From e51251d0e89f406d5102664cf09b3e3878cc90b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= Date: Mon, 30 Dec 2019 22:14:53 +0100 Subject: [PATCH] Patch vici for NHRP --- ...nal-source-and-remote-overrides-for-.patch | 481 ++++++++++++++++++ ...-send-certificates-for-ike-sa-events.patch | 140 +++++ ...port-for-individual-sa-state-changes.patch | 160 ++++++ strongswan.spec | 7 +- 4 files changed, 787 insertions(+), 1 deletion(-) create mode 100644 0001-charon-add-optional-source-and-remote-overrides-for-.patch create mode 100644 0002-vici-send-certificates-for-ike-sa-events.patch create mode 100644 0003-vici-add-support-for-individual-sa-state-changes.patch diff --git a/0001-charon-add-optional-source-and-remote-overrides-for-.patch b/0001-charon-add-optional-source-and-remote-overrides-for-.patch new file mode 100644 index 0000000..4ec6a9f --- /dev/null +++ b/0001-charon-add-optional-source-and-remote-overrides-for-.patch @@ -0,0 +1,481 @@ +From 8ca99fb0a9d0027d08937bc2b198dc74bd5bb7a2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= +Date: Tue, 9 Jul 2024 19:07:57 +0200 +Subject: [PATCH 1/4] charon: add optional source and remote overrides for + initiate + +This introduces support for specifying optional IKE SA specific +source and remote address for child sa initiation. This allows +to initiate wildcard connection for known address via vici. + +In addition this allows simpler implementation of trap-any patches +and is a prerequisite for dmvpn support. +--- + src/libcharon/control/controller.c | 36 +++++++++++++++++- + src/libcharon/control/controller.h | 28 ++++++++++++++ + src/libcharon/plugins/vici/vici_control.c | 41 ++++++++++++++++---- + src/libcharon/sa/ike_sa_manager.c | 34 ++++++++++++++++- + src/libcharon/sa/ike_sa_manager.h | 25 +++++++++++- + src/libcharon/sa/trap_manager.c | 46 +++++++++-------------- + src/swanctl/commands/initiate.c | 19 +++++++++- + 7 files changed, 189 insertions(+), 40 deletions(-) + +diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c +index 4e778ed63d..2b8a75e2c1 100644 +--- a/src/libcharon/control/controller.c ++++ b/src/libcharon/control/controller.c +@@ -1,4 +1,6 @@ + /* ++ * Copyright (C) 2023 Zoran Peričić ++ * Copyright (C) 2014 Timo Teräs + * Copyright (C) 2011-2023 Tobias Brunner + * Copyright (C) 2007-2011 Martin Willi + * +@@ -107,6 +109,16 @@ struct interface_listener_t { + */ + ike_sa_t *ike_sa; + ++ /** ++ * Our host hint. ++ */ ++ host_t *my_host; ++ ++ /** ++ * Other host hint. ++ */ ++ host_t *other_host; ++ + /** + * unique ID, used for various methods + */ +@@ -418,9 +430,17 @@ METHOD(job_t, initiate_execute, job_requeue_t, + { + ike_sa_t *ike_sa; + interface_listener_t *listener = &job->listener; ++ peer_cfg_t *peer_cfg = listener->peer_cfg; ++ host_t *my_host = listener->my_host; ++ host_t *other_host = listener->other_host; ++ ++ ike_sa = charon->ike_sa_manager->checkout_by_config2(charon->ike_sa_manager, ++ peer_cfg, my_host, other_host); ++ peer_cfg->destroy(peer_cfg); ++ ++ if (my_host) my_host->destroy(my_host); ++ if (other_host) other_host->destroy(other_host); + +- ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, +- listener->peer_cfg); + if (!ike_sa) + { + listener->status = FAILED; +@@ -502,6 +522,15 @@ METHOD(controller_t, initiate, status_t, + private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, + controller_cb_t callback, void *param, level_t max_level, u_int timeout, + bool limits) ++{ ++ return this->public.initiate2(&this->public, peer_cfg, child_cfg, NULL, NULL, callback, param, max_level, timeout, limits); ++} ++ ++METHOD(controller_t, initiate2, status_t, ++ private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, ++ host_t *my_host, host_t *other_host, ++ controller_cb_t callback, void *param, level_t max_level, u_int timeout, ++ bool limits) + { + interface_job_t *job; + status_t status; +@@ -524,6 +553,8 @@ METHOD(controller_t, initiate, status_t, + .status = FAILED, + .child_cfg = child_cfg, + .peer_cfg = peer_cfg, ++ .my_host = my_host ? my_host->clone(my_host) : NULL, ++ .other_host = other_host ? other_host->clone(other_host) : NULL, + .lock = spinlock_create(), + .options.limits = limits, + }, +@@ -771,6 +802,7 @@ controller_t *controller_create(void) + .public = { + .create_ike_sa_enumerator = _create_ike_sa_enumerator, + .initiate = _initiate, ++ .initiate2 = _initiate2, + .terminate_ike = _terminate_ike, + .terminate_child = _terminate_child, + .destroy = _destroy, +diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h +index 36a1d46317..f5c60e2e72 100644 +--- a/src/libcharon/control/controller.h ++++ b/src/libcharon/control/controller.h +@@ -98,6 +98,34 @@ struct controller_t { + controller_cb_t callback, void *param, + level_t max_level, u_int timeout, bool limits); + ++ /** ++ * Initiate a CHILD_SA, and if required, an IKE_SA. ++ * ++ * If a callback is provided the function is synchronous and thus blocks ++ * until the IKE_SA is established or failed. ++ * ++ * @param peer_cfg peer_cfg to use for IKE_SA setup ++ * @param child_cfg optional child_cfg to set up CHILD_SA from ++ * @param my_host optional address hint for source ++ * @param other_host optional address hint for destination ++ * @param cb logging callback ++ * @param param parameter to include in each call of cb ++ * @param max_level maximum log level for which cb is invoked ++ * @param timeout timeout in ms to wait for callbacks, 0 to disable ++ * @param limits whether to check limits regarding IKE_SA initiation ++ * @return ++ * - SUCCESS, if CHILD_SA established ++ * - FAILED, if setup failed ++ * - NEED_MORE, if callback returned FALSE ++ * - OUT_OF_RES if timed out ++ * - INVALID_STATE if limits prevented initiation ++ */ ++ status_t (*initiate2)(controller_t *this, ++ peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, ++ host_t *my_host, host_t *other_host, ++ controller_cb_t callback, void *param, ++ level_t max_level, u_int timeout, bool limits); ++ + /** + * Terminate an IKE_SA and all of its CHILD_SAs. + * +diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c +index 1c236d2491..932d0cb5a8 100644 +--- a/src/libcharon/plugins/vici/vici_control.c ++++ b/src/libcharon/plugins/vici/vici_control.c +@@ -1,4 +1,6 @@ + /* ++ * Copyright (C) 2023 Zoran Peričić ++ * Copyright (C) 2014 Timo Teräs + * Copyright (C) 2015-2017 Tobias Brunner + * Copyright (C) 2014 Martin Willi + * +@@ -173,9 +175,12 @@ static child_cfg_t* find_child_cfg(char *name, char *pname, peer_cfg_t **out) + CALLBACK(initiate, vici_message_t*, + private_vici_control_t *this, char *name, u_int id, vici_message_t *request) + { ++ vici_message_t* msg; + peer_cfg_t *peer_cfg = NULL; + child_cfg_t *child_cfg; + char *child, *ike, *type, *sa; ++ host_t *my_host = NULL, *other_host = NULL; ++ char *my_host_str, *other_host_str; + int timeout; + bool limits; + controller_cb_t log_cb = NULL; +@@ -189,6 +194,8 @@ CALLBACK(initiate, vici_message_t*, + timeout = request->get_int(request, 0, "timeout"); + limits = request->get_bool(request, FALSE, "init-limits"); + log.level = request->get_int(request, 1, "loglevel"); ++ my_host_str = request->get_str(request, NULL, "my-host"); ++ other_host_str = request->get_str(request, NULL, "other-host"); + + if (!child && !ike) + { +@@ -202,28 +209,48 @@ CALLBACK(initiate, vici_message_t*, + type = child ? "CHILD_SA" : "IKE_SA"; + sa = child ?: ike; + ++ if (my_host_str) ++ { ++ my_host = host_create_from_string(my_host_str, 0); ++ } ++ if (other_host_str) ++ { ++ other_host = host_create_from_string(other_host_str, 0); ++ } ++ ++ DBG1(DBG_CFG, "vici initiate %s '%s', me %H, other %H, limits %d", type, sa, my_host, other_host, limits); ++ + child_cfg = find_child_cfg(child, ike, &peer_cfg); + +- DBG1(DBG_CFG, "vici initiate %s '%s'", type, sa); + if (!peer_cfg) + { +- return send_reply(this, "%s config '%s' not found", type, sa); ++ msg = send_reply(this, "%s config '%s' not found", type, sa); ++ goto ret; + } +- switch (charon->controller->initiate(charon->controller, peer_cfg, child_cfg, ++ switch (charon->controller->initiate2(charon->controller, peer_cfg, child_cfg, ++ my_host, other_host, + log_cb, &log, log.level, timeout, limits)) + { + case SUCCESS: +- return send_reply(this, NULL); ++ msg = send_reply(this, NULL); ++ break; + case OUT_OF_RES: +- return send_reply(this, "%s '%s' not established after %dms", type, ++ msg = send_reply(this, "%s '%s' not established after %dms", type, + sa, timeout); ++ break; + case INVALID_STATE: +- return send_reply(this, "establishing %s '%s' not possible at the " ++ msg = send_reply(this, "establishing %s '%s' not possible at the " + "moment due to limits", type, sa); ++ break; + case FAILED: + default: +- return send_reply(this, "establishing %s '%s' failed", type, sa); ++ msg = send_reply(this, "establishing %s '%s' failed", type, sa); ++ break; + } ++ret: ++ if (my_host) my_host->destroy(my_host); ++ if (other_host) other_host->destroy(other_host); ++ return msg; + } + + /** +diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c +index c128cc0787..bf4e125c84 100644 +--- a/src/libcharon/sa/ike_sa_manager.c ++++ b/src/libcharon/sa/ike_sa_manager.c +@@ -1,5 +1,7 @@ + /* + * Copyright (C) 2008-2024 Tobias Brunner ++ * Copyright (C) 2023 Zoran Peričić ++ * Copyright (C) 2014 Timo Teräs + * Copyright (C) 2005-2011 Martin Willi + * Copyright (C) 2005 Jan Hutter + * +@@ -1500,6 +1502,13 @@ typedef struct { + + METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg) ++{ ++ return this->public.checkout_by_config2(&this->public, peer_cfg, NULL, NULL); ++} ++ ++METHOD(ike_sa_manager_t, checkout_by_config2, ike_sa_t*, ++ private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg, ++ host_t *my_host, host_t *other_host) + { + enumerator_t *enumerator; + entry_t *entry; +@@ -1510,7 +1519,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + u_int segment; + int i; + +- DBG2(DBG_MGR, "checkout IKE_SA by config"); ++ if (my_host && my_host->get_port(my_host) == 0) ++ { ++ my_host->set_port(my_host, IKEV2_UDP_PORT); ++ } ++ if (other_host && other_host->get_port(other_host) == 0) ++ { ++ other_host->set_port(other_host, IKEV2_UDP_PORT); ++ } ++ DBG2(DBG_MGR, "checkout IKE_SA by config '%s', me %H, other %H", ++ peer_cfg->get_name(peer_cfg), my_host, other_host); + + if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1) + { /* IKE_SA reuse disabled by config (not possible for IKEv1) */ +@@ -1569,6 +1587,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + continue; + } + ++ if (my_host && !my_host->ip_equals(my_host, entry->ike_sa->get_my_host(entry->ike_sa))) ++ { ++ continue; ++ } ++ if (other_host && !other_host->ip_equals(other_host, entry->ike_sa->get_other_host(entry->ike_sa))) ++ { ++ continue; ++ } ++ + current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); + if (current_peer && current_peer->equals(current_peer, peer_cfg)) + { +@@ -1595,6 +1622,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + { + ike_sa->set_peer_cfg(ike_sa, peer_cfg); + checkout_new(this, ike_sa); ++ if (my_host || other_host) ++ { ++ ike_sa->update_hosts(ike_sa, my_host, other_host, TRUE); ++ } + } + } + charon->bus->set_sa(charon->bus, ike_sa); +@@ -2560,6 +2591,7 @@ ike_sa_manager_t *ike_sa_manager_create() + .checkout = _checkout, + .checkout_by_message = _checkout_by_message, + .checkout_by_config = _checkout_by_config, ++ .checkout_by_config2 = _checkout_by_config2, + .checkout_by_id = _checkout_by_id, + .checkout_by_name = _checkout_by_name, + .new_initiator_spi = _new_initiator_spi, +diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h +index 004cc22168..d001f5a802 100644 +--- a/src/libcharon/sa/ike_sa_manager.h ++++ b/src/libcharon/sa/ike_sa_manager.h +@@ -123,7 +123,8 @@ struct ike_sa_manager_t { + ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message); + + /** +- * Checkout an IKE_SA for initiation by a peer_config. ++ * Checkout an IKE_SA for initiation by a peer_config and optional ++ * source and remote host addresses. + * + * To initiate, a CHILD_SA may be established within an existing IKE_SA. + * This call checks for an existing IKE_SA by comparing the configuration. +@@ -140,6 +141,28 @@ struct ike_sa_manager_t { + */ + ike_sa_t *(*checkout_by_config)(ike_sa_manager_t* this, peer_cfg_t *peer_cfg); + ++ /** ++ * Checkout an IKE_SA for initiation by a peer_config and optional ++ * source and remote host addresses. ++ * ++ * To initiate, a CHILD_SA may be established within an existing IKE_SA. ++ * This call checks for an existing IKE_SA by comparing the configuration. ++ * If the CHILD_SA can be created in an existing IKE_SA, the matching SA ++ * is returned. ++ * If no IKE_SA is found, a new one is created and registered in the ++ * manager. This is also the case when the found IKE_SA is in an unusable ++ * state (e.g. DELETING). ++ * ++ * @note The peer_config is always set on the returned IKE_SA. ++ * ++ * @param peer_cfg configuration used to find an existing IKE_SA ++ * @param my_host source host address for wildcard peer_cfg ++ * @param other_host remote host address for wildcard peer_cfg ++ * @return checked out/created IKE_SA ++ */ ++ ike_sa_t *(*checkout_by_config2)(ike_sa_manager_t* this, peer_cfg_t *peer_cfg, ++ host_t *my_host, host_t *other_host); ++ + /** + * Reset initiator SPI. + * +diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c +index 17953010a1..c316eea213 100644 +--- a/src/libcharon/sa/trap_manager.c ++++ b/src/libcharon/sa/trap_manager.c +@@ -532,9 +532,9 @@ METHOD(trap_manager_t, acquire, void, + peer_cfg_t *peer; + child_cfg_t *child; + ike_sa_t *ike_sa; +- host_t *host = NULL; ++ host_t *host = NULL, *my_host = NULL, *other_host = NULL; + uint32_t allocated_reqid, seq = 0; +- bool wildcard; ++ bool wildcard, ignore = FALSE; + + this->lock->read_lock(this->lock); + enumerator = this->traps->create_enumerator(this->traps); +@@ -609,36 +609,26 @@ METHOD(trap_manager_t, acquire, void, + this->lock->unlock(this->lock); + + if (wildcard) +- { /* the peer config would match IKE_SAs with other peers */ +- ike_sa = charon->ike_sa_manager->create_new(charon->ike_sa_manager, +- peer->get_ike_version(peer), TRUE); +- if (ike_sa) +- { +- ike_cfg_t *ike_cfg; +- uint16_t port; +- uint8_t mask; +- +- ike_sa->set_peer_cfg(ike_sa, peer); +- ike_cfg = ike_sa->get_ike_cfg(ike_sa); ++ { ++ ike_cfg_t *ike_cfg; ++ uint16_t port; ++ uint8_t mask; + +- port = ike_cfg->get_other_port(ike_cfg); +- data->dst->to_subnet(data->dst, &host, &mask); +- host->set_port(host, port); +- ike_sa->set_other_host(ike_sa, host); ++ ike_cfg = peer->get_ike_cfg(peer); + +- port = ike_cfg->get_my_port(ike_cfg); +- data->src->to_subnet(data->src, &host, &mask); +- host->set_port(host, port); +- ike_sa->set_my_host(ike_sa, host); ++ port = ike_cfg->get_other_port(ike_cfg); ++ data->dst->to_subnet(data->dst, &other_host, &mask); ++ other_host->set_port(other_host, port); + +- charon->bus->set_sa(charon->bus, ike_sa); +- } +- } +- else +- { +- ike_sa = charon->ike_sa_manager->checkout_by_config( +- charon->ike_sa_manager, peer); ++ port = ike_cfg->get_my_port(ike_cfg); ++ data->src->to_subnet(data->src, &my_host, &mask); ++ my_host->set_port(my_host, port); + } ++ ike_sa = charon->ike_sa_manager->checkout_by_config2( ++ charon->ike_sa_manager, peer, ++ my_host, other_host); ++ if (my_host) my_host->destroy(my_host); ++ if (other_host) other_host->destroy(other_host); + peer->destroy(peer); + + if (ike_sa) +diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c +index e0fffb907d..c0fc8c5952 100644 +--- a/src/swanctl/commands/initiate.c ++++ b/src/swanctl/commands/initiate.c +@@ -1,4 +1,5 @@ + /* ++ * Copyright (C) 2014 Timo Teräs + * Copyright (C) 2014 Martin Willi + * + * Copyright (C) secunet Security Networks AG +@@ -38,7 +39,7 @@ static int initiate(vici_conn_t *conn) + vici_req_t *req; + vici_res_t *res; + command_format_options_t format = COMMAND_FORMAT_NONE; +- char *arg, *child = NULL, *ike = NULL; ++ char *arg, *child = NULL, *ike = NULL, *my_host = NULL, *other_host = NULL; + int ret = 0, timeout = 0, level = 1; + + while (TRUE) +@@ -65,6 +66,12 @@ static int initiate(vici_conn_t *conn) + case 'l': + level = atoi(arg); + continue; ++ case 'S': ++ my_host = arg; ++ continue; ++ case 'R': ++ other_host = arg; ++ continue; + case EOF: + break; + default: +@@ -88,6 +95,14 @@ static int initiate(vici_conn_t *conn) + { + vici_add_key_valuef(req, "ike", "%s", ike); + } ++ if (my_host) ++ { ++ vici_add_key_valuef(req, "my-host", "%s", my_host); ++ } ++ if (other_host) ++ { ++ vici_add_key_valuef(req, "other-host", "%s", other_host); ++ } + if (timeout) + { + vici_add_key_valuef(req, "timeout", "%d", timeout * 1000); +@@ -134,6 +149,8 @@ static void __attribute__ ((constructor))reg() + {"help", 'h', 0, "show usage information"}, + {"child", 'c', 1, "initiate a CHILD_SA configuration"}, + {"ike", 'i', 1, "initiate an IKE_SA, or name of child's parent"}, ++ {"source", 'S', 1, "override source address"}, ++ {"remote", 'R', 1, "override remote address"}, + {"timeout", 't', 1, "timeout in seconds before detaching"}, + {"raw", 'r', 0, "dump raw response message"}, + {"pretty", 'P', 0, "dump raw response message in pretty print"}, +-- +2.51.0 + diff --git a/0002-vici-send-certificates-for-ike-sa-events.patch b/0002-vici-send-certificates-for-ike-sa-events.patch new file mode 100644 index 0000000..b8c1b94 --- /dev/null +++ b/0002-vici-send-certificates-for-ike-sa-events.patch @@ -0,0 +1,140 @@ +From 59e1a0469bbd50704f777835c0fcd7013f7841c7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= +Date: Mon, 21 Sep 2015 13:42:05 +0300 +Subject: [PATCH 2/4] vici: send certificates for ike-sa events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Timo Teräs +--- + src/libcharon/plugins/vici/vici_query.c | 50 +++++++++++++++++++++---- + 1 file changed, 42 insertions(+), 8 deletions(-) + +diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c +index 43e3f44137..5e49cb8a0b 100644 +--- a/src/libcharon/plugins/vici/vici_query.c ++++ b/src/libcharon/plugins/vici/vici_query.c +@@ -433,7 +433,7 @@ static void list_vips(private_vici_query_t *this, vici_builder_t *b, + * List details of an IKE_SA + */ + static void list_ike(private_vici_query_t *this, vici_builder_t *b, +- ike_sa_t *ike_sa, time_t now) ++ ike_sa_t *ike_sa, time_t now, bool add_certs) + { + time_t t; + ike_sa_id_t *id; +@@ -442,6 +442,8 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b, + uint32_t if_id; + uint16_t alg, ks; + host_t *host; ++ auth_cfg_t *auth_cfg; ++ enumerator_t *enumerator; + + b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa)); + b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa)); +@@ -451,11 +453,43 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b, + b->add_kv(b, "local-host", "%H", host); + b->add_kv(b, "local-port", "%d", host->get_port(host)); + b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa)); ++ if (add_certs) ++ { ++ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, TRUE); ++ if (enumerator->enumerate(enumerator, &auth_cfg)) ++ { ++ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT); ++ chunk_t encoding; ++ ++ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding)) ++ { ++ b->add(b, VICI_KEY_VALUE, "local-cert-data", encoding); ++ free(encoding.ptr); ++ } ++ } ++ enumerator->destroy(enumerator); ++ } + + host = ike_sa->get_other_host(ike_sa); + b->add_kv(b, "remote-host", "%H", host); + b->add_kv(b, "remote-port", "%d", host->get_port(host)); + b->add_kv(b, "remote-id", "%Y", ike_sa->get_other_id(ike_sa)); ++ if (add_certs) ++ { ++ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE); ++ if (enumerator->enumerate(enumerator, &auth_cfg)) ++ { ++ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT); ++ chunk_t encoding; ++ ++ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding)) ++ { ++ b->add(b, VICI_KEY_VALUE, "remote-cert-data", encoding); ++ free(encoding.ptr); ++ } ++ } ++ enumerator->destroy(enumerator); ++ } + + eap = ike_sa->get_other_eap_id(ike_sa); + +@@ -588,7 +622,7 @@ CALLBACK(list_sas, vici_message_t*, + b = vici_builder_create(); + b->begin_section(b, ike_sa->get_name(ike_sa)); + +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, TRUE); + + b->begin_section(b, "child-sas"); + csas = ike_sa->create_child_sa_enumerator(ike_sa); +@@ -1805,7 +1839,7 @@ METHOD(listener_t, ike_updown, bool, + } + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, up); + b->end_section(b); + + this->dispatcher->raise_event(this->dispatcher, +@@ -1830,10 +1864,10 @@ METHOD(listener_t, ike_rekey, bool, + b = vici_builder_create(); + b->begin_section(b, old->get_name(old)); + b->begin_section(b, "old"); +- list_ike(this, b, old, now); ++ list_ike(this, b, old, now, TRUE); + b->end_section(b); + b->begin_section(b, "new"); +- list_ike(this, b, new, now); ++ list_ike(this, b, new, now, TRUE); + b->end_section(b); + b->end_section(b); + +@@ -1864,7 +1898,7 @@ METHOD(listener_t, ike_update, bool, + b->add_kv(b, "remote-port", "%d", remote->get_port(remote)); + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, TRUE); + b->end_section(b); + + this->dispatcher->raise_event(this->dispatcher, +@@ -1894,7 +1928,7 @@ METHOD(listener_t, child_updown, bool, + } + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, up); + b->begin_section(b, "child-sas"); + + snprintf(buf, sizeof(buf), "%s-%u", child_sa->get_name(child_sa), +@@ -1929,7 +1963,7 @@ METHOD(listener_t, child_rekey, bool, + b = vici_builder_create(); + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, TRUE); + b->begin_section(b, "child-sas"); + + b->begin_section(b, old->get_name(old)); +-- +2.51.0 + diff --git a/0003-vici-add-support-for-individual-sa-state-changes.patch b/0003-vici-add-support-for-individual-sa-state-changes.patch new file mode 100644 index 0000000..eedcb44 --- /dev/null +++ b/0003-vici-add-support-for-individual-sa-state-changes.patch @@ -0,0 +1,160 @@ +From 17118385d600eeb9814af4106b690c8e2b285971 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= +Date: Mon, 21 Sep 2015 13:42:11 +0300 +Subject: [PATCH 3/4] vici: add support for individual sa state changes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Useful for monitoring and tracking full SA. + +Signed-off-by: Timo Teräs +--- + src/libcharon/plugins/vici/vici_query.c | 106 ++++++++++++++++++++++++ + 1 file changed, 106 insertions(+) + +diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c +index 5e49cb8a0b..1115161f6b 100644 +--- a/src/libcharon/plugins/vici/vici_query.c ++++ b/src/libcharon/plugins/vici/vici_query.c +@@ -1805,8 +1805,16 @@ static void manage_commands(private_vici_query_t *this, bool reg) + this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg); + this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg); + this->dispatcher->manage_event(this->dispatcher, "ike-update", reg); ++ this->dispatcher->manage_event(this->dispatcher, "ike-state-established", reg); ++ this->dispatcher->manage_event(this->dispatcher, "ike-state-destroying", reg); + this->dispatcher->manage_event(this->dispatcher, "child-updown", reg); + this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-installing", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-installed", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-updating", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-rekeying", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-rekeyed", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-destroying", reg); + manage_command(this, "list-sas", list_sas, reg); + manage_command(this, "list-policies", list_policies, reg); + manage_command(this, "list-conns", list_conns, reg); +@@ -1907,6 +1915,46 @@ METHOD(listener_t, ike_update, bool, + return TRUE; + } + ++ ++METHOD(listener_t, ike_state_change, bool, ++ private_vici_query_t *this, ike_sa_t *ike_sa, ike_sa_state_t state) ++{ ++ char *event; ++ vici_builder_t *b; ++ time_t now; ++ ++ switch (state) ++ { ++ case IKE_ESTABLISHED: ++ event = "ike-state-established"; ++ break; ++ case IKE_DESTROYING: ++ event = "ike-state-destroying"; ++ break; ++ default: ++ return TRUE; ++ } ++ ++ if (!this->dispatcher->has_event_listeners(this->dispatcher, event)) ++ { ++ return TRUE; ++ } ++ ++ now = time_monotonic(NULL); ++ ++ b = vici_builder_create(); ++ b->begin_section(b, ike_sa->get_name(ike_sa)); ++ list_ike(this, b, ike_sa, now, state != IKE_DESTROYING); ++ b->begin_section(b, "child-sas"); ++ b->end_section(b); ++ b->end_section(b); ++ ++ this->dispatcher->raise_event(this->dispatcher, ++ event, 0, b->finalize(b)); ++ ++ return TRUE; ++} ++ + METHOD(listener_t, child_updown, bool, + private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up) + { +@@ -1986,6 +2034,62 @@ METHOD(listener_t, child_rekey, bool, + return TRUE; + } + ++METHOD(listener_t, child_state_change, bool, ++ private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state) ++{ ++ char *event; ++ vici_builder_t *b; ++ time_t now; ++ ++ switch (state) ++ { ++ case CHILD_INSTALLING: ++ event = "child-state-installing"; ++ break; ++ case CHILD_INSTALLED: ++ event = "child-state-installed"; ++ break; ++ case CHILD_UPDATING: ++ event = "child-state-updating"; ++ break; ++ case CHILD_REKEYING: ++ event = "child-state-rekeying"; ++ break; ++ case CHILD_REKEYED: ++ event = "child-state-rekeyed"; ++ break; ++ case CHILD_DESTROYING: ++ event = "child-state-destroying"; ++ break; ++ default: ++ return TRUE; ++ } ++ ++ if (!this->dispatcher->has_event_listeners(this->dispatcher, event)) ++ { ++ return TRUE; ++ } ++ ++ now = time_monotonic(NULL); ++ ++ b = vici_builder_create(); ++ b->begin_section(b, ike_sa->get_name(ike_sa)); ++ list_ike(this, b, ike_sa, now, state != CHILD_DESTROYING); ++ b->begin_section(b, "child-sas"); ++ ++ b->begin_section(b, child_sa->get_name(child_sa)); ++ list_child(this, b, child_sa, now); ++ b->end_section(b); ++ ++ b->end_section(b); ++ b->end_section(b); ++ ++ this->dispatcher->raise_event(this->dispatcher, ++ event, 0, b->finalize(b)); ++ ++ return TRUE; ++} ++ + METHOD(vici_query_t, destroy, void, + private_vici_query_t *this) + { +@@ -2006,8 +2110,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher) + .ike_updown = _ike_updown, + .ike_rekey = _ike_rekey, + .ike_update = _ike_update, ++ .ike_state_change = _ike_state_change, + .child_updown = _child_updown, + .child_rekey = _child_rekey, ++ .child_state_change = _child_state_change, + }, + .destroy = _destroy, + }, +-- +2.51.0 + diff --git a/strongswan.spec b/strongswan.spec index cf68138..597c7d6 100644 --- a/strongswan.spec +++ b/strongswan.spec @@ -1,5 +1,6 @@ %global _hardened_build 1 #%%define prerelease dr1 +%global dist .nhrp.9%{?dist} # pytho vici bindings cannot build without network, so temp. disabled %bcond_with python3 @@ -11,7 +12,7 @@ Name: strongswan Version: 6.0.2 -Release: %autorelease +Release: 4%{?dist} Summary: An OpenSource IPsec-based VPN and TNC solution # Automatically converted from old format: GPLv2+ - review is highly recommended. License: GPL-2.0-or-later @@ -29,6 +30,10 @@ Patch2: strongswan-6.0.2-no-isolation.patch # https://github.com/strongswan/strongswan/commit/b3011e8e87a1fad1bfb026448fc37b80b7cfc007 Patch3: strongswan-6.0.2-no-md5-b3011e8e.patch +Patch10: 0001-charon-add-optional-source-and-remote-overrides-for-.patch +Patch11: 0002-vici-send-certificates-for-ike-sa-events.patch +Patch12: 0003-vici-add-support-for-individual-sa-state-changes.patch + BuildRequires: autoconf BuildRequires: automake BuildRequires: gnupg2