Compare commits
No commits in common. 'c9' and 'c10-beta' have entirely different histories.
@ -1,4 +1,4 @@
|
||||
SOURCES/ikev1_dsa.fax.bz2
|
||||
SOURCES/ikev1_psk.fax.bz2
|
||||
SOURCES/ikev2.fax.bz2
|
||||
SOURCES/libreswan-4.12.tar.gz
|
||||
SOURCES/libreswan-4.15.tar.gz
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
|
||||
861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
|
||||
fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
|
||||
786c14a4755311ea3103683a3294e1536b1e44a6 SOURCES/libreswan-4.12.tar.gz
|
||||
861eaeefff1c2f3862a8bfe0295b3e307f8e3055 SOURCES/libreswan-4.15.tar.gz
|
||||
|
||||
@ -0,0 +1,51 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBFDjilcBEAChkfasfBKTzGys9DwgBsmDVsPConW60uyKnu16+wO1kIKMFWi6
|
||||
wGllwKUJmCBY2FSQHbOBy5eHPPT1ijJhYt4j7WU+YJVh5Ca5RE3trFt31FX0vzp+
|
||||
KMqdQ8HOofA7jO6bgyHUwOJ539YkqYj1jHKfrdRqOnzB9fFyEb7485sq1F8j/rHk
|
||||
cSar1Hd9QfGAZHxXqgncgHFobB/xXEGRJIi+4kNL5SYasbw9tfYUGPrUXVol1+pn
|
||||
tsG92736O5Qe5K+wH2nAS4hwPJ1Xr4XIKeNNwxQW25wWqn4mLa4Vly+PA2uSE7ZP
|
||||
RcxE3yBCaLFMlw4rLhFAzd6TeslQONZ+9K51yfBYm7m0vWM3Ixq8yuD8E49OkKr8
|
||||
QRMaA2g89NW3AuNLExiTE0zQzAs/g6eX8WZdeWCvKxhRTAUYkw0QTimFgv6LXIeS
|
||||
//5DOAAO9WwzlseTGmUgek3BbnnJJiGHVLBgnLaqWLOZ1Y8ON1uC8lQnbIeYbTQq
|
||||
EE5R0cbVLVXBJoKakBF8gwHF51HC2pSBYmHNZsSbjMuHpJWJM4fVldNWPNaqriKC
|
||||
OkL8QgvNoapgk20k1ajLl/ibv32k7QBKy3cTMtbQYPdreXcoZuMw38ysQcgFxPCs
|
||||
Zh92aaWW0ceWowkJ7CFnes2jdPcMSOYE37wodmV3/VV7cusmTD8wikyUdQARAQAB
|
||||
tCxMaWJyZXN3YW4gKFNpZ25pbmcgS2V5KSA8dGVhbUBsaWJyZXN3YW4ub3JnPokC
|
||||
TgQTAQoAOBYhBJB+eQ8lwejlYc1ztYX/S0OzD8b5BQJi4cg4AhsDBQsJCAcDBRUK
|
||||
CQgLBRYCAwEAAh4FAheAAAoJEIX/S0OzD8b5zNcP/RuDb05Xr+IpuGWtJ38yGMWG
|
||||
mZglLHrzCAOXNAr/QXt6Kz3sThJoZFIh2E4Ab5yW59iFLFpW3VuZIGVCyh7vsuVw
|
||||
MuKoJtrZtdbHSdLbE+FHpY7osQDrcuodTv5b7STfG2Wje18iG/dCATVIDDgbPmuJ
|
||||
FpNLcR3scuoIlgxmP3Y1AFgufLR5MiN60PKnS2Husyj0f5Gqc3USLofWKgEQ4wFa
|
||||
gT1iIjkf4zkFcVlJ5K0SE1ULn8K7umkOUvLcKg6ji+1sEwEM1kCNmxI8HkiNt296
|
||||
9Z/TLK1h8McFGwG7x1p8fZ7Kjmzwnv1TSxAt1wHMoa0m9LntQOXnn3hVJaC74AzX
|
||||
heFtqDHmATpcGtQLR0zutrZ+ohUb6AEt+hAPfyDDYIR5y3oNdSLozJkJ1wlrhsYh
|
||||
SR1Hv4b3fdD6XgyUPggituOYm+yv1PuHrSEaoznnlX2z0MaVJyJIN0zUHlPBmWKC
|
||||
LmzQX2A7l9bHhkXYgHoSdeBHdwvcQQGWwkVmN2WUwsM/m9Abk8OdLdE13nI8824R
|
||||
0+b6XzJ2g4L+RIsVseerX2WIMHSMvkbFuLpEE4ILOrL+9Lq5bdx9MvZPtsZ/ZutY
|
||||
QVVvJ+nJtmPp0HpybnJdXzB7Za02A0r2gXIUrund32K97qe8XblCwxkZbZCeLcSL
|
||||
5+mb8O1XPGD39S6CCZbRuQINBFDjilcBEADXDN9o3icyDy+ity45CsQfo1f84xL6
|
||||
oJIgCLGGwm3RFPgOzdgxaE7TiLzW2NBui+yHyw48WRTxZ9XC6HtGKjH6XPvP5nF4
|
||||
8wss7tjzRNzmNgTp7G47HkW3lD0VYX4NqfCmxQK9gTXob1+JFmWkEXkXmZYg2dbn
|
||||
1REtHb03x370Z547rjvdpopQW6jaSw0C556DOxb9weJqLqAd2uZO4nwhuDs/VM+Q
|
||||
yy+/MlHTbnsmnYIMozDLMmHZ1PMeJlTFPMfapaux9UDTgQ5dwLj2FiQ/uEMzvfVv
|
||||
W23hxlpWVHsccwZR77PMDt4Nbj/7QlOIKpgid2r8SyBmhjET2u/USSzFYzK8J2Wj
|
||||
oLcxiuMTwrnM6b3bqiuSDUMAEoNN814Cbpz6yLB2wyKs5N7ZA/lVLNE8MV7to8OD
|
||||
ww1nS2bDDf5/JMNt5aWu/iO2bBrYE30LqHR3bSV6QP57JnzunM9Y4V1BnEKYW14A
|
||||
9+rRH1k1e5CuS5tqxpSubniF80AdUyPjF8rXOY0URD6zY0s4843Nf9TNr8ke/1ma
|
||||
qLEkUAF03AwBR8oz247ylu75q94ytpYUFJAkNeqpk8XypqKJMVcl4NfEP930JR82
|
||||
sGjNylVu/b4EsqKfmkoU8VFM1lfuaqX1u2ZDoUpG2Io/zpeV07RQ0KTHdKBejzix
|
||||
2IN0T7W4G0JXcwARAQABiQIfBBgBAgAJBQJQ44pXAhsMAAoJEIX/S0OzD8b5KR8P
|
||||
/jdWNVVw74/oCPtt79V1r0XN4I0ZBTQZgKp3JmZdcZlS2Uzx4u1VhxcevDQ7fh/Z
|
||||
5Y1xDBh+IKwF83hJKXy56+PJBlYIGjc2GTEmU1yo4E9iudPq56FFb6eelX1qBfxI
|
||||
0ZHdWgzWmrtnCF65zGTmeYMpck4ZuKdJAX2AM6kWcBikt4jT/SqrcS8t/duWRSSV
|
||||
iikwXD8aPexAz9XuezI+y3Exupt/lqUyVtCV3t0/gWRAMuwrMH/RABEPTaQdmxKz
|
||||
i0OkMDlHhweXZWg0/t32XLhhmy4f/30NhKYnntN6/pdNDb8vin5OP2MRyJDHIykA
|
||||
2HZcYvjdZS43+PbiuqDCTILMvxUDYjxHszgEheLariRvmRwE1HRjZWNTzGTjUgyv
|
||||
83XUhrIoAlgMVy2tQAatKbNVYAn5dmA0NCDKnSszas43gApSSjh2UXmq/owwpVj6
|
||||
zYHcoV0gdCuLJ1BPLstN0ZGO+g+eRpTI97+/04sgz/hImDsm7G3Diners/FDaebt
|
||||
pMRzVshh5lIgVBnCT36hdHW8buyiAgRQtjq7bX8JLN4Ermxlq4a33OYc7TGNC3jF
|
||||
Rm4XSY6RUDMd6uhRD5hKZB2N8az079603K7nc93x32CualHCJD+M7Z2/j9r3T3Tc
|
||||
y69oM+pgP48wySo+XEGHCM5OG7YNNiJ8xQ/J+CKCyLQV
|
||||
=ZaKB
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
@ -1,92 +0,0 @@
|
||||
From 5101913b1e623121a9222f11eefa18f0a2708b00 Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Wed, 27 Mar 2024 10:43:19 -0400
|
||||
Subject: [PATCH] ikev1: in compute_proto_keymat() only allow explicitly
|
||||
handled ESP algorithms
|
||||
|
||||
---
|
||||
programs/pluto/ikev1_quick.c | 41 ++++++++++++++----------------------
|
||||
1 file changed, 16 insertions(+), 25 deletions(-)
|
||||
|
||||
diff --git a/programs/pluto/ikev1_quick.c b/programs/pluto/ikev1_quick.c
|
||||
index 81c522c148..22c346afb4 100644
|
||||
--- a/programs/pluto/ikev1_quick.c
|
||||
+++ b/programs/pluto/ikev1_quick.c
|
||||
@@ -203,7 +203,7 @@ static bool emit_subnet_id(enum perspective perspective,
|
||||
* RFC 2409 "IKE" section 5.5
|
||||
* specifies how this is to be done.
|
||||
*/
|
||||
-static void compute_proto_keymat(struct state *st,
|
||||
+static bool compute_proto_keymat(struct state *st,
|
||||
uint8_t protoid,
|
||||
struct ipsec_proto_info *pi,
|
||||
const char *satypename)
|
||||
@@ -297,27 +297,13 @@ static void compute_proto_keymat(struct state *st,
|
||||
}
|
||||
break;
|
||||
|
||||
- case ESP_CAST:
|
||||
- case ESP_TWOFISH:
|
||||
- case ESP_SERPENT:
|
||||
- /* ESP_SEED is for IKEv1 only and not supported. Its number in IKEv2 has been re-used */
|
||||
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
|
||||
-
|
||||
default:
|
||||
- /* bytes */
|
||||
- needed_len = encrypt_max_key_bit_length(pi->attrs.transattrs.ta_encrypt) / BITS_PER_BYTE;
|
||||
- if (needed_len > 0) {
|
||||
- /* XXX: check key_len coupling with kernel.c's */
|
||||
- if (pi->attrs.transattrs.enckeylen) {
|
||||
- needed_len =
|
||||
- pi->attrs.transattrs.enckeylen
|
||||
- / BITS_PER_BYTE;
|
||||
- dbg("compute_proto_keymat: key_len=%d from peer",
|
||||
- (int)needed_len);
|
||||
- }
|
||||
- break;
|
||||
- }
|
||||
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
|
||||
+ {
|
||||
+ enum_buf eb;
|
||||
+ llog(RC_LOG, st->st_logger, "rejecting request for keymat for %s",
|
||||
+ str_enum(&esp_transformid_names, protoid, &eb));
|
||||
+ return false;
|
||||
+ }
|
||||
}
|
||||
dbg("compute_proto_keymat: needed_len (after ESP enc)=%d", (int)needed_len);
|
||||
needed_len += pi->attrs.transattrs.ta_integ->integ_keymat_size;
|
||||
@@ -359,14 +345,17 @@ static void compute_proto_keymat(struct state *st,
|
||||
DBG_dump_hunk(" inbound:", pi->inbound.keymat);
|
||||
DBG_dump_hunk(" outbound:", pi->outbound.keymat);
|
||||
}
|
||||
+
|
||||
+ return true;
|
||||
}
|
||||
|
||||
-static void compute_keymats(struct state *st)
|
||||
+static bool compute_keymats(struct state *st)
|
||||
{
|
||||
if (st->st_ah.present)
|
||||
- compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
|
||||
+ return compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
|
||||
if (st->st_esp.present)
|
||||
- compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
|
||||
+ return compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
|
||||
+ return false;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -1460,7 +1449,9 @@ static stf_status quick_inI1_outR1_continue12_tail(struct state *st, struct msg_
|
||||
fixup_v1_HASH(st, &hash_fixup, st->st_v1_msgid.id, rbody.cur);
|
||||
|
||||
/* Derive new keying material */
|
||||
- compute_keymats(st);
|
||||
+ if (!compute_keymats(st)) {
|
||||
+ return STF_FATAL;
|
||||
+ }
|
||||
|
||||
/* Tell the kernel to establish the new inbound SA
|
||||
* (unless the commit bit is set -- which we don't support).
|
||||
--
|
||||
2.45.0
|
||||
|
||||
@ -1,54 +0,0 @@
|
||||
From 2ec448884a7467743699803f8a36ee28d237666c Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Wed, 28 Feb 2024 08:29:53 -0500
|
||||
Subject: [PATCH] ikev2: return STF_FATAL when initiator fails to emit AUTH
|
||||
packet
|
||||
|
||||
---
|
||||
programs/pluto/ikev2_ike_auth.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
|
||||
index 192eb1b3b6..a54a109699 100644
|
||||
--- a/programs/pluto/ikev2_ike_auth.c
|
||||
+++ b/programs/pluto/ikev2_ike_auth.c
|
||||
@@ -1267,7 +1267,7 @@ static stf_status process_v2_IKE_AUTH_request_auth_signature_continue(struct ike
|
||||
/* now send AUTH payload */
|
||||
|
||||
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, response.pbs)) {
|
||||
- return STF_INTERNAL_ERROR;
|
||||
+ return STF_FATAL;
|
||||
}
|
||||
ike->sa.st_v2_ike_intermediate.used = false;
|
||||
|
||||
--
|
||||
2.44.0
|
||||
|
||||
From 16272f2475d25baab58fbed2af7c67cfb459137f Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Thu, 29 Feb 2024 12:19:20 -0500
|
||||
Subject: [PATCH] ikev2: always return STF_FATAL if emitting AUTH fails
|
||||
|
||||
Fix:
|
||||
ikev2: return STF_FATAL when initiator fails to emit AUTH packet
|
||||
which really fixed the responder.
|
||||
---
|
||||
programs/pluto/ikev2_ike_auth.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
|
||||
index a54a109699..491053fb10 100644
|
||||
--- a/programs/pluto/ikev2_ike_auth.c
|
||||
+++ b/programs/pluto/ikev2_ike_auth.c
|
||||
@@ -397,7 +397,7 @@ stf_status initiate_v2_IKE_AUTH_request_signature_continue(struct ike_sa *ike,
|
||||
/* send out the AUTH payload */
|
||||
|
||||
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, request.pbs)) {
|
||||
- return STF_INTERNAL_ERROR;
|
||||
+ return STF_FATAL;
|
||||
}
|
||||
|
||||
if (LIN(POLICY_MOBIKE, ike->sa.st_connection->policy)) {
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,198 +0,0 @@
|
||||
From 474d75be074799efa9e38f346d3fdb76dec3eead Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Tue, 5 Dec 2023 13:55:37 -0500
|
||||
Subject: [PATCH] x509: unpack IPv6 general names based on length
|
||||
|
||||
fix #1321
|
||||
---
|
||||
programs/pluto/x509.c | 35 +++++++++++++++++++++++++++++------
|
||||
1 file changed, 29 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/programs/pluto/x509.c b/programs/pluto/x509.c
|
||||
index fbbf5a553e..f7e97b9979 100644
|
||||
--- a/programs/pluto/x509.c
|
||||
+++ b/programs/pluto/x509.c
|
||||
@@ -336,7 +336,7 @@ generalName_t *collect_rw_ca_candidates(struct msg_digest *md)
|
||||
*/
|
||||
static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger)
|
||||
{
|
||||
- *id = empty_id;
|
||||
+ *id = empty_id; /* aka ID_NONE */
|
||||
|
||||
switch (gn->kind) {
|
||||
case GN_DNS_NAME: /* ID type: ID_FQDN */
|
||||
@@ -345,18 +345,37 @@ static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger
|
||||
break;
|
||||
case GN_IP_ADDRESS: /* ID type: ID_IPV4_ADDR */
|
||||
{
|
||||
+ const struct ip_info *afi = NULL;
|
||||
+ for (enum ip_index i = 0; i < IP_INDEX_ROOF; i++) {
|
||||
+ if (ip_families[i].ip_size == gn->name.len) {
|
||||
+ afi = &ip_families[i];
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+ if (afi == NULL) {
|
||||
+ llog(RC_LOG, logger,
|
||||
+ "warning: invalid IP_ADDRESS general name: %zu byte length is not valid",
|
||||
+ gn->name.len);
|
||||
+ PEXPECT(logger, id->kind == ID_NONE);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
/*
|
||||
* XXX: why could this fail; and what happens when it
|
||||
* is ignored?
|
||||
*/
|
||||
- const struct ip_info *afi = &ipv4_info;
|
||||
- id->kind = afi->id_ip_addr;
|
||||
- err_t ugh = hunk_to_address(gn->name, afi, &id->ip_addr);
|
||||
+ ip_address addr;
|
||||
+ err_t ugh = hunk_to_address(gn->name, afi, &addr);
|
||||
if (ugh != NULL) {
|
||||
llog(RC_LOG, logger,
|
||||
- "warning: gntoid() failed to initaddr(): %s",
|
||||
- ugh);
|
||||
+ "warning: invalid IP_ADDRESS general name: %s",
|
||||
+ ugh);
|
||||
+ PEXPECT(logger, id->kind == ID_NONE);
|
||||
+ return;
|
||||
}
|
||||
+
|
||||
+ id->kind = afi->id_ip_addr;
|
||||
+ id->ip_addr = addr;
|
||||
break;
|
||||
}
|
||||
case GN_RFC822_NAME: /* ID type: ID_USER_FQDN */
|
||||
@@ -464,14 +483,18 @@ bool add_pubkey_from_nss_cert(struct pubkey_list **pubkey_db,
|
||||
return false;
|
||||
}
|
||||
|
||||
+ ldbg(logger, "adding cert using subject name");
|
||||
replace_public_key(pubkey_db, &pk);
|
||||
passert(pk == NULL); /*stolen*/
|
||||
|
||||
+ ldbg(logger, "adding cert using general names");
|
||||
add_cert_san_pubkeys(pubkey_db, cert, logger);
|
||||
|
||||
if (keyid != NULL && keyid->kind != ID_DER_ASN1_DN &&
|
||||
keyid->kind != ID_NONE &&
|
||||
keyid->kind != ID_FROMCERT) {
|
||||
+ id_buf idb;
|
||||
+ ldbg(logger, "adding cert using keyid %s", str_id(keyid, &idb));
|
||||
struct pubkey *pk2 = NULL;
|
||||
diag_t d = create_pubkey_from_cert(keyid, cert, &pk2, logger);
|
||||
if (d != NULL) {
|
||||
--
|
||||
2.44.0
|
||||
|
||||
From 1e27be95cd710a840681d1a51913e6a32ce75a2a Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Mon, 11 Mar 2024 17:18:51 -0400
|
||||
Subject: [PATCH] building: back-port ip_families[] and ip_index
|
||||
|
||||
---
|
||||
include/ip_index.h | 27 +++++++++++++++++++++++++++
|
||||
include/ip_info.h | 7 +++++--
|
||||
lib/libswan/ip_info.c | 9 ++++++---
|
||||
3 files changed, 38 insertions(+), 5 deletions(-)
|
||||
create mode 100644 include/ip_index.h
|
||||
|
||||
diff --git a/include/ip_index.h b/include/ip_index.h
|
||||
new file mode 100644
|
||||
index 0000000000..508589b05e
|
||||
--- /dev/null
|
||||
+++ b/include/ip_index.h
|
||||
@@ -0,0 +1,27 @@
|
||||
+/* ip address type index, for libreswan
|
||||
+ *
|
||||
+ * Copyright (C) 2022 Andrew Cagney
|
||||
+ *
|
||||
+ * This library is free software; you can redistribute it and/or modify it
|
||||
+ * under the terms of the GNU Library General Public License as published by
|
||||
+ * the Free Software Foundation; either version 2 of the License, or (at your
|
||||
+ * option) any later version. See <https://www.gnu.org/licenses/lgpl-2.1.txt>.
|
||||
+ *
|
||||
+ * This library is distributed in the hope that it will be useful, but
|
||||
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
|
||||
+ * License for more details.
|
||||
+ *
|
||||
+ */
|
||||
+
|
||||
+#ifndef IP_INDEX_H
|
||||
+#define IP_INDEX_H
|
||||
+
|
||||
+enum ip_index {
|
||||
+ IPv4_INDEX,
|
||||
+ IPv6_INDEX,
|
||||
+};
|
||||
+
|
||||
+#define IP_INDEX_ROOF (IPv6_INDEX+1)
|
||||
+
|
||||
+#endif
|
||||
diff --git a/include/ip_info.h b/include/ip_info.h
|
||||
index 40e99ef687..c1329a8569 100644
|
||||
--- a/include/ip_info.h
|
||||
+++ b/include/ip_info.h
|
||||
@@ -9,6 +9,7 @@
|
||||
#include "ip_subnet.h"
|
||||
#include "ip_selector.h"
|
||||
#include "ip_sockaddr.h"
|
||||
+#include "ip_index.h"
|
||||
|
||||
struct ip_info {
|
||||
/*
|
||||
@@ -113,8 +114,10 @@ struct ip_info {
|
||||
|
||||
};
|
||||
|
||||
-extern const struct ip_info ipv4_info;
|
||||
-extern const struct ip_info ipv6_info;
|
||||
+extern const struct ip_info ip_families[IP_INDEX_ROOF];
|
||||
+
|
||||
+#define ipv4_info ip_families[IPv4_INDEX]
|
||||
+#define ipv6_info ip_families[IPv6_INDEX]
|
||||
|
||||
extern const struct ip_info *aftoinfo(int af);
|
||||
|
||||
diff --git a/lib/libswan/ip_info.c b/lib/libswan/ip_info.c
|
||||
index 70cd6a368f..97296d3a11 100644
|
||||
--- a/lib/libswan/ip_info.c
|
||||
+++ b/lib/libswan/ip_info.c
|
||||
@@ -158,7 +158,9 @@ static ip_port port_from_ipv6_sockaddr(const ip_sockaddr sa)
|
||||
|
||||
#define IPv4_FF { { 255, 255, 255, 255, }, }
|
||||
|
||||
-const struct ip_info ipv4_info = {
|
||||
+const struct ip_info ip_families[IP_INDEX_ROOF] = {
|
||||
+
|
||||
+ [IPv4_INDEX] = {
|
||||
|
||||
.ip_version = IPv4,
|
||||
.ip_size = sizeof(struct in_addr),
|
||||
@@ -210,11 +212,11 @@ const struct ip_info ipv4_info = {
|
||||
.id_ip_addr = ID_IPV4_ADDR,
|
||||
.id_ip_addr_subnet = ID_IPV4_ADDR_SUBNET,
|
||||
.id_ip_addr_range = ID_IPV4_ADDR_RANGE,
|
||||
-};
|
||||
+ },
|
||||
|
||||
#define IPv6_FF { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }, }
|
||||
|
||||
-const struct ip_info ipv6_info = {
|
||||
+ [IPv6_INDEX] = {
|
||||
|
||||
.ip_version = IPv6,
|
||||
.ip_size = sizeof(struct in6_addr),
|
||||
@@ -266,6 +268,7 @@ const struct ip_info ipv6_info = {
|
||||
.id_ip_addr = ID_IPV6_ADDR,
|
||||
.id_ip_addr_subnet = ID_IPV6_ADDR_SUBNET,
|
||||
.id_ip_addr_range = ID_IPV6_ADDR_RANGE,
|
||||
+ }
|
||||
};
|
||||
|
||||
const struct ip_info *aftoinfo(int af)
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -0,0 +1,20 @@
|
||||
diff --git a/programs/ipsec/ipsec.in b/programs/ipsec/ipsec.in
|
||||
index 40ff9f4138..41813b5258 100755
|
||||
--- a/programs/ipsec/ipsec.in
|
||||
+++ b/programs/ipsec/ipsec.in
|
||||
@@ -758,7 +758,14 @@ ipsec_import() {
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
|
||||
+ # First try blanc password to avoid uselessly prompting interactively
|
||||
+ pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" -W '' 2>/dev/null
|
||||
+ # check for SEC_ERROR_BAD_PASSWORD
|
||||
+ if [ $? -eq 18 ]; then
|
||||
+ # Not the empty password
|
||||
+ pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
|
||||
+ fi
|
||||
+
|
||||
# check and correct trust bits
|
||||
set_nss_db_trusts
|
||||
exit 0
|
||||
@ -0,0 +1,153 @@
|
||||
From 4f2af7c8c3afaaa63e8e16467de3441622a5314d Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <dueno@redhat.com>
|
||||
Date: Tue, 21 May 2024 20:12:17 +0900
|
||||
Subject: [PATCH] kernel_xfrm: record extended ack from netlink response
|
||||
|
||||
This enables pluto to log any error message reported through extended
|
||||
ACK attributes[1] in a netlink response, to make diagnostic easier
|
||||
when an error occurs. Suggested by Sabrina Dubroca.
|
||||
|
||||
1. https://docs.kernel.org/userspace-api/netlink/intro.html#ext-ack
|
||||
|
||||
Signed-off-by: Daiki Ueno <dueno@redhat.com>
|
||||
Signed-off-by: Andrew Cagney <cagney@gnu.org>
|
||||
---
|
||||
include/netlink_attrib.h | 4 +++
|
||||
lib/libswan/netlink_attrib.c | 29 +++++++++++++++++++++
|
||||
programs/pluto/kernel_xfrm.c | 49 ++++++++++++++++++++++++++++++++++++
|
||||
3 files changed, 82 insertions(+)
|
||||
|
||||
diff --git a/include/netlink_attrib.h b/include/netlink_attrib.h
|
||||
index 4c952ae3e9..fff35d83f1 100644
|
||||
--- a/include/netlink_attrib.h
|
||||
+++ b/include/netlink_attrib.h
|
||||
@@ -46,4 +46,8 @@ void nl_addattrstrz(struct nlmsghdr *n, int maxlen, int type,
|
||||
const char *str);
|
||||
void nl_addattr32(struct nlmsghdr *n, int maxlen, int type, const uint32_t data);
|
||||
|
||||
+const struct nlattr *nl_getattr(const struct nlmsghdr *n, size_t *offset);
|
||||
+const char *nl_getattrvalstrz(const struct nlmsghdr *n,
|
||||
+ const struct nlattr *attr);
|
||||
+
|
||||
#endif
|
||||
diff --git a/lib/libswan/netlink_attrib.c b/lib/libswan/netlink_attrib.c
|
||||
index 34bb4bec83..ccc08cba8f 100644
|
||||
--- a/lib/libswan/netlink_attrib.c
|
||||
+++ b/lib/libswan/netlink_attrib.c
|
||||
@@ -66,3 +66,32 @@ void nl_addattr32(struct nlmsghdr *n, int maxlen, int type, const uint32_t data)
|
||||
{
|
||||
nl_addattr_l(n, maxlen, type, &data, sizeof(uint32_t));
|
||||
}
|
||||
+
|
||||
+const struct nlattr *nl_getattr(const struct nlmsghdr *n, size_t *offset)
|
||||
+{
|
||||
+ struct nlattr *attr = (void *)n + NLMSG_HDRLEN + NLMSG_ALIGN(*offset);
|
||||
+ struct nlattr *tail = (void *)n + NLMSG_ALIGN(n->nlmsg_len);
|
||||
+
|
||||
+ if (attr == tail) {
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ *offset += NLA_ALIGN(attr->nla_len);
|
||||
+ return attr;
|
||||
+}
|
||||
+
|
||||
+const char *nl_getattrvalstrz(const struct nlmsghdr *n,
|
||||
+ const struct nlattr *attr)
|
||||
+{
|
||||
+ struct nlattr *tail = (void *)n + NLMSG_ALIGN(n->nlmsg_len);
|
||||
+
|
||||
+ ptrdiff_t len = (void *)tail - (void *)attr;
|
||||
+ if (len < (ptrdiff_t)sizeof(struct nlattr) ||
|
||||
+ attr->nla_len <= sizeof(struct nlattr) ||
|
||||
+ attr->nla_len > len ||
|
||||
+ !memchr(attr + NLA_HDRLEN, '\0', attr->nla_len - NLA_HDRLEN)) {
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ return (void *)attr + NLA_HDRLEN;
|
||||
+}
|
||||
diff --git a/programs/pluto/kernel_xfrm.c b/programs/pluto/kernel_xfrm.c
|
||||
index eed307f42b..25d1b16bc9 100644
|
||||
--- a/programs/pluto/kernel_xfrm.c
|
||||
+++ b/programs/pluto/kernel_xfrm.c
|
||||
@@ -260,6 +260,22 @@ static void init_netlink(struct logger *logger)
|
||||
"socket() in init_netlink()");
|
||||
}
|
||||
|
||||
+#ifdef SOL_NETLINK
|
||||
+ const int on = true;
|
||||
+ if (setsockopt(nl_send_fd, SOL_NETLINK, NETLINK_CAP_ACK,
|
||||
+ (const void *)&on, sizeof(on)) < 0) {
|
||||
+ llog_errno(RC_LOG, logger, errno, "xfrm: setsockopt(NETLINK_CAP_ACK) failed: ");
|
||||
+ } else {
|
||||
+ ldbg(logger, "xfrm: setsockopt(NETLINK_CAP_ACK) ok");
|
||||
+ }
|
||||
+ if (setsockopt(nl_send_fd, SOL_NETLINK, NETLINK_EXT_ACK,
|
||||
+ (const void *)&on, sizeof(on)) < 0) {
|
||||
+ llog_errno(RC_LOG, logger, errno, "xfrm: setsockopt(NETLINK_EXT_ACK) failed: ");
|
||||
+ } else {
|
||||
+ ldbg(logger, "xfrm: setsockopt(NETLINK_EXT_ACK) ok");
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
nl_xfrm_fd = cloexec_socket(AF_NETLINK, SOCK_DGRAM|SOCK_NONBLOCK, NETLINK_XFRM);
|
||||
if (nl_xfrm_fd < 0) {
|
||||
fatal_errno(PLUTO_EXIT_FAIL, logger, errno,
|
||||
@@ -301,6 +317,37 @@ static void init_netlink(struct logger *logger)
|
||||
}
|
||||
}
|
||||
|
||||
+static void llog_ext_ack(lset_t rc_flags, struct logger *logger,
|
||||
+ const struct nlmsghdr *n)
|
||||
+{
|
||||
+#ifdef SOL_NETLINK
|
||||
+ if (n->nlmsg_type != NLMSG_ERROR ||
|
||||
+ !(n->nlmsg_flags & NLM_F_ACK_TLVS)) {
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ struct nlmsgerr *err = (void *)n + NLMSG_HDRLEN;
|
||||
+ size_t offset = sizeof(*err);
|
||||
+ if (!(n->nlmsg_flags & NLM_F_CAPPED)) {
|
||||
+ offset += err->msg.nlmsg_len - NLMSG_HDRLEN;
|
||||
+ }
|
||||
+
|
||||
+ for (const struct nlattr *attr = nl_getattr(n, &offset);
|
||||
+ attr != NULL; attr = nl_getattr(n, &offset)) {
|
||||
+ if ((attr->nla_type & NLA_TYPE_MASK) == NLMSGERR_ATTR_MSG) {
|
||||
+ const char *msg = nl_getattrvalstrz(n, attr);
|
||||
+ if (msg) {
|
||||
+ llog(rc_flags, logger, "netlink ext_ack: %s",
|
||||
+ msg);
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+#else
|
||||
+ /* use the arguments */
|
||||
+ ldbg(logger, "ignoring "PRI_LSET" %p", rc_flags, n);
|
||||
+#endif
|
||||
+}
|
||||
+
|
||||
/*
|
||||
* sendrecv_xfrm_msg()
|
||||
*
|
||||
@@ -403,6 +450,7 @@ static bool sendrecv_xfrm_msg(struct nlmsghdr *hdr,
|
||||
if (rsp.u.e.error != 0) {
|
||||
llog_error(logger, -rsp.u.e.error,
|
||||
"netlink response for %s %s", description, story);
|
||||
+ llog_ext_ack(RC_LOG, logger, &rsp.n);
|
||||
return false;
|
||||
}
|
||||
/*
|
||||
@@ -413,6 +461,7 @@ static bool sendrecv_xfrm_msg(struct nlmsghdr *hdr,
|
||||
*/
|
||||
dbg("netlink response for %s %s included non-error error",
|
||||
description, story);
|
||||
+ llog_ext_ack(DEBUG_STREAM, logger, &rsp.n);
|
||||
/* ignore */
|
||||
}
|
||||
if (rbuf == NULL) {
|
||||
--
|
||||
2.45.2
|
||||
|
||||
@ -0,0 +1,52 @@
|
||||
From 0b91406427cf7292d61900991fd665f076b6d43f Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <dueno@redhat.com>
|
||||
Date: Tue, 2 Jul 2024 20:37:07 +0900
|
||||
Subject: [PATCH] tcp: call kernel_ops->poke_ipsec_policy_hole before connect
|
||||
|
||||
This fixes ondemand initiation with TCP. Without the policy hole, a
|
||||
TCP handshake will not complete, as it cannot receive SYN-ACK packet
|
||||
in plaintext and thus connect blocks until timeout.
|
||||
|
||||
Signed-off-by: Daiki Ueno <dueno@redhat.com>
|
||||
Signed-off-by: Andrew Cagney <cagney@gnu.org>
|
||||
---
|
||||
programs/pluto/iface_tcp.c | 16 +++++++++-------
|
||||
1 file changed, 9 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/programs/pluto/iface_tcp.c b/programs/pluto/iface_tcp.c
|
||||
index c63e8bfe4d..55fe639174 100644
|
||||
--- a/programs/pluto/iface_tcp.c
|
||||
+++ b/programs/pluto/iface_tcp.c
|
||||
@@ -473,6 +473,15 @@ struct iface_endpoint *connect_to_tcp_endpoint(struct iface_dev *local_dev,
|
||||
return NULL;
|
||||
}
|
||||
|
||||
+ /* This needs to be called before connect, so TCP handshake
|
||||
+ * (in plaintext) completes. */
|
||||
+ if (kernel_ops->poke_ipsec_policy_hole != NULL &&
|
||||
+ !kernel_ops->poke_ipsec_policy_hole(fd, afi, logger)) {
|
||||
+ /* already logged */
|
||||
+ close(fd);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
/*
|
||||
* Connect
|
||||
*
|
||||
@@ -551,13 +560,6 @@ struct iface_endpoint *connect_to_tcp_endpoint(struct iface_dev *local_dev,
|
||||
}
|
||||
}
|
||||
|
||||
- if (kernel_ops->poke_ipsec_policy_hole != NULL &&
|
||||
- !kernel_ops->poke_ipsec_policy_hole(fd, afi, logger)) {
|
||||
- /* already logged */
|
||||
- close(fd);
|
||||
- return NULL;
|
||||
- }
|
||||
-
|
||||
struct iface_endpoint *ifp =
|
||||
alloc_iface_endpoint(fd, local_dev, &iketcp_iface_io,
|
||||
/*esp_encapsulation_enabled*/true,
|
||||
--
|
||||
2.45.2
|
||||
|
||||
@ -0,0 +1,17 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJHBAABCgAxFiEEkH55DyXB6OVhzXO1hf9LQ7MPxvkFAmYXR8ETHHRlYW1AbGli
|
||||
cmVzd2FuLm9yZwAKCRCF/0tDsw/G+WmID/46LnJ04rvj7RBZDzZg1nUnZyquuWd+
|
||||
vqGSFG54Ku5p62/JqL3+8Eu6dQ2o8DI1SJwMJFdaSFIwxNHTvZSr1wOwaSa+NQrI
|
||||
y/zTSAdZP04P0SqqJyOQxqYFMAEoRZhRE1gD4+1KGlQwPKzAtHi+2sHlfVryZEuF
|
||||
ZRRpuEcYrsdRneWxzRHKguDLb58b159yvt/HIQNOe7/BGnlq1rkBMgT0rD98A8Qb
|
||||
EOeZh6TcV9OnW2qm4QcJ5fm0ihvZpO/h3gih4KopwZQa7fUJYUPVRrS2AO40MVIM
|
||||
peq9/V+wD/+gthVh2eqtNzghGWxxwpZgBDQCmAUTr60QdCYeR2XsB/MGG5BJBs4m
|
||||
zFgXqsSHnEVJisUxnynNIFhUECo2A0CbVTAZnqBWgGkSO82VLu7506eaxJcJW84s
|
||||
QpNM7shHVdmV3lroqbJU2zBMKEHvCldFTDO2YTvfOV0Twytyn5gmT1sVqGiwdGpR
|
||||
XhfoRWILy+ViExhv6ZTubIYc1c8yo5wCG1tAq2iYfdLIcZVvqZIWB5LCv0rN2iPl
|
||||
0OrKo7bOQEmf7C+AL/LoAKWPpQeS79CYzwSKDfYHzE559yks0KPiTE5nLu8VrWH9
|
||||
zDTJ+2Ket3Ve93cz7zdqWcD7+HfKN7CxBW/bfCrysldsEjDBmvMiUI46kwPI99Y2
|
||||
w08DOHUAwSUgDg==
|
||||
=nCeA
|
||||
-----END PGP SIGNATURE-----
|
||||
Loading…
Reference in new issue