diff options
| -rw-r--r-- | main/ipsec-tools/10-cmpsaddr-fix.patch | 421 | ||||
| -rw-r--r-- | main/ipsec-tools/20-grekey-support.patch | 608 | ||||
| -rw-r--r-- | main/ipsec-tools/50-reverse-connect.patch | 70 | ||||
| -rw-r--r-- | main/ipsec-tools/APKBUILD | 12 |
4 files changed, 1067 insertions, 44 deletions
diff --git a/main/ipsec-tools/10-cmpsaddr-fix.patch b/main/ipsec-tools/10-cmpsaddr-fix.patch new file mode 100644 index 0000000000..af73c2e5e1 --- /dev/null +++ b/main/ipsec-tools/10-cmpsaddr-fix.patch @@ -0,0 +1,421 @@ +Index: ipsec-tools-cvs-HEAD/src/racoon/grabmyaddr.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/grabmyaddr.c 2011-03-03 17:54:33.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/grabmyaddr.c 2011-03-03 18:45:24.000000000 +0200 +@@ -100,7 +100,7 @@ + return TRUE; + + LIST_FOREACH(cfg, &configured, chain) { +- if (cmpsaddr(addr, (struct sockaddr *) &cfg->addr) == 0) ++ if (cmpsaddr(addr, (struct sockaddr *) &cfg->addr) <= CMPSADDR_WILDPORT_MATCH) + return TRUE; + } + +@@ -116,7 +116,7 @@ + + /* Already open? */ + LIST_FOREACH(my, &opened, chain) { +- if (cmpsaddr(addr, (struct sockaddr *) &my->addr) == 0) ++ if (cmpsaddr(addr, (struct sockaddr *) &my->addr) <= CMPSADDR_WILDPORT_MATCH) + return TRUE; + } + +@@ -156,7 +156,7 @@ + + LIST_FOREACH(cfg, &configured, chain) { + if (addr != NULL && +- cmpsaddr(addr, (struct sockaddr *) &cfg->addr) != 0) ++ cmpsaddr(addr, (struct sockaddr *) &cfg->addr) > CMPSADDR_WILDPORT_MATCH) + continue; + if (!myaddr_open((struct sockaddr *) &cfg->addr, cfg->udp_encap)) + return FALSE; +@@ -262,7 +262,7 @@ + struct myaddr *my; + + LIST_FOREACH(my, &opened, chain) { +- if (cmpsaddr((struct sockaddr *) &my->addr, addr) == 0) ++ if (cmpsaddr((struct sockaddr *) &my->addr, addr) <= CMPSADDR_WILDPORT_MATCH) + return my->fd; + } + +@@ -276,7 +276,7 @@ + struct myaddr *my; + + LIST_FOREACH(my, &opened, chain) { +- if (cmpsaddr((struct sockaddr *) &my->addr, addr) == 0) ++ if (cmpsaddr((struct sockaddr *) &my->addr, addr) <= CMPSADDR_WILDPORT_MATCH) + return extract_port((struct sockaddr *) &my->addr); + } + +Index: ipsec-tools-cvs-HEAD/src/racoon/handler.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/handler.c 2011-03-03 17:54:33.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/handler.c 2011-03-03 18:48:10.000000000 +0200 +@@ -120,11 +120,11 @@ + LIST_FOREACH(p, &ph1tree, chain) { + if (sel != NULL) { + if (sel->local != NULL && +- cmpsaddr(sel->local, p->local) != 0) ++ cmpsaddr(sel->local, p->local) > CMPSADDR_WILDPORT_MATCH) + continue; + + if (sel->remote != NULL && +- cmpsaddr(sel->remote, p->remote) != 0) ++ cmpsaddr(sel->remote, p->remote) > CMPSADDR_WILDPORT_MATCH) + continue; + } + +@@ -300,8 +300,8 @@ + if (p->status < PHASE1ST_DYING) + continue; + +- if (cmpsaddr(iph1->local, p->local) == 0 +- && cmpsaddr(iph1->remote, p->remote) == 0) ++ if (cmpsaddr(iph1->local, p->local) == CMPSADDR_MATCH ++ && cmpsaddr(iph1->remote, p->remote) == CMPSADDR_MATCH) + migrate_ph12(p, iph1); + } + } +@@ -547,11 +547,11 @@ + continue; + + if (sel->src != NULL && +- cmpsaddr(sel->src, p->src) != 0) ++ cmpsaddr(sel->src, p->src) != CMPSADDR_MATCH) + continue; + + if (sel->dst != NULL && +- cmpsaddr(sel->dst, p->dst) != 0) ++ cmpsaddr(sel->dst, p->dst) != CMPSADDR_MATCH) + continue; + } + +@@ -615,8 +615,8 @@ + + LIST_FOREACH(p, &ph2tree, chain) { + if (spid == p->spid && +- cmpsaddr(src, p->src) == 0 && +- cmpsaddr(dst, p->dst) == 0){ ++ cmpsaddr(src, p->src) <= CMPSADDR_WILDPORT_MATCH && ++ cmpsaddr(dst, p->dst) <= CMPSADDR_WILDPORT_MATCH){ + /* Sanity check to detect zombie handlers + * XXX Sould be done "somewhere" more interesting, + * because we have lots of getph2byxxxx(), but this one +@@ -643,8 +643,8 @@ + struct ph2handle *p; + + LIST_FOREACH(p, &ph2tree, chain) { +- if (cmpsaddr(src, p->src) == 0 && +- cmpsaddr(dst, p->dst) == 0) ++ if (cmpsaddr(src, p->src) <= CMPSADDR_WILDPORT_MATCH && ++ cmpsaddr(dst, p->dst) <= CMPSADDR_WILDPORT_MATCH) + return p; + } + +@@ -947,7 +947,7 @@ + struct contacted *p; + + LIST_FOREACH(p, &ctdtree, chain) { +- if (cmpsaddr(remote, p->remote) == 0) ++ if (cmpsaddr(remote, p->remote) <= CMPSADDR_WILDPORT_MATCH) + return p; + } + +@@ -988,7 +988,7 @@ + struct contacted *p; + + LIST_FOREACH(p, &ctdtree, chain) { +- if (cmpsaddr(remote, p->remote) == 0) { ++ if (cmpsaddr(remote, p->remote) <= CMPSADDR_WILDPORT_MATCH) { + LIST_REMOVE(p, chain); + racoon_free(p->remote); + racoon_free(p); +@@ -1042,7 +1042,7 @@ + /* + * the packet was processed before, but the remote address mismatches. + */ +- if (cmpsaddr(remote, r->remote) != 0) ++ if (cmpsaddr(remote, r->remote) != CMPSADDR_MATCH) + return 2; + + /* +Index: ipsec-tools-cvs-HEAD/src/racoon/isakmp.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/isakmp.c 2011-03-03 17:54:33.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/isakmp.c 2011-03-03 18:50:22.000000000 +0200 +@@ -468,8 +468,8 @@ + /* Floating ports for NAT-T */ + if (NATT_AVAILABLE(iph1) && + ! (iph1->natt_flags & NAT_PORTS_CHANGED) && +- ((cmpsaddr(iph1->remote, remote) != 0) || +- (cmpsaddr(iph1->local, local) != 0))) ++ ((cmpsaddr(iph1->remote, remote) != CMPSADDR_MATCH) || ++ (cmpsaddr(iph1->local, local) != CMPSADDR_MATCH))) + { + /* prevent memory leak */ + racoon_free(iph1->remote); +@@ -510,7 +510,7 @@ + #endif + + /* must be same addresses in one stream of a phase at least. */ +- if (cmpsaddr(iph1->remote, remote) != 0) { ++ if (cmpsaddr(iph1->remote, remote) != CMPSADDR_MATCH) { + char *saddr_db, *saddr_act; + + saddr_db = racoon_strdup(saddr2str(iph1->remote)); +@@ -636,7 +636,7 @@ + "exchange received.\n"); + return -1; + } +- if (cmpsaddr(iph1->remote, remote) != 0) { ++ if (cmpsaddr(iph1->remote, remote) != CMPSADDR_MATCH) { + plog(LLV_WARNING, LOCATION, remote, + "remote address mismatched. " + "db=%s\n", +@@ -3322,10 +3322,10 @@ + * Select only SAs where src == local and dst == remote (outgoing) + * or src == remote and dst == local (incoming). + */ +- if ((cmpsaddr(iph1->local, src) || +- cmpsaddr(iph1->remote, dst)) && +- (cmpsaddr(iph1->local, dst) || +- cmpsaddr(iph1->remote, src))) { ++ if ((cmpsaddr(iph1->local, src) != CMPSADDR_MATCH || ++ cmpsaddr(iph1->remote, dst) != CMPSADDR_MATCH) && ++ (cmpsaddr(iph1->local, dst) != CMPSADDR_MATCH || ++ cmpsaddr(iph1->remote, src) != CMPSADDR_MATCH)) { + msg = next; + continue; + } +Index: ipsec-tools-cvs-HEAD/src/racoon/isakmp_inf.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/isakmp_inf.c 2011-03-03 17:54:34.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/isakmp_inf.c 2011-03-03 18:51:05.000000000 +0200 +@@ -1177,7 +1177,7 @@ + + /* don't delete inbound SAs at the moment */ + /* XXX should we remove SAs with opposite direction as well? */ +- if (cmpsaddr(dst0, dst)) { ++ if (cmpsaddr(dst0, dst) != CMPSADDR_MATCH) { + msg = next; + continue; + } +@@ -1355,10 +1355,10 @@ + * ports. Correct thing to do is delete all entries with + * same identity. -TT + */ +- if ((cmpsaddr(iph1->local, src) != 0 || +- cmpsaddr(iph1->remote, dst) != 0) && +- (cmpsaddr(iph1->local, dst) != 0 || +- cmpsaddr(iph1->remote, src) != 0)) ++ if ((cmpsaddr(iph1->local, src) != CMPSADDR_MATCH || ++ cmpsaddr(iph1->remote, dst) != CMPSADDR_MATCH) && ++ (cmpsaddr(iph1->local, dst) != CMPSADDR_MATCH || ++ cmpsaddr(iph1->remote, src) != CMPSADDR_MATCH)) + continue; + + /* +Index: ipsec-tools-cvs-HEAD/src/racoon/isakmp_quick.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/isakmp_quick.c 2011-03-03 17:54:34.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/isakmp_quick.c 2011-03-03 18:51:48.000000000 +0200 +@@ -629,7 +629,7 @@ + #endif + + if (cmpsaddr((struct sockaddr *) &proposed_addr, +- (struct sockaddr *) &got_addr) == 0) { ++ (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) { + plog(LLV_DEBUG, LOCATION, NULL, + "IDci matches proposal.\n"); + #ifdef ENABLE_NATT +@@ -677,13 +677,13 @@ + #endif + + if (cmpsaddr((struct sockaddr *) &proposed_addr, +- (struct sockaddr *) &got_addr) == 0) { ++ (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) { + plog(LLV_DEBUG, LOCATION, NULL, + "IDcr matches proposal.\n"); + #ifdef ENABLE_NATT + } else if (iph2->natoa_dst != NULL + && cmpsaddr(iph2->natoa_dst, +- (struct sockaddr *) &got_addr) == 0) { ++ (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) { + plog(LLV_DEBUG, LOCATION, NULL, + "IDcr matches NAT-OAr.\n"); + #endif +Index: ipsec-tools-cvs-HEAD/src/racoon/nattraversal.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/nattraversal.c 2011-03-03 17:54:34.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/nattraversal.c 2011-03-03 18:52:20.000000000 +0200 +@@ -398,8 +398,8 @@ + struct natt_ka_addrs *ka = NULL, *new_addr; + + TAILQ_FOREACH (ka, &ka_tree, chain) { +- if (cmpsaddr(ka->src, src) == 0 && +- cmpsaddr(ka->dst, dst) == 0) { ++ if (cmpsaddr(ka->src, src) == CMPSADDR_MATCH && ++ cmpsaddr(ka->dst, dst) == CMPSADDR_MATCH) { + ka->in_use++; + plog (LLV_INFO, LOCATION, NULL, "KA found: %s (in_use=%u)\n", + saddr2str_fromto("%s->%s", src, dst), ka->in_use); +@@ -462,8 +462,8 @@ + plog (LLV_DEBUG, LOCATION, NULL, "KA tree dump: %s (in_use=%u)\n", + saddr2str_fromto("%s->%s", src, dst), ka->in_use); + +- if (cmpsaddr(ka->src, src) == 0 && +- cmpsaddr(ka->dst, dst) == 0 && ++ if (cmpsaddr(ka->src, src) == CMPSADDR_MATCH && ++ cmpsaddr(ka->dst, dst) == CMPSADDR_MATCH && + -- ka->in_use <= 0) { + + plog (LLV_DEBUG, LOCATION, NULL, "KA removing this one...\n"); +Index: ipsec-tools-cvs-HEAD/src/racoon/pfkey.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/pfkey.c 2011-03-03 17:54:34.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/pfkey.c 2011-03-03 18:52:50.000000000 +0200 +@@ -2882,8 +2882,8 @@ + u_int16_t port; + + /* Already up-to-date? */ +- if (cmpsaddr(iph1->local, ma->local) == 0 && +- cmpsaddr(iph1->remote, ma->remote) == 0) ++ if (cmpsaddr(iph1->local, ma->local) == CMPSADDR_MATCH && ++ cmpsaddr(iph1->remote, ma->remote) == CMPSADDR_MATCH) + return 0; + + if (iph1->status < PHASE1ST_ESTABLISHED) { +@@ -2983,8 +2983,8 @@ + migrate_ph1_ike_addresses(iph2->ph1, arg); + + /* Already up-to-date? */ +- if (cmpsaddr(iph2->src, ma->local) == 0 && +- cmpsaddr(iph2->dst, ma->remote) == 0) ++ if (cmpsaddr(iph2->src, ma->local) == CMPSADDR_MATCH && ++ cmpsaddr(iph2->dst, ma->remote) == CMPSADDR_MATCH) + return 0; + + /* save src/dst as sa_src/sa_dst before rewriting */ +@@ -3207,8 +3207,8 @@ + "changing address families (%d to %d) for endpoints.\n", + osaddr->sa_family, nsaddr->sa_family); + +- if (cmpsaddr(osaddr, (struct sockaddr *) &saidx->src) || +- cmpsaddr(odaddr, (struct sockaddr *) &saidx->dst)) { ++ if (cmpsaddr(osaddr, (struct sockaddr *) &saidx->src) != CMPSADDR_MATCH || ++ cmpsaddr(odaddr, (struct sockaddr *) &saidx->dst) != CMPSADDR_MATCH) { + plog(LLV_DEBUG, LOCATION, NULL, "SADB_X_MIGRATE: " + "mismatch of addresses in saidx and xisr.\n"); + return -1; +Index: ipsec-tools-cvs-HEAD/src/racoon/policy.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/policy.c 2011-03-03 17:54:34.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/policy.c 2011-03-03 19:09:42.000000000 +0200 +@@ -142,7 +142,7 @@ + plog(LLV_DEBUG, LOCATION, NULL, "src2: %s\n", + saddr2str((struct sockaddr *)&spidx->src)); + +- if (cmpsaddr(iph2->src, (struct sockaddr *) &spidx->src) || ++ if (cmpsaddr(iph2->src, (struct sockaddr *) &spidx->src) != CMPSADDR_MATCH || + spidx->prefs != prefixlen) + return NULL; + +@@ -151,7 +151,7 @@ + plog(LLV_DEBUG, LOCATION, NULL, "dst2: %s\n", + saddr2str((struct sockaddr *)&spidx->dst)); + +- if (cmpsaddr(iph2->dst, (struct sockaddr *) &spidx->dst) || ++ if (cmpsaddr(iph2->dst, (struct sockaddr *) &spidx->dst) != CMPSADDR_MATCH || + spidx->prefd != prefixlen) + return NULL; + +@@ -201,10 +201,10 @@ + return 1; + + if (cmpsaddr((struct sockaddr *) &a->src, +- (struct sockaddr *) &b->src)) ++ (struct sockaddr *) &b->src) != CMPSADDR_MATCH) + return 1; + if (cmpsaddr((struct sockaddr *) &a->dst, +- (struct sockaddr *) &b->dst)) ++ (struct sockaddr *) &b->dst) != CMPSADDR_MATCH) + return 1; + + #ifdef HAVE_SECCTX +@@ -261,7 +261,7 @@ + a, b->prefs, saddr2str((struct sockaddr *)&sa1)); + plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n", + b, b->prefs, saddr2str((struct sockaddr *)&sa2)); +- if (cmpsaddr((struct sockaddr *)&sa1, (struct sockaddr *)&sa2)) ++ if (cmpsaddr((struct sockaddr *)&sa1, (struct sockaddr *)&sa2) > CMPSADDR_WILDPORT_MATCH) + return 1; + + #ifndef __linux__ +@@ -279,7 +279,7 @@ + a, b->prefd, saddr2str((struct sockaddr *)&sa1)); + plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n", + b, b->prefd, saddr2str((struct sockaddr *)&sa2)); +- if (cmpsaddr((struct sockaddr *)&sa1, (struct sockaddr *)&sa2)) ++ if (cmpsaddr((struct sockaddr *)&sa1, (struct sockaddr *)&sa2) > CMPSADDR_WILDPORT_MATCH) + return 1; + + #ifdef HAVE_SECCTX +Index: ipsec-tools-cvs-HEAD/src/racoon/sockmisc.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/sockmisc.c 2011-03-03 17:54:35.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/sockmisc.c 2011-03-03 18:55:01.000000000 +0200 +@@ -132,11 +132,13 @@ + return CMPSADDR_MISMATCH; + } + +- if (port1 == port2 || +- port1 == IPSEC_PORT_ANY || +- port2 == IPSEC_PORT_ANY) ++ if (port1 == port2) + return CMPSADDR_MATCH; + ++ if (port1 == IPSEC_PORT_ANY || ++ port2 == IPSEC_PORT_ANY) ++ return CMPSADDR_WILDPORT_MATCH; ++ + return CMPSADDR_WOP_MATCH; + } + +@@ -934,7 +936,7 @@ + free(a2); + free(a3); + } +- if (cmpsaddr(&sa, &naddr->sa.sa) == 0) ++ if (cmpsaddr(&sa, &naddr->sa.sa) <= CMPSADDR_WOP_MATCH) + return naddr->prefix + port_score; + + return -1; +Index: ipsec-tools-cvs-HEAD/src/racoon/sockmisc.h +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/sockmisc.h 2011-03-03 17:54:35.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/sockmisc.h 2011-03-03 18:40:30.000000000 +0200 +@@ -57,8 +57,9 @@ + extern const int niflags; + + #define CMPSADDR_MATCH 0 +-#define CMPSADDR_WOP_MATCH 1 +-#define CMPSADDR_MISMATCH 2 ++#define CMPSADDR_WILDPORT_MATCH 1 ++#define CMPSADDR_WOP_MATCH 2 ++#define CMPSADDR_MISMATCH 3 + + extern int cmpsaddr __P((const struct sockaddr *, const struct sockaddr *)); + +Index: ipsec-tools-cvs-HEAD/src/racoon/throttle.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/throttle.c 2011-03-03 17:54:35.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/throttle.c 2011-03-03 18:55:31.000000000 +0200 +@@ -104,7 +104,7 @@ + goto restart; + } + +- if (cmpsaddr(addr, (struct sockaddr *) &te->host) == 0) { ++ if (cmpsaddr(addr, (struct sockaddr *) &te->host) <= CMPSADDR_WOP_MATCH) { + found = 1; + break; + } diff --git a/main/ipsec-tools/20-grekey-support.patch b/main/ipsec-tools/20-grekey-support.patch new file mode 100644 index 0000000000..9ad2bca740 --- /dev/null +++ b/main/ipsec-tools/20-grekey-support.patch @@ -0,0 +1,608 @@ +Index: ipsec-tools-cvs-HEAD/src/racoon/racoonctl.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/racoonctl.c 2011-03-03 19:28:29.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/racoonctl.c 2011-03-03 19:29:42.000000000 +0200 +@@ -232,7 +232,7 @@ + "\n" + " <saopts>: \"isakmp\" <family> <src> <dst>\n" + " : {\"esp\",\"ah\"} <family> <src/prefixlen/port> <dst/prefixlen/port>\n" +-" <ul_proto>\n" ++" <ul_proto> [grekey <grekey>]\n" + " <family>: \"inet\" or \"inet6\"\n" + " <ul_proto>: \"icmp\", \"tcp\", \"udp\", \"gre\" or \"any\"\n" + "\n", +@@ -819,7 +819,7 @@ + { + int family; + +- if (ac != 3 && ac != 4) { ++ if (ac < 3) { + errno = EINVAL; + return NULL; + } +@@ -861,10 +861,8 @@ + struct sockaddr *src = NULL, *dst = NULL; + int ulproto; + +- if (ac != 2 && ac != 3) { +- errno = EINVAL; +- return NULL; +- } ++ if (ac < 2) ++ goto bad_args; + + if (get_comindex(*av, &p_name, &p_port, &p_prefs) == -1) + goto bad; +@@ -901,13 +899,34 @@ + + av++; + ac--; +- if(ac){ ++ if (ac) { + ulproto = get_ulproto(*av); + if (ulproto == -1) + goto bad; +- }else ++ av++; ++ ac--; ++ } else + ulproto=0; + ++ if (ac == 2 && strcmp(av[0], "grekey") == 0) { ++ int a, b, c, d; ++ unsigned long u; ++ ++ if (sscanf(av[1], "%d.%d.%d.%d", &a, &b, &c, &d) == 4) { ++ set_port(src, (a << 8) + b); ++ set_port(dst, (c << 8) + d); ++ } else if (sscanf(av[1], "%lu", &u) == 1) { ++ set_port(src, u >> 16); ++ set_port(dst, u & 0xffff); ++ } else ++ goto bad_args; ++ av += 2; ++ ac -= 2; ++ } ++ ++ if (ac != 0) ++ goto bad_args; ++ + ci = (struct admin_com_indexes *)buf->v; + if(p_prefs) + ci->prefs = (u_int8_t)atoi(p_prefs); /* XXX should be handled error. */ +@@ -926,7 +945,9 @@ + + return buf; + +- bad: ++bad_args: ++ errno = EINVAL; ++bad: + if (p_name) + racoon_free(p_name); + if (p_port) +Index: ipsec-tools-cvs-HEAD/src/racoon/admin.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/admin.c 2011-03-03 19:28:29.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/admin.c 2011-03-03 21:16:47.000000000 +0200 +@@ -444,7 +444,7 @@ + + /* search appropreate configuration */ + if (name == NULL) +- rmconf = getrmconf(dst, 0); ++ rmconf = getrmconf(dst, 0, 0); + else + rmconf = getrmconf_by_name(name); + if (rmconf == NULL) { +@@ -536,6 +536,16 @@ + spidx.prefs = ndx->prefd; + spidx.prefd = ndx->prefs; + spidx.ul_proto = ndx->ul_proto; ++ switch (ndx->ul_proto) { ++ case IPPROTO_ICMP: ++ case IPPROTO_ICMPV6: ++ case IPPROTO_GRE: ++ /* Ports are UL specific data, and should ++ * not get swapped */ ++ set_port((struct sockaddr *) &spidx.src, extract_port(src)); ++ set_port((struct sockaddr *) &spidx.dst, extract_port(dst)); ++ break; ++ } + + sp_in = getsp_r(&spidx); + if (sp_in) { +Index: ipsec-tools-cvs-HEAD/src/racoon/cftoken.l +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/cftoken.l 2011-03-03 19:57:26.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/cftoken.l 2011-03-04 13:07:03.000000000 +0200 +@@ -288,6 +288,7 @@ + <S_SAINF>any { YYD; return(ANY); } + <S_SAINF>from { YYD; return(FROM); } + <S_SAINF>group { YYD; return(GROUP); } ++<S_SAINF>grekey { YYD; return(GREKEY); } + /* sainfo spec */ + <S_SAINF>{bcl} { BEGIN S_SAINFS; return(BOC); } + <S_SAINF>{semi} { BEGIN S_INI; return(EOS); } +Index: ipsec-tools-cvs-HEAD/src/racoon/cfparse.y +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/cfparse.y 2011-03-03 19:57:30.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/cfparse.y 2011-03-04 13:09:01.000000000 +0200 +@@ -213,7 +213,7 @@ + /* algorithm */ + %token ALGORITHM_CLASS ALGORITHMTYPE STRENGTHTYPE + /* sainfo */ +-%token SAINFO FROM ++%token SAINFO FROM GREKEY + /* remote */ + %token REMOTE ANONYMOUS CLIENTADDR INHERIT REMOTE_ADDRESS + %token EXCHANGE_MODE EXCHANGETYPE DOI DOITYPE SITUATION SITUATIONTYPE +@@ -1301,6 +1301,35 @@ + cur_sainfo->idsrc = $1; + cur_sainfo->iddst = $2; + } ++ | sainfo_id sainfo_id GREKEY ADDRSTRING ++ { ++ int a, b, c, d; ++ ++ if (sscanf($4->v, "%d.%d.%d.%d", &a, &b, &c, &d) == 4) { ++ a = ipsecdoi_fixup_id_uldata( ++ $1, $2, IPPROTO_GRE, ++ (a << 8) + b, (c << 8) + d); ++ } else { ++ yyerror("grekey format unrecognized."); ++ return -1; ++ } ++ if (a != 0) { ++ yyerror("ul_proto needs to be 'gre' to use grekey."); ++ return -1; ++ } ++ cur_sainfo->idsrc = $1; ++ cur_sainfo->iddst = $2; ++ } ++ | sainfo_id sainfo_id GREKEY NUMBER ++ { ++ if (ipsecdoi_fixup_id_uldata($1, $2, IPPROTO_GRE, ++ ($4) >> 16, ($4) & 0xffff) != 0) { ++ yyerror("ul_proto needs to be 'gre' to use grekey."); ++ return -1; ++ } ++ cur_sainfo->idsrc = $1; ++ cur_sainfo->iddst = $2; ++ } + ; + sainfo_id + : IDENTIFIERTYPE ADDRSTRING prefix port ul_proto +@@ -1667,7 +1696,7 @@ + { + struct remoteconf *from, *new; + +- from = getrmconf($4, GETRMCONF_F_NO_ANONYMOUS); ++ from = getrmconf($4, GETRMCONF_F_NO_ANONYMOUS, 0); + if (from == NULL) { + yyerror("failed to get remoteconf for %s.", + saddr2str($4)); +Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.h +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/ipsec_doi.h 2011-03-03 20:19:23.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.h 2011-03-03 20:42:35.000000000 +0200 +@@ -227,6 +227,9 @@ + extern int set_identifier_qual __P((vchar_t **, int, vchar_t *, int)); + extern int ipsecdoi_setid2 __P((struct ph2handle *)); + extern vchar_t *ipsecdoi_sockaddr2id __P((struct sockaddr *, u_int, u_int)); ++extern int ipsecdoi_fixup_id_uldata __P((vchar_t *, vchar_t *, u_int16_t, u_int16_t, u_int16_t)); ++extern int ipsecdoi_id_has_port __P((vchar_t *)); ++ + extern int ipsecdoi_id2sockaddr __P((vchar_t *, struct sockaddr *, + u_int8_t *, u_int16_t *)); + extern char *ipsecdoi_id2str __P((const vchar_t *)); +Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/ipsec_doi.c 2011-03-03 20:19:23.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c 2011-03-03 21:01:16.000000000 +0200 +@@ -3371,6 +3371,7 @@ + vchar_t ident_t; + vchar_t ident_s; + int result; ++ int check_ports = 0; + + /* handle wildcard IDs */ + +@@ -3460,6 +3461,7 @@ + + case IPSECDOI_ID_IPV4_ADDR: + /* validate lengths */ ++ check_ports = 1; + if ((ident_t.l != sizeof(struct in_addr))|| + (ident_s.l != sizeof(struct in_addr))) + goto cmpid_invalid; +@@ -3468,6 +3470,7 @@ + case IPSECDOI_ID_IPV4_ADDR_SUBNET: + case IPSECDOI_ID_IPV4_ADDR_RANGE: + /* validate lengths */ ++ check_ports = 1; + if ((ident_t.l != (sizeof(struct in_addr)*2))|| + (ident_s.l != (sizeof(struct in_addr)*2))) + goto cmpid_invalid; +@@ -3476,6 +3479,7 @@ + #ifdef INET6 + case IPSECDOI_ID_IPV6_ADDR: + /* validate lengths */ ++ check_ports = 1; + if ((ident_t.l != sizeof(struct in6_addr))|| + (ident_s.l != sizeof(struct in6_addr))) + goto cmpid_invalid; +@@ -3484,6 +3488,7 @@ + case IPSECDOI_ID_IPV6_ADDR_SUBNET: + case IPSECDOI_ID_IPV6_ADDR_RANGE: + /* validate lengths */ ++ check_ports = 1; + if ((ident_t.l != (sizeof(struct in6_addr)*2))|| + (ident_s.l != (sizeof(struct in6_addr)*2))) + goto cmpid_invalid; +@@ -3502,10 +3507,15 @@ + } + + /* validate matching data and length */ +- if (ident_t.l == ident_s.l) +- result = memcmp(ident_t.v,ident_s.v,ident_t.l); +- else ++ if (check_ports && ++ (id_bt->port != id_bs->port && id_bs->port != 0)) ++ /* if target is wildcard, source should be too, otherwise ++ * specific rule matches wildcard request */ + result = 1; ++ else if (ident_t.l != ident_s.l) ++ result = 1; ++ else ++ result = memcmp(ident_t.v,ident_s.v,ident_t.l); + + cmpid_result: + +@@ -4089,6 +4099,44 @@ + return new; + } + ++int ipsecdoi_fixup_id_uldata(srcid, dstid, ul_proto, ul_data1, ul_data2) ++ vchar_t *srcid, *dstid; ++ u_int16_t ul_proto; ++ u_int16_t ul_data1, ul_data2; ++{ ++ struct ipsecdoi_id_b *src = (struct ipsecdoi_id_b *) srcid->v; ++ struct ipsecdoi_id_b *dst = (struct ipsecdoi_id_b *) dstid->v; ++ ++ if (src->proto_id != ul_proto || ++ dst->proto_id != ul_proto) ++ return -1; ++ ++ src->port = htons(ul_data1); ++ dst->port = htons(ul_data2); ++ ++ return 0; ++} ++ ++int ipsecdoi_id_has_port(id) ++ vchar_t *id; ++{ ++ struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *) id->v; ++ ++ switch (id_b->type) { ++ case IPSECDOI_ID_IPV4_ADDR: ++ case IPSECDOI_ID_IPV4_ADDR_SUBNET: ++ case IPSECDOI_ID_IPV4_ADDR_RANGE: ++ case IPSECDOI_ID_IPV6_ADDR: ++ case IPSECDOI_ID_IPV6_ADDR_SUBNET: ++ case IPSECDOI_ID_IPV6_ADDR_RANGE: ++ if (ntohs(id_b->port) != 0) ++ return 1; ++ break; ++ } ++ return 0; ++} ++ ++ + vchar_t * + ipsecdoi_sockrange2id(laddr, haddr, ul_proto) + struct sockaddr *laddr, *haddr; +@@ -4318,7 +4366,7 @@ + saddr.sa.sa_len = sizeof(struct sockaddr_in); + #endif + saddr.sa.sa_family = AF_INET; +- saddr.sin.sin_port = IPSEC_PORT_ANY; ++ saddr.sin.sin_port = id_b->port; + memcpy(&saddr.sin.sin_addr, + id->v + sizeof(*id_b), sizeof(struct in_addr)); + break; +@@ -4331,7 +4379,7 @@ + saddr.sa.sa_len = sizeof(struct sockaddr_in6); + #endif + saddr.sa.sa_family = AF_INET6; +- saddr.sin6.sin6_port = IPSEC_PORT_ANY; ++ saddr.sin6.sin6_port = id_b->port; + memcpy(&saddr.sin6.sin6_addr, + id->v + sizeof(*id_b), sizeof(struct in6_addr)); + saddr.sin6.sin6_scope_id = +@@ -4347,7 +4395,7 @@ + #ifdef INET6 + case IPSECDOI_ID_IPV6_ADDR: + #endif +- len = snprintf( buf, BUFLEN, "%s", saddrwop2str(&saddr.sa)); ++ len = snprintf( buf, BUFLEN, "%s", saddr2str(&saddr.sa)); + break; + + case IPSECDOI_ID_IPV4_ADDR_SUBNET: +@@ -4403,7 +4451,9 @@ + plen += l; + } + +- len = snprintf( buf, BUFLEN, "%s/%i", saddrwop2str(&saddr.sa), plen); ++ len = snprintf(buf, BUFLEN, "%s/%i[%d]", ++ saddrwop2str(&saddr.sa), plen, ++ ntohs(id_b->port)); + } + break; + +@@ -4415,12 +4465,12 @@ + saddr.sa.sa_len = sizeof(struct sockaddr_in); + #endif + saddr.sa.sa_family = AF_INET; +- saddr.sin.sin_port = IPSEC_PORT_ANY; ++ saddr.sin.sin_port = id_b->port; + memcpy(&saddr.sin.sin_addr, + id->v + sizeof(*id_b) + sizeof(struct in_addr), + sizeof(struct in_addr)); + +- len += snprintf(buf + len, BUFLEN - len, "%s", saddrwop2str(&saddr.sa)); ++ len += snprintf(buf + len, BUFLEN - len, "%s", saddr2str(&saddr.sa)); + break; + + #ifdef INET6 +@@ -4431,7 +4481,7 @@ + saddr.sa.sa_len = sizeof(struct sockaddr_in6); + #endif + saddr.sa.sa_family = AF_INET6; +- saddr.sin6.sin6_port = IPSEC_PORT_ANY; ++ saddr.sin6.sin6_port = id_b->port; + memcpy(&saddr.sin6.sin6_addr, + id->v + sizeof(*id_b) + sizeof(struct in6_addr), + sizeof(struct in6_addr)); +@@ -4440,7 +4490,7 @@ + ? ((struct sockaddr_in6 *)id_b)->sin6_scope_id + : 0); + +- len += snprintf(buf + len, BUFLEN - len, "%s", saddrwop2str(&saddr.sa)); ++ len += snprintf(buf + len, BUFLEN - len, "%s", saddr2str(&saddr.sa)); + break; + #endif + +Index: ipsec-tools-cvs-HEAD/src/racoon/sainfo.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/sainfo.c 2011-03-03 20:07:44.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/sainfo.c 2011-03-03 20:55:02.000000000 +0200 +@@ -124,7 +124,7 @@ + plog(LLV_DEBUG, LOCATION, NULL, + "evaluating sainfo: %s\n", sainfostr); + +- if(s->remoteid != remoteid) { ++ if (remoteid != -1 && s->remoteid != remoteid) { + plog(LLV_DEBUG, LOCATION, NULL, + "remoteid mismatch: %u != %u\n", + s->remoteid, remoteid); +@@ -234,16 +234,22 @@ + int pri = 0; + + if(s->remoteid) +- pri += 3; ++ pri += 7; + + if(s->id_i) +- pri += 3; ++ pri += 7; + +- if(s->idsrc) ++ if(s->idsrc) { + pri++; ++ if (ipsecdoi_id_has_port(s->idsrc)) ++ pri += 2; ++ } + +- if(s->iddst) ++ if(s->iddst) { + pri++; ++ if (ipsecdoi_id_has_port(s->iddst)) ++ pri += 2; ++ } + + return pri; + } +Index: ipsec-tools-cvs-HEAD/src/racoon/isakmp.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/isakmp.c 2011-03-03 20:55:57.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/isakmp.c 2011-03-03 21:14:13.000000000 +0200 +@@ -2170,7 +2170,15 @@ + * so no need to bother yet. --arno */ + + if (iph1hint == NULL || iph1hint->rmconf == NULL) { +- rmconf = getrmconf(iph2->dst, nopassive ? GETRMCONF_F_NO_PASSIVE : 0); ++ int flags = 0; ++ uint32_t remoteid; ++ if (nopassive) ++ flags |= GETRMCONF_F_NO_PASSIVE; ++ if (iph2->sainfo != NULL) { ++ flags |= GETRMCONF_F_HAS_REMOTEID; ++ remoteid = iph2->sainfo->remoteid; ++ } ++ rmconf = getrmconf(iph2->dst, flags, remoteid); + if (rmconf == NULL) { + plog(LLV_ERROR, LOCATION, NULL, + "no configuration found for %s.\n", +@@ -2246,7 +2254,7 @@ + struct secpolicy *sp_out, *sp_in; + { + struct remoteconf *conf; +- uint32_t remoteid = 0; ++ uint32_t remoteid = -1; + + plog(LLV_DEBUG, LOCATION, NULL, + "new acquire %s\n", spidx2str(&sp_out->spidx)); +@@ -2273,7 +2281,7 @@ + return -1; + } + +- conf = getrmconf(iph2->dst, 0); ++ conf = getrmconf(iph2->dst, 0, 0); + if (conf != NULL) + remoteid = conf->ph1id; + else +Index: ipsec-tools-cvs-HEAD/src/racoon/remoteconf.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/remoteconf.c 2011-03-03 21:06:03.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/remoteconf.c 2011-03-03 21:17:09.000000000 +0200 +@@ -217,6 +217,13 @@ + return MATCH_NONE; + } + ++ if ((rmsel->flags & GETRMCONF_F_HAS_REMOTEID) && ++ rmsel->remoteid != rmconf->ph1id){ ++ plog(LLV_DEBUG2, LOCATION, rmsel->remote, ++ "Not matched: remote_id did not match.\n"); ++ return MATCH_NONE; ++ } ++ + ret |= MATCH_BASIC; + + /* Check address */ +@@ -387,9 +394,10 @@ + */ + + struct remoteconf * +-getrmconf(remote, flags) ++getrmconf(remote, flags, remoteid) + struct sockaddr *remote; + int flags; ++ uint32_t remoteid; + { + struct rmconf_find_context ctx; + int n = 0; +@@ -397,6 +405,7 @@ + memset(&ctx, 0, sizeof(ctx)); + ctx.sel.flags = flags; + ctx.sel.remote = remote; ++ ctx.sel.remoteid = remoteid; + + if (enumrmconf(&ctx.sel, rmconf_find, &ctx) != 0) { + plog(LLV_ERROR, LOCATION, remote, +Index: ipsec-tools-cvs-HEAD/src/racoon/remoteconf.h +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/remoteconf.h 2011-03-03 21:06:03.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/remoteconf.h 2011-03-03 21:10:53.000000000 +0200 +@@ -178,6 +178,7 @@ + int flags; + struct sockaddr *remote; + int etype; ++ uint32_t remoteid; + struct isakmpsa *approval; + vchar_t *identity; + vchar_t *certificate_request; +@@ -191,12 +192,13 @@ + + #define GETRMCONF_F_NO_ANONYMOUS 0x0001 + #define GETRMCONF_F_NO_PASSIVE 0x0002 ++#define GETRMCONF_F_HAS_REMOTEID 0x0004 + + #define RMCONF_ERR_MULTIPLE ((struct remoteconf *) -1) + + extern int rmconf_match_identity __P((struct remoteconf *rmconf, + vchar_t *id_p)); +-extern struct remoteconf *getrmconf __P((struct sockaddr *remote, int flags)); ++extern struct remoteconf *getrmconf __P((struct sockaddr *remote, int flags, uint32_t remoteid)); + extern struct remoteconf *getrmconf_by_ph1 __P((struct ph1handle *iph1)); + extern struct remoteconf *getrmconf_by_name __P((const char *name)); + +Index: ipsec-tools-cvs-HEAD/src/racoon/pfkey.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/pfkey.c 2011-03-03 21:14:45.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/pfkey.c 2011-03-03 21:16:17.000000000 +0200 +@@ -2898,7 +2898,7 @@ + + /* If we are not acting as initiator, let's just leave and + * let the remote peer handle the restart */ +- rmconf = getrmconf(ma->remote, 0); ++ rmconf = getrmconf(ma->remote, 0, 0); + if (rmconf == NULL || !rmconf->passive) { + iph1->status = PHASE1ST_EXPIRED; + sched_schedule(&iph1->sce, 1, isakmp_ph1delete_stub); +@@ -3068,8 +3068,10 @@ + + if (iph2->ph1 && iph2->ph1->rmconf) + rmconf = iph2->ph1->rmconf; ++ else if (iph2->sainfo != NULL) ++ rmconf = getrmconf(iph2->dst, GETRMCONF_F_HAS_REMOTEID, iph2->sainfo->remoteid); + else +- rmconf = getrmconf(iph2->dst, 0); ++ rmconf = getrmconf(iph2->dst, 0, 0); + + if (rmconf && !rmconf->passive) { + struct ph1handle *iph1hint; +Index: ipsec-tools-cvs-HEAD/src/setkey/setkey.8 +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/setkey/setkey.8 2011-03-04 11:48:30.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/setkey/setkey.8 2011-03-04 11:48:56.000000000 +0200 +@@ -453,7 +453,7 @@ + .Pp + A second example of requiring transport mode encryption of specific + GRE tunnel: +-.Dl spdadd 0.0.0.0 0.0.0.0 gre 1234 ipsec esp/transport//require ; ++.Dl spdadd 0.0.0.0 0.0.0.0 gre 1234 -P in ipsec esp/transport//require ; + .Pp + .Em Note : + .Ar upperspec +Index: ipsec-tools-cvs-HEAD/src/racoon/racoon.conf.5 +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/racoon.conf.5 2011-03-04 11:57:36.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/racoon.conf.5 2011-03-04 12:01:13.000000000 +0200 +@@ -981,6 +981,7 @@ + .Bl -tag -width Ds -compact + .It Ic sainfo Po Ar local_id | Ic anonymous Pc \ + Po Ar remote_id | Ic clientaddr | Ic anonymous Pc \ ++Bo Ic grekey Ar key Bc \ + Bo Ic from Ar idtype Bo Ar string Bc Bc Bo Ic group Ar string Bc \ + Ic { Ar statements Ic } + Defines the parameters of the IKE phase 2 (IPsec-SA establishment). +@@ -1026,6 +1027,15 @@ + to restrict policy generation when racoon is acting as a client gateway + for peers with dynamic ip addresses. + .Pp ++If both ++.Ar local_id ++and ++.Ar remote_id ++are specified with GRE as upper layer protocol, the upper layer GRE ++key match can be specified with ++.Ic grekey ++.Ar key . ++.Pp + The + .Ic from + keyword allows an sainfo to only match for peers that use a specific phase1 +Index: ipsec-tools-cvs-HEAD/src/setkey/parse.y +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/setkey/parse.y 2011-03-04 13:04:05.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/setkey/parse.y 2011-03-04 13:04:09.000000000 +0200 +@@ -856,6 +856,17 @@ + } + $$.len = strlen($$.buf); + } ++ | DECSTRING ++ { ++ char tmp[16]; ++ sprintf(tmp, "%lu", $1); ++ $$.buf = strdup(tmp); ++ if (!$$.buf) { ++ yyerror("insufficient memory"); ++ return -1; ++ } ++ $$.len = strlen(tmp); ++ } + ; + + context_spec diff --git a/main/ipsec-tools/50-reverse-connect.patch b/main/ipsec-tools/50-reverse-connect.patch index f29c3d5091..54e77a3976 100644 --- a/main/ipsec-tools/50-reverse-connect.patch +++ b/main/ipsec-tools/50-reverse-connect.patch @@ -13,11 +13,11 @@ over pending phase1:s. Useful when the other party is firewalled or NATted. 5 files changed, 83 insertions(+), 12 deletions(-) -diff --git a/src/racoon/admin.c b/src/racoon/admin.c -index b67e545..710c9bf 100644 ---- a/src/racoon/admin.c -+++ b/src/racoon/admin.c -@@ -414,11 +414,23 @@ admin_process(so2, combuf) +Index: ipsec-tools-cvs-HEAD/src/racoon/admin.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/admin.c 2011-03-03 21:16:47.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/admin.c 2011-03-04 13:50:30.000000000 +0200 +@@ -414,11 +414,23 @@ struct sockaddr *dst; struct sockaddr *src; char *name = NULL; @@ -41,11 +41,11 @@ index b67e545..710c9bf 100644 if (com->ac_cmd == ADMIN_ESTABLISH_SA && com->ac_len > sizeof(*com) + sizeof(*ndx)) name = (char *) ((caddr_t) ndx + sizeof(*ndx)); -diff --git a/src/racoon/evt.c b/src/racoon/evt.c -index 4ce1334..000c1f8 100644 ---- a/src/racoon/evt.c -+++ b/src/racoon/evt.c -@@ -396,4 +396,17 @@ evt_list_cleanup(list) +Index: ipsec-tools-cvs-HEAD/src/racoon/evt.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/evt.c 2011-03-03 19:25:50.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/evt.c 2011-03-04 13:50:30.000000000 +0200 +@@ -396,4 +396,17 @@ evt_unsubscribe(LIST_FIRST(list)); } @@ -63,11 +63,11 @@ index 4ce1334..000c1f8 100644 +} + #endif /* ENABLE_ADMINPORT */ -diff --git a/src/racoon/evt.h b/src/racoon/evt.h -index 0ce65bd..ba7fb57 100644 ---- a/src/racoon/evt.h -+++ b/src/racoon/evt.h -@@ -124,6 +124,8 @@ void evt_phase2 __P((const struct ph2handle *ph2, int type, vchar_t *optdata)); +Index: ipsec-tools-cvs-HEAD/src/racoon/evt.h +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/evt.h 2011-03-03 19:25:50.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/evt.h 2011-03-04 13:50:30.000000000 +0200 +@@ -124,6 +124,8 @@ vchar_t *evt_dump __P((void)); int evt_subscribe __P((struct evt_listener_list *list, int fd)); @@ -76,7 +76,7 @@ index 0ce65bd..ba7fb57 100644 void evt_list_init __P((struct evt_listener_list *list)); void evt_list_cleanup __P((struct evt_listener_list *list)); -@@ -136,6 +138,7 @@ void evt_list_cleanup __P((struct evt_listener_list *list)); +@@ -136,6 +138,7 @@ #define evt_phase2(ph2, type, optdata) ; #define evt_subscribe(eventlist, fd) ; @@ -84,17 +84,11 @@ index 0ce65bd..ba7fb57 100644 #define evt_list_init(eventlist) ; #define evt_list_cleanup(eventlist) ; #define evt_get_fdmask(nfds, fdset) nfds -diff --git a/src/racoon/handler.c b/src/racoon/handler.c -index b33986f..9fd3817 100644 ---- a/src/racoon/handler.c -+++ b/src/racoon/handler.c -@@ -269,26 +269,40 @@ migrate_ph12(old_iph1, new_iph1) - } - - /* -- * the iph1 is new, migrate all phase2s that belong to a dying or dead ph1 -+ * the iph1 is new, migrate all phase2s that belong to a dying or dead ph1. - */ +Index: ipsec-tools-cvs-HEAD/src/racoon/handler.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/handler.c 2011-03-03 19:29:31.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/handler.c 2011-03-04 13:53:01.000000000 +0200 +@@ -292,17 +292,32 @@ void migrate_dying_ph12(iph1) struct ph1handle *iph1; { @@ -114,8 +108,8 @@ index b33986f..9fd3817 100644 + iph1->rmconf != p->rmconf) continue; -- if (cmpsaddr(iph1->local, p->local) == 0 -- && cmpsaddr(iph1->remote, p->remote) == 0) +- if (cmpsaddr(iph1->local, p->local) == CMPSADDR_MATCH +- && cmpsaddr(iph1->remote, p->remote) == CMPSADDR_MATCH) + /* migrate phase2:s from expiring entries */ + if (p->status >= PHASE1ST_DYING) migrate_ph12(p, iph1); @@ -132,15 +126,11 @@ index b33986f..9fd3817 100644 } } -- - /* - * dump isakmp-sa - */ -diff --git a/src/racoon/isakmp.c b/src/racoon/isakmp.c -index 0de16d1..2dfda2f 100644 ---- a/src/racoon/isakmp.c -+++ b/src/racoon/isakmp.c -@@ -2138,13 +2138,33 @@ isakmp_ph2delete(iph2) +Index: ipsec-tools-cvs-HEAD/src/racoon/isakmp.c +=================================================================== +--- ipsec-tools-cvs-HEAD.orig/src/racoon/isakmp.c 2011-03-03 21:14:13.000000000 +0200 ++++ ipsec-tools-cvs-HEAD/src/racoon/isakmp.c 2011-03-04 13:50:30.000000000 +0200 +@@ -2138,13 +2138,33 @@ remph2(iph2); delph2(iph2); @@ -176,7 +166,7 @@ index 0de16d1..2dfda2f 100644 /* * receive ACQUIRE from kernel, and begin either phase1 or phase2. * if phase1 has been finished, begin phase2. -@@ -2220,8 +2240,14 @@ isakmp_post_acquire(iph2) +@@ -2235,8 +2255,14 @@ /*NOTREACHED*/ } @@ -193,7 +183,7 @@ index 0de16d1..2dfda2f 100644 /* found ISAKMP-SA. */ plog(LLV_DEBUG, LOCATION, NULL, "begin QUICK mode.\n"); -@@ -2388,7 +2414,10 @@ isakmp_chkph1there(iph2) +@@ -2403,7 +2429,10 @@ plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(iph2->dst)); /* begin quick mode */ diff --git a/main/ipsec-tools/APKBUILD b/main/ipsec-tools/APKBUILD index 6e4a009fd4..3e9609bb77 100644 --- a/main/ipsec-tools/APKBUILD +++ b/main/ipsec-tools/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=ipsec-tools -pkgver=0.8_alpha20101208 -_myver=0.8-alpha20101208 +pkgver=0.8.0_rc1 +_myver=0.8.0.RC pkgrel=0 pkgdesc="User-space IPsec tools for various IPsec implementations" url="http://ipsec-tools.sourceforge.net/" @@ -13,6 +13,8 @@ subpackages="$pkgname-doc $pkgname-dev" source="http://downloads.sourceforge.net/$pkgname/$pkgname-$_myver.tar.gz racoon.initd racoon.confd + 10-cmpsaddr-fix.patch + 20-grekey-support.patch 50-reverse-connect.patch 70-defer-isakmp-ident-handling.patch 75-racoonctl-rcvbuf.patch @@ -55,9 +57,11 @@ package() { install -D -m644 ../racoon.confd "$pkgdir"/etc/conf.d/racoon } -md5sums="9da0417ea19629777d7d7a555667f6d8 ipsec-tools-0.8-alpha20101208.tar.gz +md5sums="9473d0ce8746f16281fce1b75a9fffa3 ipsec-tools-0.8.0.RC.tar.gz 74f12ed04ed273a738229c0bfbf829cc racoon.initd 2d00250cf72da7f2f559c91b65a48747 racoon.confd -13bda94a598aabf593280e04ea16065d 50-reverse-connect.patch +e4c9ae678bf80518107690bde97dc14b 10-cmpsaddr-fix.patch +64a859d51f57206a11e52f6ad4830ec5 20-grekey-support.patch +f97205eea3dc68d2437a2ad8720f4520 50-reverse-connect.patch 94773c94233e14cdce0fa02ff780a43e 70-defer-isakmp-ident-handling.patch 2d5d24c4a3684a38584f88720f71c7d6 75-racoonctl-rcvbuf.patch" |