rpms-fedora-extras/strongswan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

5.9.14 - Old patches

Browse Source
This commit is contained in:
Zoran Peričić
2024-09-18 13:06:59 +02:00
parent d7e57af704
commit f978fcb51f
4 changed files with 194 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
0001-charon-add-optional-source-and-remote-overrides-for-.patch
View File

@@ -1,7 +1,7 @@
From ec53b2914730f08d151d14e9b48557196ec0cc49 Mon Sep 17 00:00:00 2001 From 921093c4c0d4be10a74f148536029fb46fd31966 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:41:58 +0300 Date: Mon, 21 Sep 2015 13:41:58 +0300
Subject: [PATCH 1/3] charon: add optional source and remote overrides for Subject: [PATCH 1/4] charon: add optional source and remote overrides for
initiate initiate
MIME-Version: 1.0 MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8 Content-Type: text/plain; charset=UTF-8
@@ -38,7 +38,7 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
21 files changed, 225 insertions(+), 50 deletions(-) 21 files changed, 225 insertions(+), 50 deletions(-)
diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
index 2e2cb3ca2..b9369a8a2 100644 index 8e8d8236e..7df5bc9bf 100644
--- a/src/charon-cmd/cmd/cmd_connection.c --- a/src/charon-cmd/cmd/cmd_connection.c
+++ b/src/charon-cmd/cmd/cmd_connection.c +++ b/src/charon-cmd/cmd/cmd_connection.c
@@ -439,7 +439,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this) @@ -439,7 +439,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
@@ -51,10 +51,10 @@ index 2e2cb3ca2..b9369a8a2 100644
terminate(pid); terminate(pid);
} }
diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c
index 7f88514a7..4c3491984 100644 index 8570ef0e3..bc74f1b90 100644
--- a/src/charon-nm/nm/nm_service.c --- a/src/charon-nm/nm/nm_service.c
+++ b/src/charon-nm/nm/nm_service.c +++ b/src/charon-nm/nm/nm_service.c
@@ -942,7 +942,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection, @@ -982,7 +982,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
* Prepare IKE_SA * Prepare IKE_SA
*/ */
ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
@@ -207,7 +207,7 @@ index 695e75b83..e3f740281 100644
if (s) if (s)
{ {
diff --git a/src/libcharon/plugins/medcli/medcli_config.c b/src/libcharon/plugins/medcli/medcli_config.c diff --git a/src/libcharon/plugins/medcli/medcli_config.c b/src/libcharon/plugins/medcli/medcli_config.c
index 3211a49f1..f98b3eac8 100644 index 59a9358a1..6e322a9c1 100644
--- a/src/libcharon/plugins/medcli/medcli_config.c --- a/src/libcharon/plugins/medcli/medcli_config.c
+++ b/src/libcharon/plugins/medcli/medcli_config.c +++ b/src/libcharon/plugins/medcli/medcli_config.c
@@ -350,7 +350,7 @@ static job_requeue_t initiate_config(peer_cfg_t *peer_cfg) @@ -350,7 +350,7 @@ static job_requeue_t initiate_config(peer_cfg_t *peer_cfg)
@@ -220,10 +220,10 @@ index 3211a49f1..f98b3eac8 100644
else else
{ {
diff --git a/src/libcharon/plugins/smp/smp.c b/src/libcharon/plugins/smp/smp.c diff --git a/src/libcharon/plugins/smp/smp.c b/src/libcharon/plugins/smp/smp.c
index 91dddfeaa..1e9326822 100644 index 6ca9f1399..31a4e1d63 100644
--- a/src/libcharon/plugins/smp/smp.c --- a/src/libcharon/plugins/smp/smp.c
+++ b/src/libcharon/plugins/smp/smp.c +++ b/src/libcharon/plugins/smp/smp.c
@@ -494,7 +494,8 @@ static void request_control_initiate(xmlTextReaderPtr reader, @@ -495,7 +495,8 @@ static void request_control_initiate(xmlTextReaderPtr reader,
if (child) if (child)
{ {
status = charon->controller->initiate(charon->controller, status = charon->controller->initiate(charon->controller,
@@ -271,10 +271,10 @@ index b033c832c..f8d1be745 100644
{ {
write_fifo(this, "connection '%s' established\n", name); write_fifo(this, "connection '%s' established\n", name);
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index 522122562..b1486e337 100644 index c858e9945..a42ebf041 100644
--- a/src/libcharon/plugins/vici/vici_config.c --- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c +++ b/src/libcharon/plugins/vici/vici_config.c
@@ -2252,7 +2252,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg, @@ -2277,7 +2277,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg)); DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
charon->controller->initiate(charon->controller, charon->controller->initiate(charon->controller,
peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg), peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg),
@@ -419,7 +419,7 @@ index 122e5cee9..dec458c84 100644
} }
children->destroy(children); children->destroy(children);
diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
index fc31c2a7c..0836b8c78 100644 index 7763ae844..3fb9d4c35 100644
--- a/src/libcharon/sa/ike_sa_manager.c --- a/src/libcharon/sa/ike_sa_manager.c
+++ b/src/libcharon/sa/ike_sa_manager.c +++ b/src/libcharon/sa/ike_sa_manager.c
@@ -16,6 +16,28 @@ @@ -16,6 +16,28 @@
@@ -451,7 +451,7 @@ index fc31c2a7c..0836b8c78 100644
#include <string.h> #include <string.h>
#include <inttypes.h> #include <inttypes.h>
@@ -1497,7 +1519,8 @@ typedef struct { @@ -1498,7 +1520,8 @@ typedef struct {
} config_entry_t; } config_entry_t;
METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -461,7 +461,7 @@ index fc31c2a7c..0836b8c78 100644
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
entry_t *entry; entry_t *entry;
@@ -1508,7 +1531,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, @@ -1509,7 +1532,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
u_int segment; u_int segment;
int i; int i;
@@ -479,7 +479,7 @@ index fc31c2a7c..0836b8c78 100644
if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1) if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1)
{ /* IKE_SA reuse disabled by config (not possible for IKEv1) */ { /* IKE_SA reuse disabled by config (not possible for IKEv1) */
@@ -1566,6 +1598,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, @@ -1567,6 +1599,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
continue; continue;
} }
@@ -495,7 +495,7 @@ index fc31c2a7c..0836b8c78 100644
current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
if (current_peer && current_peer->equals(current_peer, peer_cfg)) if (current_peer && current_peer->equals(current_peer, peer_cfg))
{ {
@@ -1592,6 +1633,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, @@ -1593,6 +1634,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
{ {
ike_sa->set_peer_cfg(ike_sa, peer_cfg); ike_sa->set_peer_cfg(ike_sa, peer_cfg);
checkout_new(this, ike_sa); checkout_new(this, ike_sa);
@@ -535,7 +535,7 @@ index 004cc2216..56ef869be 100644
/** /**
* Reset initiator SPI. * Reset initiator SPI.
diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
index d8d8a421a..f458ee0f1 100644 index 1b85c66a5..f8c87437f 100644
--- a/src/libcharon/sa/trap_manager.c --- a/src/libcharon/sa/trap_manager.c
+++ b/src/libcharon/sa/trap_manager.c +++ b/src/libcharon/sa/trap_manager.c
@@ -523,7 +523,7 @@ METHOD(trap_manager_t, acquire, void, @@ -523,7 +523,7 @@ METHOD(trap_manager_t, acquire, void,
@@ -544,10 +544,10 @@ index d8d8a421a..f458ee0f1 100644
ike_sa_t *ike_sa; ike_sa_t *ike_sa;
- host_t *host; - host_t *host;
+ host_t *host, *my_host = NULL, *other_host = NULL; + host_t *host, *my_host = NULL, *other_host = NULL;
uint32_t allocated_reqid;
bool wildcard, ignore = FALSE; bool wildcard, ignore = FALSE;
this->lock->read_lock(this->lock); @@ -603,36 +603,26 @@ METHOD(trap_manager_t, acquire, void,
@@ -600,36 +600,26 @@ METHOD(trap_manager_t, acquire, void,
this->lock->unlock(this->lock); this->lock->unlock(this->lock);
if (wildcard) if (wildcard)
@@ -680,5 +680,5 @@ index e0fffb907..dcaded59d 100644
{"raw", 'r', 0, "dump raw response message"}, {"raw", 'r', 0, "dump raw response message"},
{"pretty", 'P', 0, "dump raw response message in pretty print"}, {"pretty", 'P', 0, "dump raw response message in pretty print"},
-- --
2.41.0 2.45.2

6
0002-vici-send-certificates-for-ike-sa-events.patch
View File

@@ -1,7 +1,7 @@
From 0a1ee45f16f61cb68f526aeacd58ed275e7d8c48 Mon Sep 17 00:00:00 2001 From 52e75a6cd16853a04e824ba2bac32c8acfd5f25c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:42:05 +0300 Date: Mon, 21 Sep 2015 13:42:05 +0300
Subject: [PATCH 2/3] vici: send certificates for ike-sa events Subject: [PATCH 2/4] vici: send certificates for ike-sa events
MIME-Version: 1.0 MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8 Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit
@@ -136,5 +136,5 @@ index bacb7b101..19acc0789 100644
b->begin_section(b, old->get_name(old)); b->begin_section(b, old->get_name(old));
-- --
2.41.0 2.45.2

6
0003-vici-add-support-for-individual-sa-state-changes.patch
View File

@@ -1,7 +1,7 @@
From 39f70df4d1846f9044c270fa8cb6149d42067736 Mon Sep 17 00:00:00 2001 From 91c63d771622863b2f4de1dbada28f82e2d21d7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:42:11 +0300 Date: Mon, 21 Sep 2015 13:42:11 +0300
Subject: [PATCH 3/3] vici: add support for individual sa state changes Subject: [PATCH 3/4] vici: add support for individual sa state changes
MIME-Version: 1.0 MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8 Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit
@@ -156,5 +156,5 @@ index 19acc0789..fa1aca953 100644
.destroy = _destroy, .destroy = _destroy,
}, },
-- --
2.41.0 2.45.2

304
0004-Support-GRE-key-in-selectors.patch
View File

@@ -1,20 +1,21 @@
From 027c90f6808d451f3bbcd4b2dc4b8ad04806dc64 Mon Sep 17 00:00:00 2001 From 1e0d5415c1cd61df50fa27219d9ca8f76b497c6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= <zoran.pericic@infomaas.com> From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= <zoran.pericic@infomaas.com>
Date: Sun, 21 Jan 2024 03:11:32 +0100 Date: Sun, 21 Jan 2024 03:11:32 +0100
Subject: [PATCH 4/4] Support GRE key in selectors. Subject: [PATCH 4/4] Support GRE key in selectors.
--- ---
.../kernel_netlink/kernel_netlink_ipsec.c | 12 +++++++++++ .../kernel_netlink/kernel_netlink_ipsec.c | 20 ++++++++++++
.../plugins/load_tester/load_tester_config.c | 16 ++++++++++++++ .../plugins/load_tester/load_tester_config.c | 22 ++++++++++++-
src/libcharon/plugins/stroke/stroke_config.c | 15 +++++++++++++ src/libcharon/plugins/stroke/stroke_config.c | 22 ++++++++++++-
src/libcharon/plugins/vici/vici_config.c | 21 ++++++++++++++++++- src/libcharon/plugins/vici/vici_config.c | 32 ++++++++++++++++++-
.../selectors/traffic_selector.c | 20 ++++++++++++++++++ .../selectors/traffic_selector.c | 20 ++++++++++++
.../selectors/traffic_selector.h | 12 +++++++++++ .../selectors/traffic_selector.h | 12 +++++++
src/starter/confread.c | 18 ++++++++++++++++ src/starter/confread.c | 24 +++++++++++++-
7 files changed, 113 insertions(+), 1 deletion(-) src/swanctl/swanctl.opt | 3 ++
8 files changed, 151 insertions(+), 4 deletions(-)
diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
index 7596f0c18..fdfc9d51e 100644 index db0b2ac37..e4e7d9ecb 100644
--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c --- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c +++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -864,6 +864,7 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src, @@ -864,6 +864,7 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
@@ -25,7 +26,7 @@ index 7596f0c18..fdfc9d51e 100644
memset(&sel, 0, sizeof(sel)); memset(&sel, 0, sizeof(sel));
sel.family = (src->get_type(src) == TS_IPV4_ADDR_RANGE) ? AF_INET : AF_INET6; sel.family = (src->get_type(src) == TS_IPV4_ADDR_RANGE) ? AF_INET : AF_INET6;
@@ -884,6 +885,17 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src, @@ -884,6 +885,25 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
sel.dport = htons(traffic_selector_icmp_code(port)); sel.dport = htons(traffic_selector_icmp_code(port));
sel.dport_mask = sel.dport ? ~0 : 0; sel.dport_mask = sel.dport ? ~0 : 0;
} }
@@ -34,115 +35,135 @@ index 7596f0c18..fdfc9d51e 100644
+ /* the kernel expects the GRE key in the source and destination + /* the kernel expects the GRE key in the source and destination
+ * port fields, respectively. */ + * port fields, respectively. */
+ gre_key = htons(traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst))); + gre_key = htons(traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst)));
+ DBG2(DBG_KNL, "Policy GRE key: %d (%d-%d) %d", gre_key, dst->get_from_port(dst), dst->get_to_port(dst), traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst))); + if ( gre_key != 0 )
+ sel.sport = gre_key >> 16; + {
+ sel.sport_mask = ~0; + DBG2(DBG_KNL, "Policy GRE key: %d (%d-%d) %d", gre_key, dst->get_from_port(dst), dst->get_to_port(dst), traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst)));
+ sel.dport = gre_key & 0xffff; + sel.sport = gre_key >> 16;
+ sel.dport_mask = ~0; + sel.sport_mask = ~0;
+ sel.dport = gre_key & 0xffff;
+ sel.dport_mask = ~0;
+ } else {
+ sel.sport = 0;
+ sel.sport_mask = 0;
+ sel.dport = 0;
+ sel.dport_mask = 0;
+ }
+ } + }
sel.ifindex = interface ? if_nametoindex(interface) : 0; sel.ifindex = interface ? if_nametoindex(interface) : 0;
sel.user = 0; sel.user = 0;
diff --git a/src/libcharon/plugins/load_tester/load_tester_config.c b/src/libcharon/plugins/load_tester/load_tester_config.c diff --git a/src/libcharon/plugins/load_tester/load_tester_config.c b/src/libcharon/plugins/load_tester/load_tester_config.c
index 58e1cd98a..436116361 100644 index 58e1cd98a..ac67875d8 100644
--- a/src/libcharon/plugins/load_tester/load_tester_config.c --- a/src/libcharon/plugins/load_tester/load_tester_config.c
+++ b/src/libcharon/plugins/load_tester/load_tester_config.c +++ b/src/libcharon/plugins/load_tester/load_tester_config.c
@@ -16,6 +16,8 @@ @@ -498,7 +498,27 @@ static bool parse_protoport(char *token, uint16_t *from_port,
*protocol = (uint8_t)p;
#include "load_tester_config.h"
+#include <utils/utils.h>
+
#include <netdb.h>
#include <daemon.h>
@@ -512,6 +514,20 @@ static bool parse_protoport(char *token, uint16_t *from_port,
{
*from_port = *to_port = 0;
}
+ else if (*port && *protocol == IPPROTO_GRE)
+ {
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ return FALSE;
+ }
+ end->from_port = (p >> 16) & 0xffff;
+ end->to_port = p & 0xffff;
+ if (*endptr)
+ {
+ return FALSE;
+ }
+ }
else if (*port)
{
svc = getservbyname(port, NULL);
diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index 55db379ff..9ee4c6463 100644
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -20,6 +20,7 @@
#include <daemon.h>
#include <threading/mutex.h>
#include <utils/lexparser.h>
+#include <utils/utils.h>
#include <netdb.h>
@@ -937,6 +938,20 @@ static bool parse_protoport(char *token, uint16_t *from_port,
*from_port = 0xffff;
*to_port = 0;
}
+ else if (*port && *protocol == IPPROTO_GRE)
+ {
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ return FALSE;
+ }
+ *from_port = (p >> 16) & 0xffff;
+ *to_port = p & 0xffff;
+ if (*endptr)
+ {
+ return FALSE;
+ }
+ }
else if (*port)
{
svc = getservbyname(port, NULL);
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index b1486e337..35c4df1b0 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -718,7 +718,25 @@ CALLBACK(parse_ts, bool,
from = 0xffff;
to = 0;
} }
- else if (*port && !streq(port, "any")) }
+ else if (*port && !streq(port, "any") && proto == IPPROTO_GRE) - if (streq(port, "%any"))
+ if (*protocol == IPPROTO_GRE)
+ {
+ if (*port && !streq(port, "%any"))
+ { + {
+ DBG2(DBG_CFG, " GRE key %s", port); + p = strtol(port, &endptr, 0);
+ p = strtol(port, &end, 0);
+ if (p < 0 || p > 0xffffffff) + if (p < 0 || p > 0xffffffff)
+ { + {
+ DBG2(DBG_CFG, " Invalid GRE key %s", port);
+ return FALSE; + return FALSE;
+ } + }
+ from = (p >> 16) & 0xffff; + end->from_port = (p >> 16) & 0xffff;
+ to = p & 0xffff; + end->to_port = p & 0xffff;
+ DBG2(DBG_CFG, " Parsed GRE key %d-%d(%d)", from, to, p); + if (*endptr)
+ if (*end)
+ { + {
+ DBG2(DBG_CFG, " Invalid GRE key %s", port);
+ return FALSE; + return FALSE;
+ } + }
+ } else {
+ end->from_port = 0;
+ end->to_port = 0;
+ }
+ }
+ else if (streq(port, "%any"))
{
*from_port = 0;
*to_port = 0xffff;
diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index 55db379ff..b4340b8d1 100644
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -927,7 +927,27 @@ static bool parse_protoport(char *token, uint16_t *from_port,
*protocol = (uint8_t)p;
}
}
- if (streq(port, "%any"))
+ if (*protocol == IPPROTO_GRE)
+ {
+ if (*port && !streq(port, "%any"))
+ {
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ return FALSE;
+ }
+ *from_port = (p >> 16) & 0xffff;
+ *to_port = p & 0xffff;
+ if (*endptr)
+ return FALSE;
+ }
+ else
+ {
+ *from_port = 0;
+ *to_port = 0;
+ }
+ }
+ else if (streq(port, "%any"))
{
*from_port = 0;
*to_port = 0xffff;
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index a42ebf041..53306f30d 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -715,7 +715,31 @@ CALLBACK(parse_ts, bool,
proto = (uint8_t)p;
}
}
- if (streq(port, "opaque"))
+ if (proto == IPPROTO_GRE)
+ {
+ if (*port && !streq(port, "any"))
+ {
+ DBG2(DBG_CFG, " GRE key %s", port);
+ p = strtol(port, &end, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ DBG2(DBG_CFG, " Invalid GRE key %s", port);
+ return FALSE;
+ }
+ from = (p >> 16) & 0xffff;
+ to = p & 0xffff;
+ DBG2(DBG_CFG, " Parsed GRE key %d-%d(%d)", from, to, p);
+ if (*end)
+ {
+ DBG2(DBG_CFG, " Invalid GRE key %s", port);
+ return FALSE;
+ }
+ } else {
+ from = 0;
+ to = 0;
+ }
+ } + }
+ else if (*port && !streq(port, "any") && proto != IPPROTO_GRE) + else if (streq(port, "opaque"))
{ {
svc = getservbyname(port, NULL); from = 0xffff;
if (svc) to = 0;
@@ -752,6 +770,7 @@ CALLBACK(parse_ts, bool, @@ -752,8 +776,14 @@ CALLBACK(parse_ts, bool,
}
}
} }
+ else if (proto == IPPROTO_GRE)
+ {
+ from = 0;
+ to = 0;
+ }
if (streq(buf, "dynamic")) if (streq(buf, "dynamic"))
{ {
+ DBG2(DBG_CFG, " Create dynamic selector GRE key proto=%d, from_port=%d, to_port=%d", proto, from, to); + DBG2(DBG_CFG, " Create dynamic selector GRE key proto=%d, from_port=%d, to_port=%d", proto, from, to);
@@ -150,7 +171,7 @@ index b1486e337..35c4df1b0 100644
} }
else if (strchr(buf, '-')) else if (strchr(buf, '-'))
diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c
index fe61e3768..29ffbffbd 100644 index fe61e3768..09757ec36 100644
--- a/src/libstrongswan/selectors/traffic_selector.c --- a/src/libstrongswan/selectors/traffic_selector.c
+++ b/src/libstrongswan/selectors/traffic_selector.c +++ b/src/libstrongswan/selectors/traffic_selector.c
@@ -205,6 +205,18 @@ static int print_icmp(printf_hook_data_t *data, uint16_t port) @@ -205,6 +205,18 @@ static int print_icmp(printf_hook_data_t *data, uint16_t port)
@@ -183,17 +204,17 @@ index fe61e3768..29ffbffbd 100644
else else
{ {
serv = getservbyport(htons(this->from_port), serv_proto); serv = getservbyport(htons(this->from_port), serv_proto);
@@ -343,6 +359,10 @@ int traffic_selector_printf_hook(printf_hook_data_t *data, @@ -332,6 +348,10 @@ int traffic_selector_printf_hook(printf_hook_data_t *data,
written += print_in_hook(data, "-"); }
written += print_icmp(data, this->to_port); }
} }
+ else if (this->protocol == IPPROTO_GRE) + else if (this->protocol == IPPROTO_GRE)
+ { + {
+ written += print_gre(data, this->from_port, this->to_port); + written += print_gre(data, this->from_port, this->to_port);
+ } + }
else else if (is_opaque(this))
{ {
written += print_in_hook(data, "%d-%d", written += print_in_hook(data, "OPAQUE");
diff --git a/src/libstrongswan/selectors/traffic_selector.h b/src/libstrongswan/selectors/traffic_selector.h diff --git a/src/libstrongswan/selectors/traffic_selector.h b/src/libstrongswan/selectors/traffic_selector.h
index 367b4fff9..b7010e4a7 100644 index 367b4fff9..b7010e4a7 100644
--- a/src/libstrongswan/selectors/traffic_selector.h --- a/src/libstrongswan/selectors/traffic_selector.h
@@ -218,41 +239,54 @@ index 367b4fff9..b7010e4a7 100644
* Compare two traffic selectors, usable as sort function * Compare two traffic selectors, usable as sort function
* *
diff --git a/src/starter/confread.c b/src/starter/confread.c diff --git a/src/starter/confread.c b/src/starter/confread.c
index 5065bc369..e2c03694d 100644 index 5065bc369..039b6f402 100644
--- a/src/starter/confread.c --- a/src/starter/confread.c
+++ b/src/starter/confread.c +++ b/src/starter/confread.c
@@ -25,6 +25,7 @@ @@ -325,7 +325,29 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
end->protocol = (uint8_t)p;
#include <library.h> }
#include <utils/debug.h>
+#include <utils/utils.h>
#include "keywords.h"
#include "confread.h"
@@ -335,6 +336,23 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
end->from_port = 0xffff;
end->to_port = 0;
} }
+ else if (*port && end->protocol == IPPROTO_GRE) - if (streq(port, "%any"))
+ if (end->protocol == IPPROTO_GRE)
+ { + {
+ DBG1(DBG_APP, "# GRE key: %s=%s", key, port); + if (*port && !streq(port, "%any"))
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ { + {
+ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port); + p = strtol(port, &endptr, 0);
+ goto err; + if (p < 0 || p > 0xffffffff)
+ } + {
+ end->from_port = (p >> 16) & 0xffff; + DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port);
+ end->to_port = p & 0xffff; + goto err;
+ if (*endptr) + }
+ { + end->from_port = (p >> 16) & 0xffff;
+ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port); + end->to_port = p & 0xffff;
+ goto err; + if (*endptr)
+ {
+ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port);
+ goto err;
+ }
+ } else {
+ end->from_port = 0;
+ end->to_port = 0;
+ } + }
+ } + }
else if (*port) + else if (streq(port, "%any"))
{ {
svc = getservbyname(port, NULL); end->from_port = 0;
end->to_port = 0xffff;
diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index d9fd949ed..1d63dadb8 100644
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -765,6 +765,9 @@ connections.<conn>.children.<child>.local_ts = dynamic
value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
as well, none of the kernel backends currently support port ranges, though.
+ If protocol is restricted to GRE, port restriction specifies GRE key
+ in 32 bit numeric form eg. dynamic[gre/100].
+
When IKEv1 is used only the first selector is interpreted, except if
the Cisco Unity extension plugin is used. This is due to a limitation of the
IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA.
-- --
2.43.0 2.45.2