Imported Upstream version 5.0.3

9 files changed, 252 insertions, 39 deletions

diff --git a/src/libstrongswan/utils/backtrace.c b/src/libstrongswan/utils/backtrace.c
index 0b6683233..77137f9f1 100644
--- a/src/libstrongswan/utils/backtrace.c
+++ b/src/libstrongswan/utils/backtrace.c
@@ -27,6 +27,8 @@
 
 #include "backtrace.h"
 
+#include <utils/debug.h>
+
 typedef struct private_backtrace_t private_backtrace_t;
 
 /**
@@ -50,7 +52,42 @@ struct private_backtrace_t {
 	void *frames[];
 };
 
+/**
+ * Write a format string with arguments to a FILE line, if it is NULL to DBG
+ */
+static void println(FILE *file, char *format, ...)
+{
+	char buf[512];
+	va_list args;
+
+	va_start(args, format);
+	if (file)
+	{
+		vfprintf(file, format, args);
+		fputs("\n", file);
+	}
+	else
+	{
+		vsnprintf(buf, sizeof(buf), format, args);
+		DBG1(DBG_LIB, "%s", buf);
+	}
+	va_end(args);
+}
+
 #ifdef HAVE_DLADDR
+
+/**
+ * Same as tty_escape_get(), but for a potentially NULL FILE*
+ */
+static char* esc(FILE *file, tty_escape_t escape)
+{
+	if (file)
+	{
+		return tty_escape_get(fileno(file), escape);
+	}
+	return "";
+}
+
 #ifdef HAVE_BFD_H
 
 #include <bfd.h>
@@ -158,6 +195,7 @@ static void find_addr(bfd *abfd, asection *section, bfd_find_data_t *data)
 	bfd_vma vma;
 	const char *source;
 	const char *function;
+	char fbuf[512] = "", sbuf[512] = "";
 	u_int line;
 
 	if (!data->found || (bfd_get_section_flags(abfd, section) & SEC_ALLOC) != 0)
@@ -175,16 +213,18 @@ static void find_addr(bfd *abfd, asection *section, bfd_find_data_t *data)
 				{
 					if (source || function)
 					{
-						fprintf(data->file, "    -> ");
 						if (function)
 						{
-							fprintf(data->file, "\e[34m%s() ", function);
+							snprintf(fbuf, sizeof(fbuf), "%s%s() ",
+								esc(data->file, TTY_FG_BLUE), function);
 						}
 						if (source)
 						{
-							fprintf(data->file, "\e[32m@ %s:%d", source, line);
+							snprintf(sbuf, sizeof(sbuf), "%s@ %s:%d",
+								esc(data->file, TTY_FG_GREEN), source, line);
 						}
-						fprintf(data->file, "\e[0m\n");
+						println(data->file, "    -> %s%s%s", fbuf, sbuf,
+								esc(data->file, TTY_FG_DEF));
 					}
 				}
 			}
@@ -296,26 +336,28 @@ void backtrace_deinit() {}
  */
 static void print_sourceline(FILE *file, char *filename, void *ptr)
 {
-	char cmd[1024];
+	char buf[1024];
 	FILE *output;
-	int c;
+	int c, i = 0;
 
-	snprintf(cmd, sizeof(cmd), "addr2line -e %s %p", filename, ptr);
-	output = popen(cmd, "r");
+	snprintf(buf, sizeof(buf), "addr2line -e %s %p", filename, ptr);
+	output = popen(buf, "r");
 	if (output)
 	{
-		fprintf(file, "    -> \e[32m");
-		while (TRUE)
+		while (i < sizeof(buf))
 		{
 			c = getc(output);
 			if (c == '\n' || c == EOF)
 			{
+				buf[i++] = 0;
 				break;
 			}
-			fputc(c, file);
+			buf[i++] = c;
 		}
 		pclose(output);
-		fprintf(file, "\e[0m\n");
+
+		println(file, "    -> %s%s%s", esc(file, TTY_FG_GREEN), buf,
+				esc(file, TTY_FG_DEF));
 	}
 }
 
@@ -337,7 +379,7 @@ METHOD(backtrace_t, log_, void,
 
 	strings = backtrace_symbols(this->frames, this->frame_count);
 
-	fprintf(file, " dumping %d stack frame addresses:\n", this->frame_count);
+	println(file, " dumping %d stack frame addresses:", this->frame_count);
 	for (i = 0; i < this->frame_count; i++)
 	{
 #ifdef HAVE_DLADDR
@@ -353,16 +395,20 @@ METHOD(backtrace_t, log_, void,
 			}
 			if (info.dli_sname)
 			{
-				fprintf(file, "  \e[33m%s\e[0m @ %p (\e[31m%s\e[0m+0x%tx) [%p]\n",
-						info.dli_fname, info.dli_fbase, info.dli_sname,
-						this->frames[i] - info.dli_saddr, this->frames[i]);
+				println(file, "  %s%s%s @ %p (%s%s%s+0x%tx) [%p]",
+						esc(file, TTY_FG_YELLOW), info.dli_fname,
+						esc(file, TTY_FG_DEF), info.dli_fbase,
+						esc(file, TTY_FG_RED), info.dli_sname,
+						esc(file, TTY_FG_DEF), this->frames[i] - info.dli_saddr,
+						this->frames[i]);
 			}
 			else
 			{
-				fprintf(file, "  \e[33m%s\e[0m @ %p [%p]\n", info.dli_fname,
-						info.dli_fbase, this->frames[i]);
+				println(file, "  %s%s%s @ %p [%p]",
+						esc(file, TTY_FG_YELLOW), info.dli_fname,
+						esc(file, TTY_FG_DEF), info.dli_fbase, this->frames[i]);
 			}
-			if (detailed)
+			if (detailed && info.dli_fname[0])
 			{
 				print_sourceline(file, (char*)info.dli_fname, ptr);
 			}
@@ -370,12 +416,12 @@ METHOD(backtrace_t, log_, void,
 		else
 #endif /* HAVE_DLADDR */
 		{
-			fprintf(file, "    %s\n", strings[i]);
+			println(file, "    %s", strings[i]);
 		}
 	}
 	free (strings);
 #else /* !HAVE_BACKTRACE */
-	fprintf(file, "C library does not support backtrace().\n");
+	println(file, "C library does not support backtrace().");
 #endif /* HAVE_BACKTRACE */
 }
 
@@ -511,9 +557,8 @@ void backtrace_dump(char *label, FILE *file, bool detailed)
 
 	if (label)
 	{
-		fprintf(file, "Debug backtrace: %s\n", label);
+		println(file, "Debug backtrace: %s", label);
 	}
 	backtrace->log(backtrace, file, detailed);
 	backtrace->destroy(backtrace);
 }
-
diff --git a/src/libstrongswan/utils/backtrace.h b/src/libstrongswan/utils/backtrace.h
index aeeba4dd6..62104238d 100644
--- a/src/libstrongswan/utils/backtrace.h
+++ b/src/libstrongswan/utils/backtrace.h
@@ -35,7 +35,10 @@ struct backtrace_t {
 	/**
 	 * Log the backtrace to a FILE stream.
 	 *
-	 * @param file		FILE to log backtrace to
+	 * If no file pointer is given, the backtrace is reported over the debug
+	 * framework to the registered dbg() callback function.
+	 *
+	 * @param file		FILE to log backtrace to, NULL for dbg() function
 	 * @param detailed	TRUE to resolve line/file using addr2line (slow)
 	 */
 	void (*log)(backtrace_t *this, FILE *file, bool detailed);
@@ -81,7 +84,7 @@ backtrace_t *backtrace_create(int skip);
  * Create a backtrace, dump it and clean it up.
  *
  * @param label		description to print for this backtrace, or NULL
- * @param file		FILE to log backtrace to
+ * @param file		FILE to log backtrace to, NULL to dbg() function
  * @param detailed	TRUE to resolve line/file using addr2line (slow)
  */
 void backtrace_dump(char *label, FILE *file, bool detailed);
diff --git a/src/libstrongswan/utils/capabilities.c b/src/libstrongswan/utils/capabilities.c
index c36a76efe..44a14496c 100644
--- a/src/libstrongswan/utils/capabilities.c
+++ b/src/libstrongswan/utils/capabilities.c
@@ -29,7 +29,9 @@
 
 #include <utils/debug.h>
 
-#if !defined(HAVE_GETPWNAM_R) || !defined(HAVE_GETGRNAM_R)
+#if !defined(HAVE_GETPWNAM_R) || \
+    !defined(HAVE_GETGRNAM_R) || \
+    !defined(HAVE_GETPWUID_R)
 # include <threading/mutex.h>
 # define EMULATE_R_FUNCS
 #endif
@@ -188,6 +190,34 @@ METHOD(capabilities_t, resolve_gid, bool,
 	return FALSE;
 }
 
+/**
+ * Initialize supplementary groups for unprivileged user
+ */
+static bool init_supplementary_groups(private_capabilities_t *this)
+{
+	struct passwd *pwp;
+	int res = -1;
+
+#ifdef HAVE_GETPWUID_R
+	struct passwd pwd;
+	char buf[1024];
+
+	if (getpwuid_r(this->uid, &pwd, buf, sizeof(buf), &pwp) == 0 && pwp)
+	{
+		res = initgroups(pwp->pw_name, this->gid);
+	}
+#else /* HAVE_GETPWUID_R */
+	this->mutex->lock(this->mutex);
+	pwp = getpwuid(this->uid);
+	if (pwp)
+	{
+		res = initgroups(pwp->pw_name, this->gid);
+	}
+	this->mutex->unlock(this->mutex);
+#endif /* HAVE_GETPWUID_R */
+	return res == 0;
+}
+
 METHOD(capabilities_t, drop, bool,
 	private_capabilities_t *this)
 {
@@ -195,6 +225,12 @@ METHOD(capabilities_t, drop, bool,
 	prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
 #endif
 
+	if (!init_supplementary_groups(this))
+	{
+		DBG1(DBG_LIB, "initializing supplementary groups for %u failed",
+			 this->uid);
+		return FALSE;
+	}
 	if (this->gid && setgid(this->gid) != 0)
 	{
 		DBG1(DBG_LIB, "change to unprivileged group %u failed: %s",
diff --git a/src/libstrongswan/utils/chunk.h b/src/libstrongswan/utils/chunk.h
index 67848eec1..bc14b7394 100644
--- a/src/libstrongswan/utils/chunk.h
+++ b/src/libstrongswan/utils/chunk.h
@@ -191,6 +191,11 @@ static inline void chunk_clear(chunk_t *chunk)
 #define chunk_from_thing(thing) chunk_create((char*)&(thing), sizeof(thing))
 
 /**
+ * Initialize a chunk from a static string, not containing 0-terminator
+ */
+#define chunk_from_str(str) chunk_create(str, strlen(str))
+
+/**
  * Allocate a chunk on the heap
  */
 #define chunk_alloc(bytes) ({size_t x = (bytes); chunk_create(x ? malloc(x) : NULL, x);})
diff --git a/src/libstrongswan/utils/identification.c b/src/libstrongswan/utils/identification.c
index 2669c2da6..4176320dc 100644
--- a/src/libstrongswan/utils/identification.c
+++ b/src/libstrongswan/utils/identification.c
@@ -49,10 +49,10 @@ ENUM_BEGIN(id_type_names, ID_ANY, ID_KEY_ID,
 	"ID_DER_ASN1_DN",
 	"ID_DER_ASN1_GN",
 	"ID_KEY_ID");
-ENUM_NEXT(id_type_names, ID_DER_ASN1_GN_URI, ID_MYID, ID_KEY_ID,
+ENUM_NEXT(id_type_names, ID_DER_ASN1_GN_URI, ID_USER_ID, ID_KEY_ID,
 	"ID_DER_ASN1_GN_URI",
-	"ID_MYID");
-ENUM_END(id_type_names, ID_MYID);
+	"ID_USER_ID");
+ENUM_END(id_type_names, ID_USER_ID);
 
 /**
  * coding of X.501 distinguished name
@@ -790,6 +790,7 @@ int identification_printf_hook(printf_hook_data_t *data,
 		case ID_FQDN:
 		case ID_RFC822_ADDR:
 		case ID_DER_ASN1_GN_URI:
+		case ID_USER_ID:
 			chunk_printable(this->encoded, &proper, '?');
 			snprintf(buf, sizeof(buf), "%.*s", (int)proper.len, proper.ptr);
 			chunk_free(&proper);
@@ -812,9 +813,6 @@ int identification_printf_hook(printf_hook_data_t *data,
 				snprintf(buf, sizeof(buf), "%#B", &this->encoded);
 			}
 			break;
-		case ID_MYID:
-			snprintf(buf, sizeof(buf), "%%myid");
-			break;
 		default:
 			snprintf(buf, sizeof(buf), "(unknown ID type: %d)", this->type);
 			break;
@@ -873,6 +871,7 @@ static private_identification_t *identification_create(id_type_t type)
 			break;
 		case ID_FQDN:
 		case ID_RFC822_ADDR:
+		case ID_USER_ID:
 			this->public.matches = _matches_string;
 			this->public.equals = _equals_strcasecmp;
 			this->public.contains_wildcards = _contains_wildcards_memchr;
@@ -1023,9 +1022,16 @@ identification_t * identification_create_from_data(chunk_t data)
 {
 	char buf[data.len + 1];
 
-	/* use string constructor */
-	snprintf(buf, sizeof(buf), "%.*s", (int)data.len, data.ptr);
-	return identification_create_from_string(buf);
+	if (is_asn1(data))
+	{
+		return identification_create_from_encoding(ID_DER_ASN1_DN, data);
+	}
+	else
+	{
+		/* use string constructor */
+		snprintf(buf, sizeof(buf), "%.*s", (int)data.len, data.ptr);
+		return identification_create_from_string(buf);
+	}
 }
 
 /*
diff --git a/src/libstrongswan/utils/identification.h b/src/libstrongswan/utils/identification.h
index cdf229127..00d740765 100644
--- a/src/libstrongswan/utils/identification.h
+++ b/src/libstrongswan/utils/identification.h
@@ -126,14 +126,14 @@ enum id_type_t {
 	ID_KEY_ID = 11,
 
 	/**
-	 * private type which represents a GeneralName of type URI
+	 * Private ID type which represents a GeneralName of type URI
 	 */
 	ID_DER_ASN1_GN_URI = 201,
 
 	/**
-	 * Private ID used by the pluto daemon for opportunistic encryption
+	 * Private ID type which represents a user ID
 	 */
-	ID_MYID = 203,
+	ID_USER_ID = 202
 };
 
 /**
diff --git a/src/libstrongswan/utils/leak_detective.c b/src/libstrongswan/utils/leak_detective.c
index 2b0be1661..6bf4d63cd 100644
--- a/src/libstrongswan/utils/leak_detective.c
+++ b/src/libstrongswan/utils/leak_detective.c
@@ -226,6 +226,8 @@ char *whitelist[] = {
 	"setpwent",
 	"endpwent",
 	"getspnam_r",
+	"getpwuid_r",
+	"initgroups",
 	/* ignore dlopen, as we do not dlclose to get proper leak reports */
 	"dlopen",
 	"dlerror",
diff --git a/src/libstrongswan/utils/utils.c b/src/libstrongswan/utils/utils.c
index bf0224c5f..2f38d8a93 100644
--- a/src/libstrongswan/utils/utils.c
+++ b/src/libstrongswan/utils/utils.c
@@ -194,6 +194,69 @@ bool mkdir_p(const char *path, mode_t mode)
 	return TRUE;
 }
 
+ENUM(tty_color_names, TTY_RESET, TTY_BG_DEF,
+	"\e[0m",
+	"\e[1m",
+	"\e[4m",
+	"\e[5m",
+	"\e[30m",
+	"\e[31m",
+	"\e[32m",
+	"\e[33m",
+	"\e[34m",
+	"\e[35m",
+	"\e[36m",
+	"\e[37m",
+	"\e[39m",
+	"\e[40m",
+	"\e[41m",
+	"\e[42m",
+	"\e[43m",
+	"\e[44m",
+	"\e[45m",
+	"\e[46m",
+	"\e[47m",
+	"\e[49m",
+);
+
+/**
+ * Get the escape string for a given TTY color, empty string on non-tty FILE
+ */
+char* tty_escape_get(int fd, tty_escape_t escape)
+{
+	if (!isatty(fd))
+	{
+		return "";
+	}
+	switch (escape)
+	{
+		case TTY_RESET:
+		case TTY_BOLD:
+		case TTY_UNDERLINE:
+		case TTY_BLINKING:
+		case TTY_FG_BLACK:
+		case TTY_FG_RED:
+		case TTY_FG_GREEN:
+		case TTY_FG_YELLOW:
+		case TTY_FG_BLUE:
+		case TTY_FG_MAGENTA:
+		case TTY_FG_CYAN:
+		case TTY_FG_WHITE:
+		case TTY_FG_DEF:
+		case TTY_BG_BLACK:
+		case TTY_BG_RED:
+		case TTY_BG_GREEN:
+		case TTY_BG_YELLOW:
+		case TTY_BG_BLUE:
+		case TTY_BG_MAGENTA:
+		case TTY_BG_CYAN:
+		case TTY_BG_WHITE:
+		case TTY_BG_DEF:
+			return enum_to_name(tty_color_names, escape);
+		/* warn if a excape code is missing */
+	}
+	return "";
+}
 
 /**
  * The size of the thread-specific error buffer
@@ -387,6 +450,14 @@ status_t return_failed()
 }
 
 /**
+ * returns SUCCESS
+ */
+status_t return_success()
+{
+	return SUCCESS;
+}
+
+/**
  * nop operation
  */
 void nop()
@@ -460,7 +531,7 @@ int time_printf_hook(printf_hook_data_t *data, printf_hook_spec_t *spec,
 	bool utc = *((bool*)(args[1]));;
 	struct tm t;
 
-	if (time == UNDEFINED_TIME)
+	if (*time == UNDEFINED_TIME)
 	{
 		return print_in_hook(data, "--- -- --:--:--%s----",
 							 utc ? " UTC " : " ");
diff --git a/src/libstrongswan/utils/utils.h b/src/libstrongswan/utils/utils.h
index 7b1beb93a..c66c665e0 100644
--- a/src/libstrongswan/utils/utils.h
+++ b/src/libstrongswan/utils/utils.h
@@ -314,6 +314,46 @@ enum status_t {
  */
 extern enum_name_t *status_names;
 
+typedef enum tty_escape_t tty_escape_t;
+
+/**
+ * Excape codes for tty colors
+ */
+enum tty_escape_t {
+	/** text properties */
+	TTY_RESET,
+	TTY_BOLD,
+	TTY_UNDERLINE,
+	TTY_BLINKING,
+
+	/** foreground colors */
+	TTY_FG_BLACK,
+	TTY_FG_RED,
+	TTY_FG_GREEN,
+	TTY_FG_YELLOW,
+	TTY_FG_BLUE,
+	TTY_FG_MAGENTA,
+	TTY_FG_CYAN,
+	TTY_FG_WHITE,
+	TTY_FG_DEF,
+
+	/** background colors */
+	TTY_BG_BLACK,
+	TTY_BG_RED,
+	TTY_BG_GREEN,
+	TTY_BG_YELLOW,
+	TTY_BG_BLUE,
+	TTY_BG_MAGENTA,
+	TTY_BG_CYAN,
+	TTY_BG_WHITE,
+	TTY_BG_DEF,
+};
+
+/**
+ * Get the escape string for a given TTY color, empty string on non-tty fd
+ */
+char* tty_escape_get(int fd, tty_escape_t escape);
+
 /**
  * deprecated pluto style return value:
  * error message, NULL for success
@@ -496,6 +536,11 @@ bool return_false();
 status_t return_failed();
 
 /**
+ * returns SUCCESS
+ */
+status_t return_success();
+
+/**
  * Write a 16-bit host order value in network order to an unaligned address.
  *
  * @param host		host order 16-bit value