From f978fcb51f95f01a67982272b6371e728ea04dcc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= Date: Wed, 18 Sep 2024 13:06:59 +0200 Subject: [PATCH] 5.9.14 - Old patches --- ...nal-source-and-remote-overrides-for-.patch | 38 +-- ...-send-certificates-for-ike-sa-events.patch | 6 +- ...port-for-individual-sa-state-changes.patch | 6 +- 0004-Support-GRE-key-in-selectors.patch | 304 ++++++++++-------- 4 files changed, 194 insertions(+), 160 deletions(-) diff --git a/0001-charon-add-optional-source-and-remote-overrides-for-.patch b/0001-charon-add-optional-source-and-remote-overrides-for-.patch index e28e9b6..22031db 100644 --- a/0001-charon-add-optional-source-and-remote-overrides-for-.patch +++ b/0001-charon-add-optional-source-and-remote-overrides-for-.patch @@ -1,7 +1,7 @@ -From ec53b2914730f08d151d14e9b48557196ec0cc49 Mon Sep 17 00:00:00 2001 +From 921093c4c0d4be10a74f148536029fb46fd31966 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= Date: Mon, 21 Sep 2015 13:41:58 +0300 -Subject: [PATCH 1/3] charon: add optional source and remote overrides for +Subject: [PATCH 1/4] charon: add optional source and remote overrides for initiate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -38,7 +38,7 @@ Signed-off-by: Timo Teräs 21 files changed, 225 insertions(+), 50 deletions(-) diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c -index 2e2cb3ca2..b9369a8a2 100644 +index 8e8d8236e..7df5bc9bf 100644 --- a/src/charon-cmd/cmd/cmd_connection.c +++ b/src/charon-cmd/cmd/cmd_connection.c @@ -439,7 +439,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this) @@ -51,10 +51,10 @@ index 2e2cb3ca2..b9369a8a2 100644 terminate(pid); } diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c -index 7f88514a7..4c3491984 100644 +index 8570ef0e3..bc74f1b90 100644 --- a/src/charon-nm/nm/nm_service.c +++ b/src/charon-nm/nm/nm_service.c -@@ -942,7 +942,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection, +@@ -982,7 +982,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection, * Prepare IKE_SA */ ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, @@ -207,7 +207,7 @@ index 695e75b83..e3f740281 100644 if (s) { diff --git a/src/libcharon/plugins/medcli/medcli_config.c b/src/libcharon/plugins/medcli/medcli_config.c -index 3211a49f1..f98b3eac8 100644 +index 59a9358a1..6e322a9c1 100644 --- a/src/libcharon/plugins/medcli/medcli_config.c +++ b/src/libcharon/plugins/medcli/medcli_config.c @@ -350,7 +350,7 @@ static job_requeue_t initiate_config(peer_cfg_t *peer_cfg) @@ -220,10 +220,10 @@ index 3211a49f1..f98b3eac8 100644 else { diff --git a/src/libcharon/plugins/smp/smp.c b/src/libcharon/plugins/smp/smp.c -index 91dddfeaa..1e9326822 100644 +index 6ca9f1399..31a4e1d63 100644 --- a/src/libcharon/plugins/smp/smp.c +++ b/src/libcharon/plugins/smp/smp.c -@@ -494,7 +494,8 @@ static void request_control_initiate(xmlTextReaderPtr reader, +@@ -495,7 +495,8 @@ static void request_control_initiate(xmlTextReaderPtr reader, if (child) { status = charon->controller->initiate(charon->controller, @@ -271,10 +271,10 @@ index b033c832c..f8d1be745 100644 { write_fifo(this, "connection '%s' established\n", name); diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c -index 522122562..b1486e337 100644 +index c858e9945..a42ebf041 100644 --- a/src/libcharon/plugins/vici/vici_config.c +++ b/src/libcharon/plugins/vici/vici_config.c -@@ -2252,7 +2252,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg, +@@ -2277,7 +2277,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg, DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg)); charon->controller->initiate(charon->controller, peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg), @@ -419,7 +419,7 @@ index 122e5cee9..dec458c84 100644 } children->destroy(children); diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c -index fc31c2a7c..0836b8c78 100644 +index 7763ae844..3fb9d4c35 100644 --- a/src/libcharon/sa/ike_sa_manager.c +++ b/src/libcharon/sa/ike_sa_manager.c @@ -16,6 +16,28 @@ @@ -451,7 +451,7 @@ index fc31c2a7c..0836b8c78 100644 #include #include -@@ -1497,7 +1519,8 @@ typedef struct { +@@ -1498,7 +1520,8 @@ typedef struct { } config_entry_t; METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, @@ -461,7 +461,7 @@ index fc31c2a7c..0836b8c78 100644 { enumerator_t *enumerator; entry_t *entry; -@@ -1508,7 +1531,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, +@@ -1509,7 +1532,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, u_int segment; int i; @@ -479,7 +479,7 @@ index fc31c2a7c..0836b8c78 100644 if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1) { /* IKE_SA reuse disabled by config (not possible for IKEv1) */ -@@ -1566,6 +1598,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, +@@ -1567,6 +1599,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, continue; } @@ -495,7 +495,7 @@ index fc31c2a7c..0836b8c78 100644 current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); if (current_peer && current_peer->equals(current_peer, peer_cfg)) { -@@ -1592,6 +1633,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, +@@ -1593,6 +1634,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, { ike_sa->set_peer_cfg(ike_sa, peer_cfg); checkout_new(this, ike_sa); @@ -535,7 +535,7 @@ index 004cc2216..56ef869be 100644 /** * Reset initiator SPI. diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c -index d8d8a421a..f458ee0f1 100644 +index 1b85c66a5..f8c87437f 100644 --- a/src/libcharon/sa/trap_manager.c +++ b/src/libcharon/sa/trap_manager.c @@ -523,7 +523,7 @@ METHOD(trap_manager_t, acquire, void, @@ -544,10 +544,10 @@ index d8d8a421a..f458ee0f1 100644 ike_sa_t *ike_sa; - host_t *host; + host_t *host, *my_host = NULL, *other_host = NULL; + uint32_t allocated_reqid; bool wildcard, ignore = FALSE; - this->lock->read_lock(this->lock); -@@ -600,36 +600,26 @@ METHOD(trap_manager_t, acquire, void, +@@ -603,36 +603,26 @@ METHOD(trap_manager_t, acquire, void, this->lock->unlock(this->lock); if (wildcard) @@ -680,5 +680,5 @@ index e0fffb907..dcaded59d 100644 {"raw", 'r', 0, "dump raw response message"}, {"pretty", 'P', 0, "dump raw response message in pretty print"}, -- -2.41.0 +2.45.2 diff --git a/0002-vici-send-certificates-for-ike-sa-events.patch b/0002-vici-send-certificates-for-ike-sa-events.patch index d4cdbf5..6f82da2 100644 --- a/0002-vici-send-certificates-for-ike-sa-events.patch +++ b/0002-vici-send-certificates-for-ike-sa-events.patch @@ -1,7 +1,7 @@ -From 0a1ee45f16f61cb68f526aeacd58ed275e7d8c48 Mon Sep 17 00:00:00 2001 +From 52e75a6cd16853a04e824ba2bac32c8acfd5f25c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= Date: Mon, 21 Sep 2015 13:42:05 +0300 -Subject: [PATCH 2/3] vici: send certificates for ike-sa events +Subject: [PATCH 2/4] vici: send certificates for ike-sa events MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -136,5 +136,5 @@ index bacb7b101..19acc0789 100644 b->begin_section(b, old->get_name(old)); -- -2.41.0 +2.45.2 diff --git a/0003-vici-add-support-for-individual-sa-state-changes.patch b/0003-vici-add-support-for-individual-sa-state-changes.patch index b47c271..1c0328b 100644 --- a/0003-vici-add-support-for-individual-sa-state-changes.patch +++ b/0003-vici-add-support-for-individual-sa-state-changes.patch @@ -1,7 +1,7 @@ -From 39f70df4d1846f9044c270fa8cb6149d42067736 Mon Sep 17 00:00:00 2001 +From 91c63d771622863b2f4de1dbada28f82e2d21d7c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= Date: Mon, 21 Sep 2015 13:42:11 +0300 -Subject: [PATCH 3/3] vici: add support for individual sa state changes +Subject: [PATCH 3/4] vici: add support for individual sa state changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -156,5 +156,5 @@ index 19acc0789..fa1aca953 100644 .destroy = _destroy, }, -- -2.41.0 +2.45.2 diff --git a/0004-Support-GRE-key-in-selectors.patch b/0004-Support-GRE-key-in-selectors.patch index 1329739..7b828d4 100644 --- a/0004-Support-GRE-key-in-selectors.patch +++ b/0004-Support-GRE-key-in-selectors.patch @@ -1,20 +1,21 @@ -From 027c90f6808d451f3bbcd4b2dc4b8ad04806dc64 Mon Sep 17 00:00:00 2001 +From 1e0d5415c1cd61df50fa27219d9ca8f76b497c6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= Date: Sun, 21 Jan 2024 03:11:32 +0100 Subject: [PATCH 4/4] Support GRE key in selectors. --- - .../kernel_netlink/kernel_netlink_ipsec.c | 12 +++++++++++ - .../plugins/load_tester/load_tester_config.c | 16 ++++++++++++++ - src/libcharon/plugins/stroke/stroke_config.c | 15 +++++++++++++ - src/libcharon/plugins/vici/vici_config.c | 21 ++++++++++++++++++- - .../selectors/traffic_selector.c | 20 ++++++++++++++++++ - .../selectors/traffic_selector.h | 12 +++++++++++ - src/starter/confread.c | 18 ++++++++++++++++ - 7 files changed, 113 insertions(+), 1 deletion(-) + .../kernel_netlink/kernel_netlink_ipsec.c | 20 ++++++++++++ + .../plugins/load_tester/load_tester_config.c | 22 ++++++++++++- + src/libcharon/plugins/stroke/stroke_config.c | 22 ++++++++++++- + src/libcharon/plugins/vici/vici_config.c | 32 ++++++++++++++++++- + .../selectors/traffic_selector.c | 20 ++++++++++++ + .../selectors/traffic_selector.h | 12 +++++++ + src/starter/confread.c | 24 +++++++++++++- + src/swanctl/swanctl.opt | 3 ++ + 8 files changed, 151 insertions(+), 4 deletions(-) diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c -index 7596f0c18..fdfc9d51e 100644 +index db0b2ac37..e4e7d9ecb 100644 --- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c +++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c @@ -864,6 +864,7 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src, @@ -25,7 +26,7 @@ index 7596f0c18..fdfc9d51e 100644 memset(&sel, 0, sizeof(sel)); sel.family = (src->get_type(src) == TS_IPV4_ADDR_RANGE) ? AF_INET : AF_INET6; -@@ -884,6 +885,17 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src, +@@ -884,6 +885,25 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src, sel.dport = htons(traffic_selector_icmp_code(port)); sel.dport_mask = sel.dport ? ~0 : 0; } @@ -34,115 +35,135 @@ index 7596f0c18..fdfc9d51e 100644 + /* the kernel expects the GRE key in the source and destination + * port fields, respectively. */ + gre_key = htons(traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst))); -+ DBG2(DBG_KNL, "Policy GRE key: %d (%d-%d) %d", gre_key, dst->get_from_port(dst), dst->get_to_port(dst), traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst))); -+ sel.sport = gre_key >> 16; -+ sel.sport_mask = ~0; -+ sel.dport = gre_key & 0xffff; -+ sel.dport_mask = ~0; ++ if ( gre_key != 0 ) ++ { ++ DBG2(DBG_KNL, "Policy GRE key: %d (%d-%d) %d", gre_key, dst->get_from_port(dst), dst->get_to_port(dst), traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst))); ++ sel.sport = gre_key >> 16; ++ sel.sport_mask = ~0; ++ sel.dport = gre_key & 0xffff; ++ sel.dport_mask = ~0; ++ } else { ++ sel.sport = 0; ++ sel.sport_mask = 0; ++ sel.dport = 0; ++ sel.dport_mask = 0; ++ } + } sel.ifindex = interface ? if_nametoindex(interface) : 0; sel.user = 0; diff --git a/src/libcharon/plugins/load_tester/load_tester_config.c b/src/libcharon/plugins/load_tester/load_tester_config.c -index 58e1cd98a..436116361 100644 +index 58e1cd98a..ac67875d8 100644 --- a/src/libcharon/plugins/load_tester/load_tester_config.c +++ b/src/libcharon/plugins/load_tester/load_tester_config.c -@@ -16,6 +16,8 @@ - - #include "load_tester_config.h" - -+#include -+ - #include - - #include -@@ -512,6 +514,20 @@ static bool parse_protoport(char *token, uint16_t *from_port, - { - *from_port = *to_port = 0; - } -+ else if (*port && *protocol == IPPROTO_GRE) -+ { -+ p = strtol(port, &endptr, 0); -+ if (p < 0 || p > 0xffffffff) -+ { -+ return FALSE; -+ } -+ end->from_port = (p >> 16) & 0xffff; -+ end->to_port = p & 0xffff; -+ if (*endptr) -+ { -+ return FALSE; -+ } -+ } - else if (*port) - { - svc = getservbyname(port, NULL); -diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c -index 55db379ff..9ee4c6463 100644 ---- a/src/libcharon/plugins/stroke/stroke_config.c -+++ b/src/libcharon/plugins/stroke/stroke_config.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - - #include - -@@ -937,6 +938,20 @@ static bool parse_protoport(char *token, uint16_t *from_port, - *from_port = 0xffff; - *to_port = 0; - } -+ else if (*port && *protocol == IPPROTO_GRE) -+ { -+ p = strtol(port, &endptr, 0); -+ if (p < 0 || p > 0xffffffff) -+ { -+ return FALSE; -+ } -+ *from_port = (p >> 16) & 0xffff; -+ *to_port = p & 0xffff; -+ if (*endptr) -+ { -+ return FALSE; -+ } -+ } - else if (*port) - { - svc = getservbyname(port, NULL); -diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c -index b1486e337..35c4df1b0 100644 ---- a/src/libcharon/plugins/vici/vici_config.c -+++ b/src/libcharon/plugins/vici/vici_config.c -@@ -718,7 +718,25 @@ CALLBACK(parse_ts, bool, - from = 0xffff; - to = 0; +@@ -498,7 +498,27 @@ static bool parse_protoport(char *token, uint16_t *from_port, + *protocol = (uint8_t)p; } -- else if (*port && !streq(port, "any")) -+ else if (*port && !streq(port, "any") && proto == IPPROTO_GRE) + } +- if (streq(port, "%any")) ++ if (*protocol == IPPROTO_GRE) ++ { ++ if (*port && !streq(port, "%any")) + { -+ DBG2(DBG_CFG, " GRE key %s", port); -+ p = strtol(port, &end, 0); ++ p = strtol(port, &endptr, 0); + if (p < 0 || p > 0xffffffff) + { -+ DBG2(DBG_CFG, " Invalid GRE key %s", port); + return FALSE; + } -+ from = (p >> 16) & 0xffff; -+ to = p & 0xffff; -+ DBG2(DBG_CFG, " Parsed GRE key %d-%d(%d)", from, to, p); -+ if (*end) ++ end->from_port = (p >> 16) & 0xffff; ++ end->to_port = p & 0xffff; ++ if (*endptr) + { -+ DBG2(DBG_CFG, " Invalid GRE key %s", port); + return FALSE; + } ++ } else { ++ end->from_port = 0; ++ end->to_port = 0; ++ } ++ } ++ else if (streq(port, "%any")) + { + *from_port = 0; + *to_port = 0xffff; +diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c +index 55db379ff..b4340b8d1 100644 +--- a/src/libcharon/plugins/stroke/stroke_config.c ++++ b/src/libcharon/plugins/stroke/stroke_config.c +@@ -927,7 +927,27 @@ static bool parse_protoport(char *token, uint16_t *from_port, + *protocol = (uint8_t)p; + } + } +- if (streq(port, "%any")) ++ if (*protocol == IPPROTO_GRE) ++ { ++ if (*port && !streq(port, "%any")) ++ { ++ p = strtol(port, &endptr, 0); ++ if (p < 0 || p > 0xffffffff) ++ { ++ return FALSE; ++ } ++ *from_port = (p >> 16) & 0xffff; ++ *to_port = p & 0xffff; ++ if (*endptr) ++ return FALSE; ++ } ++ else ++ { ++ *from_port = 0; ++ *to_port = 0; ++ } ++ } ++ else if (streq(port, "%any")) + { + *from_port = 0; + *to_port = 0xffff; +diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c +index a42ebf041..53306f30d 100644 +--- a/src/libcharon/plugins/vici/vici_config.c ++++ b/src/libcharon/plugins/vici/vici_config.c +@@ -715,7 +715,31 @@ CALLBACK(parse_ts, bool, + proto = (uint8_t)p; + } + } +- if (streq(port, "opaque")) ++ if (proto == IPPROTO_GRE) ++ { ++ if (*port && !streq(port, "any")) ++ { ++ DBG2(DBG_CFG, " GRE key %s", port); ++ p = strtol(port, &end, 0); ++ if (p < 0 || p > 0xffffffff) ++ { ++ DBG2(DBG_CFG, " Invalid GRE key %s", port); ++ return FALSE; ++ } ++ from = (p >> 16) & 0xffff; ++ to = p & 0xffff; ++ DBG2(DBG_CFG, " Parsed GRE key %d-%d(%d)", from, to, p); ++ if (*end) ++ { ++ DBG2(DBG_CFG, " Invalid GRE key %s", port); ++ return FALSE; ++ } ++ } else { ++ from = 0; ++ to = 0; ++ } + } -+ else if (*port && !streq(port, "any") && proto != IPPROTO_GRE) ++ else if (streq(port, "opaque")) { - svc = getservbyname(port, NULL); - if (svc) -@@ -752,6 +770,7 @@ CALLBACK(parse_ts, bool, + from = 0xffff; + to = 0; +@@ -752,8 +776,14 @@ CALLBACK(parse_ts, bool, + } + } } ++ else if (proto == IPPROTO_GRE) ++ { ++ from = 0; ++ to = 0; ++ } if (streq(buf, "dynamic")) { + DBG2(DBG_CFG, " Create dynamic selector GRE key proto=%d, from_port=%d, to_port=%d", proto, from, to); @@ -150,7 +171,7 @@ index b1486e337..35c4df1b0 100644 } else if (strchr(buf, '-')) diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c -index fe61e3768..29ffbffbd 100644 +index fe61e3768..09757ec36 100644 --- a/src/libstrongswan/selectors/traffic_selector.c +++ b/src/libstrongswan/selectors/traffic_selector.c @@ -205,6 +205,18 @@ static int print_icmp(printf_hook_data_t *data, uint16_t port) @@ -183,17 +204,17 @@ index fe61e3768..29ffbffbd 100644 else { serv = getservbyport(htons(this->from_port), serv_proto); -@@ -343,6 +359,10 @@ int traffic_selector_printf_hook(printf_hook_data_t *data, - written += print_in_hook(data, "-"); - written += print_icmp(data, this->to_port); +@@ -332,6 +348,10 @@ int traffic_selector_printf_hook(printf_hook_data_t *data, + } + } } + else if (this->protocol == IPPROTO_GRE) + { + written += print_gre(data, this->from_port, this->to_port); + } - else + else if (is_opaque(this)) { - written += print_in_hook(data, "%d-%d", + written += print_in_hook(data, "OPAQUE"); diff --git a/src/libstrongswan/selectors/traffic_selector.h b/src/libstrongswan/selectors/traffic_selector.h index 367b4fff9..b7010e4a7 100644 --- a/src/libstrongswan/selectors/traffic_selector.h @@ -218,41 +239,54 @@ index 367b4fff9..b7010e4a7 100644 * Compare two traffic selectors, usable as sort function * diff --git a/src/starter/confread.c b/src/starter/confread.c -index 5065bc369..e2c03694d 100644 +index 5065bc369..039b6f402 100644 --- a/src/starter/confread.c +++ b/src/starter/confread.c -@@ -25,6 +25,7 @@ - - #include - #include -+#include - - #include "keywords.h" - #include "confread.h" -@@ -335,6 +336,23 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token, - end->from_port = 0xffff; - end->to_port = 0; +@@ -325,7 +325,29 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token, + end->protocol = (uint8_t)p; + } } -+ else if (*port && end->protocol == IPPROTO_GRE) +- if (streq(port, "%any")) ++ if (end->protocol == IPPROTO_GRE) + { -+ DBG1(DBG_APP, "# GRE key: %s=%s", key, port); -+ p = strtol(port, &endptr, 0); -+ if (p < 0 || p > 0xffffffff) ++ if (*port && !streq(port, "%any")) + { -+ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port); -+ goto err; -+ } -+ end->from_port = (p >> 16) & 0xffff; -+ end->to_port = p & 0xffff; -+ if (*endptr) -+ { -+ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port); -+ goto err; ++ p = strtol(port, &endptr, 0); ++ if (p < 0 || p > 0xffffffff) ++ { ++ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port); ++ goto err; ++ } ++ end->from_port = (p >> 16) & 0xffff; ++ end->to_port = p & 0xffff; ++ if (*endptr) ++ { ++ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port); ++ goto err; ++ } ++ } else { ++ end->from_port = 0; ++ end->to_port = 0; + } + } - else if (*port) ++ else if (streq(port, "%any")) { - svc = getservbyname(port, NULL); + end->from_port = 0; + end->to_port = 0xffff; +diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt +index d9fd949ed..1d63dadb8 100644 +--- a/src/swanctl/swanctl.opt ++++ b/src/swanctl/swanctl.opt +@@ -765,6 +765,9 @@ connections..children..local_ts = dynamic + value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified + as well, none of the kernel backends currently support port ranges, though. + ++ If protocol is restricted to GRE, port restriction specifies GRE key ++ in 32 bit numeric form eg. dynamic[gre/100]. ++ + When IKEv1 is used only the first selector is interpreted, except if + the Cisco Unity extension plugin is used. This is due to a limitation of the + IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA. -- -2.43.0 +2.45.2