref(child_cfg), +- NULL, NULL, 0, FALSE); ++ NULL, NULL, NULL, NULL, 0, FALSE); + break; + case ACTION_ROUTE: + DBG1(DBG_JOB, "start action: route '%s'", name); +diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c +index 1e0ae42fe..52a18e3c2 100644 +--- a/src/libcharon/sa/ike_sa_manager.c ++++ b/src/libcharon/sa/ike_sa_manager.c +@@ -17,6 +17,28 @@ + * for more details. + */ + ++/* ++ * Copyright (C) 2014 Timo Teräs ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a copy ++ * of this software and associated documentation files (the "Software"), to deal ++ * in the Software without restriction, including without limitation the rights ++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell ++ * copies of the Software, and to permit persons to whom the Software is ++ * furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, ++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN ++ * THE SOFTWARE. ++ */ ++ + #include + #include + +@@ -1423,7 +1445,8 @@ out: + } + + METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, +- private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg) ++ private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg, ++ host_t *my_host, host_t *other_host) + { + enumerator_t *enumerator; + entry_t *entry; +@@ -1432,7 +1455,17 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + ike_cfg_t *current_ike; + u_int segment; + +- DBG2(DBG_MGR, "checkout IKE_SA by config"); ++ if (my_host && my_host->get_port(my_host) == 0) ++ { ++ my_host->set_port(my_host, IKEV2_UDP_PORT); ++ } ++ if (other_host && other_host->get_port(other_host) == 0) ++ { ++ other_host->set_port(other_host, IKEV2_UDP_PORT); ++ } ++ ++ DBG2(DBG_MGR, "checkout IKE_SA by config '%s', me %H, other %H", ++ peer_cfg->get_name(peer_cfg), my_host, other_host); + + if (this->reuse_ikesa || peer_cfg->get_ike_version(peer_cfg) == IKEV1) + { +@@ -1449,6 +1482,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + entry->condvar->signal(entry->condvar); + continue; + } ++ ++ if (my_host && !my_host->ip_equals(my_host, entry->ike_sa->get_my_host(entry->ike_sa))) ++ { ++ continue; ++ } ++ if (other_host && !other_host->ip_equals(other_host, entry->ike_sa->get_other_host(entry->ike_sa))) ++ { ++ continue; ++ } ++ + current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); + if (current_peer && current_peer->equals(current_peer, peer_cfg)) + { +@@ -1480,6 +1523,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + return NULL; + } + ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE); ++ if (my_host || other_host) ++ { ++ ike_sa->update_hosts(ike_sa, my_host, other_host, TRUE); ++ } + } + charon->bus->set_sa(charon->bus, ike_sa); + +diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h +index efad2e4d6..c43edabbb 100644 +--- a/src/libcharon/sa/ike_sa_manager.h ++++ b/src/libcharon/sa/ike_sa_manager.h +@@ -93,7 +93,8 @@ struct ike_sa_manager_t { + ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message); + + /** +- * Checkout an IKE_SA for initiation by a peer_config. ++ * Checkout an IKE_SA for initiation by a peer_config and optional ++ * source and remote host addresses. + * + * To initiate, a CHILD_SA may be established within an existing IKE_SA. + * This call checks for an existing IKE_SA by comparing the configuration. +@@ -103,10 +104,13 @@ struct ike_sa_manager_t { + * the found IKE_SA is in the DELETING state. + * + * @param peer_cfg configuration used to find an existing IKE_SA ++ * @param my_host source host address for wildcard peer_cfg ++ * @param other_host remote host address for wildcard peer_cfg + * @return checked out/created IKE_SA + */ + ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this, +- peer_cfg_t *peer_cfg); ++ peer_cfg_t *peer_cfg, ++ host_t *my_host, host_t *other_host); + + /** + * Reset initiator SPI. +diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c +index 2bc531b38..7220ea597 100644 +--- a/src/libcharon/sa/trap_manager.c ++++ b/src/libcharon/sa/trap_manager.c +@@ -432,7 +432,7 @@ METHOD(trap_manager_t, acquire, void, + peer_cfg_t *peer; + child_cfg_t *child; + ike_sa_t *ike_sa; +- host_t *host; ++ host_t *host, *my_host = NULL, *other_host = NULL; + bool wildcard, ignore = FALSE; + + this->lock->read_lock(this->lock); +@@ -508,36 +508,27 @@ METHOD(trap_manager_t, acquire, void, + this->lock->unlock(this->lock); + + if (wildcard) +- { /* the peer config would match IKE_SAs with other peers */ +- ike_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, +- peer->get_ike_version(peer), TRUE); +- if (ike_sa) +- { +- ike_cfg_t *ike_cfg; +- uint16_t port; +- uint8_t mask; +- +- ike_sa->set_peer_cfg(ike_sa, peer); +- ike_cfg = ike_sa->get_ike_cfg(ike_sa); +- +- port = ike_cfg->get_other_port(ike_cfg); +- dst->to_subnet(dst, &host, &mask); +- host->set_port(host, port); +- ike_sa->set_other_host(ike_sa, host); +- +- port = ike_cfg->get_my_port(ike_cfg); +- src->to_subnet(src, &host, &mask); +- host->set_port(host, port); +- ike_sa->set_my_host(ike_sa, host); +- +- charon->bus->set_sa(charon->bus, ike_sa); +- } +- } +- else + { +- ike_sa = charon->ike_sa_manager->checkout_by_config( +- charon->ike_sa_manager, peer); ++ ike_cfg_t *ike_cfg; ++ uint16_t port; ++ uint8_t mask; ++ ++ ike_cfg = peer->get_ike_cfg(peer); ++ ++ port = ike_cfg->get_other_port(ike_cfg); ++ dst->to_subnet(dst, &other_host, &mask); ++ other_host->set_port(other_host, port); ++ ++ port = ike_cfg->get_my_port(ike_cfg); ++ src->to_subnet(src, &my_host, &mask); ++ my_host->set_port(my_host, port); + } ++ ike_sa = charon->ike_sa_manager->checkout_by_config( ++ charon->ike_sa_manager, peer, ++ my_host, other_host); ++ DESTROY_IF(my_host); ++ DESTROY_IF(other_host); ++ + if (ike_sa) + { + if (ike_sa->get_peer_cfg(ike_sa) == NULL) +diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c +index 8ade8bf41..03b2cb0f4 100644 +--- a/src/swanctl/commands/initiate.c ++++ b/src/swanctl/commands/initiate.c +@@ -13,6 +13,28 @@ + * for more details. + */ + ++/* ++ * Copyright (C) 2014 Timo Teräs ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a copy ++ * of this software and associated documentation files (the "Software"), to deal ++ * in the Software without restriction, including without limitation the rights ++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell ++ * copies of the Software, and to permit persons to whom the Software is ++ * furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, ++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN ++ * THE SOFTWARE. ++ */ ++ + #include "command.h" + + #include +@@ -37,7 +59,7 @@ static int initiate(vici_conn_t *conn) + vici_req_t *req; + vici_res_t *res; + command_format_options_t format = COMMAND_FORMAT_NONE; +- char *arg, *child = NULL, *ike = NULL; ++ char *arg, *child = NULL, *ike = NULL, *my_host = NULL, *other_host = NULL; + int ret = 0, timeout = 0, level = 1; + + while (TRUE) +@@ -64,6 +86,12 @@ static int initiate(vici_conn_t *conn) + case 'l': + level = atoi(arg); + continue; ++ case 'S': ++ my_host = arg; ++ continue; ++ case 'R': ++ other_host = arg; ++ continue; + case EOF: + break; + default: +@@ -87,6 +115,14 @@ static int initiate(vici_conn_t *conn) + { + vici_add_key_valuef(req, "ike", "%s", ike); + } ++ if (my_host) ++ { ++ vici_add_key_valuef(req, "my-host", "%s", my_host); ++ } ++ if (other_host) ++ { ++ vici_add_key_valuef(req, "other-host", "%s", other_host); ++ } + if (timeout) + { + vici_add_key_valuef(req, "timeout", "%d", timeout * 1000); +@@ -133,6 +169,8 @@ static void __attribute__ ((constructor))reg() + {"help", 'h', 0, "show usage information"}, + {"child", 'c', 1, "initiate a CHILD_SA configuration"}, + {"ike", 'i', 1, "initiate an IKE_SA, or name of child's parent"}, ++ {"source", 'S', 1, "override source address"}, ++ {"remote", 'R', 1, "override remote address"}, + {"timeout", 't', 1, "timeout in seconds before detaching"}, + {"raw", 'r', 0, "dump raw response message"}, + {"pretty", 'P', 0, "dump raw response message in pretty print"}, +-- +2.25.4 + diff --git a/0003-vici-send-certificates-for-ike-sa-events.patch b/0003-vici-send-certificates-for-ike-sa-events.patch new file mode 100644 index 0000000..616c06e --- /dev/null +++ b/0003-vici-send-certificates-for-ike-sa-events.patch @@ -0,0 +1,131 @@ +From 82293ee990d4c640bd5e33e894d44b70ad50ef79 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= +Date: Mon, 21 Sep 2015 13:42:05 +0300 +Subject: [PATCH 3/7] vici: send certificates for ike-sa events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Timo Teräs +--- + src/libcharon/plugins/vici/vici_query.c | 48 +++++++++++++++++++++---- + 1 file changed, 41 insertions(+), 7 deletions(-) + +diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c +index ad07ff12d..e3f6a0d26 100644 +--- a/src/libcharon/plugins/vici/vici_query.c ++++ b/src/libcharon/plugins/vici/vici_query.c +@@ -379,7 +379,7 @@ static void list_vips(private_vici_query_t *this, vici_builder_t *b, + * List details of an IKE_SA + */ + static void list_ike(private_vici_query_t *this, vici_builder_t *b, +- ike_sa_t *ike_sa, time_t now) ++ ike_sa_t *ike_sa, time_t now, bool add_certs) + { + time_t t; + ike_sa_id_t *id; +@@ -388,6 +388,8 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b, + uint32_t if_id; + uint16_t alg, ks; + host_t *host; ++ auth_cfg_t *auth_cfg; ++ enumerator_t *enumerator; + + b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa)); + b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa)); +@@ -397,11 +399,43 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b, + b->add_kv(b, "local-host", "%H", host); + b->add_kv(b, "local-port", "%d", host->get_port(host)); + b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa)); ++ if (add_certs) ++ { ++ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, TRUE); ++ if (enumerator->enumerate(enumerator, &auth_cfg)) ++ { ++ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT); ++ chunk_t encoding; ++ ++ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding)) ++ { ++ b->add(b, VICI_KEY_VALUE, "local-cert-data", encoding); ++ free(encoding.ptr); ++ } ++ } ++ enumerator->destroy(enumerator); ++ } + + host = ike_sa->get_other_host(ike_sa); + b->add_kv(b, "remote-host", "%H", host); + b->add_kv(b, "remote-port", "%d", host->get_port(host)); + b->add_kv(b, "remote-id", "%Y", ike_sa->get_other_id(ike_sa)); ++ if (add_certs) ++ { ++ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE); ++ if (enumerator->enumerate(enumerator, &auth_cfg)) ++ { ++ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT); ++ chunk_t encoding; ++ ++ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding)) ++ { ++ b->add(b, VICI_KEY_VALUE, "remote-cert-data", encoding); ++ free(encoding.ptr); ++ } ++ } ++ enumerator->destroy(enumerator); ++ } + + eap = ike_sa->get_other_eap_id(ike_sa); + +@@ -531,7 +565,7 @@ CALLBACK(list_sas, vici_message_t*, + b = vici_builder_create(); + b->begin_section(b, ike_sa->get_name(ike_sa)); + +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, TRUE); + + b->begin_section(b, "child-sas"); + csas = ike_sa->create_child_sa_enumerator(ike_sa); +@@ -1717,7 +1751,7 @@ METHOD(listener_t, ike_updown, bool, + } + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, up); + b->end_section(b); + + this->dispatcher->raise_event(this->dispatcher, +@@ -1742,10 +1776,10 @@ METHOD(listener_t, ike_rekey, bool, + b = vici_builder_create(); + b->begin_section(b, old->get_name(old)); + b->begin_section(b, "old"); +- list_ike(this, b, old, now); ++ list_ike(this, b, old, now, TRUE); + b->end_section(b); + b->begin_section(b, "new"); +- list_ike(this, b, new, now); ++ list_ike(this, b, new, now, TRUE); + b->end_section(b); + b->end_section(b); + +@@ -1776,7 +1810,7 @@ METHOD(listener_t, child_updown, bool, + } + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, up); + b->begin_section(b, "child-sas"); + + snprintf(buf, sizeof(buf), "%s-%u", child_sa->get_name(child_sa), +@@ -1811,7 +1845,7 @@ METHOD(listener_t, child_rekey, bool, + b = vici_builder_create(); + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, TRUE); + b->begin_section(b, "child-sas"); + + b->begin_section(b, old->get_name(old)); +-- +2.25.4 + diff --git a/0004-vici-add-support-for-individual-sa-state-changes.patch b/0004-vici-add-support-for-individual-sa-state-changes.patch new file mode 100644 index 0000000..66defa7 --- /dev/null +++ b/0004-vici-add-support-for-individual-sa-state-changes.patch @@ -0,0 +1,159 @@ +From 7df0e439a339286991dda5cc14f0eb078885401b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= +Date: Mon, 21 Sep 2015 13:42:11 +0300 +Subject: [PATCH 4/7] vici: add support for individual sa state changes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Useful for monitoring and tracking full SA. + +Signed-off-by: Timo Teräs +--- + src/libcharon/plugins/vici/vici_query.c | 105 ++++++++++++++++++++++++ + 1 file changed, 105 insertions(+) + +diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c +index e3f6a0d26..9968cdd3c 100644 +--- a/src/libcharon/plugins/vici/vici_query.c ++++ b/src/libcharon/plugins/vici/vici_query.c +@@ -1717,8 +1717,16 @@ static void manage_commands(private_vici_query_t *this, bool reg) + this->dispatcher->manage_event(this->dispatcher, "list-cert", reg); + this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg); + this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg); ++ this->dispatcher->manage_event(this->dispatcher, "ike-state-established", reg); ++ this->dispatcher->manage_event(this->dispatcher, "ike-state-destroying", reg); + this->dispatcher->manage_event(this->dispatcher, "child-updown", reg); + this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-installing", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-installed", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-updating", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-rekeying", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-rekeyed", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-destroying", reg); + manage_command(this, "list-sas", list_sas, reg); + manage_command(this, "list-policies", list_policies, reg); + manage_command(this, "list-conns", list_conns, reg); +@@ -1789,6 +1797,45 @@ METHOD(listener_t, ike_rekey, bool, + return TRUE; + } + ++METHOD(listener_t, ike_state_change, bool, ++ private_vici_query_t *this, ike_sa_t *ike_sa, ike_sa_state_t state) ++{ ++ char *event; ++ vici_builder_t *b; ++ time_t now; ++ ++ switch (state) ++ { ++ case IKE_ESTABLISHED: ++ event = "ike-state-established"; ++ break; ++ case IKE_DESTROYING: ++ event = "ike-state-destroying"; ++ break; ++ default: ++ return TRUE; ++ } ++ ++ if (!this->dispatcher->has_event_listeners(this->dispatcher, event)) ++ { ++ return TRUE; ++ } ++ ++ now = time_monotonic(NULL); ++ ++ b = vici_builder_create(); ++ b->begin_section(b, ike_sa->get_name(ike_sa)); ++ list_ike(this, b, ike_sa, now, state != IKE_DESTROYING); ++ b->begin_section(b, "child-sas"); ++ b->end_section(b); ++ b->end_section(b); ++ ++ this->dispatcher->raise_event(this->dispatcher, ++ event, 0, b->finalize(b)); ++ ++ return TRUE; ++} ++ + METHOD(listener_t, child_updown, bool, + private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up) + { +@@ -1868,6 +1915,62 @@ METHOD(listener_t, child_rekey, bool, + return TRUE; + } + ++METHOD(listener_t, child_state_change, bool, ++ private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state) ++{ ++ char *event; ++ vici_builder_t *b; ++ time_t now; ++ ++ switch (state) ++ { ++ case CHILD_INSTALLING: ++ event = "child-state-installing"; ++ break; ++ case CHILD_INSTALLED: ++ event = "child-state-installed"; ++ break; ++ case CHILD_UPDATING: ++ event = "child-state-updating"; ++ break; ++ case CHILD_REKEYING: ++ event = "child-state-rekeying"; ++ break; ++ case CHILD_REKEYED: ++ event = "child-state-rekeyed"; ++ break; ++ case CHILD_DESTROYING: ++ event = "child-state-destroying"; ++ break; ++ default: ++ return TRUE; ++ } ++ ++ if (!this->dispatcher->has_event_listeners(this->dispatcher, event)) ++ { ++ return TRUE; ++ } ++ ++ now = time_monotonic(NULL); ++ ++ b = vici_builder_create(); ++ b->begin_section(b, ike_sa->get_name(ike_sa)); ++ list_ike(this, b, ike_sa, now, state != CHILD_DESTROYING); ++ b->begin_section(b, "child-sas"); ++ ++ b->begin_section(b, child_sa->get_name(child_sa)); ++ list_child(this, b, child_sa, now); ++ b->end_section(b); ++ ++ b->end_section(b); ++ b->end_section(b); ++ ++ this->dispatcher->raise_event(this->dispatcher, ++ event, 0, b->finalize(b)); ++ ++ return TRUE; ++} ++ + METHOD(vici_query_t, destroy, void, + private_vici_query_t *this) + { +@@ -1887,8 +1990,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher) + .listener = { + .ike_updown = _ike_updown, + .ike_rekey = _ike_rekey, ++ .ike_state_change = _ike_state_change, + .child_updown = _child_updown, + .child_rekey = _child_rekey, ++ .child_state_change = _child_state_change, + }, + .destroy = _destroy, + }, +-- +2.25.4 + diff --git a/0005-vici-add-deprecated-async-parameter.patch b/0005-vici-add-deprecated-async-parameter.patch new file mode 100644 index 0000000..ce8307f --- /dev/null +++ b/0005-vici-add-deprecated-async-parameter.patch @@ -0,0 +1,49 @@ +From 467ba7f78ef3d09c27ac410f147cca66a6591a1e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= +Date: Mon, 21 Sep 2015 13:42:15 +0300 +Subject: [PATCH 5/7] vici: add (deprecated) async parameter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This is obsoleted by the new "timeout=-1" option that achieves +the same. Only for compatibility with old versions of quagga-nhrp. + +Signed-off-by: Timo Teräs +--- + src/libcharon/plugins/vici/vici_control.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c +index 1e8e788c3..12ef92334 100644 +--- a/src/libcharon/plugins/vici/vici_control.c ++++ b/src/libcharon/plugins/vici/vici_control.c +@@ -203,7 +203,7 @@ CALLBACK(initiate, vici_message_t*, + vici_message_t* msg; + host_t *my_host = NULL, *other_host = NULL; + int timeout; +- bool limits; ++ bool limits, async; + controller_cb_t log_cb = NULL; + log_info_t log = { + .dispatcher = this->dispatcher, +@@ -214,6 +214,7 @@ CALLBACK(initiate, vici_message_t*, + ike = request->get_str(request, NULL, "ike"); + timeout = request->get_int(request, 0, "timeout"); + limits = request->get_bool(request, FALSE, "init-limits"); ++ async = request->get_bool(request, FALSE, "async"); + log.level = request->get_int(request, 1, "loglevel"); + my_host_str = request->get_str(request, NULL, "my-host"); + other_host_str = request->get_str(request, NULL, "other-host"); +@@ -222,7 +223,7 @@ CALLBACK(initiate, vici_message_t*, + { + return send_reply(this, "missing configuration name"); + } +- if (timeout >= 0) ++ if (timeout >= 0 && !async) + { + log_cb = (controller_cb_t)log_vici; + } +-- +2.25.4 + diff --git a/0006-support-gre-key-in-ikev1.patch b/0006-support-gre-key-in-ikev1.patch new file mode 100644 index 0000000..ecaefae --- /dev/null +++ b/0006-support-gre-key-in-ikev1.patch @@ -0,0 +1,507 @@ +From dffd2c31828ec4d9bf9a299952a1559675816241 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= +Date: Mon, 21 Sep 2015 13:42:18 +0300 +Subject: [PATCH 6/7] support gre key in ikev1 + +this implements gre key negotiation in ikev1 similarly to the +ipsec-tools patch in alpine. + +the from/to port pair is internally used as gre key for gre +protocol traffic selectors. since from/to pairs 0/0xffff and +0xffff/0 have special meaning, the gre keys 0xffff and 0xffff0000 +will not work. + +this is not standard compliant, and should probably not be upstreamed +or used widely, but it is applied for interoperability with alpine +racoon for the time being. +--- + src/libcharon/encoding/payloads/id_payload.c | 68 ++++++++++++++----- + src/libcharon/encoding/payloads/id_payload.h | 6 +- + .../kernel_netlink/kernel_netlink_ipsec.c | 40 ++++++++--- + src/libcharon/plugins/stroke/stroke_config.c | 5 ++ + src/libcharon/plugins/unity/unity_narrow.c | 2 +- + src/libcharon/plugins/vici/vici_config.c | 9 ++- + src/libcharon/sa/ikev1/tasks/quick_mode.c | 16 +++-- + .../selectors/traffic_selector.c | 33 ++++++++- + .../selectors/traffic_selector.h | 31 +++++++++ + 9 files changed, 171 insertions(+), 39 deletions(-) + +diff --git a/src/libcharon/encoding/payloads/id_payload.c b/src/libcharon/encoding/payloads/id_payload.c +index b2f1adbbc..6b44d0cf6 100644 +--- a/src/libcharon/encoding/payloads/id_payload.c ++++ b/src/libcharon/encoding/payloads/id_payload.c +@@ -245,18 +245,20 @@ METHOD(id_payload_t, get_identification, identification_t*, + * Create a traffic selector from an range ID + */ + static traffic_selector_t *get_ts_from_range(private_id_payload_t *this, +- ts_type_t type) ++ ts_type_t type, ++ uint16_t from_port, uint16_t to_port) + { + return traffic_selector_create_from_bytes(this->protocol_id, type, +- chunk_create(this->id_data.ptr, this->id_data.len / 2), this->port, +- chunk_skip(this->id_data, this->id_data.len / 2), this->port ?: 65535); ++ chunk_create(this->id_data.ptr, this->id_data.len / 2), from_port, ++ chunk_skip(this->id_data, this->id_data.len / 2), to_port); + } + + /** + * Create a traffic selector from an subnet ID + */ + static traffic_selector_t *get_ts_from_subnet(private_id_payload_t *this, +- ts_type_t type) ++ ts_type_t type, ++ uint16_t from_port, uint16_t to_port) + { + traffic_selector_t *ts; + chunk_t net, netmask; +@@ -269,7 +271,7 @@ static traffic_selector_t *get_ts_from_subnet(private_id_payload_t *this, + netmask.ptr[i] = (netmask.ptr[i] ^ 0xFF) | net.ptr[i]; + } + ts = traffic_selector_create_from_bytes(this->protocol_id, type, +- net, this->port, netmask, this->port ?: 65535); ++ net, from_port, netmask, to_port); + chunk_free(&netmask); + return ts; + } +@@ -278,51 +280,76 @@ static traffic_selector_t *get_ts_from_subnet(private_id_payload_t *this, + * Create a traffic selector from an IP ID + */ + static traffic_selector_t *get_ts_from_ip(private_id_payload_t *this, +- ts_type_t type) ++ ts_type_t type, ++ uint16_t from_port, uint16_t to_port) + { + return traffic_selector_create_from_bytes(this->protocol_id, type, +- this->id_data, this->port, this->id_data, this->port ?: 65535); ++ this->id_data, from_port, this->id_data, to_port); + } + + METHOD(id_payload_t, get_ts, traffic_selector_t*, +- private_id_payload_t *this) ++ private_id_payload_t *this, id_payload_t *other_, bool initiator) + { ++ private_id_payload_t *other = (private_id_payload_t *) other_; ++ uint16_t from_port, to_port; ++ ++ if (other && this->protocol_id == IPPROTO_GRE && other->protocol_id == IPPROTO_GRE) ++ { ++ if (initiator) ++ { ++ from_port = this->port; ++ to_port = other->port; ++ } ++ else ++ { ++ from_port = other->port; ++ to_port = this->port; ++ } ++ if (from_port == 0 && to_port == 0) ++ to_port = 0xffff; ++ } ++ else ++ { ++ from_port = this->port; ++ to_port = this->port ?: 0xffff; ++ } ++ + switch (this->id_type) + { + case ID_IPV4_ADDR_SUBNET: + if (this->id_data.len == 8) + { +- return get_ts_from_subnet(this, TS_IPV4_ADDR_RANGE); ++ return get_ts_from_subnet(this, TS_IPV4_ADDR_RANGE, from_port, to_port); + } + break; + case ID_IPV6_ADDR_SUBNET: + if (this->id_data.len == 32) + { +- return get_ts_from_subnet(this, TS_IPV6_ADDR_RANGE); ++ return get_ts_from_subnet(this, TS_IPV6_ADDR_RANGE, from_port, to_port); + } + break; + case ID_IPV4_ADDR_RANGE: + if (this->id_data.len == 8) + { +- return get_ts_from_range(this, TS_IPV4_ADDR_RANGE); ++ return get_ts_from_range(this, TS_IPV4_ADDR_RANGE, from_port, to_port); + } + break; + case ID_IPV6_ADDR_RANGE: + if (this->id_data.len == 32) + { +- return get_ts_from_range(this, TS_IPV6_ADDR_RANGE); ++ return get_ts_from_range(this, TS_IPV6_ADDR_RANGE, from_port, to_port); + } + break; + case ID_IPV4_ADDR: + if (this->id_data.len == 4) + { +- return get_ts_from_ip(this, TS_IPV4_ADDR_RANGE); ++ return get_ts_from_ip(this, TS_IPV4_ADDR_RANGE, from_port, to_port); + } + break; + case ID_IPV6_ADDR: + if (this->id_data.len == 16) + { +- return get_ts_from_ip(this, TS_IPV6_ADDR_RANGE); ++ return get_ts_from_ip(this, TS_IPV6_ADDR_RANGE, from_port, to_port); + } + break; + default: +@@ -397,7 +424,7 @@ id_payload_t *id_payload_create_from_identification(payload_type_t type, + /* + * Described in header. + */ +-id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts) ++id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts, bool initiator) + { + private_id_payload_t *this; + uint8_t mask; +@@ -460,8 +487,17 @@ id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts) + ts->get_from_address(ts), ts->get_to_address(ts)); + net->destroy(net); + } +- this->port = ts->get_from_port(ts); + this->protocol_id = ts->get_protocol(ts); ++ if (initiator || this->protocol_id != IPPROTO_GRE) ++ { ++ this->port = ts->get_from_port(ts); ++ } ++ else ++ { ++ this->port = ts->get_to_port(ts); ++ if (this->port == 0xffff && ts->get_from_port(ts) == 0) ++ this->port = 0; ++ } + this->payload_length += this->id_data.len; + + return &this->public; +diff --git a/src/libcharon/encoding/payloads/id_payload.h b/src/libcharon/encoding/payloads/id_payload.h +index 044268180..1e2306b16 100644 +--- a/src/libcharon/encoding/payloads/id_payload.h ++++ b/src/libcharon/encoding/payloads/id_payload.h +@@ -48,11 +48,11 @@ struct id_payload_t { + identification_t *(*get_identification) (id_payload_t *this); + + /** +- * Creates a traffic selector form a ID_ADDR_SUBNET/RANGE identity. ++ * Creates a traffic selector form a ID_ADDR_SUBNET/RANGE identity pair. + * + * @return traffic selector, NULL on failure + */ +- traffic_selector_t* (*get_ts)(id_payload_t *this); ++ traffic_selector_t* (*get_ts)(id_payload_t *this, id_payload_t *other, bool initiator); + + /** + * Get encoded payload without fixed payload header (used for IKEv1). +@@ -91,6 +91,6 @@ id_payload_t *id_payload_create_from_identification(payload_type_t type, + * @param ts traffic selector + * @return PLV1_ID id_payload_t object. + */ +-id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts); ++id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts, bool initiator); + + #endif /** ID_PAYLOAD_H_ @}*/ +diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c +index ef0d424bd..a0948f7c0 100644 +--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c ++++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c +@@ -814,7 +814,18 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src, + ts2subnet(src, &sel.saddr, &sel.prefixlen_s); + ts2ports(dst, &sel.dport, &sel.dport_mask); + ts2ports(src, &sel.sport, &sel.sport_mask); +- if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) && ++ if (sel.proto == IPPROTO_GRE) ++ { ++ sel.sport = htons(src->get_from_port(src)); ++ sel.dport = htons(src->get_to_port(src)); ++ sel.sport_mask = ~0; ++ sel.dport_mask = ~0; ++ if (sel.sport == htons(0) && sel.dport == htons(0xffff)) ++ { ++ sel.sport = sel.dport = sel.sport_mask = sel.dport_mask = 0; ++ } ++ } ++ else if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) && + (sel.dport || sel.sport)) + { + /* the kernel expects the ICMP type and code in the source and +@@ -838,7 +849,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src) + { + u_char *addr; + uint8_t prefixlen; +- uint16_t port = 0; ++ uint16_t from_port = 0, to_port = 65535; + host_t *host = NULL; + + if (src) +@@ -847,7 +858,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src) + prefixlen = sel->prefixlen_s; + if (sel->sport_mask) + { +- port = ntohs(sel->sport); ++ from_port = to_port = ntohs(sel->sport); + } + } + else +@@ -856,14 +867,27 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src) + prefixlen = sel->prefixlen_d; + if (sel->dport_mask) + { +- port = ntohs(sel->dport); ++ from_port = to_port = ntohs(sel->dport); + } + } +- if (sel->proto == IPPROTO_ICMP || sel->proto == IPPROTO_ICMPV6) ++ if (sel->proto == IPPROTO_GRE) ++ { ++ if (sel->sport_mask) ++ { ++ from_port = ntohs(sel->sport); ++ to_port = ntohs(sel->dport); ++ } ++ else ++ { ++ from_port = 0; ++ to_port = 0xffff; ++ } ++ } ++ else if (sel->proto == IPPROTO_ICMP || sel->proto == IPPROTO_ICMPV6) + { /* convert ICMP[v6] message type and code as supplied by the kernel in + * source and destination ports (both in network order) */ +- port = (sel->sport >> 8) | (sel->dport & 0xff00); +- port = ntohs(port); ++ from_port = (sel->sport >> 8) | (sel->dport & 0xff00); ++ from_port = to_port = ntohs(from_port); + } + /* The Linux 2.6 kernel does not set the selector's family field, + * so as a kludge we additionally test the prefix length. +@@ -880,7 +904,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src) + if (host) + { + return traffic_selector_create_from_subnet(host, prefixlen, +- sel->proto, port, port ?: 65535); ++ sel->proto, from_port, to_port); + } + return NULL; + } +diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c +index 175b6b549..db3e558f6 100644 +--- a/src/libcharon/plugins/stroke/stroke_config.c ++++ b/src/libcharon/plugins/stroke/stroke_config.c +@@ -936,6 +936,11 @@ static bool parse_protoport(char *token, uint16_t *from_port, + *from_port = 0xffff; + *to_port = 0; + } ++ else if (*port && *protocol == IPPROTO_GRE) ++ { ++ p = strtol(port, &endptr, 0); ++ traffic_selector_split_grekey(p, from_port, to_port); ++ } + else if (*port) + { + svc = getservbyname(port, NULL); +diff --git a/src/libcharon/plugins/unity/unity_narrow.c b/src/libcharon/plugins/unity/unity_narrow.c +index afbd6cc7e..911fe70c6 100644 +--- a/src/libcharon/plugins/unity/unity_narrow.c ++++ b/src/libcharon/plugins/unity/unity_narrow.c +@@ -248,7 +248,7 @@ METHOD(listener_t, message, bool, + if (!first) + { + id_payload = (id_payload_t*)payload; +- tsr = id_payload->get_ts(id_payload); ++ tsr = id_payload->get_ts(id_payload, NULL, FALSE); + break; + } + first = FALSE; +diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c +index 81f2970ae..92ab77a00 100644 +--- a/src/libcharon/plugins/vici/vici_config.c ++++ b/src/libcharon/plugins/vici/vici_config.c +@@ -709,8 +709,13 @@ CALLBACK(parse_ts, bool, + } + else if (*port && !streq(port, "any")) + { +- svc = getservbyname(port, NULL); +- if (svc) ++ if (proto == IPPROTO_GRE) ++ { ++ p = strtol(port, &end, 0); ++ if (*end) return FALSE; ++ traffic_selector_split_grekey(p, &from, &to); ++ } ++ else if ((svc = getservbyname(port, NULL)) != NULL) + { + from = to = ntohs(svc->s_port); + } +diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c +index 50c280fe5..049da8847 100644 +--- a/src/libcharon/sa/ikev1/tasks/quick_mode.c ++++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c +@@ -552,9 +552,9 @@ static void add_ts(private_quick_mode_t *this, message_t *message) + { + id_payload_t *id_payload; + +- id_payload = id_payload_create_from_ts(this->tsi); ++ id_payload = id_payload_create_from_ts(this->tsi, TRUE); + message->add_payload(message, &id_payload->payload_interface); +- id_payload = id_payload_create_from_ts(this->tsr); ++ id_payload = id_payload_create_from_ts(this->tsr, FALSE); + message->add_payload(message, &id_payload->payload_interface); + } + +@@ -565,7 +565,7 @@ static bool get_ts(private_quick_mode_t *this, message_t *message) + { + traffic_selector_t *tsi = NULL, *tsr = NULL; + enumerator_t *enumerator; +- id_payload_t *id_payload; ++ id_payload_t *idi = NULL, *idr = NULL; + payload_t *payload; + host_t *hsi, *hsr; + bool first = TRUE; +@@ -575,20 +575,22 @@ static bool get_ts(private_quick_mode_t *this, message_t *message) + { + if (payload->get_type(payload) == PLV1_ID) + { +- id_payload = (id_payload_t*)payload; +- + if (first) + { +- tsi = id_payload->get_ts(id_payload); ++ idi = (id_payload_t*)payload; + first = FALSE; + } + else + { +- tsr = id_payload->get_ts(id_payload); ++ idr = (id_payload_t*)payload; + break; + } + } + } ++ if (idi && idr) { ++ tsi = idi->get_ts(idi, idr, TRUE); ++ tsr = idr->get_ts(idr, idi, FALSE); ++ } + enumerator->destroy(enumerator); + + /* create host2host selectors if ID payloads missing */ +diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c +index cfd2b029d..d01e2ccec 100644 +--- a/src/libstrongswan/selectors/traffic_selector.c ++++ b/src/libstrongswan/selectors/traffic_selector.c +@@ -198,6 +198,14 @@ static int print_icmp(printf_hook_data_t *data, uint16_t port) + return print_in_hook(data, "%d", type); + } + ++/** ++ * Print GRE key ++ */ ++static int print_grekey(printf_hook_data_t *data, uint16_t from_port, uint16_t to_port) ++{ ++ return print_in_hook(data, "%d", traffic_selector_grekey(from_port, to_port)); ++} ++ + /** + * Described in header. + */ +@@ -303,7 +311,11 @@ int traffic_selector_printf_hook(printf_hook_data_t *data, + { + written += print_in_hook(data, "/"); + +- if (this->from_port == this->to_port) ++ if (this->protocol == IPPROTO_GRE) ++ { ++ written += print_grekey(data, this->from_port, this->to_port); ++ } ++ else if (this->from_port == this->to_port) + { + struct servent *serv; + +@@ -377,7 +389,24 @@ METHOD(traffic_selector_t, get_subset, traffic_selector_t*, + /* select protocol, which is not zero */ + protocol = max(this->protocol, other->protocol); + +- if ((is_opaque(this) && is_opaque(other)) || ++ if (this->protocol == IPPROTO_GRE) ++ { ++ if (is_any(this)) ++ { ++ from_port = other->from_port; ++ to_port = other->to_port; ++ } ++ else if (is_any(other) || ++ (this->from_port == other->from_port && ++ this->to_port == other->to_port)) ++ { ++ from_port = this->from_port; ++ to_port = this->to_port; ++ } ++ else ++ return NULL; ++ } ++ else if ((is_opaque(this) && is_opaque(other)) || + (is_opaque(this) && is_any(other)) || + (is_opaque(other) && is_any(this))) + { +diff --git a/src/libstrongswan/selectors/traffic_selector.h b/src/libstrongswan/selectors/traffic_selector.h +index 03f7a6d8c..b27ca4ad1 100644 +--- a/src/libstrongswan/selectors/traffic_selector.h ++++ b/src/libstrongswan/selectors/traffic_selector.h +@@ -120,6 +120,9 @@ struct traffic_selector_t { + * 8 bits and the code in the least significant 8 bits. Use the utility + * functions to extract them. + * ++ * If the protocol is GRE, the high 16-bits of the 32-bit GRE key is stored ++ * in the from port. Use the utility function to merge and split them. ++ * + * @return port + */ + uint16_t (*get_from_port)(traffic_selector_t *this); +@@ -134,6 +137,9 @@ struct traffic_selector_t { + * 8 bits and the code in the least significant 8 bits. Use the utility + * functions to extract them. + * ++ * If the protocol is GRE, the low 16-bits of the 32-bit GRE key is stored ++ * in the to port. Use the utility function to merge and split them. ++ * + * @return port + */ + uint16_t (*get_to_port)(traffic_selector_t *this); +@@ -277,6 +283,31 @@ static inline uint8_t traffic_selector_icmp_code(uint16_t port) + int traffic_selector_cmp(traffic_selector_t *a, traffic_selector_t *b, + void *opts); + ++/** ++ * Reconstruct the 32-bit GRE KEY in host order from a from/to ports. ++ * ++ * @param from_port port number in host order ++ * @param to_port port number in host order ++ * @return GRE KEY in host order ++ */ ++static inline uint32_t traffic_selector_grekey(uint16_t from_port, uint16_t to_port) ++{ ++ return (from_port << 16) | to_port; ++} ++ ++/** ++ * Split 32-bit GRE KEY in host order to from/to ports. ++ * ++ * @param grekey grekey in host order ++ * @param from_port from port in host order ++ * @param to_port to port in host order ++ */ ++static inline void traffic_selector_split_grekey(uint32_t grekey, uint16_t *from_port, uint16_t *to_port) ++{ ++ *from_port = grekey >> 16; ++ *to_port = grekey & 0xffff; ++} ++ + /** + * Create a new traffic selector using human readable params. + * +-- +2.25.4 + diff --git a/0007-vyos-terminate-connections-source-dest.patch b/0007-vyos-terminate-connections-source-dest.patch new file mode 100644 index 0000000..170b379 --- /dev/null +++ b/0007-vyos-terminate-connections-source-dest.patch @@ -0,0 +1,124 @@ +From a0dedc6cae5828d048bcbb16392d17b7a168a260 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= +Date: Wed, 22 Jan 2020 13:12:39 +0100 +Subject: [PATCH 7/7] vyos-terminate-connections-source-dest + +--- + src/libcharon/plugins/vici/vici_control.c | 27 ++++++++++++++++++++--- + src/swanctl/commands/terminate.c | 18 ++++++++++++++- + 2 files changed, 41 insertions(+), 4 deletions(-) + +diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c +index 12ef92334..d9cf1add5 100644 +--- a/src/libcharon/plugins/vici/vici_control.c ++++ b/src/libcharon/plugins/vici/vici_control.c +@@ -279,12 +279,13 @@ CALLBACK(terminate, vici_message_t*, + private_vici_control_t *this, char *name, u_int id, vici_message_t *request) + { + enumerator_t *enumerator, *isas, *csas; +- char *child, *ike, *errmsg = NULL; ++ char *child, *ike, *errmsg = NULL, *my_host_str, *other_host_str; + u_int child_id, ike_id, current, *del, done = 0; + bool force; + int timeout; + ike_sa_t *ike_sa; + child_sa_t *child_sa; ++ host_t *my_host = NULL, *other_host = NULL; + array_t *ids; + vici_builder_t *builder; + controller_cb_t log_cb = NULL; +@@ -300,12 +301,23 @@ CALLBACK(terminate, vici_message_t*, + force = request->get_bool(request, FALSE, "force"); + timeout = request->get_int(request, 0, "timeout"); + log.level = request->get_int(request, 1, "loglevel"); ++ my_host_str = request->get_str(request, NULL, "my-host"); ++ other_host_str = request->get_str(request, NULL, "other-host"); + +- if (!child && !ike && !ike_id && !child_id) ++ if (!child && !ike && !ike_id && !child_id && !my_host_str &&!other_host_str) + { + return send_reply(this, "missing terminate selector"); + } +- ++ if (my_host_str && !other_host_str || other_host_str && !my_host_str) ++ { ++ return send_reply(this, "missing source or remote"); ++ } ++ else ++ { ++ my_host = host_create_from_string(my_host_str, 0); ++ other_host = host_create_from_string(other_host_str, 0); ++ DBG1(DBG_CFG, "vici terminate with source me %H and other %H", my_host, other_host); ++ } + if (ike_id) + { + DBG1(DBG_CFG, "vici terminate IKE_SA #%d", ike_id); +@@ -368,6 +380,15 @@ CALLBACK(terminate, vici_message_t*, + { + array_insert(ids, ARRAY_TAIL, &ike_id); + } ++ else if (my_host && other_host) ++ { ++ if (!my_host->ip_equals(my_host, ike_sa->get_my_host(ike_sa)) || !other_host->ip_equals(other_host, ike_sa->get_other_host(ike_sa))) ++ { ++ continue; ++ } ++ current = ike_sa->get_unique_id(ike_sa); ++ array_insert(ids, ARRAY_TAIL, ¤t); ++ } + } + isas->destroy(isas); + +diff --git a/src/swanctl/commands/terminate.c b/src/swanctl/commands/terminate.c +index 2309843b2..37d0bde3f 100644 +--- a/src/swanctl/commands/terminate.c ++++ b/src/swanctl/commands/terminate.c +@@ -37,7 +37,7 @@ static int terminate(vici_conn_t *conn) + vici_req_t *req; + vici_res_t *res; + command_format_options_t format = COMMAND_FORMAT_NONE; +- char *arg, *child = NULL, *ike = NULL; ++ char *arg, *child = NULL, *ike = NULL, *my_host = NULL, *other_host = NULL; + int ret = 0, timeout = 0, level = 1, child_id = 0, ike_id = 0; + bool force = FALSE; + +@@ -74,6 +74,12 @@ static int terminate(vici_conn_t *conn) + case 'l': + level = atoi(arg); + continue; ++ case 'S': ++ my_host = arg; ++ continue; ++ case 'R': ++ other_host = arg; ++ continue; + case EOF: + break; + default: +@@ -109,6 +115,14 @@ static int terminate(vici_conn_t *conn) + { + vici_add_key_valuef(req, "force", "yes"); + } ++ if (my_host) ++ { ++ vici_add_key_valuef(req, "my-host", "%s", my_host); ++ } ++ if (other_host) ++ { ++ vici_add_key_valuef(req, "other-host", "%s", other_host); ++ } + if (timeout) + { + vici_add_key_valuef(req, "timeout", "%d", timeout * 1000); +@@ -155,6 +169,8 @@ static void __attribute__ ((constructor))reg() + { + {"help", 'h', 0, "show usage information"}, + {"child", 'c', 1, "terminate by CHILD_SA name"}, ++ {"source", 'S', 1, "override source address"}, ++ {"remote", 'R', 1, "override remote address"}, + {"ike", 'i', 1, "terminate by IKE_SA name"}, + {"child-id", 'C', 1, "terminate by CHILD_SA reqid"}, + {"ike-id", 'I', 1, "terminate by IKE_SA unique identifier"}, +-- +2.25.4 + diff --git a/strongswan.spec b/strongswan.spec index 3800268..0b8be31 100644 --- a/strongswan.spec +++ b/strongswan.spec @@ -13,6 +13,14 @@ Patch0: strongswan-5.8.4-runtime-dir.patch Patch1: strongswan-5.6.0-uintptr_t.patch Patch3: strongswan-5.6.2-CVE-2018-5388.patch +Patch10: 0001-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch +Patch11: 0002-charon-add-optional-source-and-remote-overrides-for-.patch +Patch12: 0003-vici-send-certificates-for-ike-sa-events.patch +Patch13: 0004-vici-add-support-for-individual-sa-state-changes.patch +Patch14: 0005-vici-add-deprecated-async-parameter.patch +Patch15: 0006-support-gre-key-in-ikev1.patch +Patch16: 0007-vyos-terminate-connections-source-dest.patch + # only needed for pre-release versions #BuildRequires: autoconf automake @@ -84,6 +92,14 @@ PT-TLS to support TNC over TLS. %patch1 -p1 %patch3 -p1 +%patch10 -p1 +%patch11 -p1 +%patch12 -p1 +%patch13 -p1 +%patch14 -p1 +%patch15 -p1 +%patch16 -p1 + %build # only for snapshots #autoreconf