rpms-fedora-extras/strongswan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

5.9.14 - Old patches

Browse Source
This commit is contained in:
Zoran Peričić
2024-09-18 13:06:59 +02:00
parent 87fabb3a9d
commit f98f60a125
4 changed files with 194 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
0001-charon-add-optional-source-and-remote-overrides-for-.patch
View File

@@ -1,7 +1,7 @@
From ec53b2914730f08d151d14e9b48557196ec0cc49 Mon Sep 17 00:00:00 2001
From 921093c4c0d4be10a74f148536029fb46fd31966 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:41:58 +0300
Subject: [PATCH 1/3] charon: add optional source and remote overrides for
Subject: [PATCH 1/4] charon: add optional source and remote overrides for
initiate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
@@ -38,7 +38,7 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
21 files changed, 225 insertions(+), 50 deletions(-)
diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
index 2e2cb3ca2..b9369a8a2 100644
index 8e8d8236e..7df5bc9bf 100644
--- a/src/charon-cmd/cmd/cmd_connection.c
+++ b/src/charon-cmd/cmd/cmd_connection.c
@@ -439,7 +439,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
@@ -51,10 +51,10 @@ index 2e2cb3ca2..b9369a8a2 100644
terminate(pid);
}
diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c
index 7f88514a7..4c3491984 100644
index 8570ef0e3..bc74f1b90 100644
--- a/src/charon-nm/nm/nm_service.c
+++ b/src/charon-nm/nm/nm_service.c
@@ -942,7 +942,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
@@ -982,7 +982,7 @@ static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
* Prepare IKE_SA
*/
ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
@@ -207,7 +207,7 @@ index 695e75b83..e3f740281 100644
if (s)
{
diff --git a/src/libcharon/plugins/medcli/medcli_config.c b/src/libcharon/plugins/medcli/medcli_config.c
index 3211a49f1..f98b3eac8 100644
index 59a9358a1..6e322a9c1 100644
--- a/src/libcharon/plugins/medcli/medcli_config.c
+++ b/src/libcharon/plugins/medcli/medcli_config.c
@@ -350,7 +350,7 @@ static job_requeue_t initiate_config(peer_cfg_t *peer_cfg)
@@ -220,10 +220,10 @@ index 3211a49f1..f98b3eac8 100644
else
{
diff --git a/src/libcharon/plugins/smp/smp.c b/src/libcharon/plugins/smp/smp.c
index 91dddfeaa..1e9326822 100644
index 6ca9f1399..31a4e1d63 100644
--- a/src/libcharon/plugins/smp/smp.c
+++ b/src/libcharon/plugins/smp/smp.c
@@ -494,7 +494,8 @@ static void request_control_initiate(xmlTextReaderPtr reader,
@@ -495,7 +495,8 @@ static void request_control_initiate(xmlTextReaderPtr reader,
if (child)
{
status = charon->controller->initiate(charon->controller,
@@ -271,10 +271,10 @@ index b033c832c..f8d1be745 100644
{
write_fifo(this, "connection '%s' established\n", name);
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index 522122562..b1486e337 100644
index c858e9945..a42ebf041 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -2252,7 +2252,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
@@ -2277,7 +2277,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
charon->controller->initiate(charon->controller,
peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg),
@@ -419,7 +419,7 @@ index 122e5cee9..dec458c84 100644
}
children->destroy(children);
diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
index fc31c2a7c..0836b8c78 100644
index 7763ae844..3fb9d4c35 100644
--- a/src/libcharon/sa/ike_sa_manager.c
+++ b/src/libcharon/sa/ike_sa_manager.c
@@ -16,6 +16,28 @@
@@ -451,7 +451,7 @@ index fc31c2a7c..0836b8c78 100644
#include <string.h>
#include <inttypes.h>
@@ -1497,7 +1519,8 @@ typedef struct {
@@ -1498,7 +1520,8 @@ typedef struct {
} config_entry_t;
METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -461,7 +461,7 @@ index fc31c2a7c..0836b8c78 100644
{
enumerator_t *enumerator;
entry_t *entry;
@@ -1508,7 +1531,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -1509,7 +1532,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
u_int segment;
int i;
@@ -479,7 +479,7 @@ index fc31c2a7c..0836b8c78 100644
if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1)
{ /* IKE_SA reuse disabled by config (not possible for IKEv1) */
@@ -1566,6 +1598,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -1567,6 +1599,15 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
continue;
}
@@ -495,7 +495,7 @@ index fc31c2a7c..0836b8c78 100644
current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
if (current_peer && current_peer->equals(current_peer, peer_cfg))
{
@@ -1592,6 +1633,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -1593,6 +1634,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
{
ike_sa->set_peer_cfg(ike_sa, peer_cfg);
checkout_new(this, ike_sa);
@@ -535,7 +535,7 @@ index 004cc2216..56ef869be 100644
/**
* Reset initiator SPI.
diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
index d8d8a421a..f458ee0f1 100644
index 1b85c66a5..f8c87437f 100644
--- a/src/libcharon/sa/trap_manager.c
+++ b/src/libcharon/sa/trap_manager.c
@@ -523,7 +523,7 @@ METHOD(trap_manager_t, acquire, void,
@@ -544,10 +544,10 @@ index d8d8a421a..f458ee0f1 100644
ike_sa_t *ike_sa;
- host_t *host;
+ host_t *host, *my_host = NULL, *other_host = NULL;
uint32_t allocated_reqid;
bool wildcard, ignore = FALSE;
this->lock->read_lock(this->lock);
@@ -600,36 +600,26 @@ METHOD(trap_manager_t, acquire, void,
@@ -603,36 +603,26 @@ METHOD(trap_manager_t, acquire, void,
this->lock->unlock(this->lock);
if (wildcard)
@@ -680,5 +680,5 @@ index e0fffb907..dcaded59d 100644
{"raw", 'r', 0, "dump raw response message"},
{"pretty", 'P', 0, "dump raw response message in pretty print"},
--
2.41.0
2.45.2

6
0002-vici-send-certificates-for-ike-sa-events.patch
View File

@@ -1,7 +1,7 @@
From 0a1ee45f16f61cb68f526aeacd58ed275e7d8c48 Mon Sep 17 00:00:00 2001
From 52e75a6cd16853a04e824ba2bac32c8acfd5f25c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:42:05 +0300
Subject: [PATCH 2/3] vici: send certificates for ike-sa events
Subject: [PATCH 2/4] vici: send certificates for ike-sa events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
@@ -136,5 +136,5 @@ index bacb7b101..19acc0789 100644
b->begin_section(b, old->get_name(old));
--
2.41.0
2.45.2

6
0003-vici-add-support-for-individual-sa-state-changes.patch
View File

@@ -1,7 +1,7 @@
From 39f70df4d1846f9044c270fa8cb6149d42067736 Mon Sep 17 00:00:00 2001
From 91c63d771622863b2f4de1dbada28f82e2d21d7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 21 Sep 2015 13:42:11 +0300
Subject: [PATCH 3/3] vici: add support for individual sa state changes
Subject: [PATCH 3/4] vici: add support for individual sa state changes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
@@ -156,5 +156,5 @@ index 19acc0789..fa1aca953 100644
.destroy = _destroy,
},
--
2.41.0
2.45.2

304
0004-Support-GRE-key-in-selectors.patch
View File

@@ -1,20 +1,21 @@
From 027c90f6808d451f3bbcd4b2dc4b8ad04806dc64 Mon Sep 17 00:00:00 2001
From 1e0d5415c1cd61df50fa27219d9ca8f76b497c6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zoran=20Peri=C4=8Di=C4=87?= <zoran.pericic@infomaas.com>
Date: Sun, 21 Jan 2024 03:11:32 +0100
Subject: [PATCH 4/4] Support GRE key in selectors.
---
.../kernel_netlink/kernel_netlink_ipsec.c | 12 +++++++++++
.../plugins/load_tester/load_tester_config.c | 16 ++++++++++++++
src/libcharon/plugins/stroke/stroke_config.c | 15 +++++++++++++
src/libcharon/plugins/vici/vici_config.c | 21 ++++++++++++++++++-
.../selectors/traffic_selector.c | 20 ++++++++++++++++++
.../selectors/traffic_selector.h | 12 +++++++++++
src/starter/confread.c | 18 ++++++++++++++++
7 files changed, 113 insertions(+), 1 deletion(-)
.../kernel_netlink/kernel_netlink_ipsec.c | 20 ++++++++++++
.../plugins/load_tester/load_tester_config.c | 22 ++++++++++++-
src/libcharon/plugins/stroke/stroke_config.c | 22 ++++++++++++-
src/libcharon/plugins/vici/vici_config.c | 32 ++++++++++++++++++-
.../selectors/traffic_selector.c | 20 ++++++++++++
.../selectors/traffic_selector.h | 12 +++++++
src/starter/confread.c | 24 +++++++++++++-
src/swanctl/swanctl.opt | 3 ++
8 files changed, 151 insertions(+), 4 deletions(-)
diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
index 7596f0c18..fdfc9d51e 100644
index db0b2ac37..e4e7d9ecb 100644
--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -864,6 +864,7 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
@@ -25,7 +26,7 @@ index 7596f0c18..fdfc9d51e 100644
memset(&sel, 0, sizeof(sel));
sel.family = (src->get_type(src) == TS_IPV4_ADDR_RANGE) ? AF_INET : AF_INET6;
@@ -884,6 +885,17 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
@@ -884,6 +885,25 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
sel.dport = htons(traffic_selector_icmp_code(port));
sel.dport_mask = sel.dport ? ~0 : 0;
}
@@ -34,115 +35,135 @@ index 7596f0c18..fdfc9d51e 100644
+ /* the kernel expects the GRE key in the source and destination
+ * port fields, respectively. */
+ gre_key = htons(traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst)));
+ DBG2(DBG_KNL, "Policy GRE key: %d (%d-%d) %d", gre_key, dst->get_from_port(dst), dst->get_to_port(dst), traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst)));
+ sel.sport = gre_key >> 16;
+ sel.sport_mask = ~0;
+ sel.dport = gre_key & 0xffff;
+ sel.dport_mask = ~0;
+ if ( gre_key != 0 )
+ {
+ DBG2(DBG_KNL, "Policy GRE key: %d (%d-%d) %d", gre_key, dst->get_from_port(dst), dst->get_to_port(dst), traffic_selector_gre_key(dst->get_from_port(dst), dst->get_to_port(dst)));
+ sel.sport = gre_key >> 16;
+ sel.sport_mask = ~0;
+ sel.dport = gre_key & 0xffff;
+ sel.dport_mask = ~0;
+ } else {
+ sel.sport = 0;
+ sel.sport_mask = 0;
+ sel.dport = 0;
+ sel.dport_mask = 0;
+ }
+ }
sel.ifindex = interface ? if_nametoindex(interface) : 0;
sel.user = 0;
diff --git a/src/libcharon/plugins/load_tester/load_tester_config.c b/src/libcharon/plugins/load_tester/load_tester_config.c
index 58e1cd98a..436116361 100644
index 58e1cd98a..ac67875d8 100644
--- a/src/libcharon/plugins/load_tester/load_tester_config.c
+++ b/src/libcharon/plugins/load_tester/load_tester_config.c
@@ -16,6 +16,8 @@
#include "load_tester_config.h"
+#include <utils/utils.h>
+
#include <netdb.h>
#include <daemon.h>
@@ -512,6 +514,20 @@ static bool parse_protoport(char *token, uint16_t *from_port,
{
*from_port = *to_port = 0;
}
+ else if (*port && *protocol == IPPROTO_GRE)
+ {
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ return FALSE;
+ }
+ end->from_port = (p >> 16) & 0xffff;
+ end->to_port = p & 0xffff;
+ if (*endptr)
+ {
+ return FALSE;
+ }
+ }
else if (*port)
{
svc = getservbyname(port, NULL);
diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index 55db379ff..9ee4c6463 100644
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -20,6 +20,7 @@
#include <daemon.h>
#include <threading/mutex.h>
#include <utils/lexparser.h>
+#include <utils/utils.h>
#include <netdb.h>
@@ -937,6 +938,20 @@ static bool parse_protoport(char *token, uint16_t *from_port,
*from_port = 0xffff;
*to_port = 0;
}
+ else if (*port && *protocol == IPPROTO_GRE)
+ {
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ return FALSE;
+ }
+ *from_port = (p >> 16) & 0xffff;
+ *to_port = p & 0xffff;
+ if (*endptr)
+ {
+ return FALSE;
+ }
+ }
else if (*port)
{
svc = getservbyname(port, NULL);
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index b1486e337..35c4df1b0 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -718,7 +718,25 @@ CALLBACK(parse_ts, bool,
from = 0xffff;
to = 0;
@@ -498,7 +498,27 @@ static bool parse_protoport(char *token, uint16_t *from_port,
*protocol = (uint8_t)p;
}
- else if (*port && !streq(port, "any"))
+ else if (*port && !streq(port, "any") && proto == IPPROTO_GRE)
}
- if (streq(port, "%any"))
+ if (*protocol == IPPROTO_GRE)
+ {
+ if (*port && !streq(port, "%any"))
+ {
+ DBG2(DBG_CFG, " GRE key %s", port);
+ p = strtol(port, &end, 0);
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ DBG2(DBG_CFG, " Invalid GRE key %s", port);
+ return FALSE;
+ }
+ from = (p >> 16) & 0xffff;
+ to = p & 0xffff;
+ DBG2(DBG_CFG, " Parsed GRE key %d-%d(%d)", from, to, p);
+ if (*end)
+ end->from_port = (p >> 16) & 0xffff;
+ end->to_port = p & 0xffff;
+ if (*endptr)
+ {
+ DBG2(DBG_CFG, " Invalid GRE key %s", port);
+ return FALSE;
+ }
+ } else {
+ end->from_port = 0;
+ end->to_port = 0;
+ }
+ }
+ else if (streq(port, "%any"))
{
*from_port = 0;
*to_port = 0xffff;
diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index 55db379ff..b4340b8d1 100644
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -927,7 +927,27 @@ static bool parse_protoport(char *token, uint16_t *from_port,
*protocol = (uint8_t)p;
}
}
- if (streq(port, "%any"))
+ if (*protocol == IPPROTO_GRE)
+ {
+ if (*port && !streq(port, "%any"))
+ {
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ return FALSE;
+ }
+ *from_port = (p >> 16) & 0xffff;
+ *to_port = p & 0xffff;
+ if (*endptr)
+ return FALSE;
+ }
+ else
+ {
+ *from_port = 0;
+ *to_port = 0;
+ }
+ }
+ else if (streq(port, "%any"))
{
*from_port = 0;
*to_port = 0xffff;
diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index a42ebf041..53306f30d 100644
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -715,7 +715,31 @@ CALLBACK(parse_ts, bool,
proto = (uint8_t)p;
}
}
- if (streq(port, "opaque"))
+ if (proto == IPPROTO_GRE)
+ {
+ if (*port && !streq(port, "any"))
+ {
+ DBG2(DBG_CFG, " GRE key %s", port);
+ p = strtol(port, &end, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ DBG2(DBG_CFG, " Invalid GRE key %s", port);
+ return FALSE;
+ }
+ from = (p >> 16) & 0xffff;
+ to = p & 0xffff;
+ DBG2(DBG_CFG, " Parsed GRE key %d-%d(%d)", from, to, p);
+ if (*end)
+ {
+ DBG2(DBG_CFG, " Invalid GRE key %s", port);
+ return FALSE;
+ }
+ } else {
+ from = 0;
+ to = 0;
+ }
+ }
+ else if (*port && !streq(port, "any") && proto != IPPROTO_GRE)
+ else if (streq(port, "opaque"))
{
svc = getservbyname(port, NULL);
if (svc)
@@ -752,6 +770,7 @@ CALLBACK(parse_ts, bool,
from = 0xffff;
to = 0;
@@ -752,8 +776,14 @@ CALLBACK(parse_ts, bool,
}
}
}
+ else if (proto == IPPROTO_GRE)
+ {
+ from = 0;
+ to = 0;
+ }
if (streq(buf, "dynamic"))
{
+ DBG2(DBG_CFG, " Create dynamic selector GRE key proto=%d, from_port=%d, to_port=%d", proto, from, to);
@@ -150,7 +171,7 @@ index b1486e337..35c4df1b0 100644
}
else if (strchr(buf, '-'))
diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c
index fe61e3768..29ffbffbd 100644
index fe61e3768..09757ec36 100644
--- a/src/libstrongswan/selectors/traffic_selector.c
+++ b/src/libstrongswan/selectors/traffic_selector.c
@@ -205,6 +205,18 @@ static int print_icmp(printf_hook_data_t *data, uint16_t port)
@@ -183,17 +204,17 @@ index fe61e3768..29ffbffbd 100644
else
{
serv = getservbyport(htons(this->from_port), serv_proto);
@@ -343,6 +359,10 @@ int traffic_selector_printf_hook(printf_hook_data_t *data,
written += print_in_hook(data, "-");
written += print_icmp(data, this->to_port);
@@ -332,6 +348,10 @@ int traffic_selector_printf_hook(printf_hook_data_t *data,
}
}
}
+ else if (this->protocol == IPPROTO_GRE)
+ {
+ written += print_gre(data, this->from_port, this->to_port);
+ }
else
else if (is_opaque(this))
{
written += print_in_hook(data, "%d-%d",
written += print_in_hook(data, "OPAQUE");
diff --git a/src/libstrongswan/selectors/traffic_selector.h b/src/libstrongswan/selectors/traffic_selector.h
index 367b4fff9..b7010e4a7 100644
--- a/src/libstrongswan/selectors/traffic_selector.h
@@ -218,41 +239,54 @@ index 367b4fff9..b7010e4a7 100644
* Compare two traffic selectors, usable as sort function
*
diff --git a/src/starter/confread.c b/src/starter/confread.c
index 5065bc369..e2c03694d 100644
index 5065bc369..039b6f402 100644
--- a/src/starter/confread.c
+++ b/src/starter/confread.c
@@ -25,6 +25,7 @@
#include <library.h>
#include <utils/debug.h>
+#include <utils/utils.h>
#include "keywords.h"
#include "confread.h"
@@ -335,6 +336,23 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
end->from_port = 0xffff;
end->to_port = 0;
@@ -325,7 +325,29 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
end->protocol = (uint8_t)p;
}
}
+ else if (*port && end->protocol == IPPROTO_GRE)
- if (streq(port, "%any"))
+ if (end->protocol == IPPROTO_GRE)
+ {
+ DBG1(DBG_APP, "# GRE key: %s=%s", key, port);
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ if (*port && !streq(port, "%any"))
+ {
+ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port);
+ goto err;
+ }
+ end->from_port = (p >> 16) & 0xffff;
+ end->to_port = p & 0xffff;
+ if (*endptr)
+ {
+ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port);
+ goto err;
+ p = strtol(port, &endptr, 0);
+ if (p < 0 || p > 0xffffffff)
+ {
+ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port);
+ goto err;
+ }
+ end->from_port = (p >> 16) & 0xffff;
+ end->to_port = p & 0xffff;
+ if (*endptr)
+ {
+ DBG1(DBG_APP, "# bad GRE key: %s=%s", key, port);
+ goto err;
+ }
+ } else {
+ end->from_port = 0;
+ end->to_port = 0;
+ }
+ }
else if (*port)
+ else if (streq(port, "%any"))
{
svc = getservbyname(port, NULL);
end->from_port = 0;
end->to_port = 0xffff;
diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index d9fd949ed..1d63dadb8 100644
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -765,6 +765,9 @@ connections.<conn>.children.<child>.local_ts = dynamic
value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
as well, none of the kernel backends currently support port ranges, though.
+ If protocol is restricted to GRE, port restriction specifies GRE key
+ in 32 bit numeric form eg. dynamic[gre/100].
+
When IKEv1 is used only the first selector is interpreted, except if
the Cisco Unity extension plugin is used. This is due to a limitation of the
IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA.
--
2.43.0
2.45.2