Imported Upstream version 4.5.2

7 files changed, 173 insertions, 63 deletions

diff --git a/src/libcharon/plugins/stroke/Makefile.in b/src/libcharon/plugins/stroke/Makefile.in
index ccf3eeede..fd859daeb 100644
--- a/src/libcharon/plugins/stroke/Makefile.in
+++ b/src/libcharon/plugins/stroke/Makefile.in
@@ -244,6 +244,8 @@ nm_ca_dir = @nm_ca_dir@
 oldincludedir = @oldincludedir@
 openac_plugins = @openac_plugins@
 p_plugins = @p_plugins@
+pcsclite_CFLAGS = @pcsclite_CFLAGS@
+pcsclite_LIBS = @pcsclite_LIBS@
 pdfdir = @pdfdir@
 piddir = @piddir@
 pki_plugins = @pki_plugins@
@@ -267,6 +269,7 @@ soup_LIBS = @soup_LIBS@
 srcdir = @srcdir@
 strongswan_conf = @strongswan_conf@
 sysconfdir = @sysconfdir@
+systemdsystemunitdir = @systemdsystemunitdir@
 target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index ea7d17592..2b3164384 100644
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -409,7 +409,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 		}
 		else
 		{
-			DBG1(DBG_CFG, "CA certificate %s not found, discarding CA "
+			DBG1(DBG_CFG, "CA certificate \"%s\" not found, discarding CA "
 				 "constraint", ca);
 		}
 	}
diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c
index 3541ab8f9..4943ee670 100644
--- a/src/libcharon/plugins/stroke/stroke_control.c
+++ b/src/libcharon/plugins/stroke/stroke_control.c
@@ -92,48 +92,94 @@ static child_cfg_t* get_child_from_peer(peer_cfg_t *peer_cfg, char *name)
 	return found;
 }
 
+/**
+ * call the charon controller to initiate the connection
+ */
+static void charon_initiate(peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
+							stroke_msg_t *msg, FILE *out)
+{
+	if (msg->output_verbosity < 0)
+	{
+		charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
+									 NULL, NULL);
+	}
+	else
+	{
+		stroke_log_info_t info = { msg->output_verbosity, out };
+
+		charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
+									 (controller_cb_t)stroke_log, &info);
+	}
+}
+
 METHOD(stroke_control_t, initiate, void,
 	private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
 {
+	child_cfg_t *child_cfg = NULL;
 	peer_cfg_t *peer_cfg;
-	child_cfg_t *child_cfg;
-	stroke_log_info_t info;
+	enumerator_t *enumerator;
+	bool empty = TRUE;
 
 	peer_cfg = charon->backends->get_peer_cfg_by_name(charon->backends,
 													  msg->initiate.name);
-	if (peer_cfg == NULL)
-	{
-		DBG1(DBG_CFG, "no config named '%s'\n", msg->initiate.name);
-		return;
-	}
-	if (peer_cfg->get_ike_version(peer_cfg) != 2)
+	if (peer_cfg)
 	{
-		DBG1(DBG_CFG, "ignoring initiation request for IKEv%d config",
-			 peer_cfg->get_ike_version(peer_cfg));
-		peer_cfg->destroy(peer_cfg);
-		return;
-	}
+		if (peer_cfg->get_ike_version(peer_cfg) != 2)
+		{
+			DBG1(DBG_CFG, "ignoring initiation request for IKEv%d config",
+				 peer_cfg->get_ike_version(peer_cfg));
+			peer_cfg->destroy(peer_cfg);
+			return;
+		}
 
-	child_cfg = get_child_from_peer(peer_cfg, msg->initiate.name);
-	if (child_cfg == NULL)
-	{
-		DBG1(DBG_CFG, "no child config named '%s'\n", msg->initiate.name);
-		peer_cfg->destroy(peer_cfg);
-		return;
-	}
+		child_cfg = get_child_from_peer(peer_cfg, msg->initiate.name);
+		if (child_cfg == NULL)
+		{
+			enumerator = peer_cfg->create_child_cfg_enumerator(peer_cfg);
+			while (enumerator->enumerate(enumerator, &child_cfg))
+			{
+				empty = FALSE;
+				charon_initiate(peer_cfg->get_ref(peer_cfg),
+								child_cfg->get_ref(child_cfg), msg, out);
+			}
+			enumerator->destroy(enumerator);
 
-	if (msg->output_verbosity < 0)
-	{
-		charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
-									 NULL, NULL);
+			if (empty)
+			{
+				DBG1(DBG_CFG, "no child config named '%s'", msg->initiate.name);
+				fprintf(out, "no child config named '%s'\n", msg->initiate.name);
+			}
+			peer_cfg->destroy(peer_cfg);
+			return;
+		}
 	}
 	else
 	{
-		info.out = out;
-		info.level = msg->output_verbosity;
-		charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
-									 (controller_cb_t)stroke_log, &info);
+		enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends,
+													NULL, NULL, NULL, NULL);
+		while (enumerator->enumerate(enumerator, &peer_cfg))
+		{
+			if (peer_cfg->get_ike_version(peer_cfg) != 2)
+			{
+				continue;
+			}
+			child_cfg = get_child_from_peer(peer_cfg, msg->initiate.name);
+			if (child_cfg)
+			{
+				peer_cfg->get_ref(peer_cfg);
+				break;
+			}
+		}
+		enumerator->destroy(enumerator);
+
+		if (child_cfg == NULL)
+		{
+			DBG1(DBG_CFG, "no config named '%s'", msg->initiate.name);
+			fprintf(out, "no config named '%s'\n", msg->initiate.name);
+			return;
+		}
 	}
+	charon_initiate(peer_cfg, child_cfg, msg, out);
 }
 
 /**
@@ -470,41 +516,90 @@ METHOD(stroke_control_t, purge_ike, void,
 	list->destroy(list);
 }
 
+/**
+ * call charon to install a trap
+ */
+static void charon_route(peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
+						 char *name, FILE *out)
+{
+	if (charon->traps->install(charon->traps, peer_cfg, child_cfg))
+	{
+		fprintf(out, "'%s' routed\n", name);
+	}
+	else
+	{
+		fprintf(out, "routing '%s' failed\n", name);
+	}
+}
+
 METHOD(stroke_control_t, route, void,
 	private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
 {
+	child_cfg_t *child_cfg = NULL;
 	peer_cfg_t *peer_cfg;
-	child_cfg_t *child_cfg;
+	enumerator_t *enumerator;
+	bool empty = TRUE;
 
 	peer_cfg = charon->backends->get_peer_cfg_by_name(charon->backends,
 													  msg->route.name);
-	if (peer_cfg == NULL)
-	{
-		fprintf(out, "no config named '%s'\n", msg->route.name);
-		return;
-	}
-	if (peer_cfg->get_ike_version(peer_cfg) != 2)
+	if (peer_cfg)
 	{
-		peer_cfg->destroy(peer_cfg);
-		return;
-	}
+		if (peer_cfg->get_ike_version(peer_cfg) != 2)
+		{
+			DBG1(DBG_CFG, "ignoring initiation request for IKEv%d config",
+				 peer_cfg->get_ike_version(peer_cfg));
+			peer_cfg->destroy(peer_cfg);
+			return;
+		}
 
-	child_cfg = get_child_from_peer(peer_cfg, msg->route.name);
-	if (child_cfg == NULL)
-	{
-		fprintf(out, "no child config named '%s'\n", msg->route.name);
-		peer_cfg->destroy(peer_cfg);
-		return;
-	}
+		child_cfg = get_child_from_peer(peer_cfg, msg->route.name);
+		if (child_cfg == NULL)
+		{
+			enumerator = peer_cfg->create_child_cfg_enumerator(peer_cfg);
+			while (enumerator->enumerate(enumerator, &child_cfg))
+			{
+				empty = FALSE;
+				charon_route(peer_cfg, child_cfg, child_cfg->get_name(child_cfg),
+							 out);
+			}
+			enumerator->destroy(enumerator);
 
-	if (charon->traps->install(charon->traps, peer_cfg, child_cfg))
-	{
-		fprintf(out, "configuration '%s' routed\n", msg->route.name);
+			if (empty)
+			{
+				DBG1(DBG_CFG, "no child config named '%s'", msg->route.name);
+				fprintf(out, "no child config named '%s'\n", msg->route.name);
+			}
+			peer_cfg->destroy(peer_cfg);
+			return;
+		}
 	}
 	else
 	{
-		fprintf(out, "routing configuration '%s' failed\n", msg->route.name);
+		enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends,
+													NULL, NULL, NULL, NULL);
+		while (enumerator->enumerate(enumerator, &peer_cfg))
+		{
+			if (peer_cfg->get_ike_version(peer_cfg) != 2)
+			{
+				continue;
+			}
+			child_cfg = get_child_from_peer(peer_cfg, msg->route.name);
+			if (child_cfg)
+			{
+				peer_cfg->get_ref(peer_cfg);
+				break;
+			}
+		}
+		enumerator->destroy(enumerator);
+
+		if (child_cfg == NULL)
+		{
+			DBG1(DBG_CFG, "no config named '%s'", msg->route.name);
+			fprintf(out, "no config named '%s'\n", msg->route.name);
+			return;
+		}
 	}
+	charon_route(peer_cfg, child_cfg, msg->route.name, out);
 	peer_cfg->destroy(peer_cfg);
 	child_cfg->destroy(child_cfg);
 }
diff --git a/src/libcharon/plugins/stroke/stroke_cred.c b/src/libcharon/plugins/stroke/stroke_cred.c
index 83e5a9ad6..baf02a6da 100644
--- a/src/libcharon/plugins/stroke/stroke_cred.c
+++ b/src/libcharon/plugins/stroke/stroke_cred.c
@@ -280,7 +280,7 @@ static void cache_cert(private_stroke_cred_t *this, certificate_t *cert)
 
 			chunk = crl->get_authKeyIdentifier(crl);
 			hex = chunk_to_hex(chunk, NULL, FALSE);
-			snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex);
+			snprintf(buf, sizeof(buf), "%s/%s.crl", CRL_DIR, hex.ptr);
 			free(hex.ptr);
 
 			if (cert->get_encoding(cert, CERT_ASN1_DER, &chunk))
@@ -518,7 +518,7 @@ static bool load_pin(private_stroke_cred_t *this, chunk_t line, int line_nr,
 		DBG1(DBG_CFG, "line %d: expected %%smartcard specifier", line_nr);
 		return FALSE;
 	}
-	snprintf(smartcard, sizeof(smartcard), "%.*s", sc.len, sc.ptr);
+	snprintf(smartcard, sizeof(smartcard), "%.*s", (int)sc.len, sc.ptr);
 	smartcard[sizeof(smartcard) - 1] = '\0';
 
 	/* parse slot and key id. Three formats are supported:
@@ -536,7 +536,7 @@ static bool load_pin(private_stroke_cred_t *this, chunk_t line, int line_nr,
 			return FALSE;
 		}
 		*pos = '\0';
-		strcpy(keyid, pos + 1);
+		strncpy(keyid, pos + 1, sizeof(keyid));
 		format = SC_FORMAT_SLOT_MODULE_KEYID;
 	}
 	else if (sscanf(smartcard, "%%smartcard%u:%s", &slot, keyid) == 2)
@@ -660,13 +660,13 @@ static bool load_private(private_stroke_cred_t *this, chunk_t line, int line_nr,
 	if (*filename.ptr == '/')
 	{
 		/* absolute path name */
-		snprintf(path, sizeof(path), "%.*s", filename.len, filename.ptr);
+		snprintf(path, sizeof(path), "%.*s", (int)filename.len, filename.ptr);
 	}
 	else
 	{
 		/* relative path name */
 		snprintf(path, sizeof(path), "%s/%.*s", PRIVATE_KEY_DIR,
-				 filename.len, filename.ptr);
+				 (int)filename.len, filename.ptr);
 	}
 
 	/* check for optional passphrase */
@@ -768,6 +768,8 @@ static bool load_shared(private_stroke_cred_t *this, chunk_t line, int line_nr,
 		if (ugh != NULL)
 		{
 			DBG1(DBG_CFG, "line %d: %s", line_nr, ugh);
+			shared_key->destroy(shared_key);
+			owners->destroy_offset(owners, offsetof(identification_t, destroy));
 			return FALSE;
 		}
 		if (id.len == 0)
@@ -874,7 +876,8 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level,
 					DBG1(DBG_CFG, "include pattern too long, ignored");
 					continue;
 				}
-				snprintf(pattern, sizeof(pattern), "%.*s", line.len, line.ptr);
+				snprintf(pattern, sizeof(pattern), "%.*s",
+						 (int)line.len, line.ptr);
 			}
 			else
 			{	/* use directory of current file if relative */
@@ -888,7 +891,7 @@ static void load_secrets(private_stroke_cred_t *this, char *file, int level,
 					continue;
 				}
 				snprintf(pattern, sizeof(pattern), "%s/%.*s",
-						 dir, line.len, line.ptr);
+						 dir, (int)line.len, line.ptr);
 				free(dir);
 			}
 			if (glob(pattern, GLOB_ERR, NULL, &buf) != 0)
diff --git a/src/libcharon/plugins/stroke/stroke_list.c b/src/libcharon/plugins/stroke/stroke_list.c
index 36311f092..6c42f8f8a 100644
--- a/src/libcharon/plugins/stroke/stroke_list.c
+++ b/src/libcharon/plugins/stroke/stroke_list.c
@@ -402,7 +402,8 @@ METHOD(stroke_list_t, status, void,
 	if (all)
 	{
 		peer_cfg_t *peer_cfg;
-		char *plugin, *pool;
+		plugin_t *plugin;
+		char *pool;
 		host_t *host;
 		u_int32_t dpd;
 		time_t since, now;
@@ -431,7 +432,7 @@ METHOD(stroke_list_t, status, void,
 		enumerator = lib->plugins->create_plugin_enumerator(lib->plugins);
 		while (enumerator->enumerate(enumerator, &plugin))
 		{
-			fprintf(out, "%s ", plugin);
+			fprintf(out, "%s ", plugin->get_name(plugin));
 		}
 		enumerator->destroy(enumerator);
 		fprintf(out, "\n");
@@ -1069,12 +1070,12 @@ static void print_alg(FILE *out, int *len, enum_name_t *alg_names, int alg_type,
 {
 	char alg_name[BUF_LEN];
 	int alg_name_len;
-	
+
 	alg_name_len = sprintf(alg_name, " %N[%s]", alg_names, alg_type, plugin_name);
 	if (*len + alg_name_len > CRYPTO_MAX_ALG_LINE)
 	{
 		fprintf(out, "\n             ");
-		*len = 13;	
+		*len = 13;
 	}
 	fprintf(out, "%s", alg_name);
 	*len += alg_name_len;
diff --git a/src/libcharon/plugins/stroke/stroke_plugin.c b/src/libcharon/plugins/stroke/stroke_plugin.c
index 2e83d0d28..2884db4bf 100644
--- a/src/libcharon/plugins/stroke/stroke_plugin.c
+++ b/src/libcharon/plugins/stroke/stroke_plugin.c
@@ -36,6 +36,12 @@ struct private_stroke_plugin_t {
 	stroke_socket_t *socket;
 };
 
+METHOD(plugin_t, get_name, char*,
+	private_stroke_plugin_t *this)
+{
+	return "stroke";
+}
+
 METHOD(plugin_t, destroy, void,
 	private_stroke_plugin_t *this)
 {
@@ -53,6 +59,8 @@ plugin_t *stroke_plugin_create()
 	INIT(this,
 		.public = {
 			.plugin = {
+				.get_name = _get_name,
+				.reload = (void*)return_false,
 				.destroy = _destroy,
 			},
 		},
diff --git a/src/libcharon/plugins/stroke/stroke_socket.c b/src/libcharon/plugins/stroke/stroke_socket.c
index 18e77905d..88d0270d8 100644
--- a/src/libcharon/plugins/stroke/stroke_socket.c
+++ b/src/libcharon/plugins/stroke/stroke_socket.c
@@ -122,7 +122,7 @@ static void pop_string(stroke_msg_t *msg, char **string)
 
 	/* check for sanity of string pointer and string */
 	if (string < (char**)msg ||
-		string > (char**)msg + sizeof(stroke_msg_t) ||
+		string > (char**)((char*)msg + sizeof(stroke_msg_t)) ||
 		(unsigned long)*string < (unsigned long)((char*)msg->buffer - (char*)msg) ||
 		(unsigned long)*string > msg->length)
 	{
@@ -396,7 +396,7 @@ static void stroke_export(private_stroke_socket_t *this,
 		{
 			if (cert->get_encoding(cert, CERT_PEM, &encoded))
 			{
-				fprintf(out, "%.*s", encoded.len, encoded.ptr);
+				fprintf(out, "%.*s", (int)encoded.len, encoded.ptr);
 				free(encoded.ptr);
 			}
 		}