+++ /dev/null
-Index: isakmpd-20041012.orig/dpd.c
-===================================================================
---- isakmpd-20041012.orig.orig/dpd.c 2007-06-04 13:22:39.088912864 +0200
-+++ isakmpd-20041012.orig/dpd.c 2007-06-04 13:22:39.282883376 +0200
-@@ -26,6 +26,7 @@
-
- #include <sys/types.h>
- #include <stdlib.h>
-+#include <memory.h>
-
- #include "sysdep.h"
-
-@@ -174,6 +175,7 @@
- }
- break;
- default:
-+ ;
- }
-
- /* Mark handled. */
-@@ -223,6 +225,7 @@
- dpd_check_event, sa, &tv);
- break;
- default:
-+ ;
- }
- if (!sa->dpd_event)
- log_print("dpd_timer_reset: timer_add_event failed");
-Index: isakmpd-20041012.orig/ipsec.c
-===================================================================
---- isakmpd-20041012.orig.orig/ipsec.c 2007-06-04 13:22:39.093912104 +0200
-+++ isakmpd-20041012.orig/ipsec.c 2007-06-04 13:22:39.283883224 +0200
-@@ -1020,6 +1020,52 @@
- }
- }
-
-+/*
-+ * deal with a NOTIFY of INVALID_SPI
-+ */
-+static void
-+ipsec_invalid_spi (struct message *msg, struct payload *p)
-+{
-+ struct sockaddr *dst;
-+ int invspisz, off;
-+ u_int32_t spi;
-+ u_int16_t totsiz;
-+ u_int8_t spisz;
-+
-+ /* Any notification that make us do something should be protected */
-+ if(!TAILQ_FIRST (&msg->payload[ISAKMP_PAYLOAD_HASH]))
-+ {
-+ LOG_DBG ((LOG_SA, 40,
-+ "ipsec_invalid_spi: missing HASH payload in INVALID_SPI"
-+ " notification"));
-+ return;
-+ }
-+
-+ /*
-+ * get the invalid spi out of the variable sized notification data
-+ * field, which is after the variable sized SPI field [which specifies
-+ * the receiving entity's phase-1 SPI, not the invalid spi]
-+ */
-+ totsiz = GET_ISAKMP_GEN_LENGTH (p->p);
-+ spisz = GET_ISAKMP_NOTIFY_SPI_SZ (p->p);
-+ off = ISAKMP_NOTIFY_SPI_OFF + spisz;
-+ invspisz = totsiz - off;
-+
-+ if (invspisz != sizeof spi)
-+ {
-+ LOG_DBG ((LOG_SA, 40,
-+ "ipsec_invalid_spi: SPI size %d in INVALID_SPI "
-+ "payload unsupported", spisz));
-+ return;
-+ }
-+ memcpy (&spi, p->p + off, sizeof spi);
-+
-+ msg->transport->vtbl->get_dst (msg->transport, &dst);
-+
-+ /* delete matching SPI's from this peer */
-+ ipsec_delete_spi_list (dst, 0, (u_int8_t *)&spi, 1, "INVALID_SPI");
-+}
-+
- static int
- ipsec_responder(struct message *msg)
- {
-@@ -1205,7 +1251,9 @@
- return dv != IPSEC_ENCAP_TUNNEL
- && dv != IPSEC_ENCAP_TRANSPORT
- && dv != IPSEC_ENCAP_UDP_ENCAP_TUNNEL
-- && dv != IPSEC_ENCAP_UDP_ENCAP_TRANSPORT;
-+ && dv != IPSEC_ENCAP_UDP_ENCAP_TRANSPORT
-+ && dv != IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT
-+ && dv != IPSEC_ENCAP_UDP_ENCAP_TRANSPORT_DRAFT;
- #else
- return dv < IPSEC_ENCAP_TUNNEL
- || dv > IPSEC_ENCAP_TRANSPORT;
-@@ -1837,7 +1885,7 @@
- ipsec_get_id(char *section, int *id, struct sockaddr **addr,
- struct sockaddr **mask, u_int8_t *tproto, u_int16_t *port)
- {
-- char *type, *address, *netmask;
-+ char *type, *address, *netmask;
-
- type = conf_get_str(section, "ID-type");
- if (!type) {
-Index: isakmpd-20041012.orig/GNUmakefile
-===================================================================
---- isakmpd-20041012.orig.orig/GNUmakefile 2007-06-04 13:22:39.099911192 +0200
-+++ isakmpd-20041012.orig/GNUmakefile 2007-06-04 13:22:39.283883224 +0200
-@@ -40,12 +40,12 @@
- # integrated, freebsd/netbsd means FreeBSD/NetBSD with KAME IPsec.
- # darwin means MacOS X 10.2 and later with KAME IPsec. linux means Linux-2.5
- # and later with native IPSec support.
--OS= openbsd
-+#OS= openbsd
- #OS= netbsd
- #OS= freebsd
- #OS= freeswan
- #OS= darwin
--#OS= linux
-+OS= linux
-
- .CURDIR:= $(shell pwd)
- VPATH= ${.CURDIR}/sysdep/${OS}
-@@ -55,9 +55,10 @@
- ifndef BINDIR
- BINDIR= /sbin
- endif
--ifndef LDSTATIC
--LDSTATIC= -static
--endif
-+
-+#ifndef LDSTATIC
-+#LDSTATIC= -static
-+#endif
-
- SRCS= app.c attribute.c cert.c connection.c \
- constants.c conf.c cookie.c crypto.c dh.c doi.c exchange.c \
-@@ -131,11 +132,14 @@
- ifneq ($(findstring install,$(MAKECMDGOALS)),install)
- # Skip 'regress' until the regress/ structure has gmake makefiles for it.
- #SUBDIR:= regress
--SUBDIR:=
-+#SUBDIR:= apps/certpatch
- mksubdirs:
- $(foreach DIR, ${SUBDIR}, \
-- cd ${DIR}; ${MAKE} ${MAKEFLAGS} CFLAGS="${CFLAGS}" \
-- MKDEP="${MKDEP}" ${MAKECMDGOALS})
-+ cd ${.CURDIR}/${DIR}; ${MAKE} ${MAKECMDGOALS};)
-+
-+# $(foreach DIR, ${SUBDIR}, \
-+# cd ${DIR}; ${MAKE} CFLAGS="${CFLAGS}" \
-+# MKDEP="${MKDEP}" ${MAKECMDGOALS})
- else
- mksubdirs:
- endif
-@@ -173,7 +177,7 @@
- endif
-
- SRCS+= ${IPSEC_SRCS} ${X509} ${POLICY} ${EC} ${AGGRESSIVE} ${DNSSEC} \
-- $(ISAKMP_CFG)
-+ $(ISAKMP_CFG) ${DPD} ${NAT_TRAVERSAL}
- CFLAGS+= ${IPSEC_CFLAGS}
- LDADD+= ${DESLIB}
- DPADD+= ${DESLIBDEP}
-Index: isakmpd-20041012.orig/exchange.h
-===================================================================
---- isakmpd-20041012.orig.orig/exchange.h 2007-06-04 13:22:39.104910432 +0200
-+++ isakmpd-20041012.orig/exchange.h 2007-06-04 13:22:39.283883224 +0200
-@@ -221,6 +221,8 @@
- #define EXCHANGE_FLAG_NAT_T_ENABLE 0x10 /* We are doing NAT-T. */
- #define EXCHANGE_FLAG_NAT_T_KEEPALIVE 0x20 /* We are the NAT:ed peer. */
- #define EXCHANGE_FLAG_DPD_CAP_PEER 0x40 /* Peer is DPD capable. */
-+#define EXCHANGE_FLAG_NAT_T_RFC 0x0080 /* Peer does RFC NAT-T. */
-+#define EXCHANGE_FLAG_NAT_T_DRAFT 0x0100 /* Peer does draft NAT-T.*/
-
- extern int exchange_add_certs(struct message *);
- extern void exchange_finalize(struct message *);
-Index: isakmpd-20041012.orig/log.c
-===================================================================
---- isakmpd-20041012.orig.orig/log.c 2007-06-04 13:22:39.110909520 +0200
-+++ isakmpd-20041012.orig/log.c 2007-06-04 13:22:39.284883072 +0200
-@@ -79,7 +79,6 @@
-
- struct packhdr {
- struct pcap_pkthdr pcap;/* pcap file packet header */
-- u_int32_t sa_family; /* address family */
- union {
- struct ip ip4; /* IPv4 header (w/o options) */
- struct ip6_hdr ip6; /* IPv6 header */
-@@ -97,7 +96,7 @@
- static u_int8_t *packet_buf = NULL;
-
- static int udp_cksum(struct packhdr *, const struct udphdr *,
-- u_int16_t *);
-+ u_int16_t *, int);
- static u_int16_t in_cksum(const u_int16_t *, int);
- #endif /* USE_DEBUG */
-
-@@ -539,11 +538,9 @@
- udp.uh_ulen = htons(datalen);
-
- /* ip */
-- hdr.sa_family = htonl(src->sa_family);
- switch (src->sa_family) {
- default:
- /* Assume IPv4. XXX Can 'default' ever happen here? */
-- hdr.sa_family = htonl(AF_INET);
- hdr.ip.ip4.ip_src.s_addr = 0x02020202;
- hdr.ip.ip4.ip_dst.s_addr = 0x01010101;
- /* The rest of the setup is common to AF_INET. */
-@@ -584,9 +581,7 @@
- }
-
- /* Calculate UDP checksum. */
-- udp.uh_sum = udp_cksum(&hdr, &udp, (u_int16_t *) packet_buf);
-- hdrlen += sizeof hdr.sa_family;
--
-+ udp.uh_sum = udp_cksum(&hdr, &udp, (u_int16_t *) packet_buf, src->sa_family);
- /* pcap file packet header */
- gettimeofday(&tv, 0);
- hdr.pcap.ts.tv_sec = tv.tv_sec;
-@@ -610,7 +605,7 @@
-
- /* Copied from tcpdump/print-udp.c, mostly rewritten. */
- static int
--udp_cksum(struct packhdr *hdr, const struct udphdr *u, u_int16_t *d)
-+udp_cksum(struct packhdr *hdr, const struct udphdr *u, u_int16_t *d, int af)
- {
- struct ip *ip4;
- struct ip6_hdr *ip6;
-@@ -639,7 +634,7 @@
-
- /* Setup pseudoheader. */
- memset(phu.pa, 0, sizeof phu);
-- switch (ntohl(hdr->sa_family)) {
-+ switch (af) {
- case AF_INET:
- ip4 = &hdr->ip.ip4;
- memcpy(&phu.ip4p.src, &ip4->ip_src, sizeof(struct in_addr));
-@@ -664,7 +659,7 @@
-
- /* IPv6 wants a 0xFFFF checksum "on error", not 0x0. */
- if (tlen < 0)
-- return (ntohl(hdr->sa_family) == AF_INET ? 0 : 0xFFFF);
-+ return (af == AF_INET ? 0 : 0xFFFF);
-
- sum = 0;
- for (i = 0; i < hdrlen; i += 2)
-Index: isakmpd-20041012.orig/nat_traversal.c
-===================================================================
---- isakmpd-20041012.orig.orig/nat_traversal.c 2007-06-04 13:22:39.115908760 +0200
-+++ isakmpd-20041012.orig/nat_traversal.c 2007-06-04 13:22:39.284883072 +0200
-@@ -1,4 +1,4 @@
--/* $OpenBSD: nat_traversal.c,v 1.7 2004/08/08 19:11:06 deraadt Exp $ */
-+/* $OpenBSD: nat_traversal.c,v 1.17 2006/06/14 14:03:33 hshoexer Exp $ */
-
- /*
- * Copyright (c) 2004 Håkan Olsson. All rights reserved.
-@@ -48,40 +48,40 @@
- #include "util.h"
- #include "virtual.h"
-
-+int disable_nat_t = 0;
-+
- /*
-- * XXX According to draft-ietf-ipsec-nat-t-ike-07.txt, the NAT-T
-- * capability of the other peer is determined by a particular vendor ID
-- * sent as the first message. This vendor ID string is supposed to be a
-- * MD5 hash of "RFC XXXX", where XXXX is the future RFC number.
-+ * NAT-T capability of the other peer is determined by a particular vendor
-+ * ID sent in the first message. This vendor ID string is supposed to be a
-+ * MD5 hash of "RFC 3947".
- *
- * These seem to be the "well" known variants of this string in use by
- * products today.
- */
--static const char *isakmp_nat_t_cap_text[] = {
-- "draft-ietf-ipsec-nat-t-ike-00", /* V1 (XXX: may be obsolete) */
-- "draft-ietf-ipsec-nat-t-ike-02\n", /* V2 */
-- "draft-ietf-ipsec-nat-t-ike-03", /* V3 */
--#ifdef notyet
-- "RFC XXXX",
--#endif
-+
-+static struct nat_t_cap isakmp_nat_t_cap[] = {
-+ { VID_DRAFT_V2_N, EXCHANGE_FLAG_NAT_T_DRAFT,
-+ "draft-ietf-ipsec-nat-t-ike-02\n", NULL, 0 },
-+ { VID_DRAFT_V3, EXCHANGE_FLAG_NAT_T_DRAFT,
-+ "draft-ietf-ipsec-nat-t-ike-03", NULL, 0 },
-+ { VID_RFC3947, EXCHANGE_FLAG_NAT_T_RFC,
-+ "RFC 3947", NULL, 0 },
- };
-
-+#define NUMNATTCAP (sizeof isakmp_nat_t_cap / sizeof isakmp_nat_t_cap[0])
-+
- /* In seconds. Recommended in draft-ietf-ipsec-udp-encaps-09. */
- #define NAT_T_KEEPALIVE_INTERVAL 20
-
--/* The MD5 hashes of the above strings is put in this array. */
--static char **nat_t_hashes;
--static size_t nat_t_hashsize;
--
- static int nat_t_setup_hashes(void);
--static int nat_t_add_vendor_payload(struct message *, char *);
-+static int nat_t_add_vendor_payload(struct message *, struct nat_t_cap *);
- static int nat_t_add_nat_d(struct message *, struct sockaddr *);
- static int nat_t_match_nat_d_payload(struct message *, struct sockaddr *);
-
- void
- nat_t_init(void)
- {
-- nat_t_hashes = (char **)NULL;
-+ nat_t_setup_hashes();
- }
-
- /* Generate the NAT-T capability marker hashes. Executed only once. */
-@@ -89,7 +89,7 @@
- nat_t_setup_hashes(void)
- {
- struct hash *hash;
-- int n = sizeof isakmp_nat_t_cap_text / sizeof isakmp_nat_t_cap_text[0];
-+ int n = NUMNATTCAP;
- int i;
-
- /* The draft says to use MD5. */
-@@ -100,56 +100,49 @@
- "could not find MD5 hash structure!");
- return -1;
- }
-- nat_t_hashsize = hash->hashsize;
-
-- /* Allocate one more than is necessary, i.e NULL terminated. */
-- nat_t_hashes = (char **)calloc((size_t)(n + 1), sizeof(char *));
-- if (!nat_t_hashes) {
-- log_error("nat_t_setup_hashes: calloc (%lu,%lu) failed",
-- (unsigned long)n, (unsigned long)sizeof(char *));
-- return -1;
-- }
--
-- /* Populate with hashes. */
-+ /* Populate isakmp_nat_t_cap with hashes. */
- for (i = 0; i < n; i++) {
-- nat_t_hashes[i] = (char *)malloc(nat_t_hashsize);
-- if (!nat_t_hashes[i]) {
-+ isakmp_nat_t_cap[i].hashsize = hash->hashsize;
-+ isakmp_nat_t_cap[i].hash = (char *)malloc(hash->hashsize);
-+ if (!isakmp_nat_t_cap[i].hash) {
- log_error("nat_t_setup_hashes: malloc (%lu) failed",
-- (unsigned long)nat_t_hashsize);
-+ (unsigned long)hash->hashsize);
- goto errout;
- }
-
- hash->Init(hash->ctx);
- hash->Update(hash->ctx,
-- (unsigned char *)isakmp_nat_t_cap_text[i],
-- strlen(isakmp_nat_t_cap_text[i]));
-- hash->Final(nat_t_hashes[i], hash->ctx);
-+ (unsigned char *)isakmp_nat_t_cap[i].text,
-+ strlen(isakmp_nat_t_cap[i].text));
-+ hash->Final(isakmp_nat_t_cap[i].hash, hash->ctx);
-
- LOG_DBG((LOG_EXCHANGE, 50, "nat_t_setup_hashes: "
-- "MD5(\"%s\") (%lu bytes)", isakmp_nat_t_cap_text[i],
-- (unsigned long)nat_t_hashsize));
-+ "MD5(\"%s\") (%lu bytes)", isakmp_nat_t_cap[i].text,
-+ (unsigned long)hash->hashsize));
- LOG_DBG_BUF((LOG_EXCHANGE, 50, "nat_t_setup_hashes",
-- nat_t_hashes[i], nat_t_hashsize));
-+ isakmp_nat_t_cap[i].hash, hash->hashsize));
- }
-
- return 0;
-
-- errout:
-+errout:
- for (i = 0; i < n; i++)
-- if (nat_t_hashes[i])
-- free(nat_t_hashes[i]);
-- free(nat_t_hashes);
-- nat_t_hashes = NULL;
-+ if (isakmp_nat_t_cap[i].hash)
-+ free(isakmp_nat_t_cap[i].hash);
- return -1;
- }
-
- /* Add one NAT-T VENDOR payload. */
- static int
--nat_t_add_vendor_payload(struct message *msg, char *hash)
-+nat_t_add_vendor_payload(struct message *msg, struct nat_t_cap *cap)
- {
-- size_t buflen = nat_t_hashsize + ISAKMP_GEN_SZ;
-+ size_t buflen = cap->hashsize + ISAKMP_GEN_SZ;
- u_int8_t *buf;
-
-+ if (disable_nat_t)
-+ return 0;
-+
- buf = malloc(buflen);
- if (!buf) {
- log_error("nat_t_add_vendor_payload: malloc (%lu) failed",
-@@ -158,12 +151,11 @@
- }
-
- SET_ISAKMP_GEN_LENGTH(buf, buflen);
-- memcpy(buf + ISAKMP_VENDOR_ID_OFF, hash, nat_t_hashsize);
-+ memcpy(buf + ISAKMP_VENDOR_ID_OFF, cap->hash, cap->hashsize);
- if (message_add_payload(msg, ISAKMP_PAYLOAD_VENDOR, buf, buflen, 1)) {
- free(buf);
- return -1;
- }
--
- return 0;
- }
-
-@@ -171,16 +163,14 @@
- int
- nat_t_add_vendor_payloads(struct message *msg)
- {
-- int i = 0;
-+ int i;
-
-- if (!nat_t_hashes)
-- if (nat_t_setup_hashes())
-- return 0; /* XXX should this be an error? */
-+ if (disable_nat_t)
-+ return 0;
-
-- while (nat_t_hashes[i])
-- if (nat_t_add_vendor_payload(msg, nat_t_hashes[i++]))
-+ for (i = 0; i < NUMNATTCAP; i++)
-+ if (nat_t_add_vendor_payload(msg, &isakmp_nat_t_cap[i]))
- return -1;
--
- return 0;
- }
-
-@@ -192,36 +182,31 @@
- {
- u_int8_t *pbuf = p->p;
- size_t vlen;
-- int i = 0;
-+ int i;
-
-- /* Already checked? */
-- if (p->flags & PL_MARK ||
-- msg->exchange->flags & EXCHANGE_FLAG_NAT_T_CAP_PEER)
-+ if (disable_nat_t)
- return;
-
-- if (!nat_t_hashes)
-- if (nat_t_setup_hashes())
-- return;
--
- vlen = GET_ISAKMP_GEN_LENGTH(pbuf) - ISAKMP_GEN_SZ;
-- if (vlen != nat_t_hashsize) {
-- LOG_DBG((LOG_EXCHANGE, 50, "nat_t_check_vendor_payload: "
-- "bad size %lu != %lu", (unsigned long)vlen,
-- (unsigned long)nat_t_hashsize));
-- return;
-- }
-
-- while (nat_t_hashes[i])
-- if (memcmp(nat_t_hashes[i++], pbuf + ISAKMP_GEN_SZ,
-+ for (i = 0; i < NUMNATTCAP; i++) {
-+ if (vlen != isakmp_nat_t_cap[i].hashsize) {
-+ LOG_DBG((LOG_EXCHANGE, 50, "nat_t_check_vendor_payload: "
-+ "bad size %lu != %lu", (unsigned long)vlen,
-+ (unsigned long)isakmp_nat_t_cap[i].hashsize));
-+ continue;
-+ }
-+ if (memcmp(isakmp_nat_t_cap[i].hash, pbuf + ISAKMP_GEN_SZ,
- vlen) == 0) {
- /* This peer is NAT-T capable. */
- msg->exchange->flags |= EXCHANGE_FLAG_NAT_T_CAP_PEER;
-+ msg->exchange->flags |= isakmp_nat_t_cap[i].flags;
- LOG_DBG((LOG_EXCHANGE, 10,
- "nat_t_check_vendor_payload: "
- "NAT-T capable peer detected"));
- p->flags |= PL_MARK;
-- return;
- }
-+ }
-
- return;
- }
-@@ -233,10 +218,8 @@
- {
- struct ipsec_exch *ie = (struct ipsec_exch *)msg->exchange->data;
- struct hash *hash;
-- struct prf *prf;
- u_int8_t *res;
- in_port_t port;
-- int prf_type = PRF_HMAC; /* XXX */
-
- hash = hash_get(ie->hash->type);
- if (hash == NULL) {
-@@ -244,31 +227,25 @@
- return NULL;
- }
-
-- prf = prf_alloc(prf_type, hash->type, msg->exchange->cookies,
-- ISAKMP_HDR_COOKIES_LEN);
-- if(!prf) {
-- log_print("nat_t_generate_nat_d_hash: prf_alloc failed");
-- return NULL;
-- }
-+ *hashlen = hash->hashsize;
-
-- *hashlen = prf->blocksize;
- res = (u_int8_t *)malloc((unsigned long)*hashlen);
- if (!res) {
- log_print("nat_t_generate_nat_d_hash: malloc (%lu) failed",
- (unsigned long)*hashlen);
-- prf_free(prf);
- *hashlen = 0;
- return NULL;
- }
-
- port = sockaddr_port(sa);
-- memset(res, 0, *hashlen);
--
-- prf->Update(prf->prfctx, sockaddr_addrdata(sa), sockaddr_addrlen(sa));
-- prf->Update(prf->prfctx, (unsigned char *)&port, sizeof port);
-- prf->Final(res, prf->prfctx);
-- prf_free (prf);
-+ bzero(res, *hashlen);
-
-+ hash->Init(hash->ctx);
-+ hash->Update(hash->ctx, msg->exchange->cookies,
-+ sizeof msg->exchange->cookies);
-+ hash->Update(hash->ctx, sockaddr_addrdata(sa), sockaddr_addrlen(sa));
-+ hash->Update(hash->ctx, (unsigned char *)&port, sizeof port);
-+ hash->Final(res, hash->ctx);
- return res;
- }
-
-@@ -276,6 +253,7 @@
- static int
- nat_t_add_nat_d(struct message *msg, struct sockaddr *sa)
- {
-+ int ret;
- u_int8_t *hbuf, *buf;
- size_t hbuflen, buflen;
-
-@@ -298,11 +276,19 @@
- memcpy(buf + ISAKMP_NAT_D_DATA_OFF, hbuf, hbuflen);
- free(hbuf);
-
-- if (message_add_payload(msg, ISAKMP_PAYLOAD_NAT_D, buf, buflen, 1)) {
-+ if (msg->exchange->flags & EXCHANGE_FLAG_NAT_T_RFC)
-+ ret = message_add_payload(msg, ISAKMP_PAYLOAD_NAT_D, buf,
-+ buflen, 1);
-+ else if (msg->exchange->flags & EXCHANGE_FLAG_NAT_T_DRAFT)
-+ ret = message_add_payload(msg, ISAKMP_PAYLOAD_NAT_D_DRAFT,
-+ buf, buflen, 1);
-+ else
-+ ret = -1;
-+
-+ if (ret) {
- free(buf);
- return -1;
- }
--
- return 0;
- }
-
-@@ -312,14 +298,14 @@
- {
- struct sockaddr *sa;
-
-- msg->transport->vtbl->get_src(msg->transport, &sa);
-+ /* Remote address first. */
-+ msg->transport->vtbl->get_dst(msg->transport, &sa);
- if (nat_t_add_nat_d(msg, sa))
- return -1;
-
-- msg->transport->vtbl->get_dst(msg->transport, &sa);
-+ msg->transport->vtbl->get_src(msg->transport, &sa);
- if (nat_t_add_nat_d(msg, sa))
- return -1;
--
- return 0;
- }
-
-@@ -336,8 +322,8 @@
- * If there are no NAT-D payloads in the message, return "found"
- * as this will avoid NAT-T (see nat_t_exchange_check_nat_d()).
- */
-- p = payload_first(msg, ISAKMP_PAYLOAD_NAT_D);
-- if (!p)
-+ if ((p = payload_first(msg, ISAKMP_PAYLOAD_NAT_D_DRAFT)) == NULL &&
-+ (p = payload_first(msg, ISAKMP_PAYLOAD_NAT_D)) == NULL)
- return 1;
-
- hbuf = nat_t_generate_nat_d_hash(msg, sa, &hbuflen);
-Index: isakmpd-20041012.orig/udp_encap.c
-===================================================================
---- isakmpd-20041012.orig.orig/udp_encap.c 2007-06-04 13:22:39.121907848 +0200
-+++ isakmpd-20041012.orig/udp_encap.c 2007-06-04 13:22:39.284883072 +0200
-@@ -61,6 +61,11 @@
-
- #define UDP_SIZE 65536
-
-+#if defined(USE_NAT_TRAVERSAL) && defined (LINUX_IPSEC)
-+#include <linux/socket.h>
-+#include <linux/udp.h>
-+#endif
-+
- /* If a system doesn't have SO_REUSEPORT, SO_REUSEADDR will have to do. */
- #ifndef SO_REUSEPORT
- #define SO_REUSEPORT SO_REUSEADDR
-@@ -134,6 +139,18 @@
- if (sysdep_cleartext(s, laddr->sa_family) == -1)
- goto err;
-
-+#if defined(USE_NAT_TRAVERSAL) && defined (LINUX_IPSEC)
-+ {
-+#ifndef SOL_UDP
-+#define SOL_UDP 17
-+#endif
-+ int option = UDP_ENCAP_ESPINUDP;
-+ if(setsockopt(s, SOL_UDP, UDP_ENCAP, &option,
-+ sizeof (option)) < 0)
-+ goto err;
-+ }
-+#endif
-+
- /* Wildcard address ? */
- switch (laddr->sa_family) {
- case AF_INET:
-Index: isakmpd-20041012.orig/apps/Makefile
-===================================================================
---- isakmpd-20041012.orig.orig/apps/Makefile 2007-06-04 13:22:39.126907088 +0200
-+++ isakmpd-20041012.orig/apps/Makefile 2007-06-04 13:22:39.285882920 +0200
-@@ -31,4 +31,4 @@
-
- SUBDIR= certpatch
-
--.include <bsd.subdir.mk>
-+#.include <bsd.subdir.mk>
-Index: isakmpd-20041012.orig/apps/certpatch/GNUmakefile
-===================================================================
---- /dev/null 1970-01-01 00:00:00.000000000 +0000
-+++ isakmpd-20041012.orig/apps/certpatch/GNUmakefile 2007-06-04 13:22:39.285882920 +0200
-@@ -0,0 +1,55 @@
-+# $OpenBSD: Makefile,v 1.7 2003/06/03 14:35:00 ho Exp $
-+# $EOM: Makefile,v 1.6 2000/03/28 21:22:06 ho Exp $
-+
-+#
-+# Copyright (c) 1999 Niels Provos. All rights reserved.
-+# Copyright (c) 2001 Niklas Hallqvist. All rights reserved.
-+#
-+# Redistribution and use in source and binary forms, with or without
-+# modification, are permitted provided that the following conditions
-+# are met:
-+# 1. Redistributions of source code must retain the above copyright
-+# notice, this list of conditions and the following disclaimer.
-+# 2. Redistributions in binary form must reproduce the above copyright
-+# notice, this list of conditions and the following disclaimer in the
-+# documentation and/or other materials provided with the distribution.
-+#
-+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+#
-+
-+#
-+# This code was written under funding by Ericsson Radio Systems.
-+#
-+
-+PROG= certpatch
-+SRCS= certpatch.c
-+BINDIR?= /usr/sbin
-+TOPSRC= ${.CURDIR}../..
-+TOPOBJ!= cd ${TOPSRC}; printf "all:\n\t@pwd\n" |${MAKE} -f-
-+OS= linux
-+FEATURES!= awk '/^FEATURES=/ { print $$0 }' ${.CURDIR}/../../Makefile | sed 's/FEATURES=.//'
-+.PATH: ${TOPSRC} ${TOPSRC}/sysdep/${OS} ${TOPOBJ}
-+CFLAGS+= -I${TOPSRC} -I${TOPSRC}/sysdep/${OS} -I${TOPOBJ} -Wall
-+LDFLAGS+= -lcrypto -lssl -lgmp
-+MAN= certpatch.8
-+
-+CFLAGS+= -DMP_FLAVOUR=MP_FLAVOUR_GMP
-+LDADD+= -lgmp
-+DPADD+= ${LIBGMP}
-+
-+# Override LIBSYSDEPDIR definition from Makefile.sysdep
-+LIBSYSDEPDIR= ${TOPSRC}/sysdep/common/libsysdep
-+
-+all: ${PROG}
-+
-+clean:
-+ rm -f ${PROG}
-Index: isakmpd-20041012.orig/pf_key_v2.c
-===================================================================
---- isakmpd-20041012.orig.orig/pf_key_v2.c 2007-06-04 13:22:39.137905416 +0200
-+++ isakmpd-20041012.orig/pf_key_v2.c 2007-06-04 13:22:39.287882616 +0200
-@@ -1055,6 +1055,10 @@
- #endif
- #if defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_UDPENCAP)
- struct sadb_x_udpencap udpencap;
-+#elif defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_NAT_T_TYPE)
-+ struct sadb_x_nat_t_type nat_t_type;
-+ struct sadb_x_nat_t_port nat_t_sport;
-+ struct sadb_x_nat_t_port nat_t_dport;
- #endif
- #ifdef USE_DEBUG
- char *addr_str;
-@@ -1273,10 +1277,15 @@
- log_print("pf_key_v2_set_spi: invalid proto %d", proto->proto);
- goto cleanup;
- }
-- if (incoming)
-+ if (incoming) {
- sa->transport->vtbl->get_src(sa->transport, &dst);
-- else
-+ sa->transport->vtbl->get_dst(sa->transport, &src);
-+ }
-+ else {
- sa->transport->vtbl->get_dst(sa->transport, &dst);
-+ sa->transport->vtbl->get_src(sa->transport, &src);
-+ }
-+
- #ifdef KAME
- msg.sadb_msg_seq = (incoming ?
- pf_key_v2_seq_by_sa(proto->spi[incoming], sizeof ssa.sadb_sa_spi,
-@@ -1319,12 +1328,13 @@
- ssa.sadb_sa_flags = 0;
- #ifdef SADB_X_SAFLAGS_TUNNEL
- if (iproto->encap_mode == IPSEC_ENCAP_TUNNEL ||
-- iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL)
-+ iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL ||
-+ iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT)
- ssa.sadb_sa_flags = SADB_X_SAFLAGS_TUNNEL;
- #endif
-
--#if defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_UDPENCAP)
- if (isakmp_sa->flags & SA_FLAG_NAT_T_ENABLE) {
-+#if defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_UDPENCAP)
- memset(&udpencap, 0, sizeof udpencap);
- ssa.sadb_sa_flags |= SADB_X_SAFLAGS_UDPENCAP;
- udpencap.sadb_x_udpencap_exttype = SADB_X_EXT_UDPENCAP;
-@@ -1334,8 +1344,40 @@
- if (pf_key_v2_msg_add(update, (struct sadb_ext *)&udpencap, 0)
- == -1)
- goto cleanup;
-- }
-+#elif defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_NAT_T_TYPE)
-+#ifndef UDP_ENCAP_ESPINUDP
-+#define UDP_ENCAP_ESPINUDP 2
-+#endif
-+ memset(&nat_t_type, 0, sizeof nat_t_type);
-+ memset(&nat_t_sport, 0, sizeof nat_t_sport);
-+ memset(&nat_t_dport, 0, sizeof nat_t_dport);
-+
-+ /* type = draft-udp-encap-06 */
-+ nat_t_type.sadb_x_nat_t_type_len = sizeof nat_t_type / PF_KEY_V2_CHUNK;
-+ nat_t_type.sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
-+ nat_t_type.sadb_x_nat_t_type_type = UDP_ENCAP_ESPINUDP;
-+ if(pf_key_v2_msg_add(update, (struct sadb_ext *)&nat_t_type, 0) == -1)
-+ goto cleanup;
-+
-+ /* source port */
-+ nat_t_sport.sadb_x_nat_t_port_len = sizeof nat_t_sport /
-+ PF_KEY_V2_CHUNK;
-+ nat_t_sport.sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
-+ nat_t_sport.sadb_x_nat_t_port_port = sockaddr_port(src);
-+ if(pf_key_v2_msg_add(update, (struct sadb_ext *)&nat_t_sport, 0) == -1)
-+ goto cleanup;
-+
-+ /* destination port */
-+ nat_t_dport.sadb_x_nat_t_port_len = sizeof nat_t_dport /
-+ PF_KEY_V2_CHUNK;
-+ nat_t_dport.sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
-+ nat_t_dport.sadb_x_nat_t_port_port = sockaddr_port(dst);
-+ if(pf_key_v2_msg_add(update, (struct sadb_ext *)&nat_t_dport, 0) == -1)
-+ goto cleanup;
-+
-+ /* original address (transport mode checksum missing info) goes here */
- #endif
-+ }
-
- if (pf_key_v2_msg_add(update, (struct sadb_ext *)&ssa, 0) == -1)
- goto cleanup;
-@@ -1395,10 +1437,6 @@
- /*
- * Setup the ADDRESS extensions.
- */
-- if (incoming)
-- sa->transport->vtbl->get_dst(sa->transport, &src);
-- else
-- sa->transport->vtbl->get_src(sa->transport, &src);
- len = sizeof *addr + PF_KEY_V2_ROUND(sysdep_sa_len(src));
- addr = calloc(1, len);
- if (!addr)
-@@ -2167,7 +2205,7 @@
- pf_key_v2_msg_free(ret);
- return -1;
-
--#elif defined (SADB_X_SPDADD) && defined (SADB_X_SPDDELETE)
-+#elif defined (SADB_X_SPDUPDATE) && defined (SADB_X_SPDDELETE)
- struct sadb_msg msg;
- struct sadb_x_policy *policy = 0;
- struct sadb_x_ipsecrequest *ipsecrequest;
-@@ -2181,7 +2219,7 @@
- struct sockaddr_in *ip4_sa;
- struct sockaddr_in6 *ip6_sa;
-
-- msg.sadb_msg_type = delete ? SADB_X_SPDDELETE : SADB_X_SPDADD;
-+ msg.sadb_msg_type = delete ? SADB_X_SPDDELETE : SADB_X_SPDUPDATE;
- msg.sadb_msg_satype = SADB_SATYPE_UNSPEC;
- msg.sadb_msg_seq = 0;
- flow = pf_key_v2_msg_new(&msg, 0);
-Index: isakmpd-20041012.orig/isakmp_num.cst
-===================================================================
---- isakmpd-20041012.orig.orig/isakmp_num.cst 2007-06-04 13:22:39.143904504 +0200
-+++ isakmpd-20041012.orig/isakmp_num.cst 2007-06-04 13:22:39.287882616 +0200
-@@ -57,15 +57,18 @@
- KD 17 # RFC 3547, Key Download
- SEQ 18 # RFC 3547, Sequence Number
- POP 19 # RFC 3547, Proof of possession
-- RESERVED_MIN 20
-+ NAT_D 20 # RFC 3947, NAT Discovery payload
-+ NAT_OA 21 # RFC 3947, NAT Original Address payload
-+ RESERVED_MIN 22
- RESERVED_MAX 127
- PRIVATE_MIN 128
- # XXX values from draft-ietf-ipsec-nat-t-ike-01,02,03. Later drafts specify
- # XXX NAT_D as payload 15 and NAT_OA as 16, but these are allocated by RFC
- # XXX 3547 as seen above.
-- NAT_D 130 # NAT Discovery payload
-- NAT_OA 131 # NAT Original Address payload
-+ NAT_D_DRAFT 130 # NAT Discovery payload
-+ NAT_OA_DRAFT 131 # NAT Original Address payload
- PRIVATE_MAX 255
-+ MAX 255
- .
-
- # ISAKMP exchange types.
-Index: isakmpd-20041012.orig/ipsec_num.cst
-===================================================================
---- isakmpd-20041012.orig.orig/ipsec_num.cst 2007-06-04 13:22:39.149903592 +0200
-+++ isakmpd-20041012.orig/ipsec_num.cst 2007-06-04 13:22:39.287882616 +0200
-@@ -62,10 +62,10 @@
- IPSEC_ENCAP
- TUNNEL 1
- TRANSPORT 2
-- FUTURE_UDP_ENCAP_TUNNEL 3 # XXX Not yet assigned
-- FUTURE_UDP_ENCAP_TRANSPORT 4 # XXX Not yet assigned
-- UDP_ENCAP_TUNNEL 61443 # draft-ietf-ipsec-nat-t-ike
-- UDP_ENCAP_TRANSPORT 61443 # draft-ietf-ipsec-nat-t-ike
-+ UDP_ENCAP_TUNNEL 3
-+ UDP_ENCAP_TRANSPORT 4
-+ UDP_ENCAP_TUNNEL_DRAFT 61443 # draft-ietf-ipsec-nat-t-ike
-+ UDP_ENCAP_TRANSPORT_DRAFT 61443 # draft-ietf-ipsec-nat-t-ike
- .
-
- # IPSEC authentication algorithm.
-Index: isakmpd-20041012.orig/nat_traversal.h
-===================================================================
---- isakmpd-20041012.orig.orig/nat_traversal.h 2007-06-04 13:22:39.154902832 +0200
-+++ isakmpd-20041012.orig/nat_traversal.h 2007-06-04 13:22:39.287882616 +0200
-@@ -1,4 +1,4 @@
--/* $OpenBSD: nat_traversal.h,v 1.2 2004/06/21 23:27:10 ho Exp $ */
-+/* $OpenBSD: nat_traversal.h,v 1.4 2005/07/25 15:03:47 hshoexer Exp $ */
-
- /*
- * Copyright (c) 2004 Håkan Olsson. All rights reserved.
-@@ -27,6 +27,24 @@
- #ifndef _NAT_TRAVERSAL_H_
- #define _NAT_TRAVERSAL_H_
-
-+#define VID_DRAFT_V2 0
-+#define VID_DRAFT_V2_N 1
-+#define VID_DRAFT_V3 2
-+#define VID_RFC3947 3
-+
-+struct nat_t_cap {
-+ int id;
-+ u_int32_t flags;
-+ const char *text;
-+ char *hash;
-+ size_t hashsize;
-+};
-+
-+/*
-+ * Set if -T is given on the command line to disable NAT-T support.
-+ */
-+extern int disable_nat_t;
-+
- void nat_t_init(void);
- int nat_t_add_vendor_payloads(struct message *);
- void nat_t_check_vendor_payload(struct message *, struct payload *);
-Index: isakmpd-20041012.orig/message.c
-===================================================================
---- isakmpd-20041012.orig.orig/message.c 2007-06-04 13:22:39.160901920 +0200
-+++ isakmpd-20041012.orig/message.c 2007-06-04 13:22:39.288882464 +0200
-@@ -112,6 +112,7 @@
- message_validate_hash, message_validate_sig, message_validate_nonce,
- message_validate_notify, message_validate_delete,
- message_validate_vendor, message_validate_attribute,
-+ message_validate_nat_d, message_validate_nat_oa,
- message_validate_nat_d, message_validate_nat_oa
- };
-
-@@ -120,7 +121,7 @@
- isakmp_id_fld, isakmp_cert_fld, isakmp_certreq_fld, isakmp_hash_fld,
- isakmp_sig_fld, isakmp_nonce_fld, isakmp_notify_fld, isakmp_delete_fld,
- isakmp_vendor_fld, isakmp_attribute_fld, isakmp_nat_d_fld,
-- isakmp_nat_oa_fld
-+ isakmp_nat_oa_fld, isakmp_nat_d_fld, isakmp_nat_oa_fld
- };
-
- /*
-@@ -138,7 +139,8 @@
- ISAKMP_PAYLOAD_SAK, ISAKMP_PAYLOAD_SAT, ISAKMP_PAYLOAD_KD,
- ISAKMP_PAYLOAD_SEQ, ISAKMP_PAYLOAD_POP
- #endif
-- ISAKMP_PAYLOAD_NAT_D, ISAKMP_PAYLOAD_NAT_OA
-+ ISAKMP_PAYLOAD_NAT_D, ISAKMP_PAYLOAD_NAT_OA,
-+ ISAKMP_PAYLOAD_NAT_D_DRAFT, ISAKMP_PAYLOAD_NAT_OA_DRAFT
- };
-
- static u_int8_t payload_map[256];
-@@ -347,8 +349,8 @@
- }
- /* Ignore most private payloads. */
- if (next >= ISAKMP_PAYLOAD_PRIVATE_MIN &&
-- next != ISAKMP_PAYLOAD_NAT_D &&
-- next != ISAKMP_PAYLOAD_NAT_OA) {
-+ next != ISAKMP_PAYLOAD_NAT_D_DRAFT &&
-+ next != ISAKMP_PAYLOAD_NAT_OA_DRAFT) {
- LOG_DBG((LOG_MESSAGE, 30, "message_parse_payloads: "
- "private next payload type %s in payload of "
- "type %d ignored",
-@@ -460,8 +462,10 @@
- return ISAKMP_ATTRIBUTE_SZ;
- #if defined (USE_NAT_TRAVERSAL)
- case ISAKMP_PAYLOAD_NAT_D:
-+ case ISAKMP_PAYLOAD_NAT_D_DRAFT:
- return ISAKMP_NAT_D_SZ;
- case ISAKMP_PAYLOAD_NAT_OA:
-+ case ISAKMP_PAYLOAD_NAT_OA_DRAFT:
- return ISAKMP_NAT_OA_SZ;
- #endif
- /* Not yet supported and any other unknown payloads. */
-Index: isakmpd-20041012.orig/policy.c
-===================================================================
---- isakmpd-20041012.orig.orig/policy.c 2007-06-04 13:22:39.165901160 +0200
-+++ isakmpd-20041012.orig/policy.c 2007-06-04 13:22:39.289882312 +0200
-@@ -511,7 +511,10 @@
- break;
- }
- #if defined (USE_NAT_TRAVERSAL)
-- else if (decode_16(value) == IPSEC_ENCAP_UDP_ENCAP_TUNNEL)
-+ else if (decode_16(value) ==
-+ IPSEC_ENCAP_UDP_ENCAP_TUNNEL ||
-+ decode_16(value) ==
-+ IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT)
- switch (proto->proto) {
- case IPSEC_PROTO_IPSEC_AH:
- ah_encapsulation = "udp-encap-tunnel";
-@@ -1932,7 +1935,7 @@
- void
- policy_init(void)
- {
-- char *ptr, *policy_file;
-+ char *ptr, *policy_file, *use_keynote;
- char **asserts;
- size_t sz, len;
- int fd, i;
-@@ -1940,10 +1943,11 @@
- LOG_DBG((LOG_POLICY, 30, "policy_init: initializing"));
-
- /* Do we want to use the policy modules? */
-- if (ignore_policy ||
-- strncmp("yes", conf_get_str("General", "Use-Keynote"), 3))
-- return;
--
-+ use_keynote = conf_get_str("General", "Use-Keynote");
-+ if (ignore_policy ||
-+ (use_keynote && strncmp("yes", use_keynote, 3)))
-+ return;
-+
- /* Get policy file from configuration. */
- policy_file = conf_get_str("General", "Policy-file");
- if (!policy_file)
-Index: isakmpd-20041012.orig/ike_phase_1.c
-===================================================================
---- isakmpd-20041012.orig.orig/ike_phase_1.c 2007-06-04 13:22:39.170900400 +0200
-+++ isakmpd-20041012.orig/ike_phase_1.c 2007-06-04 13:22:39.290882160 +0200
-@@ -1040,9 +1040,9 @@
-
- /* Compare expected/desired and received remote ID */
- if (bcmp(rid, payload->p + ISAKMP_ID_DATA_OFF, sz)) {
-- free(rid);
- log_print("ike_phase_1_recv_ID: "
-- "received remote ID other than expected %s", p);
-+ "received remote ID other than expected %s - %s", p, payload->p);
-+ free(rid);
- return -1;
- }
- free(rid);
-Index: isakmpd-20041012.orig/x509.c
-===================================================================
---- isakmpd-20041012.orig.orig/x509.c 2007-06-04 13:22:39.176899488 +0200
-+++ isakmpd-20041012.orig/x509.c 2007-06-04 13:22:39.290882160 +0200
-@@ -910,7 +910,11 @@
- X509_STORE_CTX_init(&csc, x509_cas, cert, NULL);
- #if OPENSSL_VERSION_NUMBER >= 0x00907000L
- /* XXX See comment in x509_read_crls_from_dir. */
-+#if OPENSSL_VERSION_NUMBER >= 0x00908000L
-+ if (x509_cas->param->flags & X509_V_FLAG_CRL_CHECK) {
-+#else
- if (x509_cas->flags & X509_V_FLAG_CRL_CHECK) {
-+#endif
- X509_STORE_CTX_set_flags(&csc, X509_V_FLAG_CRL_CHECK);
- X509_STORE_CTX_set_flags(&csc, X509_V_FLAG_CRL_CHECK_ALL);
- }
-Index: isakmpd-20041012.orig/sysdep/linux/sysdep.c
-===================================================================
---- isakmpd-20041012.orig.orig/sysdep/linux/sysdep.c 2007-06-04 13:22:39.182898576 +0200
-+++ isakmpd-20041012.orig/sysdep/linux/sysdep.c 2007-06-04 13:22:39.291882008 +0200
-@@ -169,22 +169,22 @@
- return 0;
-
- if (!(af == AF_INET || af == AF_INET6))
-- {
-+ {
- log_print ("sysdep_cleartext: unsupported protocol family %d", af);
- return -1;
- }
-
- if (setsockopt (fd, af == AF_INET ? IPPROTO_IP : IPPROTO_IPV6,
-- af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
-- &pol_in, sizeof pol_in) < 0 ||
-+ af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
-+ &pol_in, sizeof pol_in) < 0 ||
- setsockopt (fd, af == AF_INET ? IPPROTO_IP : IPPROTO_IPV6,
-- af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
-- &pol_out, sizeof pol_out) < 0)
-- {
-+ af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
-+ &pol_out, sizeof pol_out) < 0)
-+ {
- log_error ("sysdep_cleartext: "
-- "setsockopt (%d, IPPROTO_IP%s, IP%s_IPSEC_POLICY, ...) "
-- "failed", fd, af == AF_INET ? "" : "V6",
-- af == AF_INET ? "" : "V6");
-+ "setsockopt (%d, IPPROTO_IP%s, IP%s_IPSEC_POLICY, ...) "
-+ "failed", fd, af == AF_INET ? "" : "V6",
-+ af == AF_INET ? "" : "V6");
- return -1;
- }
- return 0;
-Index: isakmpd-20041012.orig/sysdep/linux/GNUmakefile.sysdep
-===================================================================
---- isakmpd-20041012.orig.orig/sysdep/linux/GNUmakefile.sysdep 2007-06-04 13:22:39.187897816 +0200
-+++ isakmpd-20041012.orig/sysdep/linux/GNUmakefile.sysdep 2007-06-04 13:22:39.291882008 +0200
-@@ -33,13 +33,13 @@
- LDADD+= -lgmp ${LIBSYSDEP} ${LIBCRYPTO}
- DPADD+= ${LIBGMP} ${LIBSYSDEP}
-
--CFLAGS+= -DUSE_OLD_SOCKADDR -DHAVE_PCAP \
-- -DNEED_SYSDEP_APP -DMP_FLAVOUR=MP_FLAVOUR_GMP \
-- -I/usr/src/linux/include -I${.CURDIR}/sysdep/common \
-+CFLAGS+= -DHAVE_GETNAMEINFO -DUSE_OLD_SOCKADDR -DHAVE_PCAP \
-+ -DNEED_SYSDEP_APP -DMP_FLAVOUR=MP_FLAVOUR_GMP -DUSE_AES \
-+ -I${.CURDIR}/sysdep/linux/include -I${.CURDIR}/sysdep/common \
- -I/usr/include/openssl
-
- FEATURES= debug tripledes blowfish cast ec aggressive x509 policy
--FEATURES+= des aes
-+FEATURES+= dpd nat_traversal isakmp_cfg des aes
-
- IPSEC_SRCS= pf_key_v2.c
- IPSEC_CFLAGS= -DUSE_PF_KEY_V2
-@@ -51,7 +51,7 @@
- # hack libsysdep.a dependenc
- ${LIBSYSDEPDIR}/.depend ${LIBSYSDEP}:
- cd ${LIBSYSDEPDIR} && \
-- ${MAKE} --no-print-directory ${MAKEFLAGS} \
-+ ${MAKE} --no-print-directory \
- CFLAGS="${CFLAGS}" MKDEP="${MKDEP}" ${MAKECMDGOALS}
-
- ifeq ($(findstring clean,$(MAKECMDGOALS)),clean)
-Index: isakmpd-20041012.orig/sysdep/linux/include/bitstring.h
-===================================================================
---- /dev/null 1970-01-01 00:00:00.000000000 +0000
-+++ isakmpd-20041012.orig/sysdep/linux/include/bitstring.h 2007-06-04 13:22:39.291882008 +0200
-@@ -0,0 +1,132 @@
-+/* $OpenBSD: bitstring.h,v 1.4 2002/06/19 02:50:10 millert Exp $ */
-+/* $NetBSD: bitstring.h,v 1.5 1997/05/14 15:49:55 pk Exp $ */
-+
-+/*
-+ * Copyright (c) 1989, 1993
-+ * The Regents of the University of California. All rights reserved.
-+ *
-+ * This code is derived from software contributed to Berkeley by
-+ * Paul Vixie.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ * 3. All advertising materials mentioning features or use of this software
-+ * must display the following acknowledgement:
-+ * This product includes software developed by the University of
-+ * California, Berkeley and its contributors.
-+ * 4. Neither the name of the University nor the names of its contributors
-+ * may be used to endorse or promote products derived from this software
-+ * without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ *
-+ * @(#)bitstring.h 8.1 (Berkeley) 7/19/93
-+ */
-+
-+#ifndef _BITSTRING_H_
-+#define _BITSTRING_H_
-+
-+/* modified for SV/AT and bitstring bugfix by M.R.Murphy, 11oct91
-+ * bitstr_size changed gratuitously, but shorter
-+ * bit_alloc spelling error fixed
-+ * the following were efficient, but didn't work, they've been made to
-+ * work, but are no longer as efficient :-)
-+ * bit_nclear, bit_nset, bit_ffc, bit_ffs
-+ */
-+typedef unsigned char bitstr_t;
-+
-+/* internal macros */
-+ /* byte of the bitstring bit is in */
-+#define _bit_byte(bit) \
-+ ((bit) >> 3)
-+
-+ /* mask for the bit within its byte */
-+#define _bit_mask(bit) \
-+ (1 << ((bit)&0x7))
-+
-+/* external macros */
-+ /* bytes in a bitstring of nbits bits */
-+#define bitstr_size(nbits) \
-+ (((nbits) + 7) >> 3)
-+
-+ /* allocate a bitstring */
-+#define bit_alloc(nbits) \
-+ (bitstr_t *)calloc((size_t)bitstr_size(nbits), sizeof(bitstr_t))
-+
-+ /* allocate a bitstring on the stack */
-+#define bit_decl(name, nbits) \
-+ ((name)[bitstr_size(nbits)])
-+
-+ /* is bit N of bitstring name set? */
-+#define bit_test(name, bit) \
-+ ((name)[_bit_byte(bit)] & _bit_mask(bit))
-+
-+ /* set bit N of bitstring name */
-+#define bit_set(name, bit) \
-+ ((name)[_bit_byte(bit)] |= _bit_mask(bit))
-+
-+ /* clear bit N of bitstring name */
-+#define bit_clear(name, bit) \
-+ ((name)[_bit_byte(bit)] &= ~_bit_mask(bit))
-+
-+ /* clear bits start ... stop in bitstring */
-+#define bit_nclear(name, start, stop) do { \
-+ register bitstr_t *_name = name; \
-+ register int _start = start, _stop = stop; \
-+ while (_start <= _stop) { \
-+ bit_clear(_name, _start); \
-+ _start++; \
-+ } \
-+} while(0)
-+
-+ /* set bits start ... stop in bitstring */
-+#define bit_nset(name, start, stop) do { \
-+ register bitstr_t *_name = name; \
-+ register int _start = start, _stop = stop; \
-+ while (_start <= _stop) { \
-+ bit_set(_name, _start); \
-+ _start++; \
-+ } \
-+} while(0)
-+
-+ /* find first bit clear in name */
-+#define bit_ffc(name, nbits, value) do { \
-+ register bitstr_t *_name = name; \
-+ register int _bit, _nbits = nbits, _value = -1; \
-+ for (_bit = 0; _bit < _nbits; ++_bit) \
-+ if (!bit_test(_name, _bit)) { \
-+ _value = _bit; \
-+ break; \
-+ } \
-+ *(value) = _value; \
-+} while(0)
-+
-+ /* find first bit set in name */
-+#define bit_ffs(name, nbits, value) do { \
-+ register bitstr_t *_name = name; \
-+ register int _bit, _nbits = nbits, _value = -1; \
-+ for (_bit = 0; _bit < _nbits; ++_bit) \
-+ if (bit_test(_name, _bit)) { \
-+ _value = _bit; \
-+ break; \
-+ } \
-+ *(value) = _value; \
-+} while(0)
-+
-+#endif /* !_BITSTRING_H_ */
-Index: isakmpd-20041012.orig/sysdep/linux/include/sys/queue.h
-===================================================================
---- /dev/null 1970-01-01 00:00:00.000000000 +0000
-+++ isakmpd-20041012.orig/sysdep/linux/include/sys/queue.h 2007-06-04 13:22:39.292881856 +0200
-@@ -0,0 +1,453 @@
-+/*
-+ * Copyright (c) 1991, 1993
-+ * The Regents of the University of California. All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ * 3. All advertising materials mentioning features or use of this software
-+ * must display the following acknowledgement:
-+ * This product includes software developed by the University of
-+ * California, Berkeley and its contributors.
-+ * 4. Neither the name of the University nor the names of its contributors
-+ * may be used to endorse or promote products derived from this software
-+ * without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ *
-+ * @(#)queue.h 8.5 (Berkeley) 8/20/94
-+ * $FreeBSD: src/sys/sys/queue.h,v 1.45 2001/12/11 11:49:58 sheldonh Exp $
-+ */
-+
-+#ifndef _SYS_QUEUE_H_
-+#define _SYS_QUEUE_H_
-+
-+//#include <machine/ansi.h> /* for __offsetof */
-+
-+/*
-+ * This file defines four types of data structures: singly-linked lists,
-+ * singly-linked tail queues, lists and tail queues.
-+ *
-+ * A singly-linked list is headed by a single forward pointer. The elements
-+ * are singly linked for minimum space and pointer manipulation overhead at
-+ * the expense of O(n) removal for arbitrary elements. New elements can be
-+ * added to the list after an existing element or at the head of the list.
-+ * Elements being removed from the head of the list should use the explicit
-+ * macro for this purpose for optimum efficiency. A singly-linked list may
-+ * only be traversed in the forward direction. Singly-linked lists are ideal
-+ * for applications with large datasets and few or no removals or for
-+ * implementing a LIFO queue.
-+ *
-+ * A singly-linked tail queue is headed by a pair of pointers, one to the
-+ * head of the list and the other to the tail of the list. The elements are
-+ * singly linked for minimum space and pointer manipulation overhead at the
-+ * expense of O(n) removal for arbitrary elements. New elements can be added
-+ * to the list after an existing element, at the head of the list, or at the
-+ * end of the list. Elements being removed from the head of the tail queue
-+ * should use the explicit macro for this purpose for optimum efficiency.
-+ * A singly-linked tail queue may only be traversed in the forward direction.
-+ * Singly-linked tail queues are ideal for applications with large datasets
-+ * and few or no removals or for implementing a FIFO queue.
-+ *
-+ * A list is headed by a single forward pointer (or an array of forward
-+ * pointers for a hash table header). The elements are doubly linked
-+ * so that an arbitrary element can be removed without a need to
-+ * traverse the list. New elements can be added to the list before
-+ * or after an existing element or at the head of the list. A list
-+ * may only be traversed in the forward direction.
-+ *
-+ * A tail queue is headed by a pair of pointers, one to the head of the
-+ * list and the other to the tail of the list. The elements are doubly
-+ * linked so that an arbitrary element can be removed without a need to
-+ * traverse the list. New elements can be added to the list before or
-+ * after an existing element, at the head of the list, or at the end of
-+ * the list. A tail queue may be traversed in either direction.
-+ *
-+ * For details on the use of these macros, see the queue(3) manual page.
-+ *
-+ *
-+ * SLIST LIST STAILQ TAILQ
-+ * _HEAD + + + +
-+ * _HEAD_INITIALIZER + + + +
-+ * _ENTRY + + + +
-+ * _INIT + + + +
-+ * _EMPTY + + + +
-+ * _FIRST + + + +
-+ * _NEXT + + + +
-+ * _PREV - - - +
-+ * _LAST - - + +
-+ * _FOREACH + + + +
-+ * _FOREACH_REVERSE - - - +
-+ * _INSERT_HEAD + + + +
-+ * _INSERT_BEFORE - + - +
-+ * _INSERT_AFTER + + + +
-+ * _INSERT_TAIL - - + +
-+ * _REMOVE_HEAD + - + -
-+ * _REMOVE + + + +
-+ *
-+ */
-+
-+/*
-+ * Singly-linked List declarations.
-+ */
-+#define SLIST_HEAD(name, type) \
-+struct name { \
-+ struct type *slh_first; /* first element */ \
-+}
-+
-+#define SLIST_HEAD_INITIALIZER(head) \
-+ { NULL }
-+
-+#define SLIST_ENTRY(type) \
-+struct { \
-+ struct type *sle_next; /* next element */ \
-+}
-+
-+/*
-+ * Singly-linked List functions.
-+ */
-+#define SLIST_EMPTY(head) ((head)->slh_first == NULL)
-+
-+#define SLIST_FIRST(head) ((head)->slh_first)
-+
-+#define SLIST_FOREACH(var, head, field) \
-+ for ((var) = SLIST_FIRST((head)); \
-+ (var); \
-+ (var) = SLIST_NEXT((var), field))
-+
-+#define SLIST_INIT(head) do { \
-+ SLIST_FIRST((head)) = NULL; \
-+} while (0)
-+
-+#define SLIST_INSERT_AFTER(slistelm, elm, field) do { \
-+ SLIST_NEXT((elm), field) = SLIST_NEXT((slistelm), field); \
-+ SLIST_NEXT((slistelm), field) = (elm); \
-+} while (0)
-+
-+#define SLIST_INSERT_HEAD(head, elm, field) do { \
-+ SLIST_NEXT((elm), field) = SLIST_FIRST((head)); \
-+ SLIST_FIRST((head)) = (elm); \
-+} while (0)
-+
-+#define SLIST_NEXT(elm, field) ((elm)->field.sle_next)
-+
-+#define SLIST_REMOVE(head, elm, type, field) do { \
-+ if (SLIST_FIRST((head)) == (elm)) { \
-+ SLIST_REMOVE_HEAD((head), field); \
-+ } \
-+ else { \
-+ struct type *curelm = SLIST_FIRST((head)); \
-+ while (SLIST_NEXT(curelm, field) != (elm)) \
-+ curelm = SLIST_NEXT(curelm, field); \
-+ SLIST_NEXT(curelm, field) = \
-+ SLIST_NEXT(SLIST_NEXT(curelm, field), field); \
-+ } \
-+} while (0)
-+
-+#define SLIST_REMOVE_HEAD(head, field) do { \
-+ SLIST_FIRST((head)) = SLIST_NEXT(SLIST_FIRST((head)), field); \
-+} while (0)
-+
-+/*
-+ * Singly-linked Tail queue declarations.
-+ */
-+#define STAILQ_HEAD(name, type) \
-+struct name { \
-+ struct type *stqh_first;/* first element */ \
-+ struct type **stqh_last;/* addr of last next element */ \
-+}
-+
-+#define STAILQ_HEAD_INITIALIZER(head) \
-+ { NULL, &(head).stqh_first }
-+
-+#define STAILQ_ENTRY(type) \
-+struct { \
-+ struct type *stqe_next; /* next element */ \
-+}
-+
-+/*
-+ * Singly-linked Tail queue functions.
-+ */
-+#define STAILQ_EMPTY(head) ((head)->stqh_first == NULL)
-+
-+#define STAILQ_FIRST(head) ((head)->stqh_first)
-+
-+#define STAILQ_FOREACH(var, head, field) \
-+ for((var) = STAILQ_FIRST((head)); \
-+ (var); \
-+ (var) = STAILQ_NEXT((var), field))
-+
-+#define STAILQ_INIT(head) do { \
-+ STAILQ_FIRST((head)) = NULL; \
-+ (head)->stqh_last = &STAILQ_FIRST((head)); \
-+} while (0)
-+
-+#define STAILQ_INSERT_AFTER(head, tqelm, elm, field) do { \
-+ if ((STAILQ_NEXT((elm), field) = STAILQ_NEXT((tqelm), field)) == NULL)\
-+ (head)->stqh_last = &STAILQ_NEXT((elm), field); \
-+ STAILQ_NEXT((tqelm), field) = (elm); \
-+} while (0)
-+
-+#define STAILQ_INSERT_HEAD(head, elm, field) do { \
-+ if ((STAILQ_NEXT((elm), field) = STAILQ_FIRST((head))) == NULL) \
-+ (head)->stqh_last = &STAILQ_NEXT((elm), field); \
-+ STAILQ_FIRST((head)) = (elm); \
-+} while (0)
-+
-+#define STAILQ_INSERT_TAIL(head, elm, field) do { \
-+ STAILQ_NEXT((elm), field) = NULL; \
-+ *(head)->stqh_last = (elm); \
-+ (head)->stqh_last = &STAILQ_NEXT((elm), field); \
-+} while (0)
-+
-+#define STAILQ_LAST(head, type, field) \
-+ (STAILQ_EMPTY(head) ? \
-+ NULL : \
-+ ((struct type *) \
-+ ((char *)((head)->stqh_last) - __offsetof(struct type, field))))
-+
-+#define STAILQ_NEXT(elm, field) ((elm)->field.stqe_next)
-+
-+#define STAILQ_REMOVE(head, elm, type, field) do { \
-+ if (STAILQ_FIRST((head)) == (elm)) { \
-+ STAILQ_REMOVE_HEAD(head, field); \
-+ } \
-+ else { \
-+ struct type *curelm = STAILQ_FIRST((head)); \
-+ while (STAILQ_NEXT(curelm, field) != (elm)) \
-+ curelm = STAILQ_NEXT(curelm, field); \
-+ if ((STAILQ_NEXT(curelm, field) = \
-+ STAILQ_NEXT(STAILQ_NEXT(curelm, field), field)) == NULL)\
-+ (head)->stqh_last = &STAILQ_NEXT((curelm), field);\
-+ } \
-+} while (0)
-+
-+#define STAILQ_REMOVE_HEAD(head, field) do { \
-+ if ((STAILQ_FIRST((head)) = \
-+ STAILQ_NEXT(STAILQ_FIRST((head)), field)) == NULL) \
-+ (head)->stqh_last = &STAILQ_FIRST((head)); \
-+} while (0)
-+
-+#define STAILQ_REMOVE_HEAD_UNTIL(head, elm, field) do { \
-+ if ((STAILQ_FIRST((head)) = STAILQ_NEXT((elm), field)) == NULL) \
-+ (head)->stqh_last = &STAILQ_FIRST((head)); \
-+} while (0)
-+
-+/*
-+ * List declarations.
-+ */
-+#define LIST_HEAD(name, type) \
-+struct name { \
-+ struct type *lh_first; /* first element */ \
-+}
-+
-+#define LIST_HEAD_INITIALIZER(head) \
-+ { NULL }
-+
-+#define LIST_ENTRY(type) \
-+struct { \
-+ struct type *le_next; /* next element */ \
-+ struct type **le_prev; /* address of previous next element */ \
-+}
-+
-+/*
-+ * List functions.
-+ */
-+
-+#define LIST_EMPTY(head) ((head)->lh_first == NULL)
-+
-+#define LIST_FIRST(head) ((head)->lh_first)
-+
-+#define LIST_FOREACH(var, head, field) \
-+ for ((var) = LIST_FIRST((head)); \
-+ (var); \
-+ (var) = LIST_NEXT((var), field))
-+
-+#define LIST_INIT(head) do { \
-+ LIST_FIRST((head)) = NULL; \
-+} while (0)
-+
-+#define LIST_INSERT_AFTER(listelm, elm, field) do { \
-+ if ((LIST_NEXT((elm), field) = LIST_NEXT((listelm), field)) != NULL)\
-+ LIST_NEXT((listelm), field)->field.le_prev = \
-+ &LIST_NEXT((elm), field); \
-+ LIST_NEXT((listelm), field) = (elm); \
-+ (elm)->field.le_prev = &LIST_NEXT((listelm), field); \
-+} while (0)
-+
-+#define LIST_INSERT_BEFORE(listelm, elm, field) do { \
-+ (elm)->field.le_prev = (listelm)->field.le_prev; \
-+ LIST_NEXT((elm), field) = (listelm); \
-+ *(listelm)->field.le_prev = (elm); \
-+ (listelm)->field.le_prev = &LIST_NEXT((elm), field); \
-+} while (0)
-+
-+#define LIST_INSERT_HEAD(head, elm, field) do { \
-+ if ((LIST_NEXT((elm), field) = LIST_FIRST((head))) != NULL) \
-+ LIST_FIRST((head))->field.le_prev = &LIST_NEXT((elm), field);\
-+ LIST_FIRST((head)) = (elm); \
-+ (elm)->field.le_prev = &LIST_FIRST((head)); \
-+} while (0)
-+
-+#define LIST_NEXT(elm, field) ((elm)->field.le_next)
-+
-+#define LIST_REMOVE(elm, field) do { \
-+ if (LIST_NEXT((elm), field) != NULL) \
-+ LIST_NEXT((elm), field)->field.le_prev = \
-+ (elm)->field.le_prev; \
-+ *(elm)->field.le_prev = LIST_NEXT((elm), field); \
-+} while (0)
-+
-+/*
-+ * Tail queue declarations.
-+ */
-+#define TAILQ_HEAD(name, type) \
-+struct name { \
-+ struct type *tqh_first; /* first element */ \
-+ struct type **tqh_last; /* addr of last next element */ \
-+}
-+
-+#define TAILQ_HEAD_INITIALIZER(head) \
-+ { NULL, &(head).tqh_first }
-+
-+#define TAILQ_ENTRY(type) \
-+struct { \
-+ struct type *tqe_next; /* next element */ \
-+ struct type **tqe_prev; /* address of previous next element */ \
-+}
-+
-+/*
-+ * Tail queue functions.
-+ */
-+#define TAILQ_EMPTY(head) ((head)->tqh_first == NULL)
-+
-+#define TAILQ_FIRST(head) ((head)->tqh_first)
-+
-+#define TAILQ_FOREACH(var, head, field) \
-+ for ((var) = TAILQ_FIRST((head)); \
-+ (var); \
-+ (var) = TAILQ_NEXT((var), field))
-+
-+#define TAILQ_FOREACH_REVERSE(var, head, headname, field) \
-+ for ((var) = TAILQ_LAST((head), headname); \
-+ (var); \
-+ (var) = TAILQ_PREV((var), headname, field))
-+
-+#define TAILQ_INIT(head) do { \
-+ TAILQ_FIRST((head)) = NULL; \
-+ (head)->tqh_last = &TAILQ_FIRST((head)); \
-+} while (0)
-+
-+#define TAILQ_INSERT_AFTER(head, listelm, elm, field) do { \
-+ if ((TAILQ_NEXT((elm), field) = TAILQ_NEXT((listelm), field)) != NULL)\
-+ TAILQ_NEXT((elm), field)->field.tqe_prev = \
-+ &TAILQ_NEXT((elm), field); \
-+ else \
-+ (head)->tqh_last = &TAILQ_NEXT((elm), field); \
-+ TAILQ_NEXT((listelm), field) = (elm); \
-+ (elm)->field.tqe_prev = &TAILQ_NEXT((listelm), field); \
-+} while (0)
-+
-+#define TAILQ_INSERT_BEFORE(listelm, elm, field) do { \
-+ (elm)->field.tqe_prev = (listelm)->field.tqe_prev; \
-+ TAILQ_NEXT((elm), field) = (listelm); \
-+ *(listelm)->field.tqe_prev = (elm); \
-+ (listelm)->field.tqe_prev = &TAILQ_NEXT((elm), field); \
-+} while (0)
-+
-+#define TAILQ_INSERT_HEAD(head, elm, field) do { \
-+ if ((TAILQ_NEXT((elm), field) = TAILQ_FIRST((head))) != NULL) \
-+ TAILQ_FIRST((head))->field.tqe_prev = \
-+ &TAILQ_NEXT((elm), field); \
-+ else \
-+ (head)->tqh_last = &TAILQ_NEXT((elm), field); \
-+ TAILQ_FIRST((head)) = (elm); \
-+ (elm)->field.tqe_prev = &TAILQ_FIRST((head)); \
-+} while (0)
-+
-+#define TAILQ_INSERT_TAIL(head, elm, field) do { \
-+ TAILQ_NEXT((elm), field) = NULL; \
-+ (elm)->field.tqe_prev = (head)->tqh_last; \
-+ *(head)->tqh_last = (elm); \
-+ (head)->tqh_last = &TAILQ_NEXT((elm), field); \
-+} while (0)
-+
-+#define TAILQ_LAST(head, headname) \
-+ (*(((struct headname *)((head)->tqh_last))->tqh_last))
-+
-+#define TAILQ_NEXT(elm, field) ((elm)->field.tqe_next)
-+
-+#define TAILQ_PREV(elm, headname, field) \
-+ (*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
-+
-+#define TAILQ_REMOVE(head, elm, field) do { \
-+ if ((TAILQ_NEXT((elm), field)) != NULL) \
-+ TAILQ_NEXT((elm), field)->field.tqe_prev = \
-+ (elm)->field.tqe_prev; \
-+ else \
-+ (head)->tqh_last = (elm)->field.tqe_prev; \
-+ *(elm)->field.tqe_prev = TAILQ_NEXT((elm), field); \
-+} while (0)
-+
-+
-+#ifdef _KERNEL
-+
-+/*
-+ * XXX insque() and remque() are an old way of handling certain queues.
-+ * They bogusly assumes that all queue heads look alike.
-+ */
-+
-+struct quehead {
-+ struct quehead *qh_link;
-+ struct quehead *qh_rlink;
-+};
-+
-+#ifdef __GNUC__
-+
-+static __inline void
-+insque(void *a, void *b)
-+{
-+ struct quehead *element = (struct quehead *)a,
-+ *head = (struct quehead *)b;
-+
-+ element->qh_link = head->qh_link;
-+ element->qh_rlink = head;
-+ head->qh_link = element;
-+ element->qh_link->qh_rlink = element;
-+}
-+
-+static __inline void
-+remque(void *a)
-+{
-+ struct quehead *element = (struct quehead *)a;
-+
-+ element->qh_link->qh_rlink = element->qh_rlink;
-+ element->qh_rlink->qh_link = element->qh_link;
-+ element->qh_rlink = 0;
-+}
-+
-+#else /* !__GNUC__ */
-+
-+void insque __P((void *a, void *b));
-+void remque __P((void *a));
-+
-+#endif /* __GNUC__ */
-+
-+#endif /* _KERNEL */
-+
-+#endif /* !_SYS_QUEUE_H_ */
-Index: isakmpd-20041012.orig/sysdep/common/pcap.h
-===================================================================
---- isakmpd-20041012.orig.orig/sysdep/common/pcap.h 2007-06-04 13:22:39.203895384 +0200
-+++ isakmpd-20041012.orig/sysdep/common/pcap.h 2007-06-04 13:22:39.292881856 +0200
-@@ -55,8 +55,13 @@
- u_int32_t linktype; /* data link type (DLT_*) */
- };
-
-+struct pcap_timeval {
-+ int32_t tv_sec; /* seconds */
-+ int32_t tv_usec; /* microseconds */
-+};
-+
- struct pcap_pkthdr {
-- struct timeval ts; /* time stamp */
-+ struct pcap_timeval ts; /* time stamp */
- u_int32_t caplen; /* length of portion present */
- u_int32_t len; /* length this packet (off wire) */
- };
-Index: isakmpd-20041012.orig/sysdep/common/libsysdep/arc4random.c
-===================================================================
---- isakmpd-20041012.orig.orig/sysdep/common/libsysdep/arc4random.c 2007-06-04 13:22:39.211894168 +0200
-+++ isakmpd-20041012.orig/sysdep/common/libsysdep/arc4random.c 2007-06-04 13:22:39.292881856 +0200
-@@ -78,7 +78,7 @@
- static void
- arc4_stir(struct arc4_stream *as)
- {
-- int fd;
-+ int fd, i;
- struct {
- struct timeval tv;
- u_int8_t rnd[128 - sizeof(struct timeval)];
-Index: isakmpd-20041012.orig/x509v3.cnf
-===================================================================
---- /dev/null 1970-01-01 00:00:00.000000000 +0000
-+++ isakmpd-20041012.orig/x509v3.cnf 2007-06-04 13:22:39.293881704 +0200
-@@ -0,0 +1,26 @@
-+# default settings
-+CERTPATHLEN = 1
-+CERTUSAGE = digitalSignature,keyCertSign
-+CERTIP = 0.0.0.0
-+CERTFQDN = nohost.nodomain
-+
-+# This section should be referenced when building an x509v3 CA
-+# Certificate.
-+# The default path length and the key usage can be overriden
-+# modified by setting the CERTPATHLEN and CERTUSAGE environment
-+# variables.
-+[x509v3_CA]
-+basicConstraints=critical,CA:true,pathlen:$ENV::CERTPATHLEN
-+keyUsage=$ENV::CERTUSAGE
-+
-+# This section should be referenced to add an IP Address
-+# as an alternate subject name, needed by isakmpd
-+# The address must be provided in the CERTIP environment variable
-+[x509v3_IPAddr]
-+subjectAltName=IP:$ENV::CERTIP
-+
-+# This section should be referenced to add a FQDN hostname
-+# as an alternate subject name, needed by isakmpd
-+# The address must be provided in the CERTFQDN environment variable
-+[x509v3_FQDN]
-+subjectAltName=DNS:$ENV::CERTFQDN
projects / openwrt / staging / dedeckeh.git / blobdiff