projects / openwrt / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
finally move buildroot-ng to trunk
[openwrt/openwrt.git] / package / isakmpd / patches / 010-debian_3.patch
1 --- isakmpd-20041012.orig/dpd.c
2 +++ isakmpd-20041012/dpd.c
3 @@ -26,6 +26,7 @@
4
5 #include <sys/types.h>
6 #include <stdlib.h>
7 +#include <memory.h>
8
9 #include "sysdep.h"
10
11 @@ -174,6 +175,7 @@
12 }
13 break;
14 default:
15 + ;
16 }
17
18 /* Mark handled. */
19 @@ -223,6 +225,7 @@
20 dpd_check_event, sa, &tv);
21 break;
22 default:
23 + ;
24 }
25 if (!sa->dpd_event)
26 log_print("dpd_timer_reset: timer_add_event failed");
27 --- isakmpd-20041012.orig/ipsec.c
28 +++ isakmpd-20041012/ipsec.c
29 @@ -1020,6 +1020,52 @@
30 }
31 }
32
33 +/*
34 + * deal with a NOTIFY of INVALID_SPI
35 + */
36 +static void
37 +ipsec_invalid_spi (struct message *msg, struct payload *p)
38 +{
39 + struct sockaddr *dst;
40 + int invspisz, off;
41 + u_int32_t spi;
42 + u_int16_t totsiz;
43 + u_int8_t spisz;
44 +
45 + /* Any notification that make us do something should be protected */
46 + if(!TAILQ_FIRST (&msg->payload[ISAKMP_PAYLOAD_HASH]))
47 + {
48 + LOG_DBG ((LOG_SA, 40,
49 + "ipsec_invalid_spi: missing HASH payload in INVALID_SPI"
50 + " notification"));
51 + return;
52 + }
53 +
54 + /*
55 + * get the invalid spi out of the variable sized notification data
56 + * field, which is after the variable sized SPI field [which specifies
57 + * the receiving entity's phase-1 SPI, not the invalid spi]
58 + */
59 + totsiz = GET_ISAKMP_GEN_LENGTH (p->p);
60 + spisz = GET_ISAKMP_NOTIFY_SPI_SZ (p->p);
61 + off = ISAKMP_NOTIFY_SPI_OFF + spisz;
62 + invspisz = totsiz - off;
63 +
64 + if (invspisz != sizeof spi)
65 + {
66 + LOG_DBG ((LOG_SA, 40,
67 + "ipsec_invalid_spi: SPI size %d in INVALID_SPI "
68 + "payload unsupported", spisz));
69 + return;
70 + }
71 + memcpy (&spi, p->p + off, sizeof spi);
72 +
73 + msg->transport->vtbl->get_dst (msg->transport, &dst);
74 +
75 + /* delete matching SPI's from this peer */
76 + ipsec_delete_spi_list (dst, 0, (u_int8_t *)&spi, 1, "INVALID_SPI");
77 +}
78 +
79 static int
80 ipsec_responder(struct message *msg)
81 {
82 @@ -1205,7 +1251,9 @@
83 return dv != IPSEC_ENCAP_TUNNEL
84 && dv != IPSEC_ENCAP_TRANSPORT
85 && dv != IPSEC_ENCAP_UDP_ENCAP_TUNNEL
86 - && dv != IPSEC_ENCAP_UDP_ENCAP_TRANSPORT;
87 + && dv != IPSEC_ENCAP_UDP_ENCAP_TRANSPORT
88 + && dv != IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT
89 + && dv != IPSEC_ENCAP_UDP_ENCAP_TRANSPORT_DRAFT;
90 #else
91 return dv < IPSEC_ENCAP_TUNNEL
92 || dv > IPSEC_ENCAP_TRANSPORT;
93 @@ -1837,7 +1885,7 @@
94 ipsec_get_id(char *section, int *id, struct sockaddr **addr,
95 struct sockaddr **mask, u_int8_t *tproto, u_int16_t *port)
96 {
97 - char *type, *address, *netmask;
98 + char *type, *address, *netmask;
99
100 type = conf_get_str(section, "ID-type");
101 if (!type) {
102 --- isakmpd-20041012.orig/GNUmakefile
103 +++ isakmpd-20041012/GNUmakefile
104 @@ -40,12 +40,12 @@
105 # integrated, freebsd/netbsd means FreeBSD/NetBSD with KAME IPsec.
106 # darwin means MacOS X 10.2 and later with KAME IPsec. linux means Linux-2.5
107 # and later with native IPSec support.
108 -OS= openbsd
109 +#OS= openbsd
110 #OS= netbsd
111 #OS= freebsd
112 #OS= freeswan
113 #OS= darwin
114 -#OS= linux
115 +OS= linux
116
117 .CURDIR:= $(shell pwd)
118 VPATH= ${.CURDIR}/sysdep/${OS}
119 @@ -55,9 +55,10 @@
120 ifndef BINDIR
121 BINDIR= /sbin
122 endif
123 -ifndef LDSTATIC
124 -LDSTATIC= -static
125 -endif
126 +
127 +#ifndef LDSTATIC
128 +#LDSTATIC= -static
129 +#endif
130
131 SRCS= app.c attribute.c cert.c connection.c \
132 constants.c conf.c cookie.c crypto.c dh.c doi.c exchange.c \
133 @@ -131,11 +132,14 @@
134 ifneq ($(findstring install,$(MAKECMDGOALS)),install)
135 # Skip 'regress' until the regress/ structure has gmake makefiles for it.
136 #SUBDIR:= regress
137 -SUBDIR:=
138 +#SUBDIR:= apps/certpatch
139 mksubdirs:
140 $(foreach DIR, ${SUBDIR}, \
141 - cd ${DIR}; ${MAKE} ${MAKEFLAGS} CFLAGS="${CFLAGS}" \
142 - MKDEP="${MKDEP}" ${MAKECMDGOALS})
143 + cd ${.CURDIR}/${DIR}; ${MAKE} ${MAKECMDGOALS};)
144 +
145 +# $(foreach DIR, ${SUBDIR}, \
146 +# cd ${DIR}; ${MAKE} CFLAGS="${CFLAGS}" \
147 +# MKDEP="${MKDEP}" ${MAKECMDGOALS})
148 else
149 mksubdirs:
150 endif
151 @@ -173,7 +177,7 @@
152 endif
153
154 SRCS+= ${IPSEC_SRCS} ${X509} ${POLICY} ${EC} ${AGGRESSIVE} ${DNSSEC} \
155 - $(ISAKMP_CFG)
156 + $(ISAKMP_CFG) ${DPD} ${NAT_TRAVERSAL}
157 CFLAGS+= ${IPSEC_CFLAGS}
158 LDADD+= ${DESLIB}
159 DPADD+= ${DESLIBDEP}
160 --- isakmpd-20041012.orig/exchange.h
161 +++ isakmpd-20041012/exchange.h
162 @@ -221,6 +221,8 @@
163 #define EXCHANGE_FLAG_NAT_T_ENABLE 0x10 /* We are doing NAT-T. */
164 #define EXCHANGE_FLAG_NAT_T_KEEPALIVE 0x20 /* We are the NAT:ed peer. */
165 #define EXCHANGE_FLAG_DPD_CAP_PEER 0x40 /* Peer is DPD capable. */
166 +#define EXCHANGE_FLAG_NAT_T_RFC 0x0080 /* Peer does RFC NAT-T. */
167 +#define EXCHANGE_FLAG_NAT_T_DRAFT 0x0100 /* Peer does draft NAT-T.*/
168
169 extern int exchange_add_certs(struct message *);
170 extern void exchange_finalize(struct message *);
171 --- isakmpd-20041012.orig/log.c
172 +++ isakmpd-20041012/log.c
173 @@ -79,7 +79,6 @@
174
175 struct packhdr {
176 struct pcap_pkthdr pcap;/* pcap file packet header */
177 - u_int32_t sa_family; /* address family */
178 union {
179 struct ip ip4; /* IPv4 header (w/o options) */
180 struct ip6_hdr ip6; /* IPv6 header */
181 @@ -97,7 +96,7 @@
182 static u_int8_t *packet_buf = NULL;
183
184 static int udp_cksum(struct packhdr *, const struct udphdr *,
185 - u_int16_t *);
186 + u_int16_t *, int);
187 static u_int16_t in_cksum(const u_int16_t *, int);
188 #endif /* USE_DEBUG */
189
190 @@ -539,11 +538,9 @@
191 udp.uh_ulen = htons(datalen);
192
193 /* ip */
194 - hdr.sa_family = htonl(src->sa_family);
195 switch (src->sa_family) {
196 default:
197 /* Assume IPv4. XXX Can 'default' ever happen here? */
198 - hdr.sa_family = htonl(AF_INET);
199 hdr.ip.ip4.ip_src.s_addr = 0x02020202;
200 hdr.ip.ip4.ip_dst.s_addr = 0x01010101;
201 /* The rest of the setup is common to AF_INET. */
202 @@ -584,9 +581,7 @@
203 }
204
205 /* Calculate UDP checksum. */
206 - udp.uh_sum = udp_cksum(&hdr, &udp, (u_int16_t *) packet_buf);
207 - hdrlen += sizeof hdr.sa_family;
208 -
209 + udp.uh_sum = udp_cksum(&hdr, &udp, (u_int16_t *) packet_buf, src->sa_family);
210 /* pcap file packet header */
211 gettimeofday(&tv, 0);
212 hdr.pcap.ts.tv_sec = tv.tv_sec;
213 @@ -610,7 +605,7 @@
214
215 /* Copied from tcpdump/print-udp.c, mostly rewritten. */
216 static int
217 -udp_cksum(struct packhdr *hdr, const struct udphdr *u, u_int16_t *d)
218 +udp_cksum(struct packhdr *hdr, const struct udphdr *u, u_int16_t *d, int af)
219 {
220 struct ip *ip4;
221 struct ip6_hdr *ip6;
222 @@ -639,7 +634,7 @@
223
224 /* Setup pseudoheader. */
225 memset(phu.pa, 0, sizeof phu);
226 - switch (ntohl(hdr->sa_family)) {
227 + switch (af) {
228 case AF_INET:
229 ip4 = &hdr->ip.ip4;
230 memcpy(&phu.ip4p.src, &ip4->ip_src, sizeof(struct in_addr));
231 @@ -664,7 +659,7 @@
232
233 /* IPv6 wants a 0xFFFF checksum "on error", not 0x0. */
234 if (tlen < 0)
235 - return (ntohl(hdr->sa_family) == AF_INET ? 0 : 0xFFFF);
236 + return (af == AF_INET ? 0 : 0xFFFF);
237
238 sum = 0;
239 for (i = 0; i < hdrlen; i += 2)
240 --- isakmpd-20041012.orig/nat_traversal.c
241 +++ isakmpd-20041012/nat_traversal.c
242 @@ -1,4 +1,4 @@
243 -/* $OpenBSD: nat_traversal.c,v 1.7 2004/08/08 19:11:06 deraadt Exp $ */
244 +/* $OpenBSD: nat_traversal.c,v 1.17 2006/06/14 14:03:33 hshoexer Exp $ */
245
246 /*
247 * Copyright (c) 2004 Håkan Olsson. All rights reserved.
248 @@ -48,40 +48,40 @@
249 #include "util.h"
250 #include "virtual.h"
251
252 +int disable_nat_t = 0;
253 +
254 /*
255 - * XXX According to draft-ietf-ipsec-nat-t-ike-07.txt, the NAT-T
256 - * capability of the other peer is determined by a particular vendor ID
257 - * sent as the first message. This vendor ID string is supposed to be a
258 - * MD5 hash of "RFC XXXX", where XXXX is the future RFC number.
259 + * NAT-T capability of the other peer is determined by a particular vendor
260 + * ID sent in the first message. This vendor ID string is supposed to be a
261 + * MD5 hash of "RFC 3947".
262 *
263 * These seem to be the "well" known variants of this string in use by
264 * products today.
265 */
266 -static const char *isakmp_nat_t_cap_text[] = {
267 - "draft-ietf-ipsec-nat-t-ike-00", /* V1 (XXX: may be obsolete) */
268 - "draft-ietf-ipsec-nat-t-ike-02\n", /* V2 */
269 - "draft-ietf-ipsec-nat-t-ike-03", /* V3 */
270 -#ifdef notyet
271 - "RFC XXXX",
272 -#endif
273 +
274 +static struct nat_t_cap isakmp_nat_t_cap[] = {
275 + { VID_DRAFT_V2_N, EXCHANGE_FLAG_NAT_T_DRAFT,
276 + "draft-ietf-ipsec-nat-t-ike-02\n", NULL, 0 },
277 + { VID_DRAFT_V3, EXCHANGE_FLAG_NAT_T_DRAFT,
278 + "draft-ietf-ipsec-nat-t-ike-03", NULL, 0 },
279 + { VID_RFC3947, EXCHANGE_FLAG_NAT_T_RFC,
280 + "RFC 3947", NULL, 0 },
281 };
282
283 +#define NUMNATTCAP (sizeof isakmp_nat_t_cap / sizeof isakmp_nat_t_cap[0])
284 +
285 /* In seconds. Recommended in draft-ietf-ipsec-udp-encaps-09. */
286 #define NAT_T_KEEPALIVE_INTERVAL 20
287
288 -/* The MD5 hashes of the above strings is put in this array. */
289 -static char **nat_t_hashes;
290 -static size_t nat_t_hashsize;
291 -
292 static int nat_t_setup_hashes(void);
293 -static int nat_t_add_vendor_payload(struct message *, char *);
294 +static int nat_t_add_vendor_payload(struct message *, struct nat_t_cap *);
295 static int nat_t_add_nat_d(struct message *, struct sockaddr *);
296 static int nat_t_match_nat_d_payload(struct message *, struct sockaddr *);
297
298 void
299 nat_t_init(void)
300 {
301 - nat_t_hashes = (char **)NULL;
302 + nat_t_setup_hashes();
303 }
304
305 /* Generate the NAT-T capability marker hashes. Executed only once. */
306 @@ -89,7 +89,7 @@
307 nat_t_setup_hashes(void)
308 {
309 struct hash *hash;
310 - int n = sizeof isakmp_nat_t_cap_text / sizeof isakmp_nat_t_cap_text[0];
311 + int n = NUMNATTCAP;
312 int i;
313
314 /* The draft says to use MD5. */
315 @@ -100,56 +100,49 @@
316 "could not find MD5 hash structure!");
317 return -1;
318 }
319 - nat_t_hashsize = hash->hashsize;
320
321 - /* Allocate one more than is necessary, i.e NULL terminated. */
322 - nat_t_hashes = (char **)calloc((size_t)(n + 1), sizeof(char *));
323 - if (!nat_t_hashes) {
324 - log_error("nat_t_setup_hashes: calloc (%lu,%lu) failed",
325 - (unsigned long)n, (unsigned long)sizeof(char *));
326 - return -1;
327 - }
328 -
329 - /* Populate with hashes. */
330 + /* Populate isakmp_nat_t_cap with hashes. */
331 for (i = 0; i < n; i++) {
332 - nat_t_hashes[i] = (char *)malloc(nat_t_hashsize);
333 - if (!nat_t_hashes[i]) {
334 + isakmp_nat_t_cap[i].hashsize = hash->hashsize;
335 + isakmp_nat_t_cap[i].hash = (char *)malloc(hash->hashsize);
336 + if (!isakmp_nat_t_cap[i].hash) {
337 log_error("nat_t_setup_hashes: malloc (%lu) failed",
338 - (unsigned long)nat_t_hashsize);
339 + (unsigned long)hash->hashsize);
340 goto errout;
341 }
342
343 hash->Init(hash->ctx);
344 hash->Update(hash->ctx,
345 - (unsigned char *)isakmp_nat_t_cap_text[i],
346 - strlen(isakmp_nat_t_cap_text[i]));
347 - hash->Final(nat_t_hashes[i], hash->ctx);
348 + (unsigned char *)isakmp_nat_t_cap[i].text,
349 + strlen(isakmp_nat_t_cap[i].text));
350 + hash->Final(isakmp_nat_t_cap[i].hash, hash->ctx);
351
352 LOG_DBG((LOG_EXCHANGE, 50, "nat_t_setup_hashes: "
353 - "MD5(\"%s\") (%lu bytes)", isakmp_nat_t_cap_text[i],
354 - (unsigned long)nat_t_hashsize));
355 + "MD5(\"%s\") (%lu bytes)", isakmp_nat_t_cap[i].text,
356 + (unsigned long)hash->hashsize));
357 LOG_DBG_BUF((LOG_EXCHANGE, 50, "nat_t_setup_hashes",
358 - nat_t_hashes[i], nat_t_hashsize));
359 + isakmp_nat_t_cap[i].hash, hash->hashsize));
360 }
361
362 return 0;
363
364 - errout:
365 +errout:
366 for (i = 0; i < n; i++)
367 - if (nat_t_hashes[i])
368 - free(nat_t_hashes[i]);
369 - free(nat_t_hashes);
370 - nat_t_hashes = NULL;
371 + if (isakmp_nat_t_cap[i].hash)
372 + free(isakmp_nat_t_cap[i].hash);
373 return -1;
374 }
375
376 /* Add one NAT-T VENDOR payload. */
377 static int
378 -nat_t_add_vendor_payload(struct message *msg, char *hash)
379 +nat_t_add_vendor_payload(struct message *msg, struct nat_t_cap *cap)
380 {
381 - size_t buflen = nat_t_hashsize + ISAKMP_GEN_SZ;
382 + size_t buflen = cap->hashsize + ISAKMP_GEN_SZ;
383 u_int8_t *buf;
384
385 + if (disable_nat_t)
386 + return 0;
387 +
388 buf = malloc(buflen);
389 if (!buf) {
390 log_error("nat_t_add_vendor_payload: malloc (%lu) failed",
391 @@ -158,12 +151,11 @@
392 }
393
394 SET_ISAKMP_GEN_LENGTH(buf, buflen);
395 - memcpy(buf + ISAKMP_VENDOR_ID_OFF, hash, nat_t_hashsize);
396 + memcpy(buf + ISAKMP_VENDOR_ID_OFF, cap->hash, cap->hashsize);
397 if (message_add_payload(msg, ISAKMP_PAYLOAD_VENDOR, buf, buflen, 1)) {
398 free(buf);
399 return -1;
400 }
401 -
402 return 0;
403 }
404
405 @@ -171,16 +163,14 @@
406 int
407 nat_t_add_vendor_payloads(struct message *msg)
408 {
409 - int i = 0;
410 + int i;
411
412 - if (!nat_t_hashes)
413 - if (nat_t_setup_hashes())
414 - return 0; /* XXX should this be an error? */
415 + if (disable_nat_t)
416 + return 0;
417
418 - while (nat_t_hashes[i])
419 - if (nat_t_add_vendor_payload(msg, nat_t_hashes[i++]))
420 + for (i = 0; i < NUMNATTCAP; i++)
421 + if (nat_t_add_vendor_payload(msg, &isakmp_nat_t_cap[i]))
422 return -1;
423 -
424 return 0;
425 }
426
427 @@ -192,36 +182,31 @@
428 {
429 u_int8_t *pbuf = p->p;
430 size_t vlen;
431 - int i = 0;
432 + int i;
433
434 - /* Already checked? */
435 - if (p->flags & PL_MARK ||
436 - msg->exchange->flags & EXCHANGE_FLAG_NAT_T_CAP_PEER)
437 + if (disable_nat_t)
438 return;
439
440 - if (!nat_t_hashes)
441 - if (nat_t_setup_hashes())
442 - return;
443 -
444 vlen = GET_ISAKMP_GEN_LENGTH(pbuf) - ISAKMP_GEN_SZ;
445 - if (vlen != nat_t_hashsize) {
446 - LOG_DBG((LOG_EXCHANGE, 50, "nat_t_check_vendor_payload: "
447 - "bad size %lu != %lu", (unsigned long)vlen,
448 - (unsigned long)nat_t_hashsize));
449 - return;
450 - }
451
452 - while (nat_t_hashes[i])
453 - if (memcmp(nat_t_hashes[i++], pbuf + ISAKMP_GEN_SZ,
454 + for (i = 0; i < NUMNATTCAP; i++) {
455 + if (vlen != isakmp_nat_t_cap[i].hashsize) {
456 + LOG_DBG((LOG_EXCHANGE, 50, "nat_t_check_vendor_payload: "
457 + "bad size %lu != %lu", (unsigned long)vlen,
458 + (unsigned long)isakmp_nat_t_cap[i].hashsize));
459 + continue;
460 + }
461 + if (memcmp(isakmp_nat_t_cap[i].hash, pbuf + ISAKMP_GEN_SZ,
462 vlen) == 0) {
463 /* This peer is NAT-T capable. */
464 msg->exchange->flags |= EXCHANGE_FLAG_NAT_T_CAP_PEER;
465 + msg->exchange->flags |= isakmp_nat_t_cap[i].flags;
466 LOG_DBG((LOG_EXCHANGE, 10,
467 "nat_t_check_vendor_payload: "
468 "NAT-T capable peer detected"));
469 p->flags |= PL_MARK;
470 - return;
471 }
472 + }
473
474 return;
475 }
476 @@ -233,10 +218,8 @@
477 {
478 struct ipsec_exch *ie = (struct ipsec_exch *)msg->exchange->data;
479 struct hash *hash;
480 - struct prf *prf;
481 u_int8_t *res;
482 in_port_t port;
483 - int prf_type = PRF_HMAC; /* XXX */
484
485 hash = hash_get(ie->hash->type);
486 if (hash == NULL) {
487 @@ -244,31 +227,25 @@
488 return NULL;
489 }
490
491 - prf = prf_alloc(prf_type, hash->type, msg->exchange->cookies,
492 - ISAKMP_HDR_COOKIES_LEN);
493 - if(!prf) {
494 - log_print("nat_t_generate_nat_d_hash: prf_alloc failed");
495 - return NULL;
496 - }
497 + *hashlen = hash->hashsize;
498
499 - *hashlen = prf->blocksize;
500 res = (u_int8_t *)malloc((unsigned long)*hashlen);
501 if (!res) {
502 log_print("nat_t_generate_nat_d_hash: malloc (%lu) failed",
503 (unsigned long)*hashlen);
504 - prf_free(prf);
505 *hashlen = 0;
506 return NULL;
507 }
508
509 port = sockaddr_port(sa);
510 - memset(res, 0, *hashlen);
511 -
512 - prf->Update(prf->prfctx, sockaddr_addrdata(sa), sockaddr_addrlen(sa));
513 - prf->Update(prf->prfctx, (unsigned char *)&port, sizeof port);
514 - prf->Final(res, prf->prfctx);
515 - prf_free (prf);
516 + bzero(res, *hashlen);
517
518 + hash->Init(hash->ctx);
519 + hash->Update(hash->ctx, msg->exchange->cookies,
520 + sizeof msg->exchange->cookies);
521 + hash->Update(hash->ctx, sockaddr_addrdata(sa), sockaddr_addrlen(sa));
522 + hash->Update(hash->ctx, (unsigned char *)&port, sizeof port);
523 + hash->Final(res, hash->ctx);
524 return res;
525 }
526
527 @@ -276,6 +253,7 @@
528 static int
529 nat_t_add_nat_d(struct message *msg, struct sockaddr *sa)
530 {
531 + int ret;
532 u_int8_t *hbuf, *buf;
533 size_t hbuflen, buflen;
534
535 @@ -298,11 +276,19 @@
536 memcpy(buf + ISAKMP_NAT_D_DATA_OFF, hbuf, hbuflen);
537 free(hbuf);
538
539 - if (message_add_payload(msg, ISAKMP_PAYLOAD_NAT_D, buf, buflen, 1)) {
540 + if (msg->exchange->flags & EXCHANGE_FLAG_NAT_T_RFC)
541 + ret = message_add_payload(msg, ISAKMP_PAYLOAD_NAT_D, buf,
542 + buflen, 1);
543 + else if (msg->exchange->flags & EXCHANGE_FLAG_NAT_T_DRAFT)
544 + ret = message_add_payload(msg, ISAKMP_PAYLOAD_NAT_D_DRAFT,
545 + buf, buflen, 1);
546 + else
547 + ret = -1;
548 +
549 + if (ret) {
550 free(buf);
551 return -1;
552 }
553 -
554 return 0;
555 }
556
557 @@ -312,14 +298,14 @@
558 {
559 struct sockaddr *sa;
560
561 - msg->transport->vtbl->get_src(msg->transport, &sa);
562 + /* Remote address first. */
563 + msg->transport->vtbl->get_dst(msg->transport, &sa);
564 if (nat_t_add_nat_d(msg, sa))
565 return -1;
566
567 - msg->transport->vtbl->get_dst(msg->transport, &sa);
568 + msg->transport->vtbl->get_src(msg->transport, &sa);
569 if (nat_t_add_nat_d(msg, sa))
570 return -1;
571 -
572 return 0;
573 }
574
575 @@ -336,8 +322,8 @@
576 * If there are no NAT-D payloads in the message, return "found"
577 * as this will avoid NAT-T (see nat_t_exchange_check_nat_d()).
578 */
579 - p = payload_first(msg, ISAKMP_PAYLOAD_NAT_D);
580 - if (!p)
581 + if ((p = payload_first(msg, ISAKMP_PAYLOAD_NAT_D_DRAFT)) == NULL &&
582 + (p = payload_first(msg, ISAKMP_PAYLOAD_NAT_D)) == NULL)
583 return 1;
584
585 hbuf = nat_t_generate_nat_d_hash(msg, sa, &hbuflen);
586 --- isakmpd-20041012.orig/udp_encap.c
587 +++ isakmpd-20041012/udp_encap.c
588 @@ -61,6 +61,11 @@
589
590 #define UDP_SIZE 65536
591
592 +#if defined(USE_NAT_TRAVERSAL) && defined (LINUX_IPSEC)
593 +#include <linux/socket.h>
594 +#include <linux/udp.h>
595 +#endif
596 +
597 /* If a system doesn't have SO_REUSEPORT, SO_REUSEADDR will have to do. */
598 #ifndef SO_REUSEPORT
599 #define SO_REUSEPORT SO_REUSEADDR
600 @@ -134,6 +139,18 @@
601 if (sysdep_cleartext(s, laddr->sa_family) == -1)
602 goto err;
603
604 +#if defined(USE_NAT_TRAVERSAL) && defined (LINUX_IPSEC)
605 + {
606 +#ifndef SOL_UDP
607 +#define SOL_UDP 17
608 +#endif
609 + int option = UDP_ENCAP_ESPINUDP;
610 + if(setsockopt(s, SOL_UDP, UDP_ENCAP, &option,
611 + sizeof (option)) < 0)
612 + goto err;
613 + }
614 +#endif
615 +
616 /* Wildcard address ? */
617 switch (laddr->sa_family) {
618 case AF_INET:
619 --- isakmpd-20041012.orig/apps/Makefile
620 +++ isakmpd-20041012/apps/Makefile
621 @@ -31,4 +31,4 @@
622
623 SUBDIR= certpatch
624
625 -.include <bsd.subdir.mk>
626 +#.include <bsd.subdir.mk>
627 --- isakmpd-20041012.orig/apps/certpatch/GNUmakefile
628 +++ isakmpd-20041012/apps/certpatch/GNUmakefile
629 @@ -0,0 +1,55 @@
630 +# $OpenBSD: Makefile,v 1.7 2003/06/03 14:35:00 ho Exp $
631 +# $EOM: Makefile,v 1.6 2000/03/28 21:22:06 ho Exp $
632 +
633 +#
634 +# Copyright (c) 1999 Niels Provos. All rights reserved.
635 +# Copyright (c) 2001 Niklas Hallqvist. All rights reserved.
636 +#
637 +# Redistribution and use in source and binary forms, with or without
638 +# modification, are permitted provided that the following conditions
639 +# are met:
640 +# 1. Redistributions of source code must retain the above copyright
641 +# notice, this list of conditions and the following disclaimer.
642 +# 2. Redistributions in binary form must reproduce the above copyright
643 +# notice, this list of conditions and the following disclaimer in the
644 +# documentation and/or other materials provided with the distribution.
645 +#
646 +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
647 +# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
648 +# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
649 +# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
650 +# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
651 +# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
652 +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
653 +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
654 +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
655 +# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
656 +#
657 +
658 +#
659 +# This code was written under funding by Ericsson Radio Systems.
660 +#
661 +
662 +PROG= certpatch
663 +SRCS= certpatch.c
664 +BINDIR?= /usr/sbin
665 +TOPSRC= ${.CURDIR}../..
666 +TOPOBJ!= cd ${TOPSRC}; printf "all:\n\t@pwd\n" |${MAKE} -f-
667 +OS= linux
668 +FEATURES!= awk '/^FEATURES=/ { print $$0 }' ${.CURDIR}/../../Makefile | sed 's/FEATURES=.//'
669 +.PATH: ${TOPSRC} ${TOPSRC}/sysdep/${OS} ${TOPOBJ}
670 +CFLAGS+= -I${TOPSRC} -I${TOPSRC}/sysdep/${OS} -I${TOPOBJ} -Wall
671 +LDFLAGS+= -lcrypto -lssl -lgmp
672 +MAN= certpatch.8
673 +
674 +CFLAGS+= -DMP_FLAVOUR=MP_FLAVOUR_GMP
675 +LDADD+= -lgmp
676 +DPADD+= ${LIBGMP}
677 +
678 +# Override LIBSYSDEPDIR definition from Makefile.sysdep
679 +LIBSYSDEPDIR= ${TOPSRC}/sysdep/common/libsysdep
680 +
681 +all: ${PROG}
682 +
683 +clean:
684 + rm -f ${PROG}
685 --- isakmpd-20041012.orig/pf_key_v2.c
686 +++ isakmpd-20041012/pf_key_v2.c
687 @@ -1055,6 +1055,10 @@
688 #endif
689 #if defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_UDPENCAP)
690 struct sadb_x_udpencap udpencap;
691 +#elif defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_NAT_T_TYPE)
692 + struct sadb_x_nat_t_type nat_t_type;
693 + struct sadb_x_nat_t_port nat_t_sport;
694 + struct sadb_x_nat_t_port nat_t_dport;
695 #endif
696 #ifdef USE_DEBUG
697 char *addr_str;
698 @@ -1273,10 +1277,15 @@
699 log_print("pf_key_v2_set_spi: invalid proto %d", proto->proto);
700 goto cleanup;
701 }
702 - if (incoming)
703 + if (incoming) {
704 sa->transport->vtbl->get_src(sa->transport, &dst);
705 - else
706 + sa->transport->vtbl->get_dst(sa->transport, &src);
707 + }
708 + else {
709 sa->transport->vtbl->get_dst(sa->transport, &dst);
710 + sa->transport->vtbl->get_src(sa->transport, &src);
711 + }
712 +
713 #ifdef KAME
714 msg.sadb_msg_seq = (incoming ?
715 pf_key_v2_seq_by_sa(proto->spi[incoming], sizeof ssa.sadb_sa_spi,
716 @@ -1319,12 +1328,13 @@
717 ssa.sadb_sa_flags = 0;
718 #ifdef SADB_X_SAFLAGS_TUNNEL
719 if (iproto->encap_mode == IPSEC_ENCAP_TUNNEL ||
720 - iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL)
721 + iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL ||
722 + iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT)
723 ssa.sadb_sa_flags = SADB_X_SAFLAGS_TUNNEL;
724 #endif
725
726 -#if defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_UDPENCAP)
727 if (isakmp_sa->flags & SA_FLAG_NAT_T_ENABLE) {
728 +#if defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_UDPENCAP)
729 memset(&udpencap, 0, sizeof udpencap);
730 ssa.sadb_sa_flags |= SADB_X_SAFLAGS_UDPENCAP;
731 udpencap.sadb_x_udpencap_exttype = SADB_X_EXT_UDPENCAP;
732 @@ -1334,8 +1344,40 @@
733 if (pf_key_v2_msg_add(update, (struct sadb_ext *)&udpencap, 0)
734 == -1)
735 goto cleanup;
736 - }
737 +#elif defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_NAT_T_TYPE)
738 +#ifndef UDP_ENCAP_ESPINUDP
739 +#define UDP_ENCAP_ESPINUDP 2
740 +#endif
741 + memset(&nat_t_type, 0, sizeof nat_t_type);
742 + memset(&nat_t_sport, 0, sizeof nat_t_sport);
743 + memset(&nat_t_dport, 0, sizeof nat_t_dport);
744 +
745 + /* type = draft-udp-encap-06 */
746 + nat_t_type.sadb_x_nat_t_type_len = sizeof nat_t_type / PF_KEY_V2_CHUNK;
747 + nat_t_type.sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
748 + nat_t_type.sadb_x_nat_t_type_type = UDP_ENCAP_ESPINUDP;
749 + if(pf_key_v2_msg_add(update, (struct sadb_ext *)&nat_t_type, 0) == -1)
750 + goto cleanup;
751 +
752 + /* source port */
753 + nat_t_sport.sadb_x_nat_t_port_len = sizeof nat_t_sport /
754 + PF_KEY_V2_CHUNK;
755 + nat_t_sport.sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
756 + nat_t_sport.sadb_x_nat_t_port_port = sockaddr_port(src);
757 + if(pf_key_v2_msg_add(update, (struct sadb_ext *)&nat_t_sport, 0) == -1)
758 + goto cleanup;
759 +
760 + /* destination port */
761 + nat_t_dport.sadb_x_nat_t_port_len = sizeof nat_t_dport /
762 + PF_KEY_V2_CHUNK;
763 + nat_t_dport.sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
764 + nat_t_dport.sadb_x_nat_t_port_port = sockaddr_port(dst);
765 + if(pf_key_v2_msg_add(update, (struct sadb_ext *)&nat_t_dport, 0) == -1)
766 + goto cleanup;
767 +
768 + /* original address (transport mode checksum missing info) goes here */
769 #endif
770 + }
771
772 if (pf_key_v2_msg_add(update, (struct sadb_ext *)&ssa, 0) == -1)
773 goto cleanup;
774 @@ -1395,10 +1437,6 @@
775 /*
776 * Setup the ADDRESS extensions.
777 */
778 - if (incoming)
779 - sa->transport->vtbl->get_dst(sa->transport, &src);
780 - else
781 - sa->transport->vtbl->get_src(sa->transport, &src);
782 len = sizeof *addr + PF_KEY_V2_ROUND(sysdep_sa_len(src));
783 addr = calloc(1, len);
784 if (!addr)
785 @@ -2167,7 +2205,7 @@
786 pf_key_v2_msg_free(ret);
787 return -1;
788
789 -#elif defined (SADB_X_SPDADD) && defined (SADB_X_SPDDELETE)
790 +#elif defined (SADB_X_SPDUPDATE) && defined (SADB_X_SPDDELETE)
791 struct sadb_msg msg;
792 struct sadb_x_policy *policy = 0;
793 struct sadb_x_ipsecrequest *ipsecrequest;
794 @@ -2181,7 +2219,7 @@
795 struct sockaddr_in *ip4_sa;
796 struct sockaddr_in6 *ip6_sa;
797
798 - msg.sadb_msg_type = delete ? SADB_X_SPDDELETE : SADB_X_SPDADD;
799 + msg.sadb_msg_type = delete ? SADB_X_SPDDELETE : SADB_X_SPDUPDATE;
800 msg.sadb_msg_satype = SADB_SATYPE_UNSPEC;
801 msg.sadb_msg_seq = 0;
802 flow = pf_key_v2_msg_new(&msg, 0);
803 --- isakmpd-20041012.orig/isakmp_num.cst
804 +++ isakmpd-20041012/isakmp_num.cst
805 @@ -57,15 +57,18 @@
806 KD 17 # RFC 3547, Key Download
807 SEQ 18 # RFC 3547, Sequence Number
808 POP 19 # RFC 3547, Proof of possession
809 - RESERVED_MIN 20
810 + NAT_D 20 # RFC 3947, NAT Discovery payload
811 + NAT_OA 21 # RFC 3947, NAT Original Address payload
812 + RESERVED_MIN 22
813 RESERVED_MAX 127
814 PRIVATE_MIN 128
815 # XXX values from draft-ietf-ipsec-nat-t-ike-01,02,03. Later drafts specify
816 # XXX NAT_D as payload 15 and NAT_OA as 16, but these are allocated by RFC
817 # XXX 3547 as seen above.
818 - NAT_D 130 # NAT Discovery payload
819 - NAT_OA 131 # NAT Original Address payload
820 + NAT_D_DRAFT 130 # NAT Discovery payload
821 + NAT_OA_DRAFT 131 # NAT Original Address payload
822 PRIVATE_MAX 255
823 + MAX 255
824 .
825
826 # ISAKMP exchange types.
827 --- isakmpd-20041012.orig/ipsec_num.cst
828 +++ isakmpd-20041012/ipsec_num.cst
829 @@ -62,10 +62,10 @@
830 IPSEC_ENCAP
831 TUNNEL 1
832 TRANSPORT 2
833 - FUTURE_UDP_ENCAP_TUNNEL 3 # XXX Not yet assigned
834 - FUTURE_UDP_ENCAP_TRANSPORT 4 # XXX Not yet assigned
835 - UDP_ENCAP_TUNNEL 61443 # draft-ietf-ipsec-nat-t-ike
836 - UDP_ENCAP_TRANSPORT 61443 # draft-ietf-ipsec-nat-t-ike
837 + UDP_ENCAP_TUNNEL 3
838 + UDP_ENCAP_TRANSPORT 4
839 + UDP_ENCAP_TUNNEL_DRAFT 61443 # draft-ietf-ipsec-nat-t-ike
840 + UDP_ENCAP_TRANSPORT_DRAFT 61443 # draft-ietf-ipsec-nat-t-ike
841 .
842
843 # IPSEC authentication algorithm.
844 --- isakmpd-20041012.orig/nat_traversal.h
845 +++ isakmpd-20041012/nat_traversal.h
846 @@ -1,4 +1,4 @@
847 -/* $OpenBSD: nat_traversal.h,v 1.2 2004/06/21 23:27:10 ho Exp $ */
848 +/* $OpenBSD: nat_traversal.h,v 1.4 2005/07/25 15:03:47 hshoexer Exp $ */
849
850 /*
851 * Copyright (c) 2004 Håkan Olsson. All rights reserved.
852 @@ -27,6 +27,24 @@
853 #ifndef _NAT_TRAVERSAL_H_
854 #define _NAT_TRAVERSAL_H_
855
856 +#define VID_DRAFT_V2 0
857 +#define VID_DRAFT_V2_N 1
858 +#define VID_DRAFT_V3 2
859 +#define VID_RFC3947 3
860 +
861 +struct nat_t_cap {
862 + int id;
863 + u_int32_t flags;
864 + const char *text;
865 + char *hash;
866 + size_t hashsize;
867 +};
868 +
869 +/*
870 + * Set if -T is given on the command line to disable NAT-T support.
871 + */
872 +extern int disable_nat_t;
873 +
874 void nat_t_init(void);
875 int nat_t_add_vendor_payloads(struct message *);
876 void nat_t_check_vendor_payload(struct message *, struct payload *);
877 --- isakmpd-20041012.orig/message.c
878 +++ isakmpd-20041012/message.c
879 @@ -112,6 +112,7 @@
880 message_validate_hash, message_validate_sig, message_validate_nonce,
881 message_validate_notify, message_validate_delete,
882 message_validate_vendor, message_validate_attribute,
883 + message_validate_nat_d, message_validate_nat_oa,
884 message_validate_nat_d, message_validate_nat_oa
885 };
886
887 @@ -120,7 +121,7 @@
888 isakmp_id_fld, isakmp_cert_fld, isakmp_certreq_fld, isakmp_hash_fld,
889 isakmp_sig_fld, isakmp_nonce_fld, isakmp_notify_fld, isakmp_delete_fld,
890 isakmp_vendor_fld, isakmp_attribute_fld, isakmp_nat_d_fld,
891 - isakmp_nat_oa_fld
892 + isakmp_nat_oa_fld, isakmp_nat_d_fld, isakmp_nat_oa_fld
893 };
894
895 /*
896 @@ -138,7 +139,8 @@
897 ISAKMP_PAYLOAD_SAK, ISAKMP_PAYLOAD_SAT, ISAKMP_PAYLOAD_KD,
898 ISAKMP_PAYLOAD_SEQ, ISAKMP_PAYLOAD_POP
899 #endif
900 - ISAKMP_PAYLOAD_NAT_D, ISAKMP_PAYLOAD_NAT_OA
901 + ISAKMP_PAYLOAD_NAT_D, ISAKMP_PAYLOAD_NAT_OA,
902 + ISAKMP_PAYLOAD_NAT_D_DRAFT, ISAKMP_PAYLOAD_NAT_OA_DRAFT
903 };
904
905 static u_int8_t payload_map[256];
906 @@ -347,8 +349,8 @@
907 }
908 /* Ignore most private payloads. */
909 if (next >= ISAKMP_PAYLOAD_PRIVATE_MIN &&
910 - next != ISAKMP_PAYLOAD_NAT_D &&
911 - next != ISAKMP_PAYLOAD_NAT_OA) {
912 + next != ISAKMP_PAYLOAD_NAT_D_DRAFT &&
913 + next != ISAKMP_PAYLOAD_NAT_OA_DRAFT) {
914 LOG_DBG((LOG_MESSAGE, 30, "message_parse_payloads: "
915 "private next payload type %s in payload of "
916 "type %d ignored",
917 @@ -460,8 +462,10 @@
918 return ISAKMP_ATTRIBUTE_SZ;
919 #if defined (USE_NAT_TRAVERSAL)
920 case ISAKMP_PAYLOAD_NAT_D:
921 + case ISAKMP_PAYLOAD_NAT_D_DRAFT:
922 return ISAKMP_NAT_D_SZ;
923 case ISAKMP_PAYLOAD_NAT_OA:
924 + case ISAKMP_PAYLOAD_NAT_OA_DRAFT:
925 return ISAKMP_NAT_OA_SZ;
926 #endif
927 /* Not yet supported and any other unknown payloads. */
928 --- isakmpd-20041012.orig/policy.c
929 +++ isakmpd-20041012/policy.c
930 @@ -511,7 +511,10 @@
931 break;
932 }
933 #if defined (USE_NAT_TRAVERSAL)
934 - else if (decode_16(value) == IPSEC_ENCAP_UDP_ENCAP_TUNNEL)
935 + else if (decode_16(value) ==
936 + IPSEC_ENCAP_UDP_ENCAP_TUNNEL ||
937 + decode_16(value) ==
938 + IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT)
939 switch (proto->proto) {
940 case IPSEC_PROTO_IPSEC_AH:
941 ah_encapsulation = "udp-encap-tunnel";
942 @@ -1932,7 +1935,7 @@
943 void
944 policy_init(void)
945 {
946 - char *ptr, *policy_file;
947 + char *ptr, *policy_file, *use_keynote;
948 char **asserts;
949 size_t sz, len;
950 int fd, i;
951 @@ -1940,10 +1943,11 @@
952 LOG_DBG((LOG_POLICY, 30, "policy_init: initializing"));
953
954 /* Do we want to use the policy modules? */
955 - if (ignore_policy ||
956 - strncmp("yes", conf_get_str("General", "Use-Keynote"), 3))
957 - return;
958 -
959 + use_keynote = conf_get_str("General", "Use-Keynote");
960 + if (ignore_policy ||
961 + (use_keynote && strncmp("yes", use_keynote, 3)))
962 + return;
963 +
964 /* Get policy file from configuration. */
965 policy_file = conf_get_str("General", "Policy-file");
966 if (!policy_file)
967 --- isakmpd-20041012.orig/ike_phase_1.c
968 +++ isakmpd-20041012/ike_phase_1.c
969 @@ -1040,9 +1040,9 @@
970
971 /* Compare expected/desired and received remote ID */
972 if (bcmp(rid, payload->p + ISAKMP_ID_DATA_OFF, sz)) {
973 - free(rid);
974 log_print("ike_phase_1_recv_ID: "
975 - "received remote ID other than expected %s", p);
976 + "received remote ID other than expected %s - %s", p, payload->p);
977 + free(rid);
978 return -1;
979 }
980 free(rid);
981 --- isakmpd-20041012.orig/x509.c
982 +++ isakmpd-20041012/x509.c
983 @@ -910,7 +910,11 @@
984 X509_STORE_CTX_init(&csc, x509_cas, cert, NULL);
985 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
986 /* XXX See comment in x509_read_crls_from_dir. */
987 +#if OPENSSL_VERSION_NUMBER >= 0x00908000L
988 + if (x509_cas->param->flags & X509_V_FLAG_CRL_CHECK) {
989 +#else
990 if (x509_cas->flags & X509_V_FLAG_CRL_CHECK) {
991 +#endif
992 X509_STORE_CTX_set_flags(&csc, X509_V_FLAG_CRL_CHECK);
993 X509_STORE_CTX_set_flags(&csc, X509_V_FLAG_CRL_CHECK_ALL);
994 }
995 --- isakmpd-20041012.orig/sysdep/linux/sysdep.c
996 +++ isakmpd-20041012/sysdep/linux/sysdep.c
997 @@ -169,22 +169,22 @@
998 return 0;
999
1000 if (!(af == AF_INET || af == AF_INET6))
1001 - {
1002 + {
1003 log_print ("sysdep_cleartext: unsupported protocol family %d", af);
1004 return -1;
1005 }
1006
1007 if (setsockopt (fd, af == AF_INET ? IPPROTO_IP : IPPROTO_IPV6,
1008 - af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
1009 - &pol_in, sizeof pol_in) < 0 ||
1010 + af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
1011 + &pol_in, sizeof pol_in) < 0 ||
1012 setsockopt (fd, af == AF_INET ? IPPROTO_IP : IPPROTO_IPV6,
1013 - af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
1014 - &pol_out, sizeof pol_out) < 0)
1015 - {
1016 + af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
1017 + &pol_out, sizeof pol_out) < 0)
1018 + {
1019 log_error ("sysdep_cleartext: "
1020 - "setsockopt (%d, IPPROTO_IP%s, IP%s_IPSEC_POLICY, ...) "
1021 - "failed", fd, af == AF_INET ? "" : "V6",
1022 - af == AF_INET ? "" : "V6");
1023 + "setsockopt (%d, IPPROTO_IP%s, IP%s_IPSEC_POLICY, ...) "
1024 + "failed", fd, af == AF_INET ? "" : "V6",
1025 + af == AF_INET ? "" : "V6");
1026 return -1;
1027 }
1028 return 0;
1029 --- isakmpd-20041012.orig/sysdep/linux/GNUmakefile.sysdep
1030 +++ isakmpd-20041012/sysdep/linux/GNUmakefile.sysdep
1031 @@ -33,13 +33,13 @@
1032 LDADD+= -lgmp ${LIBSYSDEP} ${LIBCRYPTO}
1033 DPADD+= ${LIBGMP} ${LIBSYSDEP}
1034
1035 -CFLAGS+= -DUSE_OLD_SOCKADDR -DHAVE_PCAP \
1036 - -DNEED_SYSDEP_APP -DMP_FLAVOUR=MP_FLAVOUR_GMP \
1037 - -I/usr/src/linux/include -I${.CURDIR}/sysdep/common \
1038 +CFLAGS+= -DHAVE_GETNAMEINFO -DUSE_OLD_SOCKADDR -DHAVE_PCAP \
1039 + -DNEED_SYSDEP_APP -DMP_FLAVOUR=MP_FLAVOUR_GMP -DUSE_AES \
1040 + -I${.CURDIR}/sysdep/linux/include -I${.CURDIR}/sysdep/common \
1041 -I/usr/include/openssl
1042
1043 FEATURES= debug tripledes blowfish cast ec aggressive x509 policy
1044 -FEATURES+= des aes
1045 +FEATURES+= dpd nat_traversal isakmp_cfg des aes
1046
1047 IPSEC_SRCS= pf_key_v2.c
1048 IPSEC_CFLAGS= -DUSE_PF_KEY_V2
1049 @@ -51,7 +51,7 @@
1050 # hack libsysdep.a dependenc
1051 ${LIBSYSDEPDIR}/.depend ${LIBSYSDEP}:
1052 cd ${LIBSYSDEPDIR} && \
1053 - ${MAKE} --no-print-directory ${MAKEFLAGS} \
1054 + ${MAKE} --no-print-directory \
1055 CFLAGS="${CFLAGS}" MKDEP="${MKDEP}" ${MAKECMDGOALS}
1056
1057 ifeq ($(findstring clean,$(MAKECMDGOALS)),clean)
1058 --- isakmpd-20041012.orig/sysdep/linux/include/bitstring.h
1059 +++ isakmpd-20041012/sysdep/linux/include/bitstring.h
1060 @@ -0,0 +1,132 @@
1061 +/* $OpenBSD: bitstring.h,v 1.4 2002/06/19 02:50:10 millert Exp $ */
1062 +/* $NetBSD: bitstring.h,v 1.5 1997/05/14 15:49:55 pk Exp $ */
1063 +
1064 +/*
1065 + * Copyright (c) 1989, 1993
1066 + * The Regents of the University of California. All rights reserved.
1067 + *
1068 + * This code is derived from software contributed to Berkeley by
1069 + * Paul Vixie.
1070 + *
1071 + * Redistribution and use in source and binary forms, with or without
1072 + * modification, are permitted provided that the following conditions
1073 + * are met:
1074 + * 1. Redistributions of source code must retain the above copyright
1075 + * notice, this list of conditions and the following disclaimer.
1076 + * 2. Redistributions in binary form must reproduce the above copyright
1077 + * notice, this list of conditions and the following disclaimer in the
1078 + * documentation and/or other materials provided with the distribution.
1079 + * 3. All advertising materials mentioning features or use of this software
1080 + * must display the following acknowledgement:
1081 + * This product includes software developed by the University of
1082 + * California, Berkeley and its contributors.
1083 + * 4. Neither the name of the University nor the names of its contributors
1084 + * may be used to endorse or promote products derived from this software
1085 + * without specific prior written permission.
1086 + *
1087 + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
1088 + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1089 + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1090 + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
1091 + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
1092 + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1093 + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1094 + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1095 + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1096 + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1097 + * SUCH DAMAGE.
1098 + *
1099 + * @(#)bitstring.h 8.1 (Berkeley) 7/19/93
1100 + */
1101 +
1102 +#ifndef _BITSTRING_H_
1103 +#define _BITSTRING_H_
1104 +
1105 +/* modified for SV/AT and bitstring bugfix by M.R.Murphy, 11oct91
1106 + * bitstr_size changed gratuitously, but shorter
1107 + * bit_alloc spelling error fixed
1108 + * the following were efficient, but didn't work, they've been made to
1109 + * work, but are no longer as efficient :-)
1110 + * bit_nclear, bit_nset, bit_ffc, bit_ffs
1111 + */
1112 +typedef unsigned char bitstr_t;
1113 +
1114 +/* internal macros */
1115 + /* byte of the bitstring bit is in */
1116 +#define _bit_byte(bit) \
1117 + ((bit) >> 3)
1118 +
1119 + /* mask for the bit within its byte */
1120 +#define _bit_mask(bit) \
1121 + (1 << ((bit)&0x7))
1122 +
1123 +/* external macros */
1124 + /* bytes in a bitstring of nbits bits */
1125 +#define bitstr_size(nbits) \
1126 + (((nbits) + 7) >> 3)
1127 +
1128 + /* allocate a bitstring */
1129 +#define bit_alloc(nbits) \
1130 + (bitstr_t *)calloc((size_t)bitstr_size(nbits), sizeof(bitstr_t))
1131 +
1132 + /* allocate a bitstring on the stack */
1133 +#define bit_decl(name, nbits) \
1134 + ((name)[bitstr_size(nbits)])
1135 +
1136 + /* is bit N of bitstring name set? */
1137 +#define bit_test(name, bit) \
1138 + ((name)[_bit_byte(bit)] & _bit_mask(bit))
1139 +
1140 + /* set bit N of bitstring name */
1141 +#define bit_set(name, bit) \
1142 + ((name)[_bit_byte(bit)] |= _bit_mask(bit))
1143 +
1144 + /* clear bit N of bitstring name */
1145 +#define bit_clear(name, bit) \
1146 + ((name)[_bit_byte(bit)] &= ~_bit_mask(bit))
1147 +
1148 + /* clear bits start ... stop in bitstring */
1149 +#define bit_nclear(name, start, stop) do { \
1150 + register bitstr_t *_name = name; \
1151 + register int _start = start, _stop = stop; \
1152 + while (_start <= _stop) { \
1153 + bit_clear(_name, _start); \
1154 + _start++; \
1155 + } \
1156 +} while(0)
1157 +
1158 + /* set bits start ... stop in bitstring */
1159 +#define bit_nset(name, start, stop) do { \
1160 + register bitstr_t *_name = name; \
1161 + register int _start = start, _stop = stop; \
1162 + while (_start <= _stop) { \
1163 + bit_set(_name, _start); \
1164 + _start++; \
1165 + } \
1166 +} while(0)
1167 +
1168 + /* find first bit clear in name */
1169 +#define bit_ffc(name, nbits, value) do { \
1170 + register bitstr_t *_name = name; \
1171 + register int _bit, _nbits = nbits, _value = -1; \
1172 + for (_bit = 0; _bit < _nbits; ++_bit) \
1173 + if (!bit_test(_name, _bit)) { \
1174 + _value = _bit; \
1175 + break; \
1176 + } \
1177 + *(value) = _value; \
1178 +} while(0)
1179 +
1180 + /* find first bit set in name */
1181 +#define bit_ffs(name, nbits, value) do { \
1182 + register bitstr_t *_name = name; \
1183 + register int _bit, _nbits = nbits, _value = -1; \
1184 + for (_bit = 0; _bit < _nbits; ++_bit) \
1185 + if (bit_test(_name, _bit)) { \
1186 + _value = _bit; \
1187 + break; \
1188 + } \
1189 + *(value) = _value; \
1190 +} while(0)
1191 +
1192 +#endif /* !_BITSTRING_H_ */
1193 --- isakmpd-20041012.orig/sysdep/linux/include/sys/queue.h
1194 +++ isakmpd-20041012/sysdep/linux/include/sys/queue.h
1195 @@ -0,0 +1,453 @@
1196 +/*
1197 + * Copyright (c) 1991, 1993
1198 + * The Regents of the University of California. All rights reserved.
1199 + *
1200 + * Redistribution and use in source and binary forms, with or without
1201 + * modification, are permitted provided that the following conditions
1202 + * are met:
1203 + * 1. Redistributions of source code must retain the above copyright
1204 + * notice, this list of conditions and the following disclaimer.
1205 + * 2. Redistributions in binary form must reproduce the above copyright
1206 + * notice, this list of conditions and the following disclaimer in the
1207 + * documentation and/or other materials provided with the distribution.
1208 + * 3. All advertising materials mentioning features or use of this software
1209 + * must display the following acknowledgement:
1210 + * This product includes software developed by the University of
1211 + * California, Berkeley and its contributors.
1212 + * 4. Neither the name of the University nor the names of its contributors
1213 + * may be used to endorse or promote products derived from this software
1214 + * without specific prior written permission.
1215 + *
1216 + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
1217 + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1218 + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1219 + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
1220 + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
1221 + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
1222 + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1223 + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
1224 + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
1225 + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1226 + * SUCH DAMAGE.
1227 + *
1228 + * @(#)queue.h 8.5 (Berkeley) 8/20/94
1229 + * $FreeBSD: src/sys/sys/queue.h,v 1.45 2001/12/11 11:49:58 sheldonh Exp $
1230 + */
1231 +
1232 +#ifndef _SYS_QUEUE_H_
1233 +#define _SYS_QUEUE_H_
1234 +
1235 +//#include <machine/ansi.h> /* for __offsetof */
1236 +
1237 +/*
1238 + * This file defines four types of data structures: singly-linked lists,
1239 + * singly-linked tail queues, lists and tail queues.
1240 + *
1241 + * A singly-linked list is headed by a single forward pointer. The elements
1242 + * are singly linked for minimum space and pointer manipulation overhead at
1243 + * the expense of O(n) removal for arbitrary elements. New elements can be
1244 + * added to the list after an existing element or at the head of the list.
1245 + * Elements being removed from the head of the list should use the explicit
1246 + * macro for this purpose for optimum efficiency. A singly-linked list may
1247 + * only be traversed in the forward direction. Singly-linked lists are ideal
1248 + * for applications with large datasets and few or no removals or for
1249 + * implementing a LIFO queue.
1250 + *
1251 + * A singly-linked tail queue is headed by a pair of pointers, one to the
1252 + * head of the list and the other to the tail of the list. The elements are
1253 + * singly linked for minimum space and pointer manipulation overhead at the
1254 + * expense of O(n) removal for arbitrary elements. New elements can be added
1255 + * to the list after an existing element, at the head of the list, or at the
1256 + * end of the list. Elements being removed from the head of the tail queue
1257 + * should use the explicit macro for this purpose for optimum efficiency.
1258 + * A singly-linked tail queue may only be traversed in the forward direction.
1259 + * Singly-linked tail queues are ideal for applications with large datasets
1260 + * and few or no removals or for implementing a FIFO queue.
1261 + *
1262 + * A list is headed by a single forward pointer (or an array of forward
1263 + * pointers for a hash table header). The elements are doubly linked
1264 + * so that an arbitrary element can be removed without a need to
1265 + * traverse the list. New elements can be added to the list before
1266 + * or after an existing element or at the head of the list. A list
1267 + * may only be traversed in the forward direction.
1268 + *
1269 + * A tail queue is headed by a pair of pointers, one to the head of the
1270 + * list and the other to the tail of the list. The elements are doubly
1271 + * linked so that an arbitrary element can be removed without a need to
1272 + * traverse the list. New elements can be added to the list before or
1273 + * after an existing element, at the head of the list, or at the end of
1274 + * the list. A tail queue may be traversed in either direction.
1275 + *
1276 + * For details on the use of these macros, see the queue(3) manual page.
1277 + *
1278 + *
1279 + * SLIST LIST STAILQ TAILQ
1280 + * _HEAD + + + +
1281 + * _HEAD_INITIALIZER + + + +
1282 + * _ENTRY + + + +
1283 + * _INIT + + + +
1284 + * _EMPTY + + + +
1285 + * _FIRST + + + +
1286 + * _NEXT + + + +
1287 + * _PREV - - - +
1288 + * _LAST - - + +
1289 + * _FOREACH + + + +
1290 + * _FOREACH_REVERSE - - - +
1291 + * _INSERT_HEAD + + + +
1292 + * _INSERT_BEFORE - + - +
1293 + * _INSERT_AFTER + + + +
1294 + * _INSERT_TAIL - - + +
1295 + * _REMOVE_HEAD + - + -
1296 + * _REMOVE + + + +
1297 + *
1298 + */
1299 +
1300 +/*
1301 + * Singly-linked List declarations.
1302 + */
1303 +#define SLIST_HEAD(name, type) \
1304 +struct name { \
1305 + struct type *slh_first; /* first element */ \
1306 +}
1307 +
1308 +#define SLIST_HEAD_INITIALIZER(head) \
1309 + { NULL }
1310 +
1311 +#define SLIST_ENTRY(type) \
1312 +struct { \
1313 + struct type *sle_next; /* next element */ \
1314 +}
1315 +
1316 +/*
1317 + * Singly-linked List functions.
1318 + */
1319 +#define SLIST_EMPTY(head) ((head)->slh_first == NULL)
1320 +
1321 +#define SLIST_FIRST(head) ((head)->slh_first)
1322 +
1323 +#define SLIST_FOREACH(var, head, field) \
1324 + for ((var) = SLIST_FIRST((head)); \
1325 + (var); \
1326 + (var) = SLIST_NEXT((var), field))
1327 +
1328 +#define SLIST_INIT(head) do { \
1329 + SLIST_FIRST((head)) = NULL; \
1330 +} while (0)
1331 +
1332 +#define SLIST_INSERT_AFTER(slistelm, elm, field) do { \
1333 + SLIST_NEXT((elm), field) = SLIST_NEXT((slistelm), field); \
1334 + SLIST_NEXT((slistelm), field) = (elm); \
1335 +} while (0)
1336 +
1337 +#define SLIST_INSERT_HEAD(head, elm, field) do { \
1338 + SLIST_NEXT((elm), field) = SLIST_FIRST((head)); \
1339 + SLIST_FIRST((head)) = (elm); \
1340 +} while (0)
1341 +
1342 +#define SLIST_NEXT(elm, field) ((elm)->field.sle_next)
1343 +
1344 +#define SLIST_REMOVE(head, elm, type, field) do { \
1345 + if (SLIST_FIRST((head)) == (elm)) { \
1346 + SLIST_REMOVE_HEAD((head), field); \
1347 + } \
1348 + else { \
1349 + struct type *curelm = SLIST_FIRST((head)); \
1350 + while (SLIST_NEXT(curelm, field) != (elm)) \
1351 + curelm = SLIST_NEXT(curelm, field); \
1352 + SLIST_NEXT(curelm, field) = \
1353 + SLIST_NEXT(SLIST_NEXT(curelm, field), field); \
1354 + } \
1355 +} while (0)
1356 +
1357 +#define SLIST_REMOVE_HEAD(head, field) do { \
1358 + SLIST_FIRST((head)) = SLIST_NEXT(SLIST_FIRST((head)), field); \
1359 +} while (0)
1360 +
1361 +/*
1362 + * Singly-linked Tail queue declarations.
1363 + */
1364 +#define STAILQ_HEAD(name, type) \
1365 +struct name { \
1366 + struct type *stqh_first;/* first element */ \
1367 + struct type **stqh_last;/* addr of last next element */ \
1368 +}
1369 +
1370 +#define STAILQ_HEAD_INITIALIZER(head) \
1371 + { NULL, &(head).stqh_first }
1372 +
1373 +#define STAILQ_ENTRY(type) \
1374 +struct { \
1375 + struct type *stqe_next; /* next element */ \
1376 +}
1377 +
1378 +/*
1379 + * Singly-linked Tail queue functions.
1380 + */
1381 +#define STAILQ_EMPTY(head) ((head)->stqh_first == NULL)
1382 +
1383 +#define STAILQ_FIRST(head) ((head)->stqh_first)
1384 +
1385 +#define STAILQ_FOREACH(var, head, field) \
1386 + for((var) = STAILQ_FIRST((head)); \
1387 + (var); \
1388 + (var) = STAILQ_NEXT((var), field))
1389 +
1390 +#define STAILQ_INIT(head) do { \
1391 + STAILQ_FIRST((head)) = NULL; \
1392 + (head)->stqh_last = &STAILQ_FIRST((head)); \
1393 +} while (0)
1394 +
1395 +#define STAILQ_INSERT_AFTER(head, tqelm, elm, field) do { \
1396 + if ((STAILQ_NEXT((elm), field) = STAILQ_NEXT((tqelm), field)) == NULL)\
1397 + (head)->stqh_last = &STAILQ_NEXT((elm), field); \
1398 + STAILQ_NEXT((tqelm), field) = (elm); \
1399 +} while (0)
1400 +
1401 +#define STAILQ_INSERT_HEAD(head, elm, field) do { \
1402 + if ((STAILQ_NEXT((elm), field) = STAILQ_FIRST((head))) == NULL) \
1403 + (head)->stqh_last = &STAILQ_NEXT((elm), field); \
1404 + STAILQ_FIRST((head)) = (elm); \
1405 +} while (0)
1406 +
1407 +#define STAILQ_INSERT_TAIL(head, elm, field) do { \
1408 + STAILQ_NEXT((elm), field) = NULL; \
1409 + *(head)->stqh_last = (elm); \
1410 + (head)->stqh_last = &STAILQ_NEXT((elm), field); \
1411 +} while (0)
1412 +
1413 +#define STAILQ_LAST(head, type, field) \
1414 + (STAILQ_EMPTY(head) ? \
1415 + NULL : \
1416 + ((struct type *) \
1417 + ((char *)((head)->stqh_last) - __offsetof(struct type, field))))
1418 +
1419 +#define STAILQ_NEXT(elm, field) ((elm)->field.stqe_next)
1420 +
1421 +#define STAILQ_REMOVE(head, elm, type, field) do { \
1422 + if (STAILQ_FIRST((head)) == (elm)) { \
1423 + STAILQ_REMOVE_HEAD(head, field); \
1424 + } \
1425 + else { \
1426 + struct type *curelm = STAILQ_FIRST((head)); \
1427 + while (STAILQ_NEXT(curelm, field) != (elm)) \
1428 + curelm = STAILQ_NEXT(curelm, field); \
1429 + if ((STAILQ_NEXT(curelm, field) = \
1430 + STAILQ_NEXT(STAILQ_NEXT(curelm, field), field)) == NULL)\
1431 + (head)->stqh_last = &STAILQ_NEXT((curelm), field);\
1432 + } \
1433 +} while (0)
1434 +
1435 +#define STAILQ_REMOVE_HEAD(head, field) do { \
1436 + if ((STAILQ_FIRST((head)) = \
1437 + STAILQ_NEXT(STAILQ_FIRST((head)), field)) == NULL) \
1438 + (head)->stqh_last = &STAILQ_FIRST((head)); \
1439 +} while (0)
1440 +
1441 +#define STAILQ_REMOVE_HEAD_UNTIL(head, elm, field) do { \
1442 + if ((STAILQ_FIRST((head)) = STAILQ_NEXT((elm), field)) == NULL) \
1443 + (head)->stqh_last = &STAILQ_FIRST((head)); \
1444 +} while (0)
1445 +
1446 +/*
1447 + * List declarations.
1448 + */
1449 +#define LIST_HEAD(name, type) \
1450 +struct name { \
1451 + struct type *lh_first; /* first element */ \
1452 +}
1453 +
1454 +#define LIST_HEAD_INITIALIZER(head) \
1455 + { NULL }
1456 +
1457 +#define LIST_ENTRY(type) \
1458 +struct { \
1459 + struct type *le_next; /* next element */ \
1460 + struct type **le_prev; /* address of previous next element */ \
1461 +}
1462 +
1463 +/*
1464 + * List functions.
1465 + */
1466 +
1467 +#define LIST_EMPTY(head) ((head)->lh_first == NULL)
1468 +
1469 +#define LIST_FIRST(head) ((head)->lh_first)
1470 +
1471 +#define LIST_FOREACH(var, head, field) \
1472 + for ((var) = LIST_FIRST((head)); \
1473 + (var); \
1474 + (var) = LIST_NEXT((var), field))
1475 +
1476 +#define LIST_INIT(head) do { \
1477 + LIST_FIRST((head)) = NULL; \
1478 +} while (0)
1479 +
1480 +#define LIST_INSERT_AFTER(listelm, elm, field) do { \
1481 + if ((LIST_NEXT((elm), field) = LIST_NEXT((listelm), field)) != NULL)\
1482 + LIST_NEXT((listelm), field)->field.le_prev = \
1483 + &LIST_NEXT((elm), field); \
1484 + LIST_NEXT((listelm), field) = (elm); \
1485 + (elm)->field.le_prev = &LIST_NEXT((listelm), field); \
1486 +} while (0)
1487 +
1488 +#define LIST_INSERT_BEFORE(listelm, elm, field) do { \
1489 + (elm)->field.le_prev = (listelm)->field.le_prev; \
1490 + LIST_NEXT((elm), field) = (listelm); \
1491 + *(listelm)->field.le_prev = (elm); \
1492 + (listelm)->field.le_prev = &LIST_NEXT((elm), field); \
1493 +} while (0)
1494 +
1495 +#define LIST_INSERT_HEAD(head, elm, field) do { \
1496 + if ((LIST_NEXT((elm), field) = LIST_FIRST((head))) != NULL) \
1497 + LIST_FIRST((head))->field.le_prev = &LIST_NEXT((elm), field);\
1498 + LIST_FIRST((head)) = (elm); \
1499 + (elm)->field.le_prev = &LIST_FIRST((head)); \
1500 +} while (0)
1501 +
1502 +#define LIST_NEXT(elm, field) ((elm)->field.le_next)
1503 +
1504 +#define LIST_REMOVE(elm, field) do { \
1505 + if (LIST_NEXT((elm), field) != NULL) \
1506 + LIST_NEXT((elm), field)->field.le_prev = \
1507 + (elm)->field.le_prev; \
1508 + *(elm)->field.le_prev = LIST_NEXT((elm), field); \
1509 +} while (0)
1510 +
1511 +/*
1512 + * Tail queue declarations.
1513 + */
1514 +#define TAILQ_HEAD(name, type) \
1515 +struct name { \
1516 + struct type *tqh_first; /* first element */ \
1517 + struct type **tqh_last; /* addr of last next element */ \
1518 +}
1519 +
1520 +#define TAILQ_HEAD_INITIALIZER(head) \
1521 + { NULL, &(head).tqh_first }
1522 +
1523 +#define TAILQ_ENTRY(type) \
1524 +struct { \
1525 + struct type *tqe_next; /* next element */ \
1526 + struct type **tqe_prev; /* address of previous next element */ \
1527 +}
1528 +
1529 +/*
1530 + * Tail queue functions.
1531 + */
1532 +#define TAILQ_EMPTY(head) ((head)->tqh_first == NULL)
1533 +
1534 +#define TAILQ_FIRST(head) ((head)->tqh_first)
1535 +
1536 +#define TAILQ_FOREACH(var, head, field) \
1537 + for ((var) = TAILQ_FIRST((head)); \
1538 + (var); \
1539 + (var) = TAILQ_NEXT((var), field))
1540 +
1541 +#define TAILQ_FOREACH_REVERSE(var, head, headname, field) \
1542 + for ((var) = TAILQ_LAST((head), headname); \
1543 + (var); \
1544 + (var) = TAILQ_PREV((var), headname, field))
1545 +
1546 +#define TAILQ_INIT(head) do { \
1547 + TAILQ_FIRST((head)) = NULL; \
1548 + (head)->tqh_last = &TAILQ_FIRST((head)); \
1549 +} while (0)
1550 +
1551 +#define TAILQ_INSERT_AFTER(head, listelm, elm, field) do { \
1552 + if ((TAILQ_NEXT((elm), field) = TAILQ_NEXT((listelm), field)) != NULL)\
1553 + TAILQ_NEXT((elm), field)->field.tqe_prev = \
1554 + &TAILQ_NEXT((elm), field); \
1555 + else \
1556 + (head)->tqh_last = &TAILQ_NEXT((elm), field); \
1557 + TAILQ_NEXT((listelm), field) = (elm); \
1558 + (elm)->field.tqe_prev = &TAILQ_NEXT((listelm), field); \
1559 +} while (0)
1560 +
1561 +#define TAILQ_INSERT_BEFORE(listelm, elm, field) do { \
1562 + (elm)->field.tqe_prev = (listelm)->field.tqe_prev; \
1563 + TAILQ_NEXT((elm), field) = (listelm); \
1564 + *(listelm)->field.tqe_prev = (elm); \
1565 + (listelm)->field.tqe_prev = &TAILQ_NEXT((elm), field); \
1566 +} while (0)
1567 +
1568 +#define TAILQ_INSERT_HEAD(head, elm, field) do { \
1569 + if ((TAILQ_NEXT((elm), field) = TAILQ_FIRST((head))) != NULL) \
1570 + TAILQ_FIRST((head))->field.tqe_prev = \
1571 + &TAILQ_NEXT((elm), field); \
1572 + else \
1573 + (head)->tqh_last = &TAILQ_NEXT((elm), field); \
1574 + TAILQ_FIRST((head)) = (elm); \
1575 + (elm)->field.tqe_prev = &TAILQ_FIRST((head)); \
1576 +} while (0)
1577 +
1578 +#define TAILQ_INSERT_TAIL(head, elm, field) do { \
1579 + TAILQ_NEXT((elm), field) = NULL; \
1580 + (elm)->field.tqe_prev = (head)->tqh_last; \
1581 + *(head)->tqh_last = (elm); \
1582 + (head)->tqh_last = &TAILQ_NEXT((elm), field); \
1583 +} while (0)
1584 +
1585 +#define TAILQ_LAST(head, headname) \
1586 + (*(((struct headname *)((head)->tqh_last))->tqh_last))
1587 +
1588 +#define TAILQ_NEXT(elm, field) ((elm)->field.tqe_next)
1589 +
1590 +#define TAILQ_PREV(elm, headname, field) \
1591 + (*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
1592 +
1593 +#define TAILQ_REMOVE(head, elm, field) do { \
1594 + if ((TAILQ_NEXT((elm), field)) != NULL) \
1595 + TAILQ_NEXT((elm), field)->field.tqe_prev = \
1596 + (elm)->field.tqe_prev; \
1597 + else \
1598 + (head)->tqh_last = (elm)->field.tqe_prev; \
1599 + *(elm)->field.tqe_prev = TAILQ_NEXT((elm), field); \
1600 +} while (0)
1601 +
1602 +
1603 +#ifdef _KERNEL
1604 +
1605 +/*
1606 + * XXX insque() and remque() are an old way of handling certain queues.
1607 + * They bogusly assumes that all queue heads look alike.
1608 + */
1609 +
1610 +struct quehead {
1611 + struct quehead *qh_link;
1612 + struct quehead *qh_rlink;
1613 +};
1614 +
1615 +#ifdef __GNUC__
1616 +
1617 +static __inline void
1618 +insque(void *a, void *b)
1619 +{
1620 + struct quehead *element = (struct quehead *)a,
1621 + *head = (struct quehead *)b;
1622 +
1623 + element->qh_link = head->qh_link;
1624 + element->qh_rlink = head;
1625 + head->qh_link = element;
1626 + element->qh_link->qh_rlink = element;
1627 +}
1628 +
1629 +static __inline void
1630 +remque(void *a)
1631 +{
1632 + struct quehead *element = (struct quehead *)a;
1633 +
1634 + element->qh_link->qh_rlink = element->qh_rlink;
1635 + element->qh_rlink->qh_link = element->qh_link;
1636 + element->qh_rlink = 0;
1637 +}
1638 +
1639 +#else /* !__GNUC__ */
1640 +
1641 +void insque __P((void *a, void *b));
1642 +void remque __P((void *a));
1643 +
1644 +#endif /* __GNUC__ */
1645 +
1646 +#endif /* _KERNEL */
1647 +
1648 +#endif /* !_SYS_QUEUE_H_ */
1649 --- isakmpd-20041012.orig/sysdep/common/pcap.h
1650 +++ isakmpd-20041012/sysdep/common/pcap.h
1651 @@ -55,8 +55,13 @@
1652 u_int32_t linktype; /* data link type (DLT_*) */
1653 };
1654
1655 +struct pcap_timeval {
1656 + int32_t tv_sec; /* seconds */
1657 + int32_t tv_usec; /* microseconds */
1658 +};
1659 +
1660 struct pcap_pkthdr {
1661 - struct timeval ts; /* time stamp */
1662 + struct pcap_timeval ts; /* time stamp */
1663 u_int32_t caplen; /* length of portion present */
1664 u_int32_t len; /* length this packet (off wire) */
1665 };
1666 --- isakmpd-20041012.orig/sysdep/common/libsysdep/arc4random.c
1667 +++ isakmpd-20041012/sysdep/common/libsysdep/arc4random.c
1668 @@ -78,7 +78,7 @@
1669 static void
1670 arc4_stir(struct arc4_stream *as)
1671 {
1672 - int fd;
1673 + int fd, i;
1674 struct {
1675 struct timeval tv;
1676 u_int8_t rnd[128 - sizeof(struct timeval)];
1677 --- isakmpd-20041012.orig/x509v3.cnf
1678 +++ isakmpd-20041012/x509v3.cnf
1679 @@ -0,0 +1,26 @@
1680 +# default settings
1681 +CERTPATHLEN = 1
1682 +CERTUSAGE = digitalSignature,keyCertSign
1683 +CERTIP = 0.0.0.0
1684 +CERTFQDN = nohost.nodomain
1685 +
1686 +# This section should be referenced when building an x509v3 CA
1687 +# Certificate.
1688 +# The default path length and the key usage can be overriden
1689 +# modified by setting the CERTPATHLEN and CERTUSAGE environment
1690 +# variables.
1691 +[x509v3_CA]
1692 +basicConstraints=critical,CA:true,pathlen:$ENV::CERTPATHLEN
1693 +keyUsage=$ENV::CERTUSAGE
1694 +
1695 +# This section should be referenced to add an IP Address
1696 +# as an alternate subject name, needed by isakmpd
1697 +# The address must be provided in the CERTIP environment variable
1698 +[x509v3_IPAddr]
1699 +subjectAltName=IP:$ENV::CERTIP
1700 +
1701 +# This section should be referenced to add a FQDN hostname
1702 +# as an alternate subject name, needed by isakmpd
1703 +# The address must be provided in the CERTFQDN environment variable
1704 +[x509v3_FQDN]
1705 +subjectAltName=DNS:$ENV::CERTFQDN
1706
OpenWrt Source Repository