mirror of
https://github.com/netbirdio/FreeBSD-ports.git
synced 2026-05-22 18:42:42 -07:00
security/ipsec-tools: re-add the port
I use the software and will maintain the port. Our port has no known security issues, it has patches obtained from NetBSD CVS Repository. Change WWW to point to that repo. Still, download same distfile from the SourceForge. Add TIMESTAMP to distinfo.
This commit is contained in:
Eugene Grosbein
@@ -4135,4 +4135,3 @@ devel/p5-Test-HTML-Tidy||2025-02-04|Has expired: Depends on expired textproc/p5-
|
||||
www/p5-CGI-Application-Plugin-HtmlTidy||2025-02-04|Has expired: Depends on expired textproc/p5-HTML-Tidy
|
||||
textproc/p5-HTML-Tidy||2025-02-04|Has expired: Depends on expired textproc/tidyp
|
||||
textproc/tidyp||2025-02-04|Has expired: The repository has been archived by upstream on Apr 14, 2019
|
||||
security/ipsec-tools||2025-02-04|Has expired: Deprecated by upstream in 2014, contains security issues
|
||||
|
||||
@@ -240,6 +240,7 @@
|
||||
SUBDIR += intel-ipsec-mb
|
||||
SUBDIR += ipfmeta
|
||||
SUBDIR += ipguard
|
||||
SUBDIR += ipsec-tools
|
||||
SUBDIR += ipv6toolkit
|
||||
SUBDIR += isal-kmod
|
||||
SUBDIR += ismtp
|
||||
|
||||
@@ -0,0 +1,104 @@
|
||||
PORTNAME= ipsec-tools
|
||||
PORTVERSION= 0.8.2
|
||||
PORTREVISION= 13
|
||||
CATEGORIES= security
|
||||
MASTER_SITES= SF
|
||||
|
||||
MAINTAINER= eugen@FreeBSD.org
|
||||
COMMENT= KAME racoon IKE daemon, ipsec-tools version
|
||||
WWW= http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/
|
||||
|
||||
LICENSE= BSD3CLAUSE
|
||||
|
||||
USES= cpe libtool tar:bzip2 ssl
|
||||
|
||||
CONFLICTS= racoon
|
||||
INSTALL_TARGET= install-strip
|
||||
USE_RC_SUBR= racoon
|
||||
GNU_CONFIGURE= yes
|
||||
GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
|
||||
USE_LDCONFIG= yes
|
||||
CONFIGURE_ARGS= --enable-shared --sysconfdir=${PREFIX}/etc/racoon \
|
||||
--localstatedir=${STATEDIR:S/\/racoon//}
|
||||
|
||||
STATEDIR= /var/db/racoon
|
||||
SUB_LIST+= STATEDIR=${STATEDIR} REQUIREMOD=${REQUIREMOD}
|
||||
PLIST_SUB+= STATEDIR=${STATEDIR}
|
||||
|
||||
OPTIONS_DEFINE= IPV6 ADMINPORT STATS DPD NATT FRAG HYBRID PAM \
|
||||
RADIUS LDAP GSSAPI SAUNSPEC RC5 IDEA DOCS EXAMPLES WCPSKEY
|
||||
OPTIONS_DEFAULT= ADMINPORT DPD NATT FRAG HYBRID WCPSKEY
|
||||
|
||||
ADMINPORT_DESC= Enable Admin port
|
||||
STATS_DESC= Statistics logging function
|
||||
DPD_DESC= Dead Peer Detection
|
||||
NATT_DESC= NAT-Traversal
|
||||
FRAG_DESC= IKE fragmentation payload support
|
||||
HYBRID_DESC= Hybrid, Xauth and Mode-cfg support
|
||||
SAUNSPEC_DESC= Unspecified SA mode
|
||||
RC5_DESC= RC5 encryption (patented)
|
||||
IDEA_DESC= IDEA encryption (patented)
|
||||
PAM_DESC= PAM authentication (Xauth server)
|
||||
RADIUS_DESC= Radius authentication (Xauth server)
|
||||
LDAP_DESC= LDAP authentication (Xauth server)
|
||||
WCPSKEY_DESC= Allow wildcard matching for pre-shared keys
|
||||
|
||||
PORTDOCS= *
|
||||
PORTEXAMPLES= *
|
||||
|
||||
IPV6_CONFIGURE_ENABLE= ipv6
|
||||
ADMINPORT_CONFIGURE_ENABLE=adminport
|
||||
STATS_CONFIGURE_ENABLE= stats
|
||||
DPD_CONFIGURE_ENABLE= dpd
|
||||
NATT_CONFIGURE_ON= --enable-natt=yes --enable-natt-versions=rfc
|
||||
NATT_CONFIGURE_OFF= --disable-natt
|
||||
FRAG_CONFIGURE_ENABLE= frag
|
||||
HYBRID_CONFIGURE_ENABLE=hybrid
|
||||
PAM_CONFIGURE_WITH= libpam
|
||||
GSSAPI_USES= iconv
|
||||
GSSAPI_CFLAGS= -I${LOCALBASE}/include
|
||||
GSSAPI_LDFLAGS= -L${LOCALBASE}/lib
|
||||
GSSAPI_CONFIGURE_ENABLE=gssapi
|
||||
RADIUS_CONFIGURE_WITH= libradius
|
||||
LDAP_USES= ldap
|
||||
LDAP_CONFIGURE_ON= --with-libldap=${LOCALBASE}
|
||||
LDAP_CONFIGURE_OFF= --without-libldap
|
||||
SAUNSPEC_CONFIGURE_ENABLE= samode-unspec
|
||||
RC5_CONFIGURE_ENABLE= rc5
|
||||
IDEA_CONFIGURE_ENABLE= idea
|
||||
NATT_EXTRA_PATCHES= ${FILESDIR}/natt.diff
|
||||
WCPSKEY_EXTRA_PATCHES= ${FILESDIR}/wildcard-psk.diff ${FILESDIR}/wildcard-psk-oakley.c.diff
|
||||
|
||||
.include <bsd.port.pre.mk>
|
||||
|
||||
.if ${OPSYS} == FreeBSD
|
||||
REQUIREMOD?= ipsec
|
||||
.endif
|
||||
|
||||
post-patch:
|
||||
@${REINPLACE_CMD} -e "s/-Werror//g ; s/-R$$libdir/-Wl,-rpath=$$libdir/g" ${WRKSRC}/configure
|
||||
|
||||
post-install:
|
||||
@${MKDIR} ${STAGEDIR}/${PREFIX}/etc/racoon
|
||||
@if [ -z `/sbin/sysctl -a | ${GREP} -q ipsec && ${ECHO_CMD} ipsec` ]; then \
|
||||
${ECHO_MSG} "WARNING: IPsec feature is disabled on this host"; \
|
||||
${ECHO_MSG} " You must build the kernel if you want to run racoon on the host"; \
|
||||
fi ;
|
||||
|
||||
post-install-EXAMPLES-on:
|
||||
@${MKDIR} ${STAGEDIR}/${EXAMPLESDIR}
|
||||
@${RM} ${WRKSRC}/src/racoon/samples/*.in
|
||||
@${CP} -r ${WRKSRC}/src/racoon/samples/* ${STAGEDIR}/${EXAMPLESDIR}
|
||||
|
||||
post-install-DOCS-on:
|
||||
@${MKDIR} ${STAGEDIR}/${DOCSDIR}
|
||||
${INSTALL_DATA} ${WRKSRC}/src/racoon/doc/* ${STAGEDIR}/${DOCSDIR}
|
||||
|
||||
.if ${OPSYS} == FreeBSD
|
||||
. if ${SSL_DEFAULT} != openssl111
|
||||
EXTRA_PATCHES+= ${FILESDIR}/extra-patch-ipsec-tools
|
||||
PLIST_FILES+= include/racoon/openssl_compat.h
|
||||
. endif
|
||||
.endif
|
||||
|
||||
.include <bsd.port.post.mk>
|
||||
@@ -0,0 +1,3 @@
|
||||
TIMESTAMP = 1738726293
|
||||
SHA256 (ipsec-tools-0.8.2.tar.bz2) = 8eb6b38716e2f3a8a72f1f549c9444c2bc28d52c9536792690564c74fe722f2d
|
||||
SIZE (ipsec-tools-0.8.2.tar.bz2) = 866465
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,155 @@
|
||||
--- src/libipsec/libpfkey.h
|
||||
+++ src/libipsec/libpfkey.h
|
||||
@@ -85,7 +85,7 @@ struct pfkey_send_sa_args {
|
||||
u_int32_t seq;
|
||||
u_int8_t l_natt_type;
|
||||
u_int16_t l_natt_sport, l_natt_dport;
|
||||
- struct sockaddr *l_natt_oa;
|
||||
+ struct sockaddr *l_natt_oai, *l_natt_oar;
|
||||
u_int16_t l_natt_frag;
|
||||
u_int8_t ctxdoi, ctxalg; /* Security context DOI and algorithm */
|
||||
caddr_t ctxstr; /* Security context string */
|
||||
--- src/libipsec/pfkey.c
|
||||
+++ src/libipsec/pfkey.c
|
||||
@@ -1335,9 +1335,12 @@ pfkey_send_x1(struct pfkey_send_sa_args
|
||||
len += sizeof(struct sadb_x_nat_t_type);
|
||||
len += sizeof(struct sadb_x_nat_t_port);
|
||||
len += sizeof(struct sadb_x_nat_t_port);
|
||||
- if (sa_parms->l_natt_oa)
|
||||
+ if (sa_parms->l_natt_oai)
|
||||
len += sizeof(struct sadb_address) +
|
||||
- PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oa));
|
||||
+ PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oai));
|
||||
+ if (sa_parms->l_natt_oar)
|
||||
+ len += sizeof(struct sadb_address) +
|
||||
+ PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oar));
|
||||
#ifdef SADB_X_EXT_NAT_T_FRAG
|
||||
if (sa_parms->l_natt_frag)
|
||||
len += sizeof(struct sadb_x_nat_t_frag);
|
||||
@@ -1452,10 +1455,21 @@ pfkey_send_x1(struct pfkey_send_sa_args
|
||||
return -1;
|
||||
}
|
||||
|
||||
- if (sa_parms->l_natt_oa) {
|
||||
- p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OA,
|
||||
- sa_parms->l_natt_oa,
|
||||
- (u_int)PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oa)),
|
||||
+ if (sa_parms->l_natt_oai) {
|
||||
+ p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OAI,
|
||||
+ sa_parms->l_natt_oai,
|
||||
+ (u_int)PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oai)),
|
||||
+ IPSEC_ULPROTO_ANY);
|
||||
+ if (!p) {
|
||||
+ free(newmsg);
|
||||
+ return -1;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ if (sa_parms->l_natt_oar) {
|
||||
+ p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OAR,
|
||||
+ sa_parms->l_natt_oar,
|
||||
+ (u_int)PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oar)),
|
||||
IPSEC_ULPROTO_ANY);
|
||||
if (!p) {
|
||||
free(newmsg);
|
||||
@@ -2034,7 +2048,8 @@ pfkey_align(struct sadb_msg *msg, caddr_
|
||||
case SADB_X_EXT_NAT_T_TYPE:
|
||||
case SADB_X_EXT_NAT_T_SPORT:
|
||||
case SADB_X_EXT_NAT_T_DPORT:
|
||||
- case SADB_X_EXT_NAT_T_OA:
|
||||
+ case SADB_X_EXT_NAT_T_OAI:
|
||||
+ case SADB_X_EXT_NAT_T_OAR:
|
||||
#endif
|
||||
#ifdef SADB_X_EXT_TAG
|
||||
case SADB_X_EXT_TAG:
|
||||
@@ -2592,7 +2607,7 @@ pfkey_send_update_nat(int so, u_int saty
|
||||
psaa.l_natt_type = l_natt_type;
|
||||
psaa.l_natt_sport = l_natt_sport;
|
||||
psaa.l_natt_dport = l_natt_dport;
|
||||
- psaa.l_natt_oa = l_natt_oa;
|
||||
+ psaa.l_natt_oar = l_natt_oa;
|
||||
psaa.l_natt_frag = l_natt_frag;
|
||||
|
||||
return pfkey_send_update2(&psaa);
|
||||
@@ -2667,7 +2682,7 @@ pfkey_send_add_nat(int so, u_int satype,
|
||||
psaa.l_natt_type = l_natt_type;
|
||||
psaa.l_natt_sport = l_natt_sport;
|
||||
psaa.l_natt_dport = l_natt_dport;
|
||||
- psaa.l_natt_oa = l_natt_oa;
|
||||
+ psaa.l_natt_oai = l_natt_oa;
|
||||
psaa.l_natt_frag = l_natt_frag;
|
||||
|
||||
return pfkey_send_add2(&psaa);
|
||||
--- src/racoon/isakmp_quick.c
|
||||
+++ src/racoon/isakmp_quick.c
|
||||
@@ -2390,6 +2390,34 @@
|
||||
spidx.src.ss_family, spidx.dst.ss_family,
|
||||
_XIDT(iph2->id_p),idi2type);
|
||||
}
|
||||
+#ifdef ENABLE_NATT
|
||||
+ if (iph2->ph1->natt_flags & NAT_DETECTED_PEER
|
||||
+ && _XIDT(iph2->id) != IPSECDOI_ID_IPV4_ADDR_SUBNET
|
||||
+ && _XIDT(iph2->id) != IPSECDOI_ID_IPV6_ADDR_SUBNET) {
|
||||
+ u_int16_t port;
|
||||
+
|
||||
+ port = extract_port(&spidx.src);
|
||||
+ memcpy(&spidx.src, iph2->ph1->remote,
|
||||
+ sysdep_sa_len(iph2->ph1->remote));
|
||||
+ set_port(&spidx.src, port);
|
||||
+ switch (spidx.src.ss_family) {
|
||||
+ case AF_INET:
|
||||
+ spidx.prefs = sizeof(struct in_addr) << 3;
|
||||
+ break;
|
||||
+#ifdef INET6
|
||||
+ case AF_INET6:
|
||||
+ spidx.prefs = sizeof(struct in6_addr) << 3;
|
||||
+ break;
|
||||
+#endif
|
||||
+ default:
|
||||
+ spidx.prefs = 0;
|
||||
+ break;
|
||||
+ }
|
||||
+ plog(LLV_DEBUG, LOCATION,
|
||||
+ NULL, "use NAT address %s as src\n",
|
||||
+ saddr2str((struct sockaddr *)&spidx.src));
|
||||
+ }
|
||||
+#endif
|
||||
} else {
|
||||
plog(LLV_DEBUG, LOCATION, NULL,
|
||||
"get a source address of SP index from Phase 1"
|
||||
--- src/racoon/nattraversal.c
|
||||
+++ src/racoon/nattraversal.c
|
||||
@@ -436,10 +436,7 @@ natt_keepalive_add_ph1 (struct ph1handle
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
- /* Should only the NATed host send keepalives?
|
||||
- If yes, add '(iph1->natt_flags & NAT_DETECTED_ME)'
|
||||
- to the following condition. */
|
||||
- if (iph1->natt_flags & NAT_DETECTED &&
|
||||
+ if (iph1->natt_flags & NAT_DETECTED_ME &&
|
||||
! (iph1->natt_flags & NAT_KA_QUEUED)) {
|
||||
ret = natt_keepalive_add (iph1->local, iph1->remote);
|
||||
if (ret == 0)
|
||||
--- src/racoon/pfkey.c
|
||||
+++ src/racoon/pfkey.c
|
||||
@@ -1190,7 +1190,10 @@ pk_sendupdate(iph2)
|
||||
sa_args.l_natt_type = iph2->ph1->natt_options->encaps_type;
|
||||
sa_args.l_natt_sport = extract_port(iph2->ph1->remote);
|
||||
sa_args.l_natt_dport = extract_port(iph2->ph1->local);
|
||||
- sa_args.l_natt_oa = iph2->natoa_src;
|
||||
+ /* if (iph2->ph1->natt_flags & NAT_DETECTED_PEER) */
|
||||
+ sa_args.l_natt_oai = iph2->natoa_dst;
|
||||
+ /* if (iph2->ph1->natt_flags & NAT_DETECTED_ME) */
|
||||
+ sa_args.l_natt_oar = iph2->natoa_src;
|
||||
#ifdef SADB_X_EXT_NAT_T_FRAG
|
||||
sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag;
|
||||
#endif
|
||||
@@ -1477,7 +1480,6 @@ pk_sendadd(iph2)
|
||||
sa_args.l_natt_type = UDP_ENCAP_ESPINUDP;
|
||||
sa_args.l_natt_sport = extract_port(iph2->ph1->local);
|
||||
sa_args.l_natt_dport = extract_port(iph2->ph1->remote);
|
||||
- sa_args.l_natt_oa = iph2->natoa_dst;
|
||||
#ifdef SADB_X_EXT_NAT_T_FRAG
|
||||
sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag;
|
||||
#endif
|
||||
@@ -0,0 +1,22 @@
|
||||
Index: src/racoon/handler.h
|
||||
===================================================================
|
||||
RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/handler.h,v
|
||||
retrieving revision 1.25
|
||||
retrieving revision 1.26
|
||||
diff -p -u -r1.25 -r1.26
|
||||
--- src/racoon/handler.h 17 Nov 2010 10:40:41 -0000 1.25
|
||||
+++ src/racoon/handler.h 24 Jan 2017 19:23:56 -0000 1.26
|
||||
@@ -1,4 +1,4 @@
|
||||
-/* $NetBSD: handler.h,v 1.25 2010/11/17 10:40:41 tteras Exp $ */
|
||||
+/* $NetBSD: handler.h,v 1.26 2017/01/24 19:23:56 christos Exp $ */
|
||||
|
||||
/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
|
||||
|
||||
@@ -141,6 +141,7 @@ struct ph1handle {
|
||||
#endif
|
||||
#ifdef ENABLE_FRAG
|
||||
int frag; /* IKE phase 1 fragmentation */
|
||||
+ int frag_last_index;
|
||||
struct isakmp_frag_item *frag_chain; /* Received fragments */
|
||||
#endif
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
Index: src/racoon/isakmp.c
|
||||
===================================================================
|
||||
RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp.c,v
|
||||
retrieving revision 1.75
|
||||
retrieving revision 1.76
|
||||
diff -p -u -r1.75 -r1.76
|
||||
--- src/racoon/isakmp.c 9 Mar 2016 22:27:17 -0000 1.75
|
||||
+++ src/racoon/isakmp.c 24 Jan 2017 19:23:56 -0000 1.76
|
||||
@@ -1,4 +1,4 @@
|
||||
-/* $NetBSD: isakmp.c,v 1.75 2016/03/09 22:27:17 christos Exp $ */
|
||||
+/* $NetBSD: isakmp.c,v 1.76 2017/01/24 19:23:56 christos Exp $ */
|
||||
|
||||
/* Id: isakmp.c,v 1.74 2006/05/07 21:32:59 manubsd Exp */
|
||||
|
||||
@@ -1077,6 +1077,7 @@ isakmp_ph1begin_i(rmconf, remote, local)
|
||||
iph1->frag = 1;
|
||||
else
|
||||
iph1->frag = 0;
|
||||
+ iph1->frag_last_index = 0;
|
||||
iph1->frag_chain = NULL;
|
||||
#endif
|
||||
iph1->approval = NULL;
|
||||
@@ -1181,6 +1182,7 @@ isakmp_ph1begin_r(msg, remote, local, et
|
||||
#endif
|
||||
#ifdef ENABLE_FRAG
|
||||
iph1->frag = 0;
|
||||
+ iph1->frag_last_index = 0;
|
||||
iph1->frag_chain = NULL;
|
||||
#endif
|
||||
iph1->approval = NULL;
|
||||
@@ -0,0 +1,151 @@
|
||||
Index: src/racoon/isakmp_frag.c
|
||||
===================================================================
|
||||
RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c,v
|
||||
retrieving revision 1.5
|
||||
retrieving revision 1.7
|
||||
diff -p -u -r1.5 -r1.7
|
||||
--- src/racoon/isakmp_frag.c 22 Apr 2009 11:24:20 -0000 1.5
|
||||
+++ src/racoon/isakmp_frag.c 23 Jul 2017 05:40:27 -0000 1.7
|
||||
@@ -1,4 +1,4 @@
|
||||
-/* $NetBSD: isakmp_frag.c,v 1.5 2009/04/22 11:24:20 tteras Exp $ */
|
||||
+/* $NetBSD: isakmp_frag.c,v 1.7 2017/07/23 05:40:27 christos Exp $ */
|
||||
|
||||
/* Id: isakmp_frag.c,v 1.4 2004/11/13 17:31:36 manubsd Exp */
|
||||
|
||||
@@ -173,6 +173,43 @@ vendorid_frag_cap(gen)
|
||||
return ntohl(hp[MD5_DIGEST_LENGTH / sizeof(*hp)]);
|
||||
}
|
||||
|
||||
+static int
|
||||
+isakmp_frag_insert(struct ph1handle *iph1, struct isakmp_frag_item *item)
|
||||
+{
|
||||
+ struct isakmp_frag_item *pitem = NULL;
|
||||
+ struct isakmp_frag_item *citem = iph1->frag_chain;
|
||||
+
|
||||
+ /* no frag yet, just insert at beginning of list */
|
||||
+ if (iph1->frag_chain == NULL) {
|
||||
+ iph1->frag_chain = item;
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+ do {
|
||||
+ /* duplicate fragment number, abort (CVE-2016-10396) */
|
||||
+ if (citem->frag_num == item->frag_num)
|
||||
+ return -1;
|
||||
+
|
||||
+ /* need to insert before current item */
|
||||
+ if (citem->frag_num > item->frag_num) {
|
||||
+ if (pitem != NULL)
|
||||
+ pitem->frag_next = item;
|
||||
+ else
|
||||
+ /* insert at the beginning of the list */
|
||||
+ iph1->frag_chain = item;
|
||||
+ item->frag_next = citem;
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+ pitem = citem;
|
||||
+ citem = citem->frag_next;
|
||||
+ } while (citem != NULL);
|
||||
+
|
||||
+ /* we reached the end of the list, insert */
|
||||
+ pitem->frag_next = item;
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
int
|
||||
isakmp_frag_extract(iph1, msg)
|
||||
struct ph1handle *iph1;
|
||||
@@ -224,39 +261,43 @@ isakmp_frag_extract(iph1, msg)
|
||||
item->frag_next = NULL;
|
||||
item->frag_packet = buf;
|
||||
|
||||
- /* Look for the last frag while inserting the new item in the chain */
|
||||
- if (item->frag_last)
|
||||
- last_frag = item->frag_num;
|
||||
+ /* Check for the last frag before inserting the new item in the chain */
|
||||
+ if (item->frag_last) {
|
||||
+ /* if we have the last fragment, indices must match */
|
||||
+ if (iph1->frag_last_index != 0 &&
|
||||
+ item->frag_last != iph1->frag_last_index) {
|
||||
+ plog(LLV_ERROR, LOCATION, NULL,
|
||||
+ "Repeated last fragment index mismatch\n");
|
||||
+ racoon_free(item);
|
||||
+ vfree(buf);
|
||||
+ return -1;
|
||||
+ }
|
||||
|
||||
- if (iph1->frag_chain == NULL) {
|
||||
- iph1->frag_chain = item;
|
||||
- } else {
|
||||
- struct isakmp_frag_item *current;
|
||||
+ last_frag = iph1->frag_last_index = item->frag_num;
|
||||
+ }
|
||||
|
||||
- current = iph1->frag_chain;
|
||||
- while (current->frag_next) {
|
||||
- if (current->frag_last)
|
||||
- last_frag = item->frag_num;
|
||||
- current = current->frag_next;
|
||||
- }
|
||||
- current->frag_next = item;
|
||||
+ /* insert fragment into chain */
|
||||
+ if (isakmp_frag_insert(iph1, item) == -1) {
|
||||
+ plog(LLV_ERROR, LOCATION, NULL,
|
||||
+ "Repeated fragment index mismatch\n");
|
||||
+ racoon_free(item);
|
||||
+ vfree(buf);
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
- /* If we saw the last frag, check if the chain is complete */
|
||||
+ /* If we saw the last frag, check if the chain is complete
|
||||
+ * we have a sorted list now, so just walk through */
|
||||
if (last_frag != 0) {
|
||||
+ item = iph1->frag_chain;
|
||||
for (i = 1; i <= last_frag; i++) {
|
||||
- item = iph1->frag_chain;
|
||||
- do {
|
||||
- if (item->frag_num == i)
|
||||
- break;
|
||||
- item = item->frag_next;
|
||||
- } while (item != NULL);
|
||||
-
|
||||
+ if (item->frag_num != i)
|
||||
+ break;
|
||||
+ item = item->frag_next;
|
||||
if (item == NULL) /* Not found */
|
||||
break;
|
||||
}
|
||||
|
||||
- if (item != NULL) /* It is complete */
|
||||
+ if (i > last_frag) /* It is complete */
|
||||
return 1;
|
||||
}
|
||||
|
||||
@@ -291,15 +332,9 @@ isakmp_frag_reassembly(iph1)
|
||||
}
|
||||
data = buf->v;
|
||||
|
||||
+ item = iph1->frag_chain;
|
||||
for (i = 1; i <= frag_count; i++) {
|
||||
- item = iph1->frag_chain;
|
||||
- do {
|
||||
- if (item->frag_num == i)
|
||||
- break;
|
||||
- item = item->frag_next;
|
||||
- } while (item != NULL);
|
||||
-
|
||||
- if (item == NULL) {
|
||||
+ if (item->frag_num != i) {
|
||||
plog(LLV_ERROR, LOCATION, NULL,
|
||||
"Missing fragment #%d\n", i);
|
||||
vfree(buf);
|
||||
@@ -308,6 +343,7 @@ isakmp_frag_reassembly(iph1)
|
||||
}
|
||||
memcpy(data, item->frag_packet->v, item->frag_packet->l);
|
||||
data += item->frag_packet->l;
|
||||
+ item = item->frag_next;
|
||||
}
|
||||
|
||||
out:
|
||||
@@ -0,0 +1,22 @@
|
||||
Index: src/racoon/isakmp_inf.c
|
||||
===================================================================
|
||||
RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp_inf.c,v
|
||||
retrieving revision 1.50
|
||||
retrieving revision 1.51
|
||||
diff -p -u -r1.50 -r1.51
|
||||
--- src/racoon/isakmp_inf.c 12 Apr 2013 09:53:10 -0000 1.50
|
||||
+++ src/racoon/isakmp_inf.c 24 Jan 2017 19:23:56 -0000 1.51
|
||||
@@ -1,4 +1,4 @@
|
||||
-/* $NetBSD: isakmp_inf.c,v 1.50 2013/04/12 09:53:10 tteras Exp $ */
|
||||
+/* $NetBSD: isakmp_inf.c,v 1.51 2017/01/24 19:23:56 christos Exp $ */
|
||||
|
||||
/* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */
|
||||
|
||||
@@ -720,6 +720,7 @@ isakmp_info_send_nx(isakmp, remote, loca
|
||||
#endif
|
||||
#ifdef ENABLE_FRAG
|
||||
iph1->frag = 0;
|
||||
+ iph1->frag_last_index = 0;
|
||||
iph1->frag_chain = NULL;
|
||||
#endif
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
--- src/racoon/isakmp_var.h.orig 2010-11-12 16:36:37.000000000 +0600
|
||||
+++ src/racoon/isakmp_var.h 2018-04-27 22:15:58.249644000 +0700
|
||||
@@ -128,7 +128,7 @@
|
||||
#endif
|
||||
|
||||
extern int copy_ph1addresses __P(( struct ph1handle *,
|
||||
- struct remoteconf *, struct sockaddr *, struct sockaddr *));
|
||||
+ struct remoteconf *, struct sockaddr *, struct sockaddr *, int));
|
||||
extern void log_ph1established __P((const struct ph1handle *));
|
||||
|
||||
extern void script_hook __P((struct ph1handle *, int));
|
||||
--- src/racoon/isakmp.c.orig 2018-04-27 22:13:23.465260000 +0700
|
||||
+++ src/racoon/isakmp.c 2018-04-27 22:20:44.865139000 +0700
|
||||
@@ -1075,7 +1075,7 @@ isakmp_ph1begin_i(rmconf, remote, local)
|
||||
iph1->approval = NULL;
|
||||
|
||||
/* XXX copy remote address */
|
||||
- if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) {
|
||||
+ if (copy_ph1addresses(iph1, rmconf, remote, local, 1) < 0) {
|
||||
delph1(iph1);
|
||||
return NULL;
|
||||
}
|
||||
@@ -1190,7 +1190,7 @@ isakmp_ph1begin_r(msg, remote, local, et
|
||||
|
||||
/* copy remote address; remote and local always contain
|
||||
* port numbers so rmconf is not needed */
|
||||
- if (copy_ph1addresses(iph1, NULL, remote, local) < 0) {
|
||||
+ if (copy_ph1addresses(iph1, NULL, remote, local, 0) < 0) {
|
||||
delph1(iph1);
|
||||
return -1;
|
||||
}
|
||||
@@ -2906,10 +2906,11 @@ isakmp_printpacket(msg, from, my, decode
|
||||
#endif /*HAVE_PRINT_ISAKMP_C*/
|
||||
|
||||
int
|
||||
-copy_ph1addresses(iph1, rmconf, remote, local)
|
||||
+copy_ph1addresses(iph1, rmconf, remote, local, initiator)
|
||||
struct ph1handle *iph1;
|
||||
struct remoteconf *rmconf;
|
||||
struct sockaddr *remote, *local;
|
||||
+ int initiator;
|
||||
{
|
||||
u_int16_t port;
|
||||
|
||||
@@ -2925,7 +2926,7 @@ copy_ph1addresses(iph1, rmconf, remote,
|
||||
* if remote has port # (in case of responder - from recvfrom(2))
|
||||
* respect content of "remote".
|
||||
*/
|
||||
- if (extract_port(iph1->remote) == 0) {
|
||||
+ if (initiator || extract_port(iph1->remote) == 0) {
|
||||
port = 0;
|
||||
if (rmconf != NULL)
|
||||
port = extract_port(rmconf->remote);
|
||||
--- src/racoon/isakmp_inf.c.orig 2018-04-27 22:13:23.482870000 +0700
|
||||
+++ src/racoon/isakmp_inf.c 2018-04-27 22:21:27.080881000 +0700
|
||||
@@ -725,7 +725,7 @@ isakmp_info_send_nx(isakmp, remote, loca
|
||||
#endif
|
||||
|
||||
/* copy remote address */
|
||||
- if (copy_ph1addresses(iph1, NULL, remote, local) < 0)
|
||||
+ if (copy_ph1addresses(iph1, NULL, remote, local, 0) < 0)
|
||||
goto end;
|
||||
|
||||
tlen = sizeof(*n) + spisiz;
|
||||
@@ -0,0 +1,176 @@
|
||||
--- src/racoon/cfparse.y 22 Aug 2006 18:17:17 -0000 1.66
|
||||
+++ src/racoon/cfparse.y 13 May 2018 01:53:57 -0000
|
||||
@@ -284,7 +284,7 @@ static int process_rmconf()
|
||||
/* algorithm */
|
||||
%token ALGORITHM_CLASS ALGORITHMTYPE STRENGTHTYPE
|
||||
/* sainfo */
|
||||
-%token SAINFO FROM
|
||||
+%token SAINFO FROM REQID
|
||||
/* remote */
|
||||
%token REMOTE ANONYMOUS CLIENTADDR INHERIT REMOTE_ADDRESS
|
||||
%token EXCHANGE_MODE EXCHANGETYPE DOI DOITYPE SITUATION SITUATIONTYPE
|
||||
@@ -1571,6 +1571,11 @@ sainfo_spec
|
||||
| REMOTEID NUMBER
|
||||
{
|
||||
cur_sainfo->remoteid = $2;
|
||||
+ }
|
||||
+ EOS
|
||||
+ | REQID NUMBER
|
||||
+ {
|
||||
+ cur_sainfo->reqid = $2;
|
||||
}
|
||||
EOS
|
||||
| LIFETIME LIFETYPE_TIME NUMBER unittype_time
|
||||
--- src/racoon/cftoken.l 22 Aug 2006 18:17:17 -0000 1.53
|
||||
+++ src/racoon/cftoken.l 13 May 2018 01:53:57 -0000
|
||||
@@ -290,6 +290,7 @@
|
||||
<S_SAINFS>identifier { YYD; yywarn("it is obsoleted. use \"my_identifier\"."); return(IDENTIFIER); }
|
||||
<S_SAINFS>my_identifier { YYD; return(MY_IDENTIFIER); }
|
||||
<S_SAINFS>lifetime { YYD; return(LIFETIME); }
|
||||
+<S_SAINFS>reqid { YYD; return(REQID); }
|
||||
<S_SAINFS>time { YYD; return(LIFETYPE_TIME); }
|
||||
<S_SAINFS>byte { YYD; return(LIFETYPE_BYTE); }
|
||||
<S_SAINFS>encryption_algorithm { YYD; yylval.num = algclass_ipsec_enc; return(ALGORITHM_CLASS); }
|
||||
--- src/racoon/proposal.c 27 Apr 2006 03:41:54 -0000 1.19
|
||||
+++ src/racoon/proposal.c 13 May 2018 01:53:58 -0000
|
||||
@@ -1253,8 +1253,8 @@ set_proposal_from_proposal(iph2)
|
||||
if(g_nextreqid >= IPSEC_MANUAL_REQID_MAX)
|
||||
g_nextreqid = 1;
|
||||
}else{
|
||||
- newpr->reqid_in = 0;
|
||||
- newpr->reqid_out = 0;
|
||||
+ newpr->reqid_in = iph2->sainfo->reqid;
|
||||
+ newpr->reqid_out = iph2->sainfo->reqid;
|
||||
}
|
||||
|
||||
if (set_satrnsbysainfo(newpr, iph2->sainfo) < 0)
|
||||
--- src/racoon/sainfo.c 11 Aug 2006 16:07:05 -0000 1.9
|
||||
+++ src/racoon/sainfo.c 13 May 2018 01:53:58 -0000
|
||||
@@ -383,8 +383,8 @@ sainfo2str(si)
|
||||
else
|
||||
id_i = ipsecdoi_id2str(si->id_i);
|
||||
|
||||
- snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u",
|
||||
- idloc, idrmt, id_i, si->remoteid);
|
||||
+ snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u, reqid=%u",
|
||||
+ idloc, idrmt, id_i, si->remoteid, si->reqid);
|
||||
|
||||
racoon_free(idloc);
|
||||
racoon_free(idrmt);
|
||||
--- src/racoon/sainfo.h 9 Jul 2006 17:19:38 -0000 1.5
|
||||
+++ src/racoon/sainfo.h 13 May 2018 01:53:58 -0000
|
||||
@@ -51,6 +51,7 @@
|
||||
time_t lifetime;
|
||||
int lifebyte;
|
||||
int pfs_group; /* only use when pfs is required. */
|
||||
+ uint32_t reqid;
|
||||
vchar_t *id_i; /* identifier of the authorized initiator */
|
||||
struct sainfoalg *algs[MAXALGCLASS];
|
||||
|
||||
--- src/racoon/policy.h 2018-05-13 07:42:14.828102000 +0300
|
||||
+++ src/racoon/policy.h 2018-05-13 07:41:44.807564000 +0300
|
||||
@@ -66,6 +66,7 @@ struct policyindex {
|
||||
u_int16_t ul_proto; /* upper layer Protocol */
|
||||
u_int32_t priority; /* priority for the policy */
|
||||
u_int64_t created; /* Used for generated SPD entries deletion */
|
||||
+ u_int32_t reqid; /* Reqid used for if_ipsec(4) */
|
||||
#ifdef HAVE_SECCTX
|
||||
struct security_ctx sec_ctx; /* Security Context */
|
||||
#endif
|
||||
--- src/racoon/isakmp_quick.c 2018-05-13 08:07:07.378039000 +0300
|
||||
+++ src/racoon/isakmp_quick.c 2018-05-13 08:11:12.268612000 +0300
|
||||
@@ -2473,6 +2473,7 @@ get_proposal_r(iph2)
|
||||
#endif /* HAVE_SECCTX */
|
||||
|
||||
/* get inbound policy */
|
||||
+ spidx.reqid = iph2->sainfo->reqid;
|
||||
sp_in = getsp_r(&spidx);
|
||||
if (sp_in == NULL) {
|
||||
if (iph2->ph1->rmconf->gen_policy) {
|
||||
@@ -2521,6 +2522,7 @@ get_proposal_r(iph2)
|
||||
spidx.prefs = spidx.prefd;
|
||||
spidx.prefd = pref;
|
||||
|
||||
+ spidx.reqid = iph2->sainfo->reqid;
|
||||
sp_out = getsp_r(&spidx);
|
||||
if (!sp_out) {
|
||||
plog(LLV_WARNING, LOCATION, NULL,
|
||||
--- src/racoon/pfkey.c 2018-05-13 08:12:05.730604000 +0300
|
||||
+++ src/racoon/pfkey.c 2018-05-13 08:48:02.708803000 +0300
|
||||
@@ -1888,6 +1888,10 @@ pk_recvacquire(mhp)
|
||||
spidx.prefs = sp_out->spidx.prefd;
|
||||
spidx.prefd = sp_out->spidx.prefs;
|
||||
spidx.ul_proto = sp_out->spidx.ul_proto;
|
||||
+#ifdef IPSEC_POLICYSCOPE_IFNET
|
||||
+ /* XXX: reuse reqid from outbound policy */
|
||||
+ spidx.reqid = sp_out->spidx.reqid;
|
||||
+#endif
|
||||
|
||||
#ifdef HAVE_SECCTX
|
||||
if (m_sec_ctx) {
|
||||
@@ -2787,6 +2791,25 @@ pk_recvspddump(mhp)
|
||||
}
|
||||
#endif /* HAVE_SECCTX */
|
||||
|
||||
+#ifdef IPSEC_POLICYSCOPE_IFNET
|
||||
+ if (xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET) {
|
||||
+ struct sadb_x_ipsecrequest *xisr;
|
||||
+
|
||||
+ if (PFKEY_EXTLEN(xpl) < sizeof(*xpl)) {
|
||||
+ plog(LLV_ERROR, LOCATION, NULL,
|
||||
+ "invalid xpl msg length.\n");
|
||||
+ return (-1);
|
||||
+ }
|
||||
+ xisr = (struct sadb_x_ipsecrequest *)(xpl + 1);
|
||||
+ if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr)) {
|
||||
+ plog(LLV_ERROR, LOCATION, NULL,
|
||||
+ "invalid xisr msg length.\n");
|
||||
+ return (-1);
|
||||
+ }
|
||||
+ spidx.reqid = xisr->sadb_x_ipsecrequest_reqid;
|
||||
+ }
|
||||
+#endif /* IPSEC_POLICYSCOPE_IFNET */
|
||||
+
|
||||
sp = getsp(&spidx);
|
||||
if (sp != NULL) {
|
||||
plog(LLV_ERROR, LOCATION, NULL,
|
||||
@@ -3909,6 +3932,15 @@ addnewsp(mhp, local, remote)
|
||||
created,
|
||||
&new->spidx);
|
||||
#endif
|
||||
+
|
||||
+#ifdef IPSEC_POLICYSCOPE_IFNET
|
||||
+ if (xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET) {
|
||||
+ struct sadb_x_ipsecrequest *xisr;
|
||||
+
|
||||
+ xisr = (struct sadb_x_ipsecrequest *)(xpl + 1);
|
||||
+ new->spidx.reqid = xisr->sadb_x_ipsecrequest_reqid;
|
||||
+ }
|
||||
+#endif /* IPSEC_POLICYSCOPE_IFNET */
|
||||
|
||||
#ifdef HAVE_SECCTX
|
||||
if (mhp[SADB_X_EXT_SEC_CTX] != NULL) {
|
||||
--- src/racoon/policy.c 2018-05-13 07:17:32.815475000 +0300
|
||||
+++ src/racoon/policy.c 2018-05-13 07:44:40.838093000 +0300
|
||||
@@ -197,7 +197,8 @@ cmpspidxstrict(a, b)
|
||||
if (a->dir != b->dir
|
||||
|| a->prefs != b->prefs
|
||||
|| a->prefd != b->prefd
|
||||
- || a->ul_proto != b->ul_proto)
|
||||
+ || a->ul_proto != b->ul_proto
|
||||
+ || a->reqid != b->reqid)
|
||||
return 1;
|
||||
|
||||
if (cmpsaddr((struct sockaddr *) &a->src,
|
||||
@@ -482,8 +483,9 @@ spidx2str(spidx)
|
||||
p += i;
|
||||
blen -= i;
|
||||
|
||||
- i = snprintf(p, blen, "proto=%s dir=%s",
|
||||
- s_proto(spidx->ul_proto), s_direction(spidx->dir));
|
||||
+ i = snprintf(p, blen, "proto=%s dir=%s reqid=%u",
|
||||
+ s_proto(spidx->ul_proto), s_direction(spidx->dir),
|
||||
+ spidx->reqid);
|
||||
|
||||
#ifdef HAVE_SECCTX
|
||||
if (spidx->sec_ctx.ctx_strlen) {
|
||||
@@ -0,0 +1,28 @@
|
||||
--- src/racoon/isakmp_cfg.c
|
||||
+++ src/racoon/isakmp_cfg.c
|
||||
@@ -38,7 +38,9 @@
|
||||
#include <sys/socket.h>
|
||||
#include <sys/queue.h>
|
||||
|
||||
+#if __FreeBSD_version >= 900007
|
||||
#include <utmpx.h>
|
||||
+#endif
|
||||
#if defined(__APPLE__) && defined(__MACH__)
|
||||
#include <util.h>
|
||||
#endif
|
||||
@@ -1663,6 +1665,7 @@
|
||||
char *usr;
|
||||
int inout;
|
||||
{
|
||||
+#if __FreeBSD_version >= 900007
|
||||
int error = 0;
|
||||
struct utmpx ut;
|
||||
char addr[NI_MAXHOST];
|
||||
@@ -1706,6 +1709,7 @@
|
||||
plog(LLV_ERROR, LOCATION, NULL, "Unepected inout\n");
|
||||
break;
|
||||
}
|
||||
+#endif
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
--- src/racoon/gssapi.c.orig 2015-05-19 16:38:06 UTC
|
||||
+++ src/racoon/gssapi.c
|
||||
@@ -192,6 +192,11 @@ gssapi_init(struct ph1handle *iph1)
|
||||
gss_name_t princ, canon_princ;
|
||||
OM_uint32 maj_stat, min_stat;
|
||||
|
||||
+ if (iph1->rmconf == NULL) {
|
||||
+ plog(LLV_ERROR, LOCATION, NULL, "no remote config\n");
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
gps = racoon_calloc(1, sizeof (struct gssapi_ph1_state));
|
||||
if (gps == NULL) {
|
||||
plog(LLV_ERROR, LOCATION, NULL, "racoon_calloc failed\n");
|
||||
@@ -0,0 +1,51 @@
|
||||
#!/bin/sh
|
||||
|
||||
# PROVIDE: racoon
|
||||
# REQUIRE: LOGIN
|
||||
# KEYWORD: shutdown
|
||||
#
|
||||
# Define these racoon_* variables in one of these files:
|
||||
# /etc/rc.conf
|
||||
# /etc/rc.conf.local
|
||||
# /etc/rc.conf.d/racoon
|
||||
#
|
||||
# DO NOT CHANGE THESE DEFAULT VALUES HERE
|
||||
|
||||
. /etc/rc.subr
|
||||
|
||||
name="racoon"
|
||||
rcvar=racoon_enable
|
||||
|
||||
load_rc_config $name
|
||||
|
||||
racoon_enable=${racoon_enable:-"NO"} # Disable by default
|
||||
racoon_dirs=${racoon_dirs:-"%%STATEDIR%%"} # For controlling socket
|
||||
racoon_create_dirs=${racoon_create_dirs:-"NO"} # Create $racoon_dirs
|
||||
#racoon_flags="" # Flags to racoon program
|
||||
|
||||
command="%%PREFIX%%/sbin/${name}"
|
||||
pidfile="/var/run/${name}.pid"
|
||||
|
||||
start_precmd="${name}_prestart"
|
||||
stop_postcmd="${name}_cleanup"
|
||||
|
||||
socketfile="%%STATEDIR%%/${name}.sock"
|
||||
required_files="%%PREFIX%%/etc/${name}/${name}.conf"
|
||||
required_modules="%%REQUIREMOD%%"
|
||||
|
||||
racoon_cleanup()
|
||||
{
|
||||
/bin/rm -f ${pidfile}
|
||||
/bin/rm -f ${socketfile}
|
||||
}
|
||||
|
||||
racoon_prestart()
|
||||
{
|
||||
racoon_cleanup
|
||||
|
||||
if checkyesno "${name}_create_dirs"; then
|
||||
install -m 0755 -d $racoon_dirs
|
||||
fi
|
||||
}
|
||||
|
||||
run_rc_command "$1"
|
||||
@@ -0,0 +1,22 @@
|
||||
--- src/racoon/oakley.c.orig 2012-08-29 18:35:09.000000000 +0700
|
||||
+++ src/racoon/oakley.c 2019-07-01 11:03:18.864245000 +0700
|
||||
@@ -2400,7 +2400,19 @@ oakley_skeyid(iph1)
|
||||
case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
|
||||
#endif
|
||||
if (iph1->etype != ISAKMP_ETYPE_IDENT) {
|
||||
+ struct ipsecdoi_id_b *id_b;
|
||||
+
|
||||
+ id_b = (struct ipsecdoi_id_b *)iph1->id_p->v;
|
||||
+ if (id_b->type != IPSECDOI_ID_IPV4_ADDR &&
|
||||
+ id_b->type != IPSECDOI_ID_IPV6_ADDR)
|
||||
iph1->authstr = getpskbyname(iph1->id_p);
|
||||
+ else {
|
||||
+ struct sockaddr addr;
|
||||
+ u_int16_t ul_proto;
|
||||
+ u_int8_t prefix;
|
||||
+ if (!ipsecdoi_id2sockaddr(iph1->id_p, &addr, &prefix, &ul_proto))
|
||||
+ iph1->authstr = getpskbyaddr(&addr);
|
||||
+ }
|
||||
if (iph1->authstr == NULL) {
|
||||
if (iph1->rmconf->verify_identifier) {
|
||||
plog(LLV_ERROR, LOCATION, iph1->remote,
|
||||
@@ -0,0 +1,12 @@
|
||||
--- src/racoon/localconf.c 9 Sep 2006 16:22:09 -0000 1.4
|
||||
+++ src/racoon/localconf.c 11 Jul 2008 20:58:55 -0000
|
||||
@@ -211,7 +211,8 @@ getpsk(str, len)
|
||||
if (*p == '\0')
|
||||
continue; /* no 2nd parameter */
|
||||
p--;
|
||||
- if (strncmp(buf, str, len) == 0 && buf[len] == '\0') {
|
||||
+ if (strcmp(buf, "*") == 0
|
||||
+ || (strncmp(buf, str, len) == 0 && buf[len] == '\0')) {
|
||||
p++;
|
||||
keylen = 0;
|
||||
for (q = p; *q != '\0' && *q != '\n'; q++)
|
||||
@@ -0,0 +1,22 @@
|
||||
racoon speaks IKE (ISAKMP/Oakley) key management protocol, to
|
||||
establish security association with other hosts.
|
||||
|
||||
This is the IPSec-tools version of racoon.
|
||||
|
||||
Enchancements:
|
||||
- Support of NAT-T and IKE fragmentation.
|
||||
- Support of many authentication algorithms.
|
||||
- Tons of bugfixes.
|
||||
|
||||
Known issues:
|
||||
- Non-threaded implementation. Simultaneous key negotiation performance
|
||||
should be improved.
|
||||
- Cannot negotiate keys for per-socket policy.
|
||||
- Cryptic configuration syntax - blame IPsec specification too...
|
||||
- Needs more documentation.
|
||||
|
||||
Design choice, not a bug:
|
||||
- racoon negotiate IPsec keys only. It does not negotiate policy. Policy must
|
||||
be configured into the kernel separately from racoon. If you want to
|
||||
support roaming clients, you may need to have a mechanism to put policy
|
||||
for the roaming client after phase 1 finishes.
|
||||
@@ -0,0 +1,37 @@
|
||||
sbin/plainrsa-gen
|
||||
sbin/racoon
|
||||
sbin/racoonctl
|
||||
sbin/setkey
|
||||
include/libipsec/libpfkey.h
|
||||
include/racoon/admin.h
|
||||
include/racoon/evt.h
|
||||
include/racoon/gcmalloc.h
|
||||
include/racoon/ipsec_doi.h
|
||||
include/racoon/isakmp.h
|
||||
include/racoon/isakmp_cfg.h
|
||||
include/racoon/isakmp_unity.h
|
||||
include/racoon/isakmp_var.h
|
||||
include/racoon/isakmp_xauth.h
|
||||
include/racoon/misc.h
|
||||
include/racoon/racoonctl.h
|
||||
include/racoon/schedule.h
|
||||
include/racoon/sockmisc.h
|
||||
include/racoon/var.h
|
||||
include/racoon/vmbuf.h
|
||||
lib/libipsec.a
|
||||
lib/libipsec.so
|
||||
lib/libipsec.so.0
|
||||
lib/libipsec.so.0.0.1
|
||||
lib/libracoon.a
|
||||
lib/libracoon.so
|
||||
lib/libracoon.so.0
|
||||
lib/libracoon.so.0.0.0
|
||||
share/man/man3/ipsec_set_policy.3.gz
|
||||
share/man/man3/ipsec_strerror.3.gz
|
||||
share/man/man5/racoon.conf.5.gz
|
||||
share/man/man8/plainrsa-gen.8.gz
|
||||
share/man/man8/racoon.8.gz
|
||||
share/man/man8/racoonctl.8.gz
|
||||
share/man/man8/setkey.8.gz
|
||||
@dir etc/racoon
|
||||
@dir %%STATEDIR%%
|
||||
Reference in New Issue
Block a user