Commit 2e54a215 authored by Timo Teräs's avatar Timo Teräs

main/ipsec-tools: one more fix for grekey support

sainfo matching needs to allow wildcard matching.
parent 8764f0da
......@@ -84,7 +84,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/racoonctl.c
Index: ipsec-tools-cvs-HEAD/src/racoon/admin.c
===================================================================
--- ipsec-tools-cvs-HEAD.orig/src/racoon/admin.c 2011-03-05 09:23:59.000000000 +0200
+++ ipsec-tools-cvs-HEAD/src/racoon/admin.c 2011-03-30 08:31:00.000000000 +0300
+++ ipsec-tools-cvs-HEAD/src/racoon/admin.c 2011-03-30 09:41:46.000000000 +0300
@@ -444,7 +444,7 @@
/* search appropreate configuration */
......@@ -190,8 +190,35 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.h
Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
===================================================================
--- ipsec-tools-cvs-HEAD.orig/src/racoon/ipsec_doi.c 2011-03-05 09:23:59.000000000 +0200
+++ ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c 2011-03-30 09:22:56.000000000 +0300
@@ -3371,6 +3371,7 @@
+++ ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c 2011-03-30 16:59:49.000000000 +0300
@@ -3308,6 +3308,7 @@
const vchar_t *subnet;
const vchar_t *address;
{
+ struct in_addr *a, *b;
struct in_addr *mask;
if (address->l != sizeof(struct in_addr))
@@ -3316,12 +3317,15 @@
if (subnet->l != (sizeof(struct in_addr)*2))
return 1;
+ a = (struct in_addr*)(subnet->v);
+ b = (struct in_addr*)(address->v);
mask = (struct in_addr*)(subnet->v + sizeof(struct in_addr));
- if (mask->s_addr!=0xffffffff)
- return 1;
+ //if (mask->s_addr!=0xffffffff)
+ // return 1;
+ //return memcmp(subnet->v,address->v,address->l);
- return memcmp(subnet->v,address->v,address->l);
+ return (a->s_addr & mask->s_addr) != (b->s_addr & mask->s_addr);
}
#ifdef INET6
@@ -3371,6 +3375,7 @@
vchar_t ident_t;
vchar_t ident_s;
int result;
......@@ -199,7 +226,37 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
/* handle wildcard IDs */
@@ -3460,6 +3461,7 @@
@@ -3410,12 +3415,14 @@
if ((id_bs->type == IPSECDOI_ID_IPV4_ADDR)&&
(id_bt->type == IPSECDOI_ID_IPV4_ADDR_SUBNET)) {
+ check_ports = 1;
result = ipsecdoi_subnetisaddr_v4(&ident_t,&ident_s);
goto cmpid_result;
}
if ((id_bs->type == IPSECDOI_ID_IPV4_ADDR_SUBNET)&&
(id_bt->type == IPSECDOI_ID_IPV4_ADDR)) {
+ check_ports = 1;
result = ipsecdoi_subnetisaddr_v4(&ident_s,&ident_t);
goto cmpid_result;
}
@@ -3423,12 +3430,14 @@
#ifdef INET6
if ((id_bs->type == IPSECDOI_ID_IPV6_ADDR)&&
(id_bt->type == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
+ check_ports = 1;
result = ipsecdoi_subnetisaddr_v6(&ident_t,&ident_s);
goto cmpid_result;
}
if ((id_bs->type == IPSECDOI_ID_IPV6_ADDR_SUBNET)&&
(id_bt->type == IPSECDOI_ID_IPV6_ADDR)) {
+ check_ports = 1;
result = ipsecdoi_subnetisaddr_v6(&ident_s,&ident_t);
goto cmpid_result;
}
@@ -3460,6 +3469,7 @@
case IPSECDOI_ID_IPV4_ADDR:
/* validate lengths */
......@@ -207,7 +264,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
if ((ident_t.l != sizeof(struct in_addr))||
(ident_s.l != sizeof(struct in_addr)))
goto cmpid_invalid;
@@ -3468,6 +3470,7 @@
@@ -3468,6 +3478,7 @@
case IPSECDOI_ID_IPV4_ADDR_SUBNET:
case IPSECDOI_ID_IPV4_ADDR_RANGE:
/* validate lengths */
......@@ -215,7 +272,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
if ((ident_t.l != (sizeof(struct in_addr)*2))||
(ident_s.l != (sizeof(struct in_addr)*2)))
goto cmpid_invalid;
@@ -3476,6 +3479,7 @@
@@ -3476,6 +3487,7 @@
#ifdef INET6
case IPSECDOI_ID_IPV6_ADDR:
/* validate lengths */
......@@ -223,7 +280,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
if ((ident_t.l != sizeof(struct in6_addr))||
(ident_s.l != sizeof(struct in6_addr)))
goto cmpid_invalid;
@@ -3484,6 +3488,7 @@
@@ -3484,6 +3496,7 @@
case IPSECDOI_ID_IPV6_ADDR_SUBNET:
case IPSECDOI_ID_IPV6_ADDR_RANGE:
/* validate lengths */
......@@ -231,26 +288,29 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
if ((ident_t.l != (sizeof(struct in6_addr)*2))||
(ident_s.l != (sizeof(struct in6_addr)*2)))
goto cmpid_invalid;
@@ -3502,10 +3507,15 @@
@@ -3502,12 +3515,18 @@
}
/* validate matching data and length */
- if (ident_t.l == ident_s.l)
- result = memcmp(ident_t.v,ident_s.v,ident_t.l);
- else
+ if (check_ports &&
+ (id_bt->port != id_bs->port && id_bs->port != 0))
+ /* if target is wildcard, source should be too, otherwise
+ * specific rule matches wildcard request */
+ result = 1;
+ else if (ident_t.l != ident_s.l)
+ if (ident_t.l != ident_s.l)
result = 1;
+ else
+ result = memcmp(ident_t.v,ident_s.v,ident_t.l);
cmpid_result:
+ if (check_ports &&
+ (id_bt->port != id_bs->port && id_bs->port != 0)) {
+ /* if target is wildcard, source should be too, otherwise
+ * specific rule matches wildcard request */
+ result = 1;
+ }
@@ -4089,6 +4099,67 @@
/* debug level output */
if(loglevel >= LLV_DEBUG) {
@@ -4089,6 +4108,67 @@
return new;
}
......@@ -318,7 +378,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
vchar_t *
ipsecdoi_sockrange2id(laddr, haddr, ul_proto)
struct sockaddr *laddr, *haddr;
@@ -4318,7 +4389,7 @@
@@ -4318,7 +4398,7 @@
saddr.sa.sa_len = sizeof(struct sockaddr_in);
#endif
saddr.sa.sa_family = AF_INET;
......@@ -327,7 +387,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
memcpy(&saddr.sin.sin_addr,
id->v + sizeof(*id_b), sizeof(struct in_addr));
break;
@@ -4331,7 +4402,7 @@
@@ -4331,7 +4411,7 @@
saddr.sa.sa_len = sizeof(struct sockaddr_in6);
#endif
saddr.sa.sa_family = AF_INET6;
......@@ -336,7 +396,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
memcpy(&saddr.sin6.sin6_addr,
id->v + sizeof(*id_b), sizeof(struct in6_addr));
saddr.sin6.sin6_scope_id =
@@ -4347,7 +4418,7 @@
@@ -4347,7 +4427,7 @@
#ifdef INET6
case IPSECDOI_ID_IPV6_ADDR:
#endif
......@@ -345,7 +405,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
break;
case IPSECDOI_ID_IPV4_ADDR_SUBNET:
@@ -4403,7 +4474,9 @@
@@ -4403,7 +4483,9 @@
plen += l;
}
......@@ -356,7 +416,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
}
break;
@@ -4415,12 +4488,12 @@
@@ -4415,12 +4497,12 @@
saddr.sa.sa_len = sizeof(struct sockaddr_in);
#endif
saddr.sa.sa_family = AF_INET;
......@@ -371,7 +431,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
break;
#ifdef INET6
@@ -4431,7 +4504,7 @@
@@ -4431,7 +4513,7 @@
saddr.sa.sa_len = sizeof(struct sockaddr_in6);
#endif
saddr.sa.sa_family = AF_INET6;
......@@ -380,7 +440,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/ipsec_doi.c
memcpy(&saddr.sin6.sin6_addr,
id->v + sizeof(*id_b) + sizeof(struct in6_addr),
sizeof(struct in6_addr));
@@ -4440,7 +4513,7 @@
@@ -4440,7 +4522,7 @@
? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
: 0);
......@@ -432,7 +492,7 @@ Index: ipsec-tools-cvs-HEAD/src/racoon/sainfo.c
Index: ipsec-tools-cvs-HEAD/src/racoon/isakmp.c
===================================================================
--- ipsec-tools-cvs-HEAD.orig/src/racoon/isakmp.c 2011-03-14 19:18:12.000000000 +0200
+++ ipsec-tools-cvs-HEAD/src/racoon/isakmp.c 2011-03-30 08:20:18.000000000 +0300
+++ ipsec-tools-cvs-HEAD/src/racoon/isakmp.c 2011-03-30 09:41:46.000000000 +0300
@@ -2173,7 +2173,15 @@
* so no need to bother yet. --arno */
......
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=ipsec-tools
pkgver=0.8.0
pkgrel=1
pkgrel=2
pkgdesc="User-space IPsec tools for various IPsec implementations"
url="http://ipsec-tools.sourceforge.net/"
arch="all"
......@@ -58,7 +58,7 @@ package() {
md5sums="c9a318cdbc0946f4e51464866d529739 ipsec-tools-0.8.0.tar.gz
74f12ed04ed273a738229c0bfbf829cc racoon.initd
2d00250cf72da7f2f559c91b65a48747 racoon.confd
bcfe83b42e7a093915a39977ec94aedb 20-grekey-support.patch
79b919ab23080f54dc3e7686877ca6bd 20-grekey-support.patch
f97205eea3dc68d2437a2ad8720f4520 50-reverse-connect.patch
94773c94233e14cdce0fa02ff780a43e 70-defer-isakmp-ident-handling.patch
2d5d24c4a3684a38584f88720f71c7d6 75-racoonctl-rcvbuf.patch"
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment