[svn-upgrade] Integrating new upstream version, strongswan (4.3.6)

1 files changed, 129 insertions, 60 deletions

diff --git a/src/pluto/kernel.c b/src/pluto/kernel.c
index 46edac1cd..fe4655d3f 100644
--- a/src/pluto/kernel.c
+++ b/src/pluto/kernel.c
@@ -45,7 +45,6 @@
 
 #include "constants.h"
 #include "defs.h"
-#include "id.h"
 #include "connections.h"
 #include "state.h"
 #include "timer.h"
@@ -151,7 +150,7 @@ static void DBG_bare_shunt(const char *op, const struct bare_shunt *bs)
 struct eroute_info *orphaned_holds = NULL;
 
 /* forward declaration */
-static bool shunt_eroute(struct connection *c, struct spd_route *sr,
+static bool shunt_eroute(connection_t *c, struct spd_route *sr,
 						 enum routing_t rt_kind, unsigned int op,
 						 const char *opname);
 
@@ -347,14 +346,43 @@ ipsec_spi_t get_my_cpi(struct spd_route *sr, bool tunnel)
 	latest_cpi++;
 
 	if (latest_cpi == first_busy_cpi)
+	{
 		find_my_cpi_gap(&latest_cpi, &first_busy_cpi);
-
+	}
 	if (latest_cpi > IPCOMP_LAST_NEGOTIATED)
+	{
 		latest_cpi = IPCOMP_FIRST_NEGOTIATED;
-
+	}
 	return htonl((ipsec_spi_t)latest_cpi);
 }
 
+/* Replace the shell metacharacters ', \, ", `, and $ in a character string
+ * by escape sequences consisting of their octal values
+ */
+static void escape_metachar(const char *src, char *dst, size_t dstlen)
+{
+	while (*src != '\0' && dstlen > 4)
+	{
+		switch (*src)
+		{
+		case '\'':
+		case '\\':
+		case '"':
+		case '`':
+		case '$':
+			sprintf(dst,"\\%s%o", (*src < 64)?"0":"", *src);
+			dst += 4;
+			dstlen -= 4;
+			break;
+		default:
+			*dst++ = *src;
+			dstlen--;
+		}
+		src++;
+	}
+	*dst = '\0';
+}
+
 /* invoke the updown script to do the routing and firewall commands required
  *
  * The user-specified updown script is run.  Parameters are fed to it in
@@ -392,7 +420,7 @@ ipsec_spi_t get_my_cpi(struct spd_route *sr, bool tunnel)
 # define DEFAULT_UPDOWN "ipsec _updown"
 #endif
 
-static bool do_command(struct connection *c, struct spd_route *sr,
+static bool do_command(connection_t *c, struct spd_route *sr,
 					   const char *verb)
 {
 	char cmd[1536];     /* arbitrary limit on shell command length */
@@ -469,7 +497,7 @@ static bool do_command(struct connection *c, struct spd_route *sr,
 		}
 
 		addrtot(&sr->this.host_addr, 0, me_str, sizeof(me_str));
-		idtoa(&sr->this.id, myid_str, sizeof(myid_str));
+		snprintf(myid_str, sizeof(myid_str), "%Y", sr->this.id);
 		escape_metachar(myid_str, secure_myid_str, sizeof(secure_myid_str));
 		subnettot(&sr->this.client, 0, myclient_str, sizeof(myclientnet_str));
 		networkof(&sr->this.client, &ta);
@@ -478,7 +506,7 @@ static bool do_command(struct connection *c, struct spd_route *sr,
 		addrtot(&ta, 0, myclientmask_str, sizeof(myclientmask_str));
 
 		addrtot(&sr->that.host_addr, 0, peer_str, sizeof(peer_str));
-		idtoa(&sr->that.id, peerid_str, sizeof(peerid_str));
+		snprintf(peerid_str, sizeof(peerid_str), "%Y", sr->that.id);
 		escape_metachar(peerid_str, secure_peerid_str, sizeof(secure_peerid_str));
 		subnettot(&sr->that.client, 0, peerclient_str, sizeof(peerclientnet_str));
 		networkof(&sr->that.client, &ta);
@@ -492,11 +520,19 @@ static bool do_command(struct connection *c, struct spd_route *sr,
 			key_type_t type = key->public_key->get_type(key->public_key);
 			int pathlen;
 
-			if (type == KEY_RSA && same_id(&sr->that.id, &key->id) &&
+			if (type == KEY_RSA &&
+				sr->that.id->equals(sr->that.id, key->id) &&
 				trusted_ca(key->issuer, sr->that.ca, &pathlen))
 			{
-				dntoa_or_null(peerca_str, BUF_LEN, key->issuer, "");
-				escape_metachar(peerca_str, secure_peerca_str, sizeof(secure_peerca_str));
+				if (key->issuer)
+				{
+					snprintf(peerca_str, BUF_LEN, "%Y", key->issuer);	
+					escape_metachar(peerca_str, secure_peerca_str, BUF_LEN);
+				}
+				else
+				{
+					secure_peerca_str[0] = '\0';
+				}
 				break;
 			}
 		}
@@ -653,10 +689,10 @@ enum routability {
 	route_farconflict = 3
 };
 
-static enum routability could_route(struct connection *c)
+static enum routability could_route(connection_t *c)
 {
 	struct spd_route *esr, *rosr;
-	struct connection *ero      /* who, if anyone, owns our eroute? */
+	connection_t *ero      /* who, if anyone, owns our eroute? */
 		, *ro = route_owner(c, &rosr, &ero, &esr); /* who owns our route? */
 
 	/* it makes no sense to route a connection that is ISAKMP-only */
@@ -710,8 +746,8 @@ static enum routability could_route(struct connection *c)
 	/* if there is an eroute for another connection, there is a problem */
 	if (ero != NULL && ero != c)
 	{
-		struct connection *ero2, *ero_top;
-		struct connection *inside, *outside;
+		connection_t *ero2, *ero_top;
+		connection_t *inside, *outside;
 
 		/*
 		 * note, wavesec (PERMANENT) goes *outside* and
@@ -797,7 +833,7 @@ static enum routability could_route(struct connection *c)
 	return route_easy;
 }
 
-bool trap_connection(struct connection *c)
+bool trap_connection(connection_t *c)
 {
 	switch (could_route(c))
 	{
@@ -825,7 +861,7 @@ bool trap_connection(struct connection *c)
 /**
  * Delete any eroute for a connection and unroute it if route isn't shared
  */
-void unroute_connection(struct connection *c)
+void unroute_connection(connection_t *c)
 {
 	struct spd_route *sr;
 	enum routing_t cr;
@@ -847,7 +883,9 @@ void unroute_connection(struct connection *c)
 
 		/* only unroute if no other connection shares it */
 		if (routed(cr) && route_owner(c, NULL, NULL, NULL) == NULL)
+		{
 			(void) do_command(c, sr, "unroute");
+		}
 	}
 }
 
@@ -868,7 +906,7 @@ static void set_text_said(char *text_said, const ip_address *dst,
  * this allows the entry to be deleted.
  */
 static struct bare_shunt** bare_shunt_ptr(const ip_subnet *ours,
-										  const ip_subnet *his, 
+										  const ip_subnet *his,
 										  int transport_proto)
 {
 	struct bare_shunt *p, **pp;
@@ -942,8 +980,8 @@ static bool raw_eroute(const ip_address *this_host,
 					   const ip_subnet *this_client,
 					   const ip_address *that_host,
 					   const ip_subnet *that_client,
-		   			   ipsec_spi_t spi,
-		   			   unsigned int proto,
+					   ipsec_spi_t spi,
+					   unsigned int proto,
 					   unsigned int satype,
 					   unsigned int transport_proto,
 					   const struct pfkey_proto_info *proto_info,
@@ -1072,8 +1110,9 @@ static bool eroute_connection(struct spd_route *sr, ipsec_spi_t spi,
 			 , "eroute_connection %s", opname);
 
 	if (proto == SA_INT)
+	{
 		peer = aftoinfo(addrtypeof(peer))->any;
-
+	}
 	return raw_eroute(&sr->this.host_addr, &sr->this.client
 					  , peer
 					  , &sr->that.client
@@ -1083,7 +1122,7 @@ static bool eroute_connection(struct spd_route *sr, ipsec_spi_t spi,
 
 /* assign a bare hold to a connection */
 
-bool assign_hold(struct connection *c USED_BY_DEBUG, struct spd_route *sr,
+bool assign_hold(connection_t *c USED_BY_DEBUG, struct spd_route *sr,
 				 int transport_proto,
 				 const ip_address *src,
 				 const ip_address *dst)
@@ -1225,7 +1264,7 @@ static bool sag_eroute(struct state *st, struct spd_route *sr,
 
 /* compute a (host-order!) SPI to implement the policy in connection c */
 ipsec_spi_t
-shunt_policy_spi(struct connection *c, bool prospective)
+shunt_policy_spi(connection_t *c, bool prospective)
 {
 	/* note: these are in host order :-( */
 	static const ipsec_spi_t shunt_spi[] =
@@ -1256,7 +1295,7 @@ shunt_policy_spi(struct connection *c, bool prospective)
  * If negotiation has failed, the choice between %trap/%pass/%drop/%reject
  * is specified in the policy of connection c.
  */
-static bool shunt_eroute(struct connection *c, struct spd_route *sr,
+static bool shunt_eroute(connection_t *c, struct spd_route *sr,
 						 enum routing_t rt_kind,
 						 unsigned int op, const char *opname)
 {
@@ -1316,7 +1355,7 @@ static bool shunt_eroute(struct connection *c, struct spd_route *sr,
 	{
 		/* maybe we are uneclipsing something */
 		struct spd_route *esr;
-		struct connection *ue = eclipsed(c, &esr);
+		connection_t *ue = eclipsed(c, &esr);
 
 		if (ue != NULL)
 		{
@@ -1359,15 +1398,20 @@ static const char *read_proto(const char * s, size_t * len, int * transport_prot
 
 	l = *len;
 	p = memchr(s, ':', l);
-	if (p == 0) {
+	if (p == 0)
+	{
 		*transport_proto = 0;
 		return 0;
 	}
 	ugh = ttoul(p+1, l-((p-s)+1), 10, &proto);
 	if (ugh != 0)
+	{
 		return ugh;
+	}
 	if (proto > 65535)
+	{
 		return "protocol number is too large, legal range is 0-65535";
+	}
 	*len = p-s;
 	*transport_proto = proto;
 	return 0;
@@ -1429,7 +1473,9 @@ void scan_proc_shunts(void)
 
 	f = fopen(procname, "r");
 	if (f == NULL)
+	{
 		return;
+	}
 
 	/* for each line... */
 	for (lino = 1; ; lino++)
@@ -1445,7 +1491,9 @@ void scan_proc_shunts(void)
 
 		cp = fgets(buf, sizeof(buf), f);
 		if (cp == NULL)
+		{
 			break;
+		}
 
 		/* break out each field
 		 * Note: if there are too many fields, just stop;
@@ -1461,7 +1509,9 @@ void scan_proc_shunts(void)
 			field[fi] = chunk_create(cp, w);
 			cp += w;
 			if (w == 0)
+			{
 				break;
+			}
 		}
 
 		/* This odd do-hickey is to share error reporting code.
@@ -1473,9 +1523,13 @@ void scan_proc_shunts(void)
 			 * check if things are as they should be.
 			 */
 			if (fi == 5)
+			{
 				ff = &field[0]; /* old form, with no count */
+			}
 			else if (fi == 6)
+			{
 				ff = &field[1]; /* new form, with count */
+			}
 			else
 			{
 				ugh = "has wrong number of fields";
@@ -1501,7 +1555,9 @@ void scan_proc_shunts(void)
 				context = "count field is malformed: ";
 				ugh = ttoul(field[0].ptr, field[0].len, 10, &eri.count);
 				if (ugh != NULL)
+				{
 					break;
+				}
 			}
 
 			/* our client */
@@ -1509,21 +1565,27 @@ void scan_proc_shunts(void)
 			context = "source subnet field malformed: ";
 			ugh = ttosubnet(ff[0].ptr, ff[0].len, AF_INET, &eri.ours);
 			if (ugh != NULL)
+			{
 				break;
+			}
 
 			/* his client */
 
 			context = "destination subnet field malformed: ";
 			ugh = ttosubnet(ff[2].ptr, ff[2].len, AF_INET, &eri.his);
 			if (ugh != NULL)
+			{
 				break;
+			}
 
 			/* SAID */
 
 			context = "SA ID field malformed: ";
 			ugh = read_proto(ff[4].ptr, &ff[4].len, &eri.transport_proto);
 			if (ugh != NULL)
+			{
 				break;
+			}
 			ugh = ttosa(ff[4].ptr, ff[4].len, &eri.said);
 		} while (FALSE);
 
@@ -1666,7 +1728,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 {
 	/* Build an inbound or outbound SA */
 
-	struct connection *c = st->st_connection;
+	connection_t *c = st->st_connection;
 	ip_subnet src, dst;
 	ip_subnet src_client, dst_client;
 	ipsec_spi_t inner_spi = 0;
@@ -1738,9 +1800,13 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 
 			ipip_spi = htonl(++last_tunnel_spi);
 			if (inbound)
+			{
 				st->st_tunnel_in_spi = ipip_spi;
+			}
 			else
+			{
 				st->st_tunnel_out_spi = ipip_spi;
+			}
 		}
 
 		set_text_said(text_said
@@ -1797,10 +1863,10 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 		said_next->text_said = text_said;
 
 		if (!kernel_ops->add_sa(said_next, replace))
+		{
 			goto fail;
-
+		}
 		said_next++;
-
 		encapsulation = ENCAPSULATION_MODE_TRANSPORT;
 	}
 
@@ -1861,7 +1927,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 			if (ei == &esp_info[countof(esp_info)])
 			{
 				/* Check for additional kernel alg */
-				if ((ei=kernel_alg_esp_info(st->st_esp.attrs.transid, 
+				if ((ei=kernel_alg_esp_info(st->st_esp.attrs.transid,
 										st->st_esp.attrs.auth))!=NULL)
 				{
 					break;
@@ -1873,7 +1939,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 				 * assuming the name will be found.
 				 */
 				loglog(RC_LOG_SERIOUS, "ESP transform %s / auth %s not implemented yet"
-					, enum_name(&esp_transformid_names, st->st_esp.attrs.transid)
+					, enum_name(&esp_transform_names, st->st_esp.attrs.transid)
 					, enum_name(&auth_alg_names, st->st_esp.attrs.auth));
 				goto fail;
 			}
@@ -1892,7 +1958,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 			if (key_len > ei->enckeylen)
 			{
 				loglog(RC_LOG_SERIOUS, "ESP transform %s passed key_len=%d > %d",
-					enum_name(&esp_transformid_names, st->st_esp.attrs.transid),
+					enum_name(&esp_transform_names, st->st_esp.attrs.transid),
 					(int)key_len, (int)ei->enckeylen);
 				goto fail;
 			}
@@ -1906,7 +1972,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 		{
 			case ESP_3DES:
 				/* 168 bits in kernel, need 192 bits for keymat_len */
-				if (key_len == 21) 
+				if (key_len == 21)
 				{
 					key_len = 24;
 				}
@@ -1914,7 +1980,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 			case ESP_DES:
 				/* 56 bits in kernel, need 64 bits for keymat_len */
 				if (key_len == 7)
-				{ 
+				{
 					key_len = 8;
 				}
 				break;
@@ -1930,7 +1996,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 				key_len += 4;
 				break;
 			default:
-				break;			
+				break;
 		}
 
 		/* divide up keying material */
@@ -2032,7 +2098,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 		{
 			struct pfkey_proto_info proto_info[4];
 			int i = 0;
-			
+
 			if (st->st_ipcomp.present)
 			{
 				proto_info[i].proto = IPPROTO_COMP;
@@ -2040,7 +2106,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 				proto_info[i].reqid = c->spd.reqid + 2;
 				i++;
 			}
-			
+
 			if (st->st_esp.present)
 			{
 				proto_info[i].proto = IPPROTO_ESP;
@@ -2048,7 +2114,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 				proto_info[i].reqid = c->spd.reqid + 1;
 				i++;
 			}
-			
+
 			if (st->st_ah.present)
 			{
 				proto_info[i].proto = IPPROTO_AH;
@@ -2056,9 +2122,9 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 				proto_info[i].reqid = c->spd.reqid;
 				i++;
 			}
-			
+
 			proto_info[i].proto = 0;
-			
+
 			if (kernel_ops->inbound_eroute
 				&& encapsulation == ENCAPSULATION_MODE_TUNNEL)
 			{
@@ -2068,7 +2134,7 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 					proto_info[i].encapsulation = ENCAPSULATION_MODE_TRANSPORT;
 				}
 			}
-			
+
 			/* MCR - should be passed a spd_eroute structure here */
 			(void) raw_eroute(&c->spd.that.host_addr, &c->spd.that.client
 							  , &c->spd.this.host_addr, &c->spd.this.client
@@ -2079,11 +2145,11 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 	}
 
 	/* If there are multiple SPIs, group them. */
-	
+
 	if (kernel_ops->grp_sa && said_next > &said[1])
 	{
 		struct kernel_sa *s;
-		
+
 		/* group SAs, two at a time, inner to outer (backwards in said[])
 		 * The grouping is by pairs.  So if said[] contains ah esp ipip,
 		 * the grouping would be ipip:esp, esp:ah.
@@ -2095,15 +2161,15 @@ static bool setup_half_ipsec_sa(struct state *st, bool inbound)
 				text_said1[SATOT_BUF];
 
 			/* group s[1] and s[0], in that order */
-			
+
 			set_text_said(text_said0, s[0].dst, s[0].spi, s[0].proto);
 			set_text_said(text_said1, s[1].dst, s[1].spi, s[1].proto);
-			
+
 			DBG(DBG_KLIPS, DBG_log("grouping %s and %s", text_said1, text_said0));
-			
+
 			s[0].text_said = text_said0;
 			s[1].text_said = text_said1;
-			
+
 			if (!kernel_ops->grp_sa(s + 1, s))
 			{
 				goto fail;
@@ -2135,7 +2201,7 @@ static bool teardown_half_ipsec_sa(struct state *st, bool inbound)
 	 * so deleting any one will do.  So we just delete the
 	 * first one found.  It may or may not be the only one.
 	 */
-	struct connection *c = st->st_connection;
+	connection_t *c = st->st_connection;
 	struct {
 		unsigned proto;
 		struct ipsec_proto_info *info;
@@ -2227,7 +2293,7 @@ bool get_sa_info(struct state *st, bool inbound, u_int *bytes, time_t *use_time)
 {
 	char text_said[SATOT_BUF];
 	struct kernel_sa sa;
-	struct connection *c = st->st_connection;
+	connection_t *c = st->st_connection;
 
 	*use_time = UNDEFINED_TIME;
 
@@ -2353,7 +2419,7 @@ void init_kernel(void)
  */
 bool install_inbound_ipsec_sa(struct state *st)
 {
-	struct connection *const c = st->st_connection;
+	connection_t *const c = st->st_connection;
 
 	/* If our peer has a fixed-address client, check if we already
 	 * have a route for that client that conflicts.  We will take this
@@ -2367,7 +2433,7 @@ bool install_inbound_ipsec_sa(struct state *st)
 		for (;;)
 		{
 			struct spd_route *esr;
-			struct connection *o = route_owner(c, &esr, NULL, NULL);
+			connection_t *o = route_owner(c, &esr, NULL, NULL);
 
 			if (o == NULL)
 			{
@@ -2417,20 +2483,20 @@ bool install_inbound_ipsec_sa(struct state *st)
  * Any SA Group must have already been created.
  * On failure, steps will be unwound.
  */
-bool route_and_eroute(struct connection *c USED_BY_KLIPS,
+bool route_and_eroute(connection_t *c USED_BY_KLIPS,
 					  struct spd_route *sr USED_BY_KLIPS,
 					  struct state *st USED_BY_KLIPS)
 {
 #ifdef KLIPS
 	struct spd_route *esr;
 	struct spd_route *rosr;
-	struct connection *ero      /* who, if anyone, owns our eroute? */
+	connection_t *ero      /* who, if anyone, owns our eroute? */
 		, *ro = route_owner(c, &rosr, &ero, &esr);
 	bool eroute_installed = FALSE
 		, firewall_notified = FALSE
 		, route_installed = FALSE;
 
-	struct connection *ero_top;
+	connection_t *ero_top;
 	struct bare_shunt **bspp;
 
 	DBG(DBG_CONTROLMORE,
@@ -2438,7 +2504,7 @@ bool route_and_eroute(struct connection *c USED_BY_KLIPS,
 				, c->name
 				, (c->policy_next ? c->policy_next->name : "none")
 				, ero ? ero->name : "null"
-				, esr 
+				, esr
 				, ro ? ro->name : "null"
 				, rosr
 				, st ? st->st_serialno : 0));
@@ -2472,11 +2538,14 @@ bool route_and_eroute(struct connection *c USED_BY_KLIPS,
 
 		/* if no state provided, then install a shunt for later */
 		if (st == NULL)
+		{
 			eroute_installed = shunt_eroute(c, sr, RT_ROUTED_PROSPECTIVE
 											, ERO_REPLACE, "replace");
+		}
 		else
+		{
 			eroute_installed = sag_eroute(st, sr, ERO_REPLACE, "replace");
-
+		}
 #if 0
 		/* XXX - MCR. I previously felt that this was a bogus check */
 		if (ero != NULL && ero != c && esr != sr)
@@ -2588,7 +2657,7 @@ bool route_and_eroute(struct connection *c USED_BY_KLIPS,
 		else if (ero != NULL && ero != c)
 		{
 			/* check if ero is an ancestor of c. */
-			struct connection *ero2;
+			connection_t *ero2;
 
 			for (ero2 = c; ero2 != NULL && ero2 != c; ero2 = ero2->policy_next)
 				;
@@ -2788,7 +2857,7 @@ void delete_ipsec_sa(struct state *st USED_BY_KLIPS,
 		/* If the state is the eroute owner, we must adjust
 		 * the routing for the connection.
 		 */
-		struct connection *c = st->st_connection;
+		connection_t *c = st->st_connection;
 		struct spd_route *sr;
 
 		passert(st->st_connection);
@@ -2837,9 +2906,9 @@ void delete_ipsec_sa(struct state *st USED_BY_KLIPS,
 #ifdef KLIPS
 static bool update_nat_t_ipsec_esp_sa (struct state *st, bool inbound)
 {
-	struct connection *c = st->st_connection;
+	connection_t *c = st->st_connection;
 	char text_said[SATOT_BUF];
-	struct kernel_sa sa;        
+	struct kernel_sa sa;
 	ip_address
 		src = inbound? c->spd.that.host_addr : c->spd.this.host_addr,
 		dst = inbound? c->spd.this.host_addr : c->spd.that.host_addr;
@@ -2924,7 +2993,7 @@ bool was_eroute_idle(struct state *st, time_t idle_max, time_t *idle_time)
 			ret = *idle_time >= idle_max;
 		}
 	}
-	else 
+	else
 	{
 		while (f != NULL)
 		{