[package] add GRE support to ipsec-tools, so that opennhrp can work (#6926)
[openwrt/svn-archive/archive.git] / net / ipsec-tools / patches / 004-opennhrp.patch
1 Index: ipsec-tools-0.7.3/src/racoon/admin.c
2 ===================================================================
3 --- ipsec-tools-0.7.3.orig/src/racoon/admin.c 2009-04-20 15:32:57.000000000 +0200
4 +++ ipsec-tools-0.7.3/src/racoon/admin.c 2010-03-28 17:07:57.000000000 +0200
5 @@ -76,6 +76,7 @@
6 #include "evt.h"
7 #include "pfkey.h"
8 #include "ipsec_doi.h"
9 +#include "policy.h"
10 #include "admin.h"
11 #include "admin_var.h"
12 #include "isakmp_inf.h"
13 @@ -147,16 +148,18 @@
14 goto end;
15 }
16
17 - if (com.ac_cmd == ADMIN_RELOAD_CONF) {
18 - /* reload does not work at all! */
19 - signal_handler(SIGHUP);
20 - goto end;
21 - }
22 + plog(LLV_DEBUG, LOCATION, NULL,
23 + "[%d] admin connection established\n", so2);
24
25 error = admin_process(so2, combuf);
26
27 - end:
28 - (void)close(so2);
29 +end:
30 + if (error != -2) {
31 + plog(LLV_DEBUG, LOCATION, NULL,
32 + "[%d] admin connection closed\n", so2);
33 + (void)close(so2);
34 + }
35 +
36 if (combuf)
37 racoon_free(combuf);
38
39 @@ -177,6 +180,8 @@
40 vchar_t *key = NULL;
41 int idtype = 0;
42 int error = -1;
43 + int send_events = 0;
44 + struct evt_listener_list *event_list = NULL;
45
46 com->ac_errno = 0;
47
48 @@ -208,9 +213,7 @@
49 }
50
51 case ADMIN_SHOW_EVT:
52 - /* It's not really an error, don't force racoonctl to quit */
53 - if ((buf = evt_dump()) == NULL)
54 - com->ac_errno = 0;
55 + send_events = 1;
56 break;
57
58 case ADMIN_SHOW_SA:
59 @@ -393,17 +396,17 @@
60 /* FALLTHROUGH */
61 case ADMIN_ESTABLISH_SA:
62 {
63 + struct admin_com_indexes *ndx;
64 struct sockaddr *dst;
65 struct sockaddr *src;
66 - src = (struct sockaddr *)
67 - &((struct admin_com_indexes *)
68 - ((caddr_t)com + sizeof(*com)))->src;
69 - dst = (struct sockaddr *)
70 - &((struct admin_com_indexes *)
71 - ((caddr_t)com + sizeof(*com)))->dst;
72 +
73 + ndx = (struct admin_com_indexes *) ((caddr_t)com + sizeof(*com));
74 + src = (struct sockaddr *) &ndx->src;
75 + dst = (struct sockaddr *) &ndx->dst;
76
77 switch (com->ac_proto) {
78 case ADMIN_PROTO_ISAKMP: {
79 + struct ph1handle *ph1;
80 struct remoteconf *rmconf;
81 struct sockaddr *remote = NULL;
82 struct sockaddr *local = NULL;
83 @@ -411,6 +414,17 @@
84
85 com->ac_errno = -1;
86
87 + /* connected already? */
88 + ph1 = getph1byaddrwop(src, dst);
89 + if (ph1 != NULL) {
90 + event_list = &ph1->evt_listeners;
91 + if (ph1->status == PHASE1ST_ESTABLISHED)
92 + com->ac_errno = EEXIST;
93 + else
94 + com->ac_errno = 0;
95 + break;
96 + }
97 +
98 /* search appropreate configuration */
99 rmconf = getrmconf(dst);
100 if (rmconf == NULL) {
101 @@ -461,9 +475,11 @@
102 "%s\n", saddrwop2str(remote));
103
104 /* begin ident mode */
105 - if (isakmp_ph1begin_i(rmconf, remote, local) < 0)
106 + ph1 = isakmp_ph1begin_i(rmconf, remote, local);
107 + if (ph1 == NULL)
108 goto out1;
109
110 + event_list = &ph1->evt_listeners;
111 com->ac_errno = 0;
112 out1:
113 if (local != NULL)
114 @@ -473,8 +489,105 @@
115 break;
116 }
117 case ADMIN_PROTO_AH:
118 - case ADMIN_PROTO_ESP:
119 + case ADMIN_PROTO_ESP: {
120 + struct ph2handle *iph2;
121 + struct secpolicy *sp_out = NULL, *sp_in = NULL;
122 + struct policyindex spidx;
123 +
124 + com->ac_errno = -1;
125 +
126 + /* got outbound policy */
127 + memset(&spidx, 0, sizeof(spidx));
128 + spidx.dir = IPSEC_DIR_OUTBOUND;
129 + memcpy(&spidx.src, src, sizeof(spidx.src));
130 + memcpy(&spidx.dst, dst, sizeof(spidx.dst));
131 + spidx.prefs = ndx->prefs;
132 + spidx.prefd = ndx->prefd;
133 + spidx.ul_proto = ndx->ul_proto;
134 +
135 + sp_out = getsp_r(&spidx);
136 + if (sp_out) {
137 + plog(LLV_DEBUG, LOCATION, NULL,
138 + "suitable outbound SP found: %s.\n",
139 + spidx2str(&sp_out->spidx));
140 + } else {
141 + com->ac_errno = ENOENT;
142 + plog(LLV_NOTIFY, LOCATION, NULL,
143 + "no outbound policy found: %s\n",
144 + spidx2str(&spidx));
145 + break;
146 + }
147 +
148 + iph2 = getph2byid(src, dst, sp_out->id);
149 + if (iph2 != NULL) {
150 + event_list = &iph2->evt_listeners;
151 + if (iph2->status == PHASE2ST_ESTABLISHED)
152 + com->ac_errno = EEXIST;
153 + else
154 + com->ac_errno = 0;
155 + break;
156 + }
157 +
158 + /* get inbound policy */
159 + memset(&spidx, 0, sizeof(spidx));
160 + spidx.dir = IPSEC_DIR_INBOUND;
161 + memcpy(&spidx.src, dst, sizeof(spidx.src));
162 + memcpy(&spidx.dst, src, sizeof(spidx.dst));
163 + spidx.prefs = ndx->prefd;
164 + spidx.prefd = ndx->prefs;
165 + spidx.ul_proto = ndx->ul_proto;
166 +
167 + sp_in = getsp_r(&spidx);
168 + if (sp_in) {
169 + plog(LLV_DEBUG, LOCATION, NULL,
170 + "suitable inbound SP found: %s.\n",
171 + spidx2str(&sp_in->spidx));
172 + } else {
173 + com->ac_errno = ENOENT;
174 + plog(LLV_NOTIFY, LOCATION, NULL,
175 + "no inbound policy found: %s\n",
176 + spidx2str(&spidx));
177 + break;
178 + }
179 +
180 + /* allocate a phase 2 */
181 + iph2 = newph2();
182 + if (iph2 == NULL) {
183 + plog(LLV_ERROR, LOCATION, NULL,
184 + "failed to allocate phase2 entry.\n");
185 + break;
186 + }
187 + iph2->side = INITIATOR;
188 + iph2->satype = admin2pfkey_proto(com->ac_proto);
189 + iph2->spid = sp_out->id;
190 + iph2->seq = pk_getseq();
191 + iph2->status = PHASE2ST_STATUS2;
192 +
193 + /* set end addresses of SA */
194 + iph2->dst = dupsaddr(dst);
195 + iph2->src = dupsaddr(src);
196 + if (iph2->dst == NULL || iph2->src == NULL) {
197 + delph2(iph2);
198 + break;
199 + }
200 +
201 + if (isakmp_get_sainfo(iph2, sp_out, sp_in) < 0) {
202 + delph2(iph2);
203 + break;
204 + }
205 +
206 + insph2(iph2);
207 + if (isakmp_post_acquire(iph2) < 0) {
208 + unbindph12(iph2);
209 + remph2(iph2);
210 + delph2(iph2);
211 + break;
212 + }
213 +
214 + event_list = &iph2->evt_listeners;
215 + com->ac_errno = 0;
216 break;
217 + }
218 default:
219 /* ignore */
220 com->ac_errno = -1;
221 @@ -491,7 +604,8 @@
222 if ((error = admin_reply(so2, com, buf)) != 0)
223 goto out;
224
225 - error = 0;
226 + if (send_events || event_list != NULL)
227 + error = evt_subscribe(event_list, so2);
228 out:
229 if (buf != NULL)
230 vfree(buf);
231 Index: ipsec-tools-0.7.3/src/racoon/evt.c
232 ===================================================================
233 --- ipsec-tools-0.7.3.orig/src/racoon/evt.c 2006-09-09 18:22:09.000000000 +0200
234 +++ ipsec-tools-0.7.3/src/racoon/evt.c 2010-03-28 17:07:57.000000000 +0200
235 @@ -46,113 +46,219 @@
236 #include "plog.h"
237 #include "misc.h"
238 #include "admin.h"
239 +#include "handler.h"
240 #include "gcmalloc.h"
241 #include "evt.h"
242
243 #ifdef ENABLE_ADMINPORT
244 -struct evtlist evtlist = TAILQ_HEAD_INITIALIZER(evtlist);
245 -int evtlist_len = 0;
246 +static EVT_LISTENER_LIST(evt_listeners);
247 +static EVT_LISTENER_LIST(evt_fds);
248
249 -void
250 -evt_push(src, dst, type, optdata)
251 - struct sockaddr *src;
252 - struct sockaddr *dst;
253 +struct evtdump {
254 + struct admin_com adm;
255 + struct evt_common evt;
256 +};
257 +
258 +static struct evtdump *
259 +evtdump_create(type, optdata)
260 int type;
261 vchar_t *optdata;
262 {
263 - struct evtdump *evtdump;
264 - struct evt *evt;
265 + struct evtdump *e;
266 size_t len;
267
268 - /* If admin socket is disabled, silently discard anything */
269 - if (adminsock_path == NULL)
270 + len = sizeof(struct admin_com) + sizeof(struct evt_common);
271 + if (optdata != NULL)
272 + len += optdata->l;
273 +
274 + if ((e = racoon_malloc(len)) == NULL) {
275 + plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate event: %s\n",
276 + strerror(errno));
277 + return NULL;
278 + }
279 +
280 + memset(e, 0, sizeof(struct evtdump));
281 + e->adm.ac_len = len;
282 + e->adm.ac_cmd = ADMIN_SHOW_EVT;
283 + e->adm.ac_errno = 0;
284 + e->adm.ac_proto = 0;
285 + e->evt.ec_type = type;
286 + time(&e->evt.ec_timestamp);
287 + if (optdata != NULL)
288 + memcpy(e + 1, optdata->v, optdata->l);
289 +
290 + return e;
291 +}
292 +
293 +static void
294 +evt_unsubscribe(l)
295 + struct evt_listener *l;
296 +{
297 + plog(LLV_DEBUG, LOCATION, NULL,
298 + "[%d] admin connection released\n", l->fd);
299 +
300 + LIST_REMOVE(l, ll_chain);
301 + LIST_REMOVE(l, fd_chain);
302 + close(l->fd);
303 + racoon_free(l);
304 +}
305 +
306 +static void
307 +evtdump_broadcast(ll, e)
308 + const struct evt_listener_list *ll;
309 + struct evtdump *e;
310 +{
311 + struct evt_listener *l, *nl;
312 +
313 + for (l = LIST_FIRST(ll); l != NULL; l = nl) {
314 + nl = LIST_NEXT(l, ll_chain);
315 +
316 + if (send(l->fd, e, e->adm.ac_len,
317 + MSG_NOSIGNAL | MSG_DONTWAIT) < 0) {
318 + plog(LLV_DEBUG, LOCATION, NULL, "Cannot send event to fd: %s\n",
319 + strerror(errno));
320 + evt_unsubscribe(l);
321 + }
322 +
323 + }
324 +
325 +}
326 +
327 +void
328 +evt_generic(type, optdata)
329 + int type;
330 + vchar_t *optdata;
331 +{
332 + struct evtdump *e;
333 +
334 +
335 + if ((e = evtdump_create(type, optdata)) == NULL)
336 return;
337
338 - /* If we are above the limit, don't record anything */
339 - if (evtlist_len > EVTLIST_MAX) {
340 - plog(LLV_DEBUG, LOCATION, NULL,
341 - "Cannot record event: event queue overflowed\n");
342 + evtdump_broadcast(&evt_listeners, e);
343 +
344 + racoon_free(e);
345 +}
346 +
347 +void
348 +evt_phase1(ph1, type, optdata)
349 + const struct ph1handle *ph1;
350 + int type;
351 + vchar_t *optdata;
352 +{
353 + struct evtdump *e;
354 +
355 + if ((e = evtdump_create(type, optdata)) == NULL)
356 + return;
357 +
358 + if (ph1->local)
359 + memcpy(&e->evt.ec_ph1src, ph1->local, sysdep_sa_len(ph1->local));
360 + if (ph1->remote)
361 + memcpy(&e->evt.ec_ph1dst, ph1->remote, sysdep_sa_len(ph1->remote));
362 +
363 + evtdump_broadcast(&ph1->evt_listeners, e);
364 + evtdump_broadcast(&evt_listeners, e);
365 +
366 + racoon_free(e);
367 + }
368 +
369 +void
370 +evt_phase2(ph2, type, optdata)
371 + const struct ph2handle *ph2;
372 + int type;
373 + vchar_t *optdata;
374 +{
375 + struct evtdump *e;
376 + struct ph1handle *ph1 = ph2->ph1;
377 +
378 + if ((e = evtdump_create(type, optdata)) == NULL)
379 return;
380 +
381 + if (ph1) {
382 + if (ph1->local)
383 + memcpy(&e->evt.ec_ph1src, ph1->local, sysdep_sa_len(ph1->local));
384 + if (ph1->remote)
385 + memcpy(&e->evt.ec_ph1dst, ph1->remote, sysdep_sa_len(ph1->remote));
386 }
387 + e->evt.ec_ph2msgid = ph2->msgid;
388
389 - /* If we hit the limit, record an overflow event instead */
390 - if (evtlist_len == EVTLIST_MAX) {
391 - plog(LLV_ERROR, LOCATION, NULL,
392 - "Cannot record event: event queue overflow\n");
393 - src = NULL;
394 - dst = NULL;
395 - type = EVTT_OVERFLOW;
396 - optdata = NULL;
397 - }
398 -
399 - len = sizeof(*evtdump);
400 - if (optdata)
401 - len += optdata->l;
402 -
403 - if ((evtdump = racoon_malloc(len)) == NULL) {
404 - plog(LLV_ERROR, LOCATION, NULL, "Cannot record event: %s\n",
405 - strerror(errno));
406 - return;
407 + evtdump_broadcast(&ph2->evt_listeners, e);
408 + if (ph1)
409 + evtdump_broadcast(&ph1->evt_listeners, e);
410 + evtdump_broadcast(&evt_listeners, e);
411 +
412 + racoon_free(e);
413 }
414
415 - if ((evt = racoon_malloc(sizeof(*evt))) == NULL) {
416 - plog(LLV_ERROR, LOCATION, NULL, "Cannot record event: %s\n",
417 - strerror(errno));
418 - racoon_free(evtdump);
419 - return;
420 +int
421 +evt_subscribe(list, fd)
422 + struct evt_listener_list *list;
423 + int fd;
424 +{
425 + struct evt_listener *l;
426 +
427 + if ((l = racoon_malloc(sizeof(*l))) == NULL) {
428 + plog(LLV_ERROR, LOCATION, NULL,
429 + "Cannot allocate event listener: %s\n",
430 + strerror(errno));
431 + return errno;
432 }
433
434 - if (src)
435 - memcpy(&evtdump->src, src, sysdep_sa_len(src));
436 - if (dst)
437 - memcpy(&evtdump->dst, dst, sysdep_sa_len(dst));
438 - evtdump->len = len;
439 - evtdump->type = type;
440 - time(&evtdump->timestamp);
441 + if (list == NULL)
442 + list = &evt_listeners;
443
444 - if (optdata)
445 - memcpy(evtdump + 1, optdata->v, optdata->l);
446 + LIST_INSERT_HEAD(list, l, ll_chain);
447 + LIST_INSERT_HEAD(&evt_fds, l, fd_chain);
448 + l->fd = fd;
449
450 - evt->dump = evtdump;
451 - TAILQ_INSERT_TAIL(&evtlist, evt, next);
452 + plog(LLV_DEBUG, LOCATION, NULL,
453 + "[%d] admin connection is polling events\n", fd);
454
455 - evtlist_len++;
456 + return -2;
457 +}
458
459 - return;
460 +void
461 +evt_list_init(list)
462 + struct evt_listener_list *list;
463 +{
464 + LIST_INIT(list);
465 }
466
467 -struct evtdump *
468 -evt_pop(void) {
469 - struct evtdump *evtdump;
470 - struct evt *evt;
471
472 - if ((evt = TAILQ_FIRST(&evtlist)) == NULL)
473 - return NULL;
474 +void
475 +evt_list_cleanup(list)
476 + struct evt_listener_list *list;
477 +{
478 + while (!LIST_EMPTY(list))
479 + evt_unsubscribe(LIST_FIRST(list));
480 +}
481
482 - evtdump = evt->dump;
483 - TAILQ_REMOVE(&evtlist, evt, next);
484 - racoon_free(evt);
485 - evtlist_len--;
486 -
487 - return evtdump;
488 -}
489 -
490 -vchar_t *
491 -evt_dump(void) {
492 - struct evtdump *evtdump;
493 - vchar_t *buf = NULL;
494 -
495 - if ((evtdump = evt_pop()) != NULL) {
496 - if ((buf = vmalloc(evtdump->len)) == NULL) {
497 - plog(LLV_ERROR, LOCATION, NULL,
498 - "evt_dump failed: %s\n", strerror(errno));
499 - return NULL;
500 - }
501 - memcpy(buf->v, evtdump, evtdump->len);
502 - racoon_free(evtdump);
503 +int
504 +evt_get_fdmask(nfds, fdset)
505 + int nfds;
506 + fd_set *fdset;
507 +{
508 + struct evt_listener *l;
509 + LIST_FOREACH(l, &evt_fds, fd_chain) {
510 + FD_SET(l->fd, fdset);
511 + if (l->fd + 1 > nfds)
512 + nfds = l->fd + 1;
513 }
514 + return nfds;
515 +}
516
517 - return buf;
518 +void
519 +evt_handle_fdmask(fdset)
520 + fd_set *fdset;
521 +{
522 + struct evt_listener *l, *nl;
523 +
524 + for (l = LIST_FIRST(&evt_fds); l != NULL; l = nl) {
525 + nl = LIST_NEXT(l, ll_chain);
526 +
527 + if (FD_ISSET(l->fd, fdset))
528 + evt_unsubscribe(l);
529 + }
530 }
531
532 #endif /* ENABLE_ADMINPORT */
533 Index: ipsec-tools-0.7.3/src/racoon/evt.h
534 ===================================================================
535 --- ipsec-tools-0.7.3.orig/src/racoon/evt.h 2006-09-09 18:22:09.000000000 +0200
536 +++ ipsec-tools-0.7.3/src/racoon/evt.h 2010-03-28 17:07:57.000000000 +0200
537 @@ -34,12 +34,27 @@
538 #ifndef _EVT_H
539 #define _EVT_H
540
541 -struct evtdump {
542 - size_t len;
543 - struct sockaddr_storage src;
544 - struct sockaddr_storage dst;
545 - time_t timestamp;
546 - int type;
547 +#ifdef ENABLE_ADMINPORT
548 +
549 +struct evt_listener {
550 + LIST_ENTRY(evt_listener) ll_chain;
551 + LIST_ENTRY(evt_listener) fd_chain;
552 + int fd;
553 +};
554 +LIST_HEAD(evt_listener_list, evt_listener);
555 +#define EVT_LISTENER_LIST(x) struct evt_listener_list x;
556 +
557 +struct ph1handle;
558 +struct ph2handle;
559 +
560 +struct evt_common {
561 + uint32_t ec_type;
562 + time_t ec_timestamp;
563 +
564 + struct sockaddr_storage ec_ph1src;
565 + struct sockaddr_storage ec_ph1dst;
566 + u_int32_t ec_ph2msgid;
567 +
568 /*
569 * Optionnal list of struct isakmp_data
570 * for type EVTT_ISAKMP_CFG_DONE
571 @@ -47,42 +62,46 @@
572 };
573
574 /* type */
575 -#define EVTT_UNSEPC 0
576 -#define EVTT_PHASE1_UP 1
577 -#define EVTT_PHASE1_DOWN 2
578 -#define EVTT_XAUTH_SUCCESS 3
579 -#define EVTT_ISAKMP_CFG_DONE 4
580 -#define EVTT_PHASE2_UP 5
581 -#define EVTT_PHASE2_DOWN 6
582 -#define EVTT_DPD_TIMEOUT 7
583 -#define EVTT_PEER_NO_RESPONSE 8
584 -#define EVTT_PEER_DELETE 9
585 -#define EVTT_RACOON_QUIT 10
586 -#define EVTT_XAUTH_FAILED 11
587 -#define EVTT_OVERFLOW 12 /* Event queue overflowed */
588 -#define EVTT_PEERPH1AUTH_FAILED 13
589 -#define EVTT_PEERPH1_NOPROP 14 /* NO_PROPOSAL_CHOSEN & friends */
590 -#define EVTT_NO_ISAKMP_CFG 15 /* no need to wait for mode_cfg */
591 -
592 -struct evt {
593 - struct evtdump *dump;
594 - TAILQ_ENTRY(evt) next;
595 -};
596 -
597 -TAILQ_HEAD(evtlist, evt);
598 -
599 -#define EVTLIST_MAX 32
600 +#define EVTT_RACOON_QUIT 0x0001
601 +#define EVTT_PHASE1_UP 0x0100
602 +#define EVTT_PHASE1_DOWN 0x0101
603 +#define EVTT_PHASE1_NO_RESPONSE 0x0102
604 +#define EVTT_PHASE1_NO_PROPOSAL 0x0103
605 +#define EVTT_PHASE1_AUTH_FAILED 0x0104
606 +#define EVTT_PHASE1_DPD_TIMEOUT 0x0105
607 +#define EVTT_PHASE1_PEER_DELETED 0x0106
608 +#define EVTT_PHASE1_MODE_CFG 0x0107
609 +#define EVTT_PHASE1_XAUTH_SUCCESS 0x0108
610 +#define EVTT_PHASE1_XAUTH_FAILED 0x0109
611 +
612 +#define EVTT_PHASE2_NO_PHASE1 0x0200
613 +#define EVTT_PHASE2_UP 0x0201
614 +#define EVTT_PHASE2_DOWN 0x0202
615 +#define EVTT_PHASE2_NO_RESPONSE 0x0203
616 +
617 +void evt_generic __P((int type, vchar_t *optdata));
618 +void evt_phase1 __P((const struct ph1handle *ph1, int type, vchar_t *optdata));
619 +void evt_phase2 __P((const struct ph2handle *ph2, int type, vchar_t *optdata));
620 +
621 +int evt_subscribe __P((struct evt_listener_list *list, int fd));
622 +void evt_list_init __P((struct evt_listener_list *list));
623 +void evt_list_cleanup __P((struct evt_listener_list *list));
624 +int evt_get_fdmask __P((int nfds, fd_set *fdset));
625 +void evt_handle_fdmask __P((fd_set *fdset));
626 +
627 +#else
628
629 -#ifdef ENABLE_ADMINPORT
630 -struct evtdump *evt_pop(void);
631 -vchar_t *evt_dump(void);
632 -void evt_push(struct sockaddr *, struct sockaddr *, int, vchar_t *);
633 -#endif
634 +#define EVT_LISTENER_LIST(x)
635 +#define evt_generic(type, optdata) ;
636 +#define evt_phase1(ph1, type, optdata) ;
637 +#define evt_phase2(ph2, type, optdata) ;
638 +
639 +#define evt_subscribe(eventlist, fd) ;
640 +#define evt_list_init(eventlist) ;
641 +#define evt_list_cleanup(eventlist) ;
642 +#define evt_get_fdmask(nfds, fdset) nfds
643 +#define evt_handle_fdmask(fdset) ;
644
645 -#ifdef ENABLE_ADMINPORT
646 -#define EVT_PUSH(src, dst, type, optdata) evt_push(src, dst, type, optdata);
647 -#else
648 -#define EVT_PUSH(src, dst, type, optdata) ;
649 -#endif
650 +#endif /* ENABLE_ADMINPORT */
651
652 #endif /* _EVT_H */
653 Index: ipsec-tools-0.7.3/src/racoon/handler.c
654 ===================================================================
655 --- ipsec-tools-0.7.3.orig/src/racoon/handler.c 2009-04-20 15:25:27.000000000 +0200
656 +++ ipsec-tools-0.7.3/src/racoon/handler.c 2010-03-28 17:07:57.000000000 +0200
657 @@ -289,8 +289,7 @@
658
659 /* SA down shell script hook */
660 script_hook(iph1, SCRIPT_PHASE1_DOWN);
661 -
662 - EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_DOWN, NULL);
663 + evt_list_cleanup(&iph1->evt_listeners);
664
665 #ifdef ENABLE_NATT
666 if (iph1->natt_flags & NAT_KA_QUEUED)
667 Index: ipsec-tools-0.7.3/src/racoon/handler.h
668 ===================================================================
669 --- ipsec-tools-0.7.3.orig/src/racoon/handler.h 2008-01-11 15:12:01.000000000 +0100
670 +++ ipsec-tools-0.7.3/src/racoon/handler.h 2010-03-28 17:07:57.000000000 +0200
671 @@ -41,6 +41,7 @@
672
673 #include "isakmp_var.h"
674 #include "oakley.h"
675 +#include "evt.h"
676
677 /* Phase 1 handler */
678 /*
679 @@ -211,7 +212,7 @@
680 #ifdef ENABLE_HYBRID
681 struct isakmp_cfg_state *mode_cfg; /* ISAKMP mode config state */
682 #endif
683 -
684 + EVT_LISTENER_LIST(evt_listeners);
685 };
686
687 /* Phase 2 handler */
688 @@ -320,6 +321,7 @@
689
690 LIST_ENTRY(ph2handle) chain;
691 LIST_ENTRY(ph2handle) ph1bind; /* chain to ph1handle */
692 + EVT_LISTENER_LIST(evt_listeners);
693 };
694
695 /*
696 Index: ipsec-tools-0.7.3/src/racoon/isakmp_agg.c
697 ===================================================================
698 --- ipsec-tools-0.7.3.orig/src/racoon/isakmp_agg.c 2006-09-30 23:49:37.000000000 +0200
699 +++ ipsec-tools-0.7.3/src/racoon/isakmp_agg.c 2010-03-28 17:07:57.000000000 +0200
700 @@ -587,8 +587,7 @@
701 /* message printed inner oakley_validate_auth() */
702 goto end;
703 }
704 - EVT_PUSH(iph1->local, iph1->remote,
705 - EVTT_PEERPH1AUTH_FAILED, NULL);
706 + evt_phase1(iph1, EVTT_PHASE1_AUTH_FAILED, NULL);
707 isakmp_info_send_n1(iph1, ptype, NULL);
708 goto end;
709 }
710 @@ -1486,8 +1485,7 @@
711 /* message printed inner oakley_validate_auth() */
712 goto end;
713 }
714 - EVT_PUSH(iph1->local, iph1->remote,
715 - EVTT_PEERPH1AUTH_FAILED, NULL);
716 + evt_phase1(iph1, EVTT_PHASE1_AUTH_FAILED, NULL);
717 isakmp_info_send_n1(iph1, ptype, NULL);
718 goto end;
719 }
720 Index: ipsec-tools-0.7.3/src/racoon/isakmp_base.c
721 ===================================================================
722 --- ipsec-tools-0.7.3.orig/src/racoon/isakmp_base.c 2006-10-02 23:51:33.000000000 +0200
723 +++ ipsec-tools-0.7.3/src/racoon/isakmp_base.c 2010-03-28 17:07:57.000000000 +0200
724 @@ -716,8 +716,7 @@
725 /* message printed inner oakley_validate_auth() */
726 goto end;
727 }
728 - EVT_PUSH(iph1->local, iph1->remote,
729 - EVTT_PEERPH1AUTH_FAILED, NULL);
730 + evt_phase1(iph1, EVTT_PHASE1_AUTH_FAILED, NULL);
731 isakmp_info_send_n1(iph1, ptype, NULL);
732 goto end;
733 }
734 @@ -1242,8 +1241,7 @@
735 /* message printed inner oakley_validate_auth() */
736 goto end;
737 }
738 - EVT_PUSH(iph1->local, iph1->remote,
739 - EVTT_PEERPH1AUTH_FAILED, NULL);
740 + evt_phase1(iph1, EVTT_PHASE1_AUTH_FAILED, NULL);
741 isakmp_info_send_n1(iph1, ptype, NULL);
742 goto end;
743 }
744 Index: ipsec-tools-0.7.3/src/racoon/isakmp.c
745 ===================================================================
746 --- ipsec-tools-0.7.3.orig/src/racoon/isakmp.c 2008-09-25 11:34:39.000000000 +0200
747 +++ ipsec-tools-0.7.3/src/racoon/isakmp.c 2010-03-28 17:10:11.000000000 +0200
748 @@ -88,6 +88,9 @@
749 #include "pfkey.h"
750 #include "crypto_openssl.h"
751 #include "policy.h"
752 +#include "algorithm.h"
753 +#include "proposal.h"
754 +#include "sainfo.h"
755 #include "isakmp_ident.h"
756 #include "isakmp_agg.h"
757 #include "isakmp_base.h"
758 @@ -1015,7 +1018,7 @@
759 }
760
761 /* new negotiation of phase 1 for initiator */
762 -int
763 +struct ph1handle *
764 isakmp_ph1begin_i(rmconf, remote, local)
765 struct remoteconf *rmconf;
766 struct sockaddr *remote, *local;
767 @@ -1028,7 +1031,7 @@
768 /* get new entry to isakmp status table. */
769 iph1 = newph1();
770 if (iph1 == NULL)
771 - return -1;
772 + return NULL;
773
774 iph1->status = PHASE1ST_START;
775 iph1->rmconf = rmconf;
776 @@ -1043,7 +1046,7 @@
777 #ifdef ENABLE_HYBRID
778 if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) {
779 delph1(iph1);
780 - return -1;
781 + return NULL;
782 }
783 #endif
784 #ifdef ENABLE_FRAG
785 @@ -1059,7 +1062,7 @@
786 /* XXX copy remote address */
787 if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) {
788 delph1(iph1);
789 - return -1;
790 + return NULL;
791 }
792
793 (void)insph1(iph1);
794 @@ -1095,7 +1098,7 @@
795 remph1(iph1);
796 delph1(iph1);
797
798 - return -1;
799 + return NULL;
800 }
801
802 #ifdef ENABLE_STATS
803 @@ -1106,7 +1109,7 @@
804 timedelta(&start, &end));
805 #endif
806
807 - return 0;
808 + return iph1;
809 }
810
811 /* new negotiation of phase 1 for responder */
812 @@ -1887,8 +1890,7 @@
813 plog(LLV_ERROR, LOCATION, NULL,
814 "phase1 negotiation failed due to time up. %s\n",
815 isakmp_pindex(&iph1->index, iph1->msgid));
816 - EVT_PUSH(iph1->local, iph1->remote,
817 - EVTT_PEER_NO_RESPONSE, NULL);
818 + evt_phase1(iph1, EVTT_PHASE1_NO_RESPONSE, NULL);
819
820 return -1;
821 }
822 @@ -1897,8 +1899,7 @@
823 plog(LLV_ERROR, LOCATION, NULL,
824 "phase1 negotiation failed due to send error. %s\n",
825 isakmp_pindex(&iph1->index, iph1->msgid));
826 - EVT_PUSH(iph1->local, iph1->remote,
827 - EVTT_PEER_NO_RESPONSE, NULL);
828 + evt_phase1(iph1, EVTT_PHASE1_NO_RESPONSE, NULL);
829 return -1;
830 }
831
832 @@ -1947,7 +1948,7 @@
833 plog(LLV_ERROR, LOCATION, NULL,
834 "phase2 negotiation failed due to time up. %s\n",
835 isakmp_pindex(&iph2->ph1->index, iph2->msgid));
836 - EVT_PUSH(iph2->src, iph2->dst, EVTT_PEER_NO_RESPONSE, NULL);
837 + evt_phase2(iph2, EVTT_PHASE2_NO_RESPONSE, NULL);
838 unbindph12(iph2);
839 return -1;
840 }
841 @@ -1956,8 +1957,7 @@
842 plog(LLV_ERROR, LOCATION, NULL,
843 "phase2 negotiation failed due to send error. %s\n",
844 isakmp_pindex(&iph2->ph1->index, iph2->msgid));
845 - EVT_PUSH(iph2->src, iph2->dst, EVTT_PEER_NO_RESPONSE, NULL);
846 -
847 + evt_phase2(iph2, EVTT_PHASE2_NO_RESPONSE, NULL);
848 return -1;
849 }
850
851 @@ -2048,7 +2048,7 @@
852 plog(LLV_INFO, LOCATION, NULL,
853 "ISAKMP-SA deleted %s-%s spi:%s\n",
854 src, dst, isakmp_pindex(&iph1->index, 0));
855 - EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_DOWN, NULL);
856 + evt_phase1(iph1, EVTT_PHASE1_DOWN, NULL);
857 racoon_free(src);
858 racoon_free(dst);
859
860 @@ -2195,7 +2195,7 @@
861 saddrwop2str(iph2->dst));
862
863 /* start phase 1 negotiation as a initiator. */
864 - if (isakmp_ph1begin_i(rmconf, iph2->dst, iph2->src) < 0) {
865 + if (isakmp_ph1begin_i(rmconf, iph2->dst, iph2->src) == NULL) {
866 SCHED_KILL(sc);
867 return -1;
868 }
869 @@ -2228,6 +2228,71 @@
870 return 0;
871 }
872
873 +int
874 +isakmp_get_sainfo(iph2, sp_out, sp_in)
875 + struct ph2handle *iph2;
876 + struct secpolicy *sp_out, *sp_in;
877 +{
878 + int remoteid=0;
879 +
880 + plog(LLV_DEBUG, LOCATION, NULL,
881 + "new acquire %s\n", spidx2str(&sp_out->spidx));
882 +
883 + /* get sainfo */
884 + {
885 + vchar_t *idsrc, *iddst;
886 +
887 + idsrc = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.src,
888 + sp_out->spidx.prefs, sp_out->spidx.ul_proto);
889 + if (idsrc == NULL) {
890 + plog(LLV_ERROR, LOCATION, NULL,
891 + "failed to get ID for %s\n",
892 + spidx2str(&sp_out->spidx));
893 + return -1;
894 + }
895 + iddst = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.dst,
896 + sp_out->spidx.prefd, sp_out->spidx.ul_proto);
897 + if (iddst == NULL) {
898 + plog(LLV_ERROR, LOCATION, NULL,
899 + "failed to get ID for %s\n",
900 + spidx2str(&sp_out->spidx));
901 + vfree(idsrc);
902 + return -1;
903 + }
904 + {
905 + struct remoteconf *conf;
906 + conf = getrmconf(iph2->dst);
907 + if (conf != NULL)
908 + remoteid=conf->ph1id;
909 + else{
910 + plog(LLV_DEBUG, LOCATION, NULL, "Warning: no valid rmconf !\n");
911 + remoteid=0;
912 + }
913 + }
914 + iph2->sainfo = getsainfo(idsrc, iddst, NULL, remoteid);
915 + vfree(idsrc);
916 + vfree(iddst);
917 + if (iph2->sainfo == NULL) {
918 + plog(LLV_ERROR, LOCATION, NULL,
919 + "failed to get sainfo.\n");
920 + return -1;
921 + /* XXX should use the algorithm list from register message */
922 + }
923 +
924 + plog(LLV_DEBUG, LOCATION, NULL,
925 + "selected sainfo: %s\n", sainfo2str(iph2->sainfo));
926 + }
927 +
928 + if (set_proposal_from_policy(iph2, sp_out, sp_in) < 0) {
929 + plog(LLV_ERROR, LOCATION, NULL,
930 + "failed to create saprop.\n");
931 + return -1;
932 + }
933 +
934 + return 0;
935 +}
936 +
937 +
938 /*
939 * receive GETSPI from kernel.
940 */
941 @@ -2931,9 +2996,9 @@
942 src, dst,
943 isakmp_pindex(&iph1->index, 0));
944
945 - EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_UP, NULL);
946 + evt_phase1(iph1, EVTT_PHASE1_UP, NULL);
947 if(!iph1->rmconf->mode_cfg)
948 - EVT_PUSH(iph1->local, iph1->remote, EVTT_NO_ISAKMP_CFG, NULL);
949 + evt_phase1(iph1, EVTT_PHASE1_MODE_CFG, NULL);
950
951 racoon_free(src);
952 racoon_free(dst);
953 Index: ipsec-tools-0.7.3/src/racoon/isakmp_cfg.c
954 ===================================================================
955 --- ipsec-tools-0.7.3.orig/src/racoon/isakmp_cfg.c 2008-11-27 16:25:20.000000000 +0100
956 +++ ipsec-tools-0.7.3/src/racoon/isakmp_cfg.c 2010-03-28 17:07:57.000000000 +0200
957 @@ -473,8 +473,7 @@
958 "Cannot allocate memory: %s\n", strerror(errno));
959 } else {
960 memcpy(buf->v, attrpl + 1, buf->l);
961 - EVT_PUSH(iph1->local, iph1->remote,
962 - EVTT_ISAKMP_CFG_DONE, buf);
963 + evt_phase1(iph1, EVTT_PHASE1_MODE_CFG, buf);
964 vfree(buf);
965 }
966 }
967 Index: ipsec-tools-0.7.3/src/racoon/isakmp_ident.c
968 ===================================================================
969 --- ipsec-tools-0.7.3.orig/src/racoon/isakmp_ident.c 2006-10-02 23:41:59.000000000 +0200
970 +++ ipsec-tools-0.7.3/src/racoon/isakmp_ident.c 2010-03-28 17:07:57.000000000 +0200
971 @@ -788,8 +788,7 @@
972 /* msg printed inner oakley_validate_auth() */
973 goto end;
974 }
975 - EVT_PUSH(iph1->local, iph1->remote,
976 - EVTT_PEERPH1AUTH_FAILED, NULL);
977 + evt_phase1(iph1, EVTT_PHASE1_AUTH_FAILED, NULL);
978 isakmp_info_send_n1(iph1, type, NULL);
979 goto end;
980 }
981 @@ -1537,8 +1536,7 @@
982 /* msg printed inner oakley_validate_auth() */
983 goto end;
984 }
985 - EVT_PUSH(iph1->local, iph1->remote,
986 - EVTT_PEERPH1AUTH_FAILED, NULL);
987 + evt_phase1(iph1, EVTT_PHASE1_AUTH_FAILED, NULL);
988 isakmp_info_send_n1(iph1, type, NULL);
989 goto end;
990 }
991 Index: ipsec-tools-0.7.3/src/racoon/isakmp_inf.c
992 ===================================================================
993 --- ipsec-tools-0.7.3.orig/src/racoon/isakmp_inf.c 2009-05-18 19:07:46.000000000 +0200
994 +++ ipsec-tools-0.7.3/src/racoon/isakmp_inf.c 2010-03-28 17:07:57.000000000 +0200
995 @@ -510,8 +510,7 @@
996 del_ph1=getph1byindex((isakmp_index *)(delete + 1));
997 if(del_ph1 != NULL){
998
999 - EVT_PUSH(del_ph1->local, del_ph1->remote,
1000 - EVTT_PEERPH1_NOPROP, NULL);
1001 + evt_phase1(iph1, EVTT_PHASE1_PEER_DELETED, NULL);
1002 if (del_ph1->scr)
1003 SCHED_KILL(del_ph1->scr);
1004
1005 @@ -532,8 +531,6 @@
1006 delete->spi_size, delete->proto_id);
1007 return 0;
1008 }
1009 - EVT_PUSH(iph1->local, iph1->remote,
1010 - EVTT_PEER_DELETE, NULL);
1011 purge_ipsec_spi(iph1->remote, delete->proto_id,
1012 (u_int32_t *)(delete + 1), num_spi);
1013 break;
1014 @@ -1630,7 +1627,7 @@
1015 "DPD: remote (ISAKMP-SA spi=%s) seems to be dead.\n",
1016 isakmp_pindex(&iph1->index, 0));
1017
1018 - EVT_PUSH(iph1->local, iph1->remote, EVTT_DPD_TIMEOUT, NULL);
1019 + evt_phase1(iph1, EVTT_PHASE1_DPD_TIMEOUT, NULL);
1020 purge_remote(iph1);
1021
1022 /* Do not reschedule here: phase1 is deleted,
1023 Index: ipsec-tools-0.7.3/src/racoon/isakmp_var.h
1024 ===================================================================
1025 --- ipsec-tools-0.7.3.orig/src/racoon/isakmp_var.h 2007-02-20 10:08:49.000000000 +0100
1026 +++ ipsec-tools-0.7.3/src/racoon/isakmp_var.h 2010-03-28 17:07:57.000000000 +0200
1027 @@ -35,6 +35,7 @@
1028 #define _ISAKMP_VAR_H
1029
1030 #include "vmbuf.h"
1031 +#include "policy.h"
1032
1033 #define PORT_ISAKMP 500
1034 #define PORT_ISAKMP_NATT 4500
1035 @@ -62,8 +63,8 @@
1036 struct isakmp_pl_nonce; /* XXX */
1037
1038 extern int isakmp_handler __P((int));
1039 -extern int isakmp_ph1begin_i __P((struct remoteconf *, struct sockaddr *,
1040 - struct sockaddr *));
1041 +extern struct ph1handle *isakmp_ph1begin_i __P((struct remoteconf *,
1042 + struct sockaddr *, struct sockaddr *));
1043
1044 extern vchar_t *isakmp_parsewoh __P((int, struct isakmp_gen *, int));
1045 extern vchar_t *isakmp_parse __P((vchar_t *));
1046 @@ -87,6 +88,7 @@
1047 extern void isakmp_ph2delete_stub __P((void *));
1048 extern void isakmp_ph2delete __P((struct ph2handle *));
1049
1050 +extern int isakmp_get_sainfo __P((struct ph2handle *, struct secpolicy *, struct secpolicy *));
1051 extern int isakmp_post_acquire __P((struct ph2handle *));
1052 extern int isakmp_post_getspi __P((struct ph2handle *));
1053 extern void isakmp_chkph1there_stub __P((void *));
1054 Index: ipsec-tools-0.7.3/src/racoon/isakmp_xauth.c
1055 ===================================================================
1056 --- ipsec-tools-0.7.3.orig/src/racoon/isakmp_xauth.c 2009-04-20 15:35:36.000000000 +0200
1057 +++ ipsec-tools-0.7.3/src/racoon/isakmp_xauth.c 2010-03-28 17:07:57.000000000 +0200
1058 @@ -1568,13 +1568,11 @@
1059 plog(LLV_ERROR, LOCATION, NULL,
1060 "Xauth authentication failed\n");
1061
1062 - EVT_PUSH(iph1->local, iph1->remote,
1063 - EVTT_XAUTH_FAILED, NULL);
1064 + evt_phase1(iph1, EVTT_PHASE1_XAUTH_FAILED, NULL);
1065
1066 iph1->mode_cfg->flags |= ISAKMP_CFG_DELETE_PH1;
1067 } else {
1068 - EVT_PUSH(iph1->local, iph1->remote,
1069 - EVTT_XAUTH_SUCCESS, NULL);
1070 + evt_phase1(iph1, EVTT_PHASE1_XAUTH_SUCCESS, NULL);
1071 }
1072
1073
1074 Index: ipsec-tools-0.7.3/src/racoon/pfkey.c
1075 ===================================================================
1076 --- ipsec-tools-0.7.3.orig/src/racoon/pfkey.c 2008-03-05 23:14:24.000000000 +0100
1077 +++ ipsec-tools-0.7.3/src/racoon/pfkey.c 2010-03-28 17:07:57.000000000 +0200
1078 @@ -92,6 +92,7 @@
1079 #include "algorithm.h"
1080 #include "sainfo.h"
1081 #include "admin.h"
1082 +#include "evt.h"
1083 #include "privsep.h"
1084 #include "strnames.h"
1085 #include "backupsa.h"
1086 @@ -1266,6 +1267,7 @@
1087
1088 /* update status */
1089 iph2->status = PHASE2ST_ESTABLISHED;
1090 + evt_phase2(iph2, EVTT_PHASE2_UP, NULL);
1091
1092 #ifdef ENABLE_STATS
1093 gettimeofday(&iph2->end, NULL);
1094 @@ -1636,7 +1638,6 @@
1095 struct ph2handle *iph2[MAXNESTEDSA];
1096 struct sockaddr *src, *dst;
1097 int n; /* # of phase 2 handler */
1098 - int remoteid=0;
1099 #ifdef HAVE_SECCTX
1100 struct sadb_x_sec_ctx *m_sec_ctx;
1101 #endif /* HAVE_SECCTX */
1102 @@ -1825,63 +1826,11 @@
1103 return -1;
1104 }
1105
1106 - plog(LLV_DEBUG, LOCATION, NULL,
1107 - "new acquire %s\n", spidx2str(&sp_out->spidx));
1108 -
1109 - /* get sainfo */
1110 - {
1111 - vchar_t *idsrc, *iddst;
1112 -
1113 - idsrc = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.src,
1114 - sp_out->spidx.prefs, sp_out->spidx.ul_proto);
1115 - if (idsrc == NULL) {
1116 - plog(LLV_ERROR, LOCATION, NULL,
1117 - "failed to get ID for %s\n",
1118 - spidx2str(&sp_out->spidx));
1119 - delph2(iph2[n]);
1120 - return -1;
1121 - }
1122 - iddst = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.dst,
1123 - sp_out->spidx.prefd, sp_out->spidx.ul_proto);
1124 - if (iddst == NULL) {
1125 - plog(LLV_ERROR, LOCATION, NULL,
1126 - "failed to get ID for %s\n",
1127 - spidx2str(&sp_out->spidx));
1128 - vfree(idsrc);
1129 - delph2(iph2[n]);
1130 - return -1;
1131 - }
1132 - {
1133 - struct remoteconf *conf;
1134 - conf = getrmconf(iph2[n]->dst);
1135 - if (conf != NULL)
1136 - remoteid=conf->ph1id;
1137 - else{
1138 - plog(LLV_DEBUG, LOCATION, NULL, "Warning: no valid rmconf !\n");
1139 - remoteid=0;
1140 - }
1141 - }
1142 - iph2[n]->sainfo = getsainfo(idsrc, iddst, NULL, remoteid);
1143 - vfree(idsrc);
1144 - vfree(iddst);
1145 - if (iph2[n]->sainfo == NULL) {
1146 - plog(LLV_ERROR, LOCATION, NULL,
1147 - "failed to get sainfo.\n");
1148 + if (isakmp_get_sainfo(iph2[n], sp_out, sp_in) < 0) {
1149 delph2(iph2[n]);
1150 return -1;
1151 - /* XXX should use the algorithm list from register message */
1152 }
1153
1154 - plog(LLV_DEBUG, LOCATION, NULL,
1155 - "selected sainfo: %s\n", sainfo2str(iph2[n]->sainfo));
1156 - }
1157 -
1158 - if (set_proposal_from_policy(iph2[n], sp_out, sp_in) < 0) {
1159 - plog(LLV_ERROR, LOCATION, NULL,
1160 - "failed to create saprop.\n");
1161 - delph2(iph2[n]);
1162 - return -1;
1163 - }
1164 #ifdef HAVE_SECCTX
1165 if (m_sec_ctx) {
1166 set_secctx_in_proposal(iph2[n], spidx);
1167 Index: ipsec-tools-0.7.3/src/racoon/racoonctl.c
1168 ===================================================================
1169 --- ipsec-tools-0.7.3.orig/src/racoon/racoonctl.c 2009-04-20 15:32:57.000000000 +0200
1170 +++ ipsec-tools-0.7.3/src/racoon/racoonctl.c 2010-03-28 17:07:57.000000000 +0200
1171 @@ -135,26 +135,24 @@
1172 struct evtmsg {
1173 int type;
1174 char *msg;
1175 - enum { UNSPEC, ERROR, INFO } level;
1176 } evtmsg[] = {
1177 - { EVTT_PHASE1_UP, "Phase 1 established", INFO },
1178 - { EVTT_PHASE1_DOWN, "Phase 1 deleted", INFO },
1179 - { EVTT_XAUTH_SUCCESS, "Xauth exchange passed", INFO },
1180 - { EVTT_ISAKMP_CFG_DONE, "ISAKMP mode config done", INFO },
1181 - { EVTT_PHASE2_UP, "Phase 2 established", INFO },
1182 - { EVTT_PHASE2_DOWN, "Phase 2 deleted", INFO },
1183 - { EVTT_DPD_TIMEOUT, "Peer not reachable anymore", ERROR },
1184 - { EVTT_PEER_NO_RESPONSE, "Peer not responding", ERROR },
1185 - { EVTT_PEER_DELETE, "Peer terminated security association", ERROR },
1186 - { EVTT_RACOON_QUIT, "Raccon terminated", ERROR },
1187 - { EVTT_OVERFLOW, "Event queue overflow", ERROR },
1188 - { EVTT_XAUTH_FAILED, "Xauth exchange failed", ERROR },
1189 - { EVTT_PEERPH1AUTH_FAILED, "Peer failed phase 1 authentication "
1190 - "(certificate problem?)", ERROR },
1191 - { EVTT_PEERPH1_NOPROP, "Peer failed phase 1 initiation "
1192 - "(proposal problem?)", ERROR },
1193 - { 0, NULL, UNSPEC },
1194 - { EVTT_NO_ISAKMP_CFG, "No need for ISAKMP mode config ", INFO },
1195 + { EVTT_RACOON_QUIT, "Racoon terminated" },
1196 +
1197 + { EVTT_PHASE1_UP, "Phase 1 established" },
1198 + { EVTT_PHASE1_DOWN, "Phase 1 deleted" },
1199 + { EVTT_PHASE1_NO_RESPONSE, "Phase 1 error: peer not responding" },
1200 + { EVTT_PHASE1_NO_PROPOSAL, "Phase 1 error: no proposal chosen" },
1201 + { EVTT_PHASE1_AUTH_FAILED,
1202 + "Phase 1 error: authentication failed (bad certificate?)" },
1203 + { EVTT_PHASE1_DPD_TIMEOUT, "Phase 1 error: dead peer detected" },
1204 + { EVTT_PHASE1_MODE_CFG, "Phase 1 mode configuration done" },
1205 + { EVTT_PHASE1_XAUTH_SUCCESS, "Phase 1 Xauth succeeded" },
1206 + { EVTT_PHASE1_XAUTH_FAILED, "Phase 1 Xauth failed" },
1207 +
1208 + { EVTT_PHASE2_NO_PHASE1, "Phase 2 error: no suitable phase 1" },
1209 + { EVTT_PHASE2_UP, "Phase 2 established" },
1210 + { EVTT_PHASE2_DOWN, "Phase 2 deleted" },
1211 + { EVTT_PHASE2_NO_RESPONSE, "Phase 2 error: no response" },
1212 };
1213
1214 static int get_proto __P((char *));
1215 @@ -184,6 +182,7 @@
1216 { IPPROTO_ICMP, "icmp" },
1217 { IPPROTO_TCP, "tcp" },
1218 { IPPROTO_UDP, "udp" },
1219 + { IPPROTO_GRE, "gre" },
1220 { 0, NULL },
1221 };
1222
1223 @@ -193,31 +192,13 @@
1224
1225 char *pname;
1226 int long_format = 0;
1227 -
1228 -#define EVTF_NONE 0x0000 /* Ignore any events */
1229 -#define EVTF_LOOP 0x0001 /* Loop awaiting for new events */
1230 -#define EVTF_CFG_STOP 0x0002 /* Stop after ISAKMP mode config */
1231 -#define EVTF_CFG 0x0004 /* Print ISAKMP mode config info */
1232 -#define EVTF_ALL 0x0008 /* Print any events */
1233 -#define EVTF_PURGE 0x0010 /* Print all available events */
1234 -#define EVTF_PH1DOWN_STOP 0x0020 /* Stop when phase 1 SA gets down */
1235 -#define EVTF_PH1DOWN 0x0040 /* Print that phase 1 SA got down */
1236 -#define EVTF_ERR 0x0080 /* Print any error */
1237 -#define EVTF_ERR_STOP 0x0100 /* Stop on any error */
1238 -
1239 -int evt_filter = EVTF_NONE;
1240 -time_t evt_start;
1241 +int evt_quit_event = 0;
1242
1243 void dump_isakmp_sa __P((char *, int));
1244 void dump_internal __P((char *, int));
1245 char *pindex_isakmp __P((isakmp_index *));
1246 void print_schedule __P((caddr_t, int));
1247 -void print_evt __P((caddr_t, int));
1248 -void print_cfg __P((caddr_t, int));
1249 -void print_err __P((caddr_t, int));
1250 -void print_ph1down __P((caddr_t, int));
1251 -void print_ph1up __P((caddr_t, int));
1252 -int evt_poll __P((void));
1253 +void print_evt __P((struct evt_common *));
1254 char * fixed_addr __P((char *, char *, int));
1255
1256 static void
1257 @@ -226,13 +207,15 @@
1258 printf(
1259 "Usage:\n"
1260 " %s reload-config\n"
1261 +" %s show-schedule\n"
1262 " %s [-l [-l]] show-sa [protocol]\n"
1263 " %s flush-sa [protocol]\n"
1264 " %s delete-sa <saopts>\n"
1265 -" %s establish-sa [-u identity] <saopts>\n"
1266 +" %s establish-sa [-u identity] [-w] <saopts>\n"
1267 " %s vpn-connect [-u identity] vpn_gateway\n"
1268 " %s vpn-disconnect vpn_gateway\n"
1269 -"\n"
1270 +" %s show-event\n"
1271 +" %s logout-user login\n""\n"
1272 " <protocol>: \"isakmp\", \"esp\" or \"ah\".\n"
1273 " In the case of \"show-sa\" or \"flush-sa\", you can use \"ipsec\".\n"
1274 "\n"
1275 @@ -240,8 +223,8 @@
1276 " : {\"esp\",\"ah\"} <family> <src/prefixlen/port> <dst/prefixlen/port>\n"
1277 " <ul_proto>\n"
1278 " <family>: \"inet\" or \"inet6\"\n"
1279 -" <ul_proto>: \"icmp\", \"tcp\", \"udp\" or \"any\"\n",
1280 - pname, pname, pname, pname, pname, pname, pname);
1281 +" <ul_proto>: \"icmp\", \"tcp\", \"udp\", \"gre\" or \"any\"\n",
1282 + pname, pname, pname, pname, pname, pname, pname, pname, pname, pname);
1283 }
1284
1285 /*
1286 @@ -312,53 +295,24 @@
1287
1288 vfree(combuf);
1289
1290 - if (com_recv(&combuf) != 0)
1291 - goto bad;
1292 - if (handle_recv(combuf) != 0)
1293 - goto bad;
1294 -
1295 - vfree(combuf);
1296 + do {
1297 + if (com_recv(&combuf) != 0)
1298 + goto bad;
1299 + if (handle_recv(combuf) != 0)
1300 + goto bad;
1301 + vfree(combuf);
1302 + } while (evt_quit_event != 0);
1303
1304 - if (evt_filter != EVTF_NONE)
1305 - if (evt_poll() != 0)
1306 - goto bad;
1307 -
1308 + close(so);
1309 exit(0);
1310
1311 - bad:
1312 +bad:
1313 + close(so);
1314 + if (errno == EEXIST)
1315 + exit(0);
1316 exit(1);
1317 }
1318
1319 -int
1320 -evt_poll(void) {
1321 - struct timeval tv;
1322 - vchar_t *recvbuf;
1323 - vchar_t *sendbuf;
1324 -
1325 - if ((sendbuf = f_getevt(0, NULL)) == NULL)
1326 - errx(1, "Cannot make combuf");
1327 -
1328 -
1329 - while (evt_filter & (EVTF_LOOP|EVTF_PURGE)) {
1330 - /* handle_recv closes the socket time, so open it each time */
1331 - com_init();
1332 -
1333 - if (com_send(sendbuf) != 0)
1334 - errx(1, "Cannot send combuf");
1335 -
1336 - if (com_recv(&recvbuf) == 0) {
1337 - handle_recv(recvbuf);
1338 - vfree(recvbuf);
1339 - }
1340 -
1341 - tv.tv_sec = 0;
1342 - tv.tv_usec = 10;
1343 - (void)select(0, NULL, NULL, NULL, &tv);
1344 - }
1345 -
1346 - vfree(sendbuf);
1347 - return 0;
1348 -}
1349
1350 /* %%% */
1351 /*
1352 @@ -422,20 +376,8 @@
1353 vchar_t *buf;
1354 struct admin_com *head;
1355
1356 - /*
1357 - * There are 3 ways of getting here
1358 - * 1) racoonctl vc => evt_filter = (EVTF_LOOP|EVTF_CFG| ... )
1359 - * 2) racoonctl es => evt_filter = EVTF_NONE
1360 - * 3) racoonctl es -l => evt_filter = EVTF_LOOP
1361 - * Catch the second case: show-event is here to purge all
1362 - */
1363 - if (evt_filter == EVTF_NONE)
1364 - evt_filter = (EVTF_ALL|EVTF_PURGE);
1365 -
1366 - if ((ac >= 1) && (strcmp(av[0], "-l") == 0))
1367 - evt_filter |= EVTF_LOOP;
1368 -
1369 - if (ac >= 2)
1370 + evt_quit_event = -1;
1371 + if (ac >= 1)
1372 errx(1, "too many arguments");
1373
1374 buf = vmalloc(sizeof(*head));
1375 @@ -653,6 +595,7 @@
1376 char *id = NULL;
1377 char *key = NULL;
1378 struct admin_com_psk *acp;
1379 + int wait = 0;
1380
1381 if (ac < 1)
1382 errx(1, "insufficient arguments");
1383 @@ -673,6 +616,12 @@
1384 ac -= 2;
1385 }
1386
1387 + if (ac >= 1 && strcmp(av[0], "-w") == 0) {
1388 + wait = 1;
1389 + av++;
1390 + ac--;
1391 + }
1392 +
1393 /* need protocol */
1394 if (ac < 1)
1395 errx(1, "insufficient arguments");
1396 @@ -687,12 +636,16 @@
1397 index = get_index(ac, av);
1398 if (index == NULL)
1399 return NULL;
1400 + if (wait)
1401 + evt_quit_event = EVTT_PHASE1_MODE_CFG;
1402 break;
1403 case ADMIN_PROTO_AH:
1404 case ADMIN_PROTO_ESP:
1405 index = get_index(ac, av);
1406 if (index == NULL)
1407 return NULL;
1408 + if (wait)
1409 + evt_quit_event = EVTT_PHASE2_UP;
1410 break;
1411 default:
1412 errno = EPROTONOSUPPORT;
1413 @@ -749,8 +702,7 @@
1414 if (ac < 1)
1415 errx(1, "insufficient arguments");
1416
1417 - evt_filter = (EVTF_LOOP|EVTF_CFG|EVTF_CFG_STOP|EVTF_ERR|EVTF_ERR_STOP);
1418 - time(&evt_start);
1419 + evt_quit_event = EVTT_PHASE1_MODE_CFG;
1420
1421 /* Optional -u identity */
1422 if (strcmp(av[0], "-u") == 0) {
1423 @@ -814,8 +766,7 @@
1424 if (ac > 1)
1425 warnx("Extra arguments");
1426
1427 - evt_filter =
1428 - (EVTF_PH1DOWN|EVTF_PH1DOWN_STOP|EVTF_LOOP|EVTF_ERR|EVTF_ERR_STOP);
1429 + evt_quit_event = EVTT_PHASE1_DOWN;
1430
1431 nav[nac++] = isakmp;
1432 nav[nac++] = inet;
1433 @@ -1337,84 +1288,32 @@
1434
1435
1436 void
1437 -print_evt(buf, len)
1438 - caddr_t buf;
1439 - int len;
1440 +print_evt(evtdump)
1441 + struct evt_common *evtdump;
1442 {
1443 - struct evtdump *evtdump = (struct evtdump *)buf;
1444 int i;
1445 char *srcstr;
1446 char *dststr;
1447
1448 - for (i = 0; evtmsg[i].msg; i++)
1449 - if (evtmsg[i].type == evtdump->type)
1450 - break;
1451 -
1452 - if (evtmsg[i].msg == NULL)
1453 - printf("Event %d: ", evtdump->type);
1454 + for (i = 0; i < sizeof(evtmsg) / sizeof(evtmsg[0]); i++)
1455 + if (evtmsg[i].type == evtdump->ec_type)
1456 + break;
1457 +
1458 + if (evtmsg[i].msg == NULL)
1459 + printf("Event %d: ", evtdump->ec_type);
1460 else
1461 printf("%s : ", evtmsg[i].msg);
1462
1463 - if ((srcstr = saddr2str((struct sockaddr *)&evtdump->src)) == NULL)
1464 + if ((srcstr = saddr2str((struct sockaddr *)&evtdump->ec_ph1src)) == NULL)
1465 printf("unknown");
1466 else
1467 printf("%s", srcstr);
1468 printf(" -> ");
1469 - if ((dststr = saddr2str((struct sockaddr *)&evtdump->dst)) == NULL)
1470 + if ((dststr = saddr2str((struct sockaddr *)&evtdump->ec_ph1dst)) == NULL)
1471 printf("unknown");
1472 else
1473 printf("%s", dststr);
1474 printf("\n");
1475 -
1476 - return;
1477 -}
1478 -
1479 -void
1480 -print_err(buf, len)
1481 - caddr_t buf;
1482 - int len;
1483 -{
1484 - struct evtdump *evtdump = (struct evtdump *)buf;
1485 - int i;
1486 -
1487 -
1488 - for (i = 0; evtmsg[i].msg; i++)
1489 - if (evtmsg[i].type == evtdump->type)
1490 - break;
1491 -
1492 - if (evtmsg[i].level != ERROR)
1493 - return;
1494 -
1495 - if (evtmsg[i].msg == NULL)
1496 - printf("Error: Event %d\n", evtdump->type);
1497 - else
1498 - printf("Error: %s\n", evtmsg[i].msg);
1499 -
1500 - if (evt_filter & EVTF_ERR_STOP)
1501 - evt_filter &= ~EVTF_LOOP;
1502 -
1503 - return;
1504 -}
1505 -
1506 -/*
1507 - * Print a message when phase 1 SA goes down
1508 - */
1509 -void
1510 -print_ph1down(buf, len)
1511 - caddr_t buf;
1512 - int len;
1513 -{
1514 - struct evtdump *evtdump = (struct evtdump *)buf;
1515 -
1516 - if (evtdump->type != EVTT_PHASE1_DOWN)
1517 - return;
1518 -
1519 - printf("VPN connexion terminated\n");
1520 -
1521 - if (evt_filter & EVTF_PH1DOWN_STOP)
1522 - evt_filter &= ~EVTF_LOOP;
1523 -
1524 - return;
1525 }
1526
1527 /*
1528 @@ -1425,15 +1324,14 @@
1529 caddr_t buf;
1530 int len;
1531 {
1532 - struct evtdump *evtdump = (struct evtdump *)buf;
1533 + struct evt_common *evtdump = (struct evt_common *)buf;
1534 struct isakmp_data *attr;
1535 char *banner = NULL;
1536 struct in_addr addr4;
1537
1538 memset(&addr4, 0, sizeof(addr4));
1539
1540 - if (evtdump->type != EVTT_ISAKMP_CFG_DONE &&
1541 - evtdump->type != EVTT_NO_ISAKMP_CFG)
1542 + if (evtdump->ec_type != EVTT_PHASE1_MODE_CFG)
1543 return;
1544
1545 len -= sizeof(*evtdump);
1546 @@ -1487,7 +1385,7 @@
1547 }
1548 }
1549
1550 - if (evtdump->type == EVTT_ISAKMP_CFG_DONE)
1551 + if (len > 0)
1552 printf("Bound to address %s\n", inet_ntoa(addr4));
1553 else
1554 printf("VPN connexion established\n");
1555 @@ -1508,11 +1406,6 @@
1556 printf("\n");
1557 racoon_free(banner);
1558 }
1559 -
1560 - if (evt_filter & EVTF_CFG_STOP)
1561 - evt_filter &= ~EVTF_LOOP;
1562 -
1563 - return;
1564 }
1565
1566
1567 @@ -1563,32 +1456,28 @@
1568 break;
1569
1570 case ADMIN_SHOW_EVT: {
1571 - struct evtdump *evtdump;
1572 + struct evt_common *ec;
1573
1574 - /* We got no event */
1575 - if (len == 0) {
1576 - /* If we were purging the queue, it is now done */
1577 - if (evt_filter & EVTF_PURGE)
1578 - evt_filter &= ~EVTF_PURGE;
1579 + /* We got no event? */
1580 + if (len == 0)
1581 break;
1582 - }
1583 + if (len < sizeof(struct evt_common))
1584 + errx(1, "Short buffer\n");
1585
1586 - if (len < sizeof(struct evtdump))
1587 - errx(1, "Short buffer\n");
1588 -
1589 - /* Toss outdated events */
1590 - evtdump = (struct evtdump *)buf;
1591 - if (evtdump->timestamp < evt_start)
1592 - break;
1593 -
1594 - if (evt_filter & EVTF_ALL)
1595 - print_evt(buf, len);
1596 - if (evt_filter & EVTF_ERR)
1597 - print_err(buf, len);
1598 - if (evt_filter & EVTF_CFG)
1599 - print_cfg(buf, len);
1600 - if (evt_filter & EVTF_PH1DOWN)
1601 - print_ph1down(buf, len);
1602 + ec = (struct evt_common *) buf;
1603 + if (evt_quit_event <= 0)
1604 + print_evt(ec);
1605 + else if (evt_quit_event == ec->ec_type) {
1606 + switch (ec->ec_type) {
1607 + case EVTT_PHASE1_MODE_CFG:
1608 + print_cfg(ec, len);
1609 + break;
1610 + default:
1611 + print_evt(ec);
1612 + break;
1613 + };
1614 + evt_quit_event = 0;
1615 + }
1616 break;
1617 }
1618
1619 @@ -1645,10 +1534,8 @@
1620 break;
1621 }
1622
1623 - close(so);
1624 return 0;
1625
1626 - bad:
1627 - close(so);
1628 +bad:
1629 return -1;
1630 }
1631 Index: ipsec-tools-0.7.3/src/racoon/session.c
1632 ===================================================================
1633 --- ipsec-tools-0.7.3.orig/src/racoon/session.c 2007-08-01 13:52:22.000000000 +0200
1634 +++ ipsec-tools-0.7.3/src/racoon/session.c 2010-03-28 17:07:57.000000000 +0200
1635 @@ -192,6 +192,7 @@
1636 /* scheduling */
1637 timeout = schedular();
1638
1639 + nfds = evt_get_fdmask(nfds, &rfds);
1640 error = select(nfds, &rfds, (fd_set *)0, (fd_set *)0, timeout);
1641 if (error < 0) {
1642 switch (errno) {
1643 @@ -211,6 +212,7 @@
1644 (FD_ISSET(lcconf->sock_admin, &rfds)))
1645 admin_handler();
1646 #endif
1647 + evt_handle_fdmask(&rfds);
1648
1649 for (p = lcconf->myaddrs; p; p = p->next) {
1650 if (!p->addr)
1651 @@ -451,7 +453,7 @@
1652 case SIGTERM:
1653 plog(LLV_INFO, LOCATION, NULL,
1654 "caught signal %d\n", sig);
1655 - EVT_PUSH(NULL, NULL, EVTT_RACOON_QUIT, NULL);
1656 + evt_generic(EVTT_RACOON_QUIT, NULL);
1657 pfkey_send_flush(lcconf->sock_pfkey,
1658 SADB_SATYPE_UNSPEC);
1659 #ifdef ENABLE_FASTQUIT