[svn-upgrade] Integrating new upstream version, strongswan (4.3.6)

1 files changed, 79 insertions, 63 deletions

diff --git a/src/charon/plugins/stroke/stroke_config.c b/src/charon/plugins/stroke/stroke_config.c
index 0b6a4ac31..0752f3c93 100644
--- a/src/charon/plugins/stroke/stroke_config.c
+++ b/src/charon/plugins/stroke/stroke_config.c
@@ -16,7 +16,7 @@
 #include "stroke_config.h"
 
 #include <daemon.h>
-#include <utils/mutex.h>
+#include <threading/mutex.h>
 #include <utils/lexparser.h>
 
 typedef struct private_stroke_config_t private_stroke_config_t;
@@ -30,22 +30,22 @@ struct private_stroke_config_t {
 	 * public functions
 	 */
 	stroke_config_t public;
-	
+
 	/**
 	 * list of peer_cfg_t
 	 */
 	linked_list_t *list;
-	
+
 	/**
 	 * mutex to lock config list
 	 */
 	mutex_t *mutex;
-	
+
 	/**
 	 * ca sections
 	 */
 	stroke_ca_t *ca;
-	
+
 	/**
 	 * credentials
 	 */
@@ -93,7 +93,7 @@ static peer_cfg_t *get_peer_cfg_by_name(private_stroke_config_t *this, char *nam
 	enumerator_t *e1, *e2;
 	peer_cfg_t *current, *found = NULL;
 	child_cfg_t *child;
-	
+
 	this->mutex->lock(this->mutex);
 	e1 = this->list->create_enumerator(this->list);
 	while (e1->enumerate(e1, &current))
@@ -139,7 +139,7 @@ static void add_proposals(private_stroke_config_t *this, char *string,
 		char *strict;
 		proposal_t *proposal;
 		protocol_id_t proto = PROTO_ESP;
-		
+
 		if (ike_cfg)
 		{
 			proto = PROTO_IKE;
@@ -195,7 +195,7 @@ static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg
 	ike_cfg_t *ike_cfg;
 	char *interface;
 	host_t *host;
-	
+
 	host = host_create_from_dns(msg->add_conn.other.address, 0, 0);
 	if (host)
 	{
@@ -227,7 +227,7 @@ static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg
 				{
 					free(interface);
 				}
-				
+
 			}
 		}
 	}
@@ -236,7 +236,7 @@ static ike_cfg_t *build_ike_cfg(private_stroke_config_t *this, stroke_msg_t *msg
 							 msg->add_conn.me.address,
 							 msg->add_conn.other.address);
 	add_proposals(this, msg->add_conn.algorithms.ike, ike_cfg, NULL);
-	return ike_cfg;					 
+	return ike_cfg;
 }
 
 /**
@@ -275,7 +275,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 	stroke_end_t *end, *other_end;
 	auth_cfg_t *cfg;
 	char eap_buf[32];
-	
+
 	/* select strings */
 	if (local)
 	{
@@ -317,7 +317,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 			ca = other_end->ca2;
 		}
 	}
-	
+
 	if (!auth)
 	{
 		if (primary)
@@ -366,9 +366,9 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 			return NULL;
 		}
 	}
-	
+
 	cfg = auth_cfg_create();
-	
+
 	/* add identity and peer certifcate */
 	identity = identification_create_from_string(id);
 	if (cert)
@@ -380,12 +380,12 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 			{
 				this->ca->check_for_hash_and_url(this->ca, certificate);
 			}
-			cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate); 
+			cfg->add(cfg, AUTH_RULE_SUBJECT_CERT, certificate);
 			if (identity->get_type(identity) == ID_ANY ||
 				!certificate->has_subject(certificate, identity))
 			{
-				DBG1(DBG_CFG, "  peerid %Y not confirmed by certificate, "
-					 "defaulting to subject DN: %Y", identity,
+				DBG1(DBG_CFG, "  id '%Y' not confirmed by certificate, "
+					 "defaulting to '%Y'", identity,
 					 certificate->get_subject(certificate));
 				identity->destroy(identity);
 				identity = certificate->get_subject(certificate);
@@ -394,7 +394,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 		}
 	}
 	cfg->add(cfg, AUTH_RULE_IDENTITY, identity);
-	
+
 	/* CA constraint */
 	if (ca)
 	{
@@ -412,13 +412,13 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 				 "constraint", ca);
 		}
 	}
-	
+
 	/* AC groups */
 	if (end->groups)
 	{
 		enumerator_t *enumerator;
 		char *group;
-		
+
 		enumerator = enumerator_create_token(end->groups, ",", " ");
 		while (enumerator->enumerate(enumerator, &group))
 		{
@@ -428,7 +428,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 		}
 		enumerator->destroy(enumerator);
 	}
-	
+
 	/* authentication metod (class, actually) */
 	if (streq(auth, "pubkey") ||
 		streq(auth, "rsasig") || streq(auth, "rsa") ||
@@ -446,9 +446,9 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 		enumerator_t *enumerator;
 		char *str;
 		int i = 0, type = 0, vendor;
-		
+
 		cfg->add(cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
-		
+
 		/* parse EAP string, format: eap[-type[-vendor]] */
 		enumerator = enumerator_create_token(auth, "-", " ");
 		while (enumerator->enumerate(enumerator, &str))
@@ -488,7 +488,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 			i++;
 		}
 		enumerator->destroy(enumerator);
-		
+
 		if (msg->add_conn.eap_identity)
 		{
 			if (streq(msg->add_conn.eap_identity, "%identity"))
@@ -529,37 +529,36 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 	u_int32_t rekey = 0, reauth = 0, over, jitter;
 	peer_cfg_t *peer_cfg;
 	auth_cfg_t *auth_cfg;
-	
+
 #ifdef ME
 	if (msg->add_conn.ikeme.mediation && msg->add_conn.ikeme.mediated_by)
 	{
-		DBG1(DBG_CFG, "a mediation connection cannot be a"
-				" mediated connection at the same time, aborting");
+		DBG1(DBG_CFG, "a mediation connection cannot be a mediated connection "
+			 "at the same time, aborting");
 		return NULL;
 	}
-	
+
 	if (msg->add_conn.ikeme.mediation)
 	{
 		/* force unique connections for mediation connections */
 		msg->add_conn.unique = 1;
 	}
-	
+
 	if (msg->add_conn.ikeme.mediated_by)
 	{
 		mediated_by = charon->backends->get_peer_cfg_by_name(charon->backends,
-												msg->add_conn.ikeme.mediated_by);
+											msg->add_conn.ikeme.mediated_by);
 		if (!mediated_by)
 		{
 			DBG1(DBG_CFG, "mediation connection '%s' not found, aborting",
 				 msg->add_conn.ikeme.mediated_by);
 			return NULL;
 		}
-		
 		if (!mediated_by->is_mediation(mediated_by))
 		{
-			DBG1(DBG_CFG, "connection '%s' as referred to by '%s' is"
-				 "no mediation connection, aborting", 
-				msg->add_conn.ikeme.mediated_by, msg->add_conn.name);
+			DBG1(DBG_CFG, "connection '%s' as referred to by '%s' is "
+				 "no mediation connection, aborting",
+				 msg->add_conn.ikeme.mediated_by, msg->add_conn.name);
 			mediated_by->destroy(mediated_by);
 			return NULL;
 		}
@@ -573,7 +572,7 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 		}
 	}
 #endif /* ME */
-	
+
 	jitter = msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100;
 	over = msg->add_conn.rekey.margin;
 	if (msg->add_conn.rekey.reauth)
@@ -583,8 +582,8 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 	else
 	{
 		rekey = msg->add_conn.rekey.ike_lifetime - over;
-	}	
-	if (msg->add_conn.me.sourceip_size)
+	}
+	if (msg->add_conn.me.sourceip_mask)
 	{
 		if (msg->add_conn.me.sourceip)
 		{
@@ -633,19 +632,19 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 	{	/* dpdaction=none disables DPD */
 		msg->add_conn.dpd.delay = 0;
 	}
-	
+
 	/* other.sourceip is managed in stroke_attributes. If it is set, we define
 	 * the pool name as the connection name, which the attribute provider
 	 * uses to serve pool addresses. */
 	peer_cfg = peer_cfg_create(msg->add_conn.name,
 		msg->add_conn.ikev2 ? 2 : 1, ike_cfg,
-		msg->add_conn.me.sendcert, unique, 
+		msg->add_conn.me.sendcert, unique,
 		msg->add_conn.rekey.tries, rekey, reauth, jitter, over,
 		msg->add_conn.mobike, msg->add_conn.dpd.delay,
-		vip, msg->add_conn.other.sourceip_size ?
+		vip, msg->add_conn.other.sourceip_mask ?
 							msg->add_conn.name : msg->add_conn.other.sourceip,
 		msg->add_conn.ikeme.mediation, mediated_by, peer_id);
-	
+
 	/* build leftauth= */
 	auth_cfg = build_auth_cfg(this, msg, TRUE, TRUE);
 	if (auth_cfg)
@@ -685,7 +684,7 @@ static void add_ts(private_stroke_config_t *this,
 				   stroke_end_t *end, child_cfg_t *child_cfg, bool local)
 {
 	traffic_selector_t *ts;
-	
+
 	if (end->tohost)
 	{
 		ts = traffic_selector_create_dynamic(end->protocol,
@@ -695,7 +694,7 @@ static void add_ts(private_stroke_config_t *this,
 	else
 	{
 		host_t *net;
-		
+
 		if (!end->subnets)
 		{
 			net = host_create_from_string(end->address, IKEV2_UDP_PORT);
@@ -709,12 +708,12 @@ static void add_ts(private_stroke_config_t *this,
 		else
 		{
 			char *del, *start, *bits;
-			
+
 			start = end->subnets;
 			do
 			{
 				int intbits = 0;
-				
+
 				del = strchr(start, ',');
 				if (del)
 				{
@@ -726,7 +725,7 @@ static void add_ts(private_stroke_config_t *this,
 					*bits = '\0';
 					intbits = atoi(bits + 1);
 				}
-				
+
 				net = host_create_from_string(start, IKEV2_UDP_PORT);
 				if (net)
 				{
@@ -753,7 +752,24 @@ static child_cfg_t *build_child_cfg(private_stroke_config_t *this,
 {
 	child_cfg_t *child_cfg;
 	action_t dpd;
-	
+	lifetime_cfg_t lifetime = {
+		.time = {
+			.life = msg->add_conn.rekey.ipsec_lifetime,
+			.rekey = msg->add_conn.rekey.ipsec_lifetime - msg->add_conn.rekey.margin,
+			.jitter = msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100
+		},
+		.bytes = {
+			.life = msg->add_conn.rekey.life_bytes,
+			.rekey = msg->add_conn.rekey.life_bytes - msg->add_conn.rekey.margin_bytes,
+			.jitter = msg->add_conn.rekey.margin_bytes * msg->add_conn.rekey.fuzz / 100
+		},
+		.packets = {
+			.life = msg->add_conn.rekey.life_packets,
+			.rekey = msg->add_conn.rekey.life_packets - msg->add_conn.rekey.margin_packets,
+			.jitter = msg->add_conn.rekey.margin_packets * msg->add_conn.rekey.fuzz / 100
+		}
+	};
+
 	switch (msg->add_conn.dpd.action)
 	{	/* map startes magic values to our action type */
 		case 2: /* =hold */
@@ -766,19 +782,19 @@ static child_cfg_t *build_child_cfg(private_stroke_config_t *this,
 			dpd = ACTION_NONE;
 			break;
 	}
+
 	child_cfg = child_cfg_create(
-				msg->add_conn.name, msg->add_conn.rekey.ipsec_lifetime,
-				msg->add_conn.rekey.ipsec_lifetime - msg->add_conn.rekey.margin,
-				msg->add_conn.rekey.margin * msg->add_conn.rekey.fuzz / 100, 
+				msg->add_conn.name, &lifetime,
 				msg->add_conn.me.updown, msg->add_conn.me.hostaccess,
-				msg->add_conn.mode, dpd, dpd, msg->add_conn.ipcomp);
+				msg->add_conn.mode, dpd, dpd, msg->add_conn.ipcomp,
+				msg->add_conn.inactivity);
 	child_cfg->set_mipv6_options(child_cfg, msg->add_conn.proxy_mode,
 											msg->add_conn.install_policy);
 	add_ts(this, &msg->add_conn.me, child_cfg, TRUE);
 	add_ts(this, &msg->add_conn.other, child_cfg, FALSE);
-	
+
 	add_proposals(this, msg->add_conn.algorithms.esp, NULL, child_cfg);
-	
+
 	return child_cfg;
 }
 
@@ -804,7 +820,7 @@ static void add(private_stroke_config_t *this, stroke_msg_t *msg)
 		ike_cfg->destroy(ike_cfg);
 		return;
 	}
-	
+
 	enumerator = create_peer_cfg_enumerator(this, NULL, NULL);
 	while (enumerator->enumerate(enumerator, &existing))
 	{
@@ -822,7 +838,7 @@ static void add(private_stroke_config_t *this, stroke_msg_t *msg)
 		}
 	}
 	enumerator->destroy(enumerator);
-	
+
 	child_cfg = build_child_cfg(this, msg);
 	if (!child_cfg)
 	{
@@ -830,7 +846,7 @@ static void add(private_stroke_config_t *this, stroke_msg_t *msg)
 		return;
 	}
 	peer_cfg->add_child_cfg(peer_cfg, child_cfg);
-	
+
 	if (use_existing)
 	{
 		peer_cfg->destroy(peer_cfg);
@@ -854,13 +870,13 @@ static void del(private_stroke_config_t *this, stroke_msg_t *msg)
 	peer_cfg_t *peer;
 	child_cfg_t *child;
 	bool deleted = FALSE;
-	
+
 	this->mutex->lock(this->mutex);
 	enumerator = this->list->create_enumerator(this->list);
 	while (enumerator->enumerate(enumerator, (void**)&peer))
 	{
 		bool keep = FALSE;
-		
+
 		/* remove any child with such a name */
 		children = peer->create_child_cfg_enumerator(peer);
 		while (children->enumerate(children, &child))
@@ -877,7 +893,7 @@ static void del(private_stroke_config_t *this, stroke_msg_t *msg)
 			}
 		}
 		children->destroy(children);
-		
+
 		/* if peer config matches, or has no children anymore, remove it */
 		if (!keep || streq(peer->get_name(peer), msg->del_conn.name))
 		{
@@ -888,7 +904,7 @@ static void del(private_stroke_config_t *this, stroke_msg_t *msg)
 	}
 	enumerator->destroy(enumerator);
 	this->mutex->unlock(this->mutex);
-	
+
 	if (deleted)
 	{
 		DBG1(DBG_CFG, "deleted connection '%s'", msg->del_conn.name);
@@ -915,19 +931,19 @@ static void destroy(private_stroke_config_t *this)
 stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred)
 {
 	private_stroke_config_t *this = malloc_thing(private_stroke_config_t);
-	
+
 	this->public.backend.create_peer_cfg_enumerator = (enumerator_t*(*)(backend_t*, identification_t *me, identification_t *other))create_peer_cfg_enumerator;
 	this->public.backend.create_ike_cfg_enumerator = (enumerator_t*(*)(backend_t*, host_t *me, host_t *other))create_ike_cfg_enumerator;
 	this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
 	this->public.add = (void(*)(stroke_config_t*, stroke_msg_t *msg))add;
 	this->public.del = (void(*)(stroke_config_t*, stroke_msg_t *msg))del;
 	this->public.destroy = (void(*)(stroke_config_t*))destroy;
-	
+
 	this->list = linked_list_create();
 	this->mutex = mutex_create(MUTEX_TYPE_RECURSIVE);
 	this->ca = ca;
 	this->cred = cred;
-	
+
 	return &this->public;
 }