From 63e90eb697a6bc3eadb784e40e2060223a9a3d83 Mon Sep 17 00:00:00 2001 From: Eugene Grosbein Date: Wed, 5 Feb 2025 10:37:16 +0700 Subject: [PATCH] security/ipsec-tools: re-add the port I use the software and will maintain the port. Our port has no known security issues, it has patches obtained from NetBSD CVS Repository. Change WWW to point to that repo. Still, download same distfile from the SourceForge. Add TIMESTAMP to distinfo. --- MOVED | 1 - security/Makefile | 1 + security/ipsec-tools/Makefile | 104 ++ security/ipsec-tools/distinfo | 3 + .../ipsec-tools/files/extra-patch-ipsec-tools | 1035 +++++++++++++++++ security/ipsec-tools/files/natt.diff | 155 +++ security/ipsec-tools/files/patch-handler.c | 22 + security/ipsec-tools/files/patch-isakmp.c | 30 + .../ipsec-tools/files/patch-isakmp_frag.c | 151 +++ security/ipsec-tools/files/patch-isakmp_inf.c | 22 + security/ipsec-tools/files/patch-isakmpinit | 64 + security/ipsec-tools/files/patch-reqid.diff | 176 +++ .../files/patch-src-racoon-isakmp_cfg.c | 28 + .../files/patch-src_racoon_gssapi.c | 14 + security/ipsec-tools/files/racoon.in | 51 + .../files/wildcard-psk-oakley.c.diff | 22 + security/ipsec-tools/files/wildcard-psk.diff | 12 + security/ipsec-tools/pkg-descr | 22 + security/ipsec-tools/pkg-plist | 37 + 19 files changed, 1949 insertions(+), 1 deletion(-) create mode 100644 security/ipsec-tools/Makefile create mode 100644 security/ipsec-tools/distinfo create mode 100644 security/ipsec-tools/files/extra-patch-ipsec-tools create mode 100644 security/ipsec-tools/files/natt.diff create mode 100644 security/ipsec-tools/files/patch-handler.c create mode 100644 security/ipsec-tools/files/patch-isakmp.c create mode 100644 security/ipsec-tools/files/patch-isakmp_frag.c create mode 100644 security/ipsec-tools/files/patch-isakmp_inf.c create mode 100644 security/ipsec-tools/files/patch-isakmpinit create mode 100644 security/ipsec-tools/files/patch-reqid.diff create mode 100644 security/ipsec-tools/files/patch-src-racoon-isakmp_cfg.c create mode 100644 security/ipsec-tools/files/patch-src_racoon_gssapi.c create mode 100644 security/ipsec-tools/files/racoon.in create mode 100644 security/ipsec-tools/files/wildcard-psk-oakley.c.diff create mode 100644 security/ipsec-tools/files/wildcard-psk.diff create mode 100644 security/ipsec-tools/pkg-descr create mode 100644 security/ipsec-tools/pkg-plist diff --git a/MOVED b/MOVED index 28c102afcb93..7ff0d6f7fde2 100644 --- a/MOVED +++ b/MOVED @@ -4135,4 +4135,3 @@ devel/p5-Test-HTML-Tidy||2025-02-04|Has expired: Depends on expired textproc/p5- www/p5-CGI-Application-Plugin-HtmlTidy||2025-02-04|Has expired: Depends on expired textproc/p5-HTML-Tidy textproc/p5-HTML-Tidy||2025-02-04|Has expired: Depends on expired textproc/tidyp textproc/tidyp||2025-02-04|Has expired: The repository has been archived by upstream on Apr 14, 2019 -security/ipsec-tools||2025-02-04|Has expired: Deprecated by upstream in 2014, contains security issues diff --git a/security/Makefile b/security/Makefile index 9ac224036c64..5cfd261889ea 100644 --- a/security/Makefile +++ b/security/Makefile @@ -240,6 +240,7 @@ SUBDIR += intel-ipsec-mb SUBDIR += ipfmeta SUBDIR += ipguard + SUBDIR += ipsec-tools SUBDIR += ipv6toolkit SUBDIR += isal-kmod SUBDIR += ismtp diff --git a/security/ipsec-tools/Makefile b/security/ipsec-tools/Makefile new file mode 100644 index 000000000000..8ba6e0d49df7 --- /dev/null +++ b/security/ipsec-tools/Makefile @@ -0,0 +1,104 @@ +PORTNAME= ipsec-tools +PORTVERSION= 0.8.2 +PORTREVISION= 13 +CATEGORIES= security +MASTER_SITES= SF + +MAINTAINER= eugen@FreeBSD.org +COMMENT= KAME racoon IKE daemon, ipsec-tools version +WWW= http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/ + +LICENSE= BSD3CLAUSE + +USES= cpe libtool tar:bzip2 ssl + +CONFLICTS= racoon +INSTALL_TARGET= install-strip +USE_RC_SUBR= racoon +GNU_CONFIGURE= yes +GNU_CONFIGURE_MANPREFIX=${PREFIX}/share +USE_LDCONFIG= yes +CONFIGURE_ARGS= --enable-shared --sysconfdir=${PREFIX}/etc/racoon \ + --localstatedir=${STATEDIR:S/\/racoon//} + +STATEDIR= /var/db/racoon +SUB_LIST+= STATEDIR=${STATEDIR} REQUIREMOD=${REQUIREMOD} +PLIST_SUB+= STATEDIR=${STATEDIR} + +OPTIONS_DEFINE= IPV6 ADMINPORT STATS DPD NATT FRAG HYBRID PAM \ + RADIUS LDAP GSSAPI SAUNSPEC RC5 IDEA DOCS EXAMPLES WCPSKEY +OPTIONS_DEFAULT= ADMINPORT DPD NATT FRAG HYBRID WCPSKEY + +ADMINPORT_DESC= Enable Admin port +STATS_DESC= Statistics logging function +DPD_DESC= Dead Peer Detection +NATT_DESC= NAT-Traversal +FRAG_DESC= IKE fragmentation payload support +HYBRID_DESC= Hybrid, Xauth and Mode-cfg support +SAUNSPEC_DESC= Unspecified SA mode +RC5_DESC= RC5 encryption (patented) +IDEA_DESC= IDEA encryption (patented) +PAM_DESC= PAM authentication (Xauth server) +RADIUS_DESC= Radius authentication (Xauth server) +LDAP_DESC= LDAP authentication (Xauth server) +WCPSKEY_DESC= Allow wildcard matching for pre-shared keys + +PORTDOCS= * +PORTEXAMPLES= * + +IPV6_CONFIGURE_ENABLE= ipv6 +ADMINPORT_CONFIGURE_ENABLE=adminport +STATS_CONFIGURE_ENABLE= stats +DPD_CONFIGURE_ENABLE= dpd +NATT_CONFIGURE_ON= --enable-natt=yes --enable-natt-versions=rfc +NATT_CONFIGURE_OFF= --disable-natt +FRAG_CONFIGURE_ENABLE= frag +HYBRID_CONFIGURE_ENABLE=hybrid +PAM_CONFIGURE_WITH= libpam +GSSAPI_USES= iconv +GSSAPI_CFLAGS= -I${LOCALBASE}/include +GSSAPI_LDFLAGS= -L${LOCALBASE}/lib +GSSAPI_CONFIGURE_ENABLE=gssapi +RADIUS_CONFIGURE_WITH= libradius +LDAP_USES= ldap +LDAP_CONFIGURE_ON= --with-libldap=${LOCALBASE} +LDAP_CONFIGURE_OFF= --without-libldap +SAUNSPEC_CONFIGURE_ENABLE= samode-unspec +RC5_CONFIGURE_ENABLE= rc5 +IDEA_CONFIGURE_ENABLE= idea +NATT_EXTRA_PATCHES= ${FILESDIR}/natt.diff +WCPSKEY_EXTRA_PATCHES= ${FILESDIR}/wildcard-psk.diff ${FILESDIR}/wildcard-psk-oakley.c.diff + +.include + +.if ${OPSYS} == FreeBSD +REQUIREMOD?= ipsec +.endif + +post-patch: + @${REINPLACE_CMD} -e "s/-Werror//g ; s/-R$$libdir/-Wl,-rpath=$$libdir/g" ${WRKSRC}/configure + +post-install: + @${MKDIR} ${STAGEDIR}/${PREFIX}/etc/racoon + @if [ -z `/sbin/sysctl -a | ${GREP} -q ipsec && ${ECHO_CMD} ipsec` ]; then \ + ${ECHO_MSG} "WARNING: IPsec feature is disabled on this host"; \ + ${ECHO_MSG} " You must build the kernel if you want to run racoon on the host"; \ + fi ; + +post-install-EXAMPLES-on: + @${MKDIR} ${STAGEDIR}/${EXAMPLESDIR} + @${RM} ${WRKSRC}/src/racoon/samples/*.in + @${CP} -r ${WRKSRC}/src/racoon/samples/* ${STAGEDIR}/${EXAMPLESDIR} + +post-install-DOCS-on: + @${MKDIR} ${STAGEDIR}/${DOCSDIR} + ${INSTALL_DATA} ${WRKSRC}/src/racoon/doc/* ${STAGEDIR}/${DOCSDIR} + +.if ${OPSYS} == FreeBSD +. if ${SSL_DEFAULT} != openssl111 +EXTRA_PATCHES+= ${FILESDIR}/extra-patch-ipsec-tools +PLIST_FILES+= include/racoon/openssl_compat.h +. endif +.endif + +.include diff --git a/security/ipsec-tools/distinfo b/security/ipsec-tools/distinfo new file mode 100644 index 000000000000..8f367a222f84 --- /dev/null +++ b/security/ipsec-tools/distinfo @@ -0,0 +1,3 @@ +TIMESTAMP = 1738726293 +SHA256 (ipsec-tools-0.8.2.tar.bz2) = 8eb6b38716e2f3a8a72f1f549c9444c2bc28d52c9536792690564c74fe722f2d +SIZE (ipsec-tools-0.8.2.tar.bz2) = 866465 diff --git a/security/ipsec-tools/files/extra-patch-ipsec-tools b/security/ipsec-tools/files/extra-patch-ipsec-tools new file mode 100644 index 000000000000..718ad0e807ba --- /dev/null +++ b/security/ipsec-tools/files/extra-patch-ipsec-tools @@ -0,0 +1,1035 @@ +--- src/racoon/Makefile.in ++++ src/racoon/Makefile.in +@@ -571,7 +571,7 @@ top_builddir = @top_builddir@ + top_srcdir = @top_srcdir@ + include_racoon_HEADERS = racoonctl.h var.h vmbuf.h misc.h gcmalloc.h admin.h \ + schedule.h sockmisc.h isakmp_var.h isakmp.h isakmp_xauth.h \ +- isakmp_cfg.h isakmp_unity.h ipsec_doi.h evt.h ++ isakmp_cfg.h isakmp_unity.h ipsec_doi.h evt.h openssl_compat.h + + lib_LTLIBRARIES = libracoon.la + adminsockdir = ${localstatedir}/racoon +@@ -597,7 +597,7 @@ racoon_SOURCES = \ + gssapi.c dnssec.c getcertsbyname.c privsep.c \ + pfkey.c admin.c evt.c ipsec_doi.c oakley.c grabmyaddr.c vendorid.c \ + policy.c localconf.c remoteconf.c crypto_openssl.c algorithm.c \ +- proposal.c sainfo.c strnames.c \ ++ openssl_compat.c proposal.c sainfo.c strnames.c \ + plog.c logger.c schedule.c str2val.c \ + safefile.c backupsa.c genlist.c rsalist.c \ + cftoken.l cfparse.y prsa_tok.l prsa_par.y +@@ -617,12 +617,12 @@ racoonctl_LDADD = libracoon.la ../libipsec/libipsec.la + libracoon_la_SOURCES = kmpstat.c vmbuf.c sockmisc.c misc.c + libracoon_la_CFLAGS = -DNOUSE_PRIVSEP $(AM_CFLAGS) + plainrsa_gen_SOURCES = plainrsa-gen.c plog.c \ +- crypto_openssl.c logger.c ++ crypto_openssl.c logger.c openssl_compat.c + + EXTRA_plainrsa_gen_SOURCES = $(MISSING_ALGOS) + plainrsa_gen_LDADD = $(CRYPTOBJS) vmbuf.o misc.o + plainrsa_gen_DEPENDENCIES = $(CRYPTOBJS) vmbuf.o misc.o +-eaytest_SOURCES = eaytest.c plog.c logger.c ++eaytest_SOURCES = eaytest.c plog.c logger.c openssl_compat.c + EXTRA_eaytest_SOURCES = missing/crypto/sha2/sha2.c + eaytest_LDADD = crypto_openssl_test.o vmbuf.o str2val.o misc_noplog.o \ + $(CRYPTOBJS) +@@ -642,7 +642,7 @@ noinst_HEADERS = \ + debugrm.h isakmp.h misc.h sainfo.h \ + dhgroup.h isakmp_agg.h netdb_dnssec.h schedule.h \ + isakmp_cfg.h isakmp_xauth.h isakmp_unity.h isakmp_frag.h \ +- throttle.h privsep.h \ ++ throttle.h privsep.h openssl_compat.h \ + cfparse_proto.h cftoken_proto.h genlist.h rsalist.h \ + missing/crypto/sha2/sha2.h missing/crypto/rijndael/rijndael_local.h \ + missing/crypto/rijndael/rijndael-api-fst.h \ +--- src/racoon/algorithm.c ++++ src/racoon/algorithm.c +@@ -128,7 +128,7 @@ static struct enc_algorithm oakley_encdef[] = { + { "aes", algtype_aes, OAKLEY_ATTR_ENC_ALG_AES, 16, + eay_aes_encrypt, eay_aes_decrypt, + eay_aes_weakkey, eay_aes_keylen, }, +-#ifdef HAVE_OPENSSL_CAMELLIA_H ++#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA) + { "camellia", algtype_camellia, OAKLEY_ATTR_ENC_ALG_CAMELLIA, 16, + eay_camellia_encrypt, eay_camellia_decrypt, + eay_camellia_weakkey, eay_camellia_keylen, }, +@@ -168,7 +168,7 @@ static struct enc_algorithm ipsec_encdef[] = { + { "twofish", algtype_twofish, IPSECDOI_ESP_TWOFISH, 16, + NULL, NULL, + NULL, eay_twofish_keylen, }, +-#ifdef HAVE_OPENSSL_IDEA_H ++#if defined(HAVE_OPENSSL_IDEA_H) && ! defined(OPENSSL_NO_IDEA) + { "3idea", algtype_3idea, IPSECDOI_ESP_3IDEA, 8, + NULL, NULL, + NULL, NULL, }, +@@ -179,7 +179,7 @@ static struct enc_algorithm ipsec_encdef[] = { + { "rc4", algtype_rc4, IPSECDOI_ESP_RC4, 8, + NULL, NULL, + NULL, NULL, }, +-#ifdef HAVE_OPENSSL_CAMELLIA_H ++#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA) + { "camellia", algtype_camellia, IPSECDOI_ESP_CAMELLIA, 16, + NULL, NULL, + NULL, eay_camellia_keylen, }, +--- src/racoon/cfparse.y ++++ src/racoon/cfparse.y +@@ -2564,7 +2564,7 @@ set_isakmp_proposal(rmconf) + plog(LLV_DEBUG2, LOCATION, NULL, + "encklen=%d\n", s->encklen); + +- memset(types, 0, ARRAYLEN(types)); ++ memset(types, 0, sizeof types); + types[algclass_isakmp_enc] = s->algclass[algclass_isakmp_enc]; + types[algclass_isakmp_hash] = s->algclass[algclass_isakmp_hash]; + types[algclass_isakmp_dh] = s->algclass[algclass_isakmp_dh]; +--- src/racoon/crypto_openssl.c ++++ src/racoon/crypto_openssl.c +@@ -90,6 +90,7 @@ + #endif + #endif + #include "plog.h" ++#include "openssl_compat.h" + + #define USE_NEW_DES_API + +@@ -316,9 +317,12 @@ eay_cmp_asn1dn(n1, n2) + i = idx+1; + goto end; + } +- if ((ea->value->length == 1 && ea->value->data[0] == '*') || +- (eb->value->length == 1 && eb->value->data[0] == '*')) { +- if (OBJ_cmp(ea->object,eb->object)) { ++ ASN1_STRING *sa = X509_NAME_ENTRY_get_data(ea); ++ ASN1_STRING *sb = X509_NAME_ENTRY_get_data(eb); ++ if ((ASN1_STRING_length(sa) == 1 && ASN1_STRING_get0_data(sa)[0] == '*') || ++ (ASN1_STRING_length(sb) == 1 && ASN1_STRING_get0_data(sb)[0] == '*')) { ++ if (OBJ_cmp(X509_NAME_ENTRY_get_object(ea), ++ X509_NAME_ENTRY_get_object(eb))) { + i = idx+1; + goto end; + } +@@ -430,7 +434,7 @@ cb_check_cert_local(ok, ctx) + + if (!ok) { + X509_NAME_oneline( +- X509_get_subject_name(ctx->current_cert), ++ X509_get_subject_name(X509_STORE_CTX_get_current_cert(ctx)), + buf, + 256); + /* +@@ -438,7 +442,8 @@ cb_check_cert_local(ok, ctx) + * ok if they are self signed. But we should still warn + * the user. + */ +- switch (ctx->error) { ++ int ctx_error = X509_STORE_CTX_get_error(ctx); ++ switch (ctx_error) { + case X509_V_ERR_CERT_HAS_EXPIRED: + case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: + case X509_V_ERR_INVALID_CA: +@@ -453,9 +458,9 @@ cb_check_cert_local(ok, ctx) + } + plog(log_tag, LOCATION, NULL, + "%s(%d) at depth:%d SubjectName:%s\n", +- X509_verify_cert_error_string(ctx->error), +- ctx->error, +- ctx->error_depth, ++ X509_verify_cert_error_string(ctx_error), ++ ctx_error, ++ X509_STORE_CTX_get_error_depth(ctx), + buf); + } + ERR_clear_error(); +@@ -477,10 +482,11 @@ cb_check_cert_remote(ok, ctx) + + if (!ok) { + X509_NAME_oneline( +- X509_get_subject_name(ctx->current_cert), ++ X509_get_subject_name(X509_STORE_CTX_get_current_cert(ctx)), + buf, + 256); +- switch (ctx->error) { ++ int ctx_error=X509_STORE_CTX_get_error(ctx); ++ switch (ctx_error) { + case X509_V_ERR_UNABLE_TO_GET_CRL: + ok = 1; + log_tag = LLV_WARNING; +@@ -490,9 +496,9 @@ cb_check_cert_remote(ok, ctx) + } + plog(log_tag, LOCATION, NULL, + "%s(%d) at depth:%d SubjectName:%s\n", +- X509_verify_cert_error_string(ctx->error), +- ctx->error, +- ctx->error_depth, ++ X509_verify_cert_error_string(ctx_error), ++ ctx_error, ++ X509_STORE_CTX_get_error_depth(ctx), + buf); + } + ERR_clear_error(); +@@ -516,14 +522,15 @@ eay_get_x509asn1subjectname(cert) + if (x509 == NULL) + goto error; + ++ X509_NAME *subject_name = X509_get_subject_name(x509); + /* get the length of the name */ +- len = i2d_X509_NAME(x509->cert_info->subject, NULL); ++ len = i2d_X509_NAME(subject_name, NULL); + name = vmalloc(len); + if (!name) + goto error; + /* get the name */ + bp = (unsigned char *) name->v; +- len = i2d_X509_NAME(x509->cert_info->subject, &bp); ++ len = i2d_X509_NAME(subject_name, &bp); + + X509_free(x509); + +@@ -661,15 +668,16 @@ eay_get_x509asn1issuername(cert) + if (x509 == NULL) + goto error; + ++ X509_NAME *issuer_name = X509_get_issuer_name(x509); + /* get the length of the name */ +- len = i2d_X509_NAME(x509->cert_info->issuer, NULL); ++ len = i2d_X509_NAME(issuer_name, NULL); + name = vmalloc(len); + if (name == NULL) + goto error; + + /* get the name */ + bp = (unsigned char *) name->v; +- len = i2d_X509_NAME(x509->cert_info->issuer, &bp); ++ len = i2d_X509_NAME(issuer_name, &bp); + + X509_free(x509); + +@@ -850,7 +858,7 @@ eay_check_x509sign(source, sig, cert) + return -1; + } + +- res = eay_rsa_verify(source, sig, evp->pkey.rsa); ++ res = eay_rsa_verify(source, sig, EVP_PKEY_get0_RSA(evp)); + + EVP_PKEY_free(evp); + X509_free(x509); +@@ -992,7 +1000,7 @@ eay_get_x509sign(src, privkey) + if (evp == NULL) + return NULL; + +- sig = eay_rsa_sign(src, evp->pkey.rsa); ++ sig = eay_rsa_sign(src, EVP_PKEY_get0_RSA(evp)); + + EVP_PKEY_free(evp); + +@@ -1079,7 +1087,11 @@ eay_strerror() + int line, flags; + unsigned long es; + ++#if OPENSSL_VERSION_NUMBER >= 0x10100000L ++ es = 0; /* even when allowed by OPENSSL_API_COMPAT, it is defined as 0 */ ++#else + es = CRYPTO_thread_id(); ++#endif + + while ((l = ERR_get_error_line_data(&file, &line, &data, &flags)) != 0){ + n = snprintf(ebuf + len, sizeof(ebuf) - len, +@@ -1100,7 +1112,7 @@ vchar_t * + evp_crypt(vchar_t *data, vchar_t *key, vchar_t *iv, const EVP_CIPHER *e, int enc) + { + vchar_t *res; +- EVP_CIPHER_CTX ctx; ++ EVP_CIPHER_CTX *ctx; + + if (!e) + return NULL; +@@ -1111,7 +1123,7 @@ evp_crypt(vchar_t *data, vchar_t *key, vchar_t *iv, const EVP_CIPHER *e, int enc + if ((res = vmalloc(data->l)) == NULL) + return NULL; + +- EVP_CIPHER_CTX_init(&ctx); ++ ctx = EVP_CIPHER_CTX_new(); + + switch(EVP_CIPHER_nid(e)){ + case NID_bf_cbc: +@@ -1125,54 +1137,41 @@ evp_crypt(vchar_t *data, vchar_t *key, vchar_t *iv, const EVP_CIPHER *e, int enc + /* XXX: can we do that also for algos with a fixed key size ? + */ + /* init context without key/iv +- */ +- if (!EVP_CipherInit(&ctx, e, NULL, NULL, enc)) +- { +- OpenSSL_BUG(); +- vfree(res); +- return NULL; +- } ++ */ ++ if (!EVP_CipherInit(ctx, e, NULL, NULL, enc)) ++ goto out; + +- /* update key size +- */ +- if (!EVP_CIPHER_CTX_set_key_length(&ctx, key->l)) +- { +- OpenSSL_BUG(); +- vfree(res); +- return NULL; +- } +- +- /* finalize context init with desired key size +- */ +- if (!EVP_CipherInit(&ctx, NULL, (u_char *) key->v, ++ /* update key size ++ */ ++ if (!EVP_CIPHER_CTX_set_key_length(ctx, key->l)) ++ goto out; ++ ++ /* finalize context init with desired key size ++ */ ++ if (!EVP_CipherInit(ctx, NULL, (u_char *) key->v, + (u_char *) iv->v, enc)) +- { +- OpenSSL_BUG(); +- vfree(res); +- return NULL; +- } ++ goto out; + break; + default: +- if (!EVP_CipherInit(&ctx, e, (u_char *) key->v, +- (u_char *) iv->v, enc)) { +- OpenSSL_BUG(); +- vfree(res); +- return NULL; +- } ++ if (!EVP_CipherInit(ctx, e, (u_char *) key->v, ++ (u_char *) iv->v, enc)) ++ goto out; + } + + /* disable openssl padding */ +- EVP_CIPHER_CTX_set_padding(&ctx, 0); ++ EVP_CIPHER_CTX_set_padding(ctx, 0); + +- if (!EVP_Cipher(&ctx, (u_char *) res->v, (u_char *) data->v, data->l)) { +- OpenSSL_BUG(); +- vfree(res); +- return NULL; +- } ++ if (!EVP_Cipher(ctx, (u_char *) res->v, (u_char *) data->v, data->l)) ++ goto out; + +- EVP_CIPHER_CTX_cleanup(&ctx); ++ EVP_CIPHER_CTX_free(ctx); + + return res; ++out: ++ EVP_CIPHER_CTX_free(ctx); ++ OpenSSL_BUG(); ++ vfree(res); ++ return NULL; + } + + int +@@ -1230,7 +1229,7 @@ eay_des_keylen(len) + return evp_keylen(len, EVP_des_cbc()); + } + +-#ifdef HAVE_OPENSSL_IDEA_H ++#if defined(HAVE_OPENSSL_IDEA_H) && ! defined(OPENSSL_NO_IDEA) + /* + * IDEA-CBC + */ +@@ -1587,7 +1586,7 @@ eay_aes_keylen(len) + return len; + } + +-#if defined(HAVE_OPENSSL_CAMELLIA_H) ++#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA) + /* + * CAMELLIA-CBC + */ +@@ -1680,9 +1679,9 @@ eay_hmac_init(key, md) + vchar_t *key; + const EVP_MD *md; + { +- HMAC_CTX *c = racoon_malloc(sizeof(*c)); ++ HMAC_CTX *c = HMAC_CTX_new(); + +- HMAC_Init(c, key->v, key->l, md); ++ HMAC_Init_ex(c, key->v, key->l, md, NULL); + + return (caddr_t)c; + } +@@ -1761,8 +1760,7 @@ eay_hmacsha2_512_final(c) + + HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l); + res->l = l; +- HMAC_cleanup((HMAC_CTX *)c); +- (void)racoon_free(c); ++ HMAC_CTX_free((HMAC_CTX *)c); + + if (SHA512_DIGEST_LENGTH != res->l) { + plog(LLV_ERROR, LOCATION, NULL, +@@ -1811,8 +1809,7 @@ eay_hmacsha2_384_final(c) + + HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l); + res->l = l; +- HMAC_cleanup((HMAC_CTX *)c); +- (void)racoon_free(c); ++ HMAC_CTX_free((HMAC_CTX *)c); + + if (SHA384_DIGEST_LENGTH != res->l) { + plog(LLV_ERROR, LOCATION, NULL, +@@ -1861,8 +1858,7 @@ eay_hmacsha2_256_final(c) + + HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l); + res->l = l; +- HMAC_cleanup((HMAC_CTX *)c); +- (void)racoon_free(c); ++ HMAC_CTX_free((HMAC_CTX *)c); + + if (SHA256_DIGEST_LENGTH != res->l) { + plog(LLV_ERROR, LOCATION, NULL, +@@ -1912,8 +1908,7 @@ eay_hmacsha1_final(c) + + HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l); + res->l = l; +- HMAC_cleanup((HMAC_CTX *)c); +- (void)racoon_free(c); ++ HMAC_CTX_free((HMAC_CTX *)c); + + if (SHA_DIGEST_LENGTH != res->l) { + plog(LLV_ERROR, LOCATION, NULL, +@@ -1962,8 +1957,7 @@ eay_hmacmd5_final(c) + + HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l); + res->l = l; +- HMAC_cleanup((HMAC_CTX *)c); +- (void)racoon_free(c); ++ HMAC_CTX_free((HMAC_CTX *)c); + + if (MD5_DIGEST_LENGTH != res->l) { + plog(LLV_ERROR, LOCATION, NULL, +@@ -2266,6 +2260,7 @@ eay_dh_generate(prime, g, publen, pub, priv) + u_int32_t g; + { + BIGNUM *p = NULL; ++ BIGNUM *BNg = NULL; + DH *dh = NULL; + int error = -1; + +@@ -2276,25 +2271,28 @@ eay_dh_generate(prime, g, publen, pub, priv) + + if ((dh = DH_new()) == NULL) + goto end; +- dh->p = p; +- p = NULL; /* p is now part of dh structure */ +- dh->g = NULL; +- if ((dh->g = BN_new()) == NULL) ++ if ((BNg = BN_new()) == NULL) + goto end; +- if (!BN_set_word(dh->g, g)) ++ if (!BN_set_word(BNg, g)) + goto end; ++ if (! DH_set0_pqg(dh, p, NULL, BNg)) ++ goto end; ++ BNg = NULL; ++ p = NULL; /* p is now part of dh structure */ + + if (publen != 0) +- dh->length = publen; ++ DH_set_length(dh, publen); + + /* generate public and private number */ + if (!DH_generate_key(dh)) + goto end; + + /* copy results to buffers */ +- if (eay_bn2v(pub, dh->pub_key) < 0) ++ BIGNUM *pub_key, *priv_key; ++ DH_get0_key(dh, (const BIGNUM**) &pub_key, (const BIGNUM**) &priv_key); ++ if (eay_bn2v(pub, pub_key) < 0) + goto end; +- if (eay_bn2v(priv, dh->priv_key) < 0) { ++ if (eay_bn2v(priv, priv_key) < 0) { + vfree(*pub); + goto end; + } +@@ -2306,6 +2304,8 @@ end: + DH_free(dh); + if (p != 0) + BN_free(p); ++ if (BNg != 0) ++ BN_free(BNg); + return(error); + } + +@@ -2319,6 +2319,10 @@ eay_dh_compute(prime, g, pub, priv, pub2, key) + int l; + unsigned char *v = NULL; + int error = -1; ++ BIGNUM *p = BN_new(); ++ BIGNUM *BNg = BN_new(); ++ BIGNUM *pub_key = BN_new(); ++ BIGNUM *priv_key = BN_new(); + + /* make public number to compute */ + if (eay_v2bn(&dh_pub, pub2) < 0) +@@ -2327,19 +2331,21 @@ eay_dh_compute(prime, g, pub, priv, pub2, key) + /* make DH structure */ + if ((dh = DH_new()) == NULL) + goto end; +- if (eay_v2bn(&dh->p, prime) < 0) ++ if (p == NULL || BNg == NULL || pub_key == NULL || priv_key == NULL) + goto end; +- if (eay_v2bn(&dh->pub_key, pub) < 0) ++ ++ if (eay_v2bn(&p, prime) < 0) + goto end; +- if (eay_v2bn(&dh->priv_key, priv) < 0) ++ if (eay_v2bn(&pub_key, pub) < 0) + goto end; +- dh->length = pub2->l * 8; +- +- dh->g = NULL; +- if ((dh->g = BN_new()) == NULL) ++ if (eay_v2bn(&priv_key, priv) < 0) + goto end; +- if (!BN_set_word(dh->g, g)) ++ if (!BN_set_word(BNg, g)) + goto end; ++ DH_set0_key(dh, pub_key, priv_key); ++ DH_set_length(dh, pub2->l * 8); ++ DH_set0_pqg(dh, p, NULL, BNg); ++ pub_key = priv_key = p = BNg = NULL; + + if ((v = racoon_calloc(prime->l, sizeof(u_char))) == NULL) + goto end; +@@ -2350,6 +2356,14 @@ eay_dh_compute(prime, g, pub, priv, pub2, key) + error = 0; + + end: ++ if (p != NULL) ++ BN_free(p); ++ if (BNg != NULL) ++ BN_free(BNg); ++ if (pub_key != NULL) ++ BN_free(pub_key); ++ if (priv_key != NULL) ++ BN_free(priv_key); + if (dh_pub != NULL) + BN_free(dh_pub); + if (dh != NULL) +@@ -2400,12 +2414,14 @@ eay_bn2v(var, bn) + void + eay_init() + { ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + OpenSSL_add_all_algorithms(); + ERR_load_crypto_strings(); + #ifdef HAVE_OPENSSL_ENGINE_H + ENGINE_load_builtin_engines(); + ENGINE_register_all_complete(); + #endif ++#endif + } + + vchar_t * +@@ -2504,8 +2520,7 @@ binbuf_pubkey2rsa(vchar_t *binbuf) + goto out; + } + +- rsa_pub->n = mod; +- rsa_pub->e = exp; ++ RSA_set0_key(rsa_pub, mod, exp, NULL); + + out: + return rsa_pub; +@@ -2582,5 +2597,5 @@ eay_random() + const char * + eay_version() + { +- return SSLeay_version(SSLEAY_VERSION); ++ return OpenSSL_version(OPENSSL_VERSION); + } +--- src/racoon/crypto_openssl.h ++++ src/racoon/crypto_openssl.h +@@ -124,7 +124,7 @@ extern vchar_t *eay_aes_decrypt __P((vchar_t *, vchar_t *, vchar_t *)); + extern int eay_aes_weakkey __P((vchar_t *)); + extern int eay_aes_keylen __P((int)); + +-#if defined(HAVE_OPENSSL_CAMELLIA_H) ++#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA) + /* Camellia */ + extern vchar_t *eay_camellia_encrypt __P((vchar_t *, vchar_t *, vchar_t *)); + extern vchar_t *eay_camellia_decrypt __P((vchar_t *, vchar_t *, vchar_t *)); +--- src/racoon/eaytest.c ++++ src/racoon/eaytest.c +@@ -62,6 +62,7 @@ + #include "dhgroup.h" + #include "crypto_openssl.h" + #include "gnuc.h" ++#include "openssl_compat.h" + + #include "package_version.h" + +@@ -103,7 +104,7 @@ rsa_verify_with_pubkey(src, sig, pubkey_txt) + printf ("PEM_read_PUBKEY(): %s\n", eay_strerror()); + return -1; + } +- error = eay_check_rsasign(src, sig, evp->pkey.rsa); ++ error = eay_check_rsasign(src, sig, EVP_PKEY_get0_RSA(evp)); + + return error; + } +@@ -698,7 +699,7 @@ ciphertest(ac, av) + eay_cast_encrypt, eay_cast_decrypt) < 0) + return -1; + +-#ifdef HAVE_OPENSSL_IDEA_H ++#if defined(HAVE_OPENSSL_IDEA_H) && ! defined(OPENSSL_NO_IDEA) + if (ciphertest_1 ("IDEA", + &data, 8, + &key, key.l, +@@ -715,7 +716,7 @@ ciphertest(ac, av) + eay_rc5_encrypt, eay_rc5_decrypt) < 0) + return -1; + #endif +-#if defined(HAVE_OPENSSL_CAMELLIA_H) ++#if defined(HAVE_OPENSSL_CAMELLIA_H) && ! defined(OPENSSL_NO_CAMELLIA) + if (ciphertest_1 ("CAMELLIA", + &data, 16, + &key, key.l, +--- src/racoon/ipsec_doi.c ++++ src/racoon/ipsec_doi.c +@@ -715,7 +715,7 @@ out: + /* key length must not be specified on some algorithms */ + if (keylen) { + if (sa->enctype == OAKLEY_ATTR_ENC_ALG_DES +-#ifdef HAVE_OPENSSL_IDEA_H ++#if defined(HAVE_OPENSSL_IDEA_H) && ! defined(OPENSSL_NO_IDEA) + || sa->enctype == OAKLEY_ATTR_ENC_ALG_IDEA + #endif + || sa->enctype == OAKLEY_ATTR_ENC_ALG_3DES) { +--- /dev/null ++++ src/racoon/openssl_compat.c +@@ -0,0 +1,213 @@ ++/* ++ * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. ++ * ++ * Licensed under the OpenSSL license (the "License"). You may not use ++ * this file except in compliance with the License. You can obtain a copy ++ * in the file LICENSE in the source distribution or at ++ * https://www.openssl.org/source/license.html ++ */ ++ ++#include "openssl_compat.h" ++ ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++ ++#include ++ ++static void *OPENSSL_zalloc(size_t num) ++{ ++ void *ret = OPENSSL_malloc(num); ++ ++ if (ret != NULL) ++ memset(ret, 0, num); ++ return ret; ++} ++ ++int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) ++{ ++ /* If the fields n and e in r are NULL, the corresponding input ++ * parameters MUST be non-NULL for n and e. d may be ++ * left NULL (in case only the public key is used). ++ */ ++ if ((r->n == NULL && n == NULL) ++ || (r->e == NULL && e == NULL)) ++ return 0; ++ ++ if (n != NULL) { ++ BN_free(r->n); ++ r->n = n; ++ } ++ if (e != NULL) { ++ BN_free(r->e); ++ r->e = e; ++ } ++ if (d != NULL) { ++ BN_free(r->d); ++ r->d = d; ++ } ++ ++ return 1; ++} ++ ++int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q) ++{ ++ /* If the fields p and q in r are NULL, the corresponding input ++ * parameters MUST be non-NULL. ++ */ ++ if ((r->p == NULL && p == NULL) ++ || (r->q == NULL && q == NULL)) ++ return 0; ++ ++ if (p != NULL) { ++ BN_free(r->p); ++ r->p = p; ++ } ++ if (q != NULL) { ++ BN_free(r->q); ++ r->q = q; ++ } ++ ++ return 1; ++} ++ ++int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp) ++{ ++ /* If the fields dmp1, dmq1 and iqmp in r are NULL, the corresponding input ++ * parameters MUST be non-NULL. ++ */ ++ if ((r->dmp1 == NULL && dmp1 == NULL) ++ || (r->dmq1 == NULL && dmq1 == NULL) ++ || (r->iqmp == NULL && iqmp == NULL)) ++ return 0; ++ ++ if (dmp1 != NULL) { ++ BN_free(r->dmp1); ++ r->dmp1 = dmp1; ++ } ++ if (dmq1 != NULL) { ++ BN_free(r->dmq1); ++ r->dmq1 = dmq1; ++ } ++ if (iqmp != NULL) { ++ BN_free(r->iqmp); ++ r->iqmp = iqmp; ++ } ++ ++ return 1; ++} ++ ++void RSA_get0_key(const RSA *r, ++ const BIGNUM **n, const BIGNUM **e, const BIGNUM **d) ++{ ++ if (n != NULL) ++ *n = r->n; ++ if (e != NULL) ++ *e = r->e; ++ if (d != NULL) ++ *d = r->d; ++} ++ ++void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q) ++{ ++ if (p != NULL) ++ *p = r->p; ++ if (q != NULL) ++ *q = r->q; ++} ++ ++void RSA_get0_crt_params(const RSA *r, ++ const BIGNUM **dmp1, const BIGNUM **dmq1, ++ const BIGNUM **iqmp) ++{ ++ if (dmp1 != NULL) ++ *dmp1 = r->dmp1; ++ if (dmq1 != NULL) ++ *dmq1 = r->dmq1; ++ if (iqmp != NULL) ++ *iqmp = r->iqmp; ++} ++ ++int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) ++{ ++ /* If the fields p and g in d are NULL, the corresponding input ++ * parameters MUST be non-NULL. q may remain NULL. ++ */ ++ if ((dh->p == NULL && p == NULL) ++ || (dh->g == NULL && g == NULL)) ++ return 0; ++ ++ if (p != NULL) { ++ BN_free(dh->p); ++ dh->p = p; ++ } ++ if (q != NULL) { ++ BN_free(dh->q); ++ dh->q = q; ++ } ++ if (g != NULL) { ++ BN_free(dh->g); ++ dh->g = g; ++ } ++ ++ if (q != NULL) { ++ dh->length = BN_num_bits(q); ++ } ++ ++ return 1; ++} ++ ++void DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key) ++{ ++ if (pub_key != NULL) ++ *pub_key = dh->pub_key; ++ if (priv_key != NULL) ++ *priv_key = dh->priv_key; ++} ++ ++int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key) ++{ ++ /* If the field pub_key in dh is NULL, the corresponding input ++ * parameters MUST be non-NULL. The priv_key field may ++ * be left NULL. ++ */ ++ if (dh->pub_key == NULL && pub_key == NULL) ++ return 0; ++ ++ if (pub_key != NULL) { ++ BN_free(dh->pub_key); ++ dh->pub_key = pub_key; ++ } ++ if (priv_key != NULL) { ++ BN_free(dh->priv_key); ++ dh->priv_key = priv_key; ++ } ++ ++ return 1; ++} ++ ++int DH_set_length(DH *dh, long length) ++{ ++ dh->length = length; ++ return 1; ++} ++ ++HMAC_CTX *HMAC_CTX_new(void) ++{ ++ return OPENSSL_zalloc(sizeof(HMAC_CTX)); ++} ++ ++void HMAC_CTX_free(HMAC_CTX *ctx) ++{ ++ HMAC_CTX_cleanup(ctx); ++ OPENSSL_free(ctx); ++} ++ ++RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey) ++{ ++ if (pkey->type != EVP_PKEY_RSA) { ++ return NULL; ++ } ++ return pkey->pkey.rsa; ++} ++ ++ ++#endif /* OPENSSL_VERSION_NUMBER */ +--- /dev/null ++++ src/racoon/openssl_compat.h +@@ -0,0 +1,45 @@ ++#ifndef OPENSSL_COMPAT_H ++#define OPENSSL_COMPAT_H ++ ++#include ++#if OPENSSL_VERSION_NUMBER < 0x10100000L ++ ++#include ++#include ++#include ++#include ++ ++int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d); ++int RSA_set0_factors(RSA *r, BIGNUM *p, BIGNUM *q); ++int RSA_set0_crt_params(RSA *r, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp); ++void RSA_get0_key(const RSA *r, const BIGNUM **n, const BIGNUM **e, const BIGNUM **d); ++void RSA_get0_factors(const RSA *r, const BIGNUM **p, const BIGNUM **q); ++void RSA_get0_crt_params(const RSA *r, const BIGNUM **dmp1, const BIGNUM **dmq1, const BIGNUM **iqmp); ++ ++int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g); ++void DH_get0_key(const DH *dh, const BIGNUM **pub_key, const BIGNUM **priv_key); ++int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key); ++int DH_set_length(DH *dh, long length); ++ ++HMAC_CTX *HMAC_CTX_new(void); ++void HMAC_CTX_free(HMAC_CTX* ctx); ++ ++RSA *EVP_PKEY_get0_RSA(EVP_PKEY *pkey); ++ ++#define ASN1_STRING_length(s) s->length ++#define ASN1_STRING_get0_data(s) s->data ++ ++#define X509_get_subject_name(x) x->cert_info->subject ++#define X509_get_issuer_name(x) x->cert_info->issuer ++#define X509_NAME_ENTRY_get_data(n) n->value ++#define X509_NAME_ENTRY_get_object(n) n->object ++#define X509_STORE_CTX_get_current_cert(ctx) ctx->current_cert ++#define X509_STORE_CTX_get_error(ctx) ctx->error ++#define X509_STORE_CTX_get_error_depth(ctx) ctx->error_depth ++ ++#define OPENSSL_VERSION SSLEAY_VERSION ++#define OpenSSL_version SSLeay_version ++ ++#endif /* OPENSSL_VERSION_NUMBER */ ++ ++#endif /* OPENSSL_COMPAT_H */ +--- src/racoon/plainrsa-gen.c ++++ src/racoon/plainrsa-gen.c +@@ -60,6 +60,7 @@ + #include "vmbuf.h" + #include "plog.h" + #include "crypto_openssl.h" ++#include "openssl_compat.h" + + #include "package_version.h" + +@@ -90,12 +91,14 @@ mix_b64_pubkey(const RSA *key) + char *binbuf; + long binlen, ret; + vchar_t *res; +- +- binlen = 1 + BN_num_bytes(key->e) + BN_num_bytes(key->n); ++ const BIGNUM *e, *n; ++ ++ RSA_get0_key(key, &n, &e, NULL); ++ binlen = 1 + BN_num_bytes(e) + BN_num_bytes(n); + binbuf = malloc(binlen); + memset(binbuf, 0, binlen); +- binbuf[0] = BN_bn2bin(key->e, (unsigned char *) &binbuf[1]); +- ret = BN_bn2bin(key->n, (unsigned char *) (&binbuf[binbuf[0] + 1])); ++ binbuf[0] = BN_bn2bin(e, (unsigned char *) &binbuf[1]); ++ ret = BN_bn2bin(n, (unsigned char *) (&binbuf[binbuf[0] + 1])); + if (1 + binbuf[0] + ret != binlen) { + plog(LLV_ERROR, LOCATION, NULL, + "Pubkey generation failed. This is really strange...\n"); +@@ -131,16 +134,20 @@ print_rsa_key(FILE *fp, const RSA *key) + + fprintf(fp, "# : PUB 0s%s\n", pubkey64->v); + fprintf(fp, ": RSA\t{\n"); +- fprintf(fp, "\t# RSA %d bits\n", BN_num_bits(key->n)); ++ const BIGNUM *n, *e, *d, *p, *q, *dmp1, *dmq1, *iqmp; ++ RSA_get0_key(key, &n, &e, &d); ++ RSA_get0_factors(key, &p, &q); ++ RSA_get0_crt_params(key, &dmp1, &dmq1, &iqmp); ++ fprintf(fp, "\t# RSA %d bits\n", BN_num_bits(n)); + fprintf(fp, "\t# pubkey=0s%s\n", pubkey64->v); +- fprintf(fp, "\tModulus: 0x%s\n", lowercase(BN_bn2hex(key->n))); +- fprintf(fp, "\tPublicExponent: 0x%s\n", lowercase(BN_bn2hex(key->e))); +- fprintf(fp, "\tPrivateExponent: 0x%s\n", lowercase(BN_bn2hex(key->d))); +- fprintf(fp, "\tPrime1: 0x%s\n", lowercase(BN_bn2hex(key->p))); +- fprintf(fp, "\tPrime2: 0x%s\n", lowercase(BN_bn2hex(key->q))); +- fprintf(fp, "\tExponent1: 0x%s\n", lowercase(BN_bn2hex(key->dmp1))); +- fprintf(fp, "\tExponent2: 0x%s\n", lowercase(BN_bn2hex(key->dmq1))); +- fprintf(fp, "\tCoefficient: 0x%s\n", lowercase(BN_bn2hex(key->iqmp))); ++ fprintf(fp, "\tModulus: 0x%s\n", lowercase(BN_bn2hex(n))); ++ fprintf(fp, "\tPublicExponent: 0x%s\n", lowercase(BN_bn2hex(e))); ++ fprintf(fp, "\tPrivateExponent: 0x%s\n", lowercase(BN_bn2hex(d))); ++ fprintf(fp, "\tPrime1: 0x%s\n", lowercase(BN_bn2hex(p))); ++ fprintf(fp, "\tPrime2: 0x%s\n", lowercase(BN_bn2hex(q))); ++ fprintf(fp, "\tExponent1: 0x%s\n", lowercase(BN_bn2hex(dmp1))); ++ fprintf(fp, "\tExponent2: 0x%s\n", lowercase(BN_bn2hex(dmq1))); ++ fprintf(fp, "\tCoefficient: 0x%s\n", lowercase(BN_bn2hex(iqmp))); + fprintf(fp, " }\n"); + + vfree(pubkey64); +@@ -203,11 +210,13 @@ int + gen_rsa_key(FILE *fp, size_t bits, unsigned long exp) + { + int ret; +- RSA *key; ++ RSA *key = RSA_new(); ++ BIGNUM *e = BN_new(); + +- key = RSA_generate_key(bits, exp, NULL, NULL); +- if (!key) { ++ BN_set_word(e, exp); ++ if (! RSA_generate_key_ex(key, bits, e, NULL)) { + fprintf(stderr, "RSA_generate_key(): %s\n", eay_strerror()); ++ RSA_free(key); + return -1; + } + +--- src/racoon/prsa_par.y ++++ src/racoon/prsa_par.y +@@ -68,6 +68,7 @@ + #include "isakmp_var.h" + #include "handler.h" + #include "crypto_openssl.h" ++#include "openssl_compat.h" + #include "sockmisc.h" + #include "rsalist.h" + +@@ -85,7 +86,18 @@ char *prsa_cur_fname = NULL; + struct genlist *prsa_cur_list = NULL; + enum rsa_key_type prsa_cur_type = RSA_TYPE_ANY; + +-static RSA *rsa_cur; ++struct my_rsa_st { ++ BIGNUM *n; ++ BIGNUM *e; ++ BIGNUM *d; ++ BIGNUM *p; ++ BIGNUM *q; ++ BIGNUM *dmp1; ++ BIGNUM *dmq1; ++ BIGNUM *iqmp; ++}; ++ ++static struct my_rsa_st *rsa_cur; + + void + prsaerror(const char *s, ...) +@@ -201,8 +213,12 @@ rsa_statement: + rsa_cur->iqmp = NULL; + } + } +- $$ = rsa_cur; +- rsa_cur = RSA_new(); ++ RSA * rsa_tmp = RSA_new(); ++ RSA_set0_key(rsa_tmp, rsa_cur->n, rsa_cur->e, rsa_cur->d); ++ RSA_set0_factors(rsa_tmp, rsa_cur->p, rsa_cur->q); ++ RSA_set0_crt_params(rsa_tmp, rsa_cur->dmp1, rsa_cur->dmq1, rsa_cur->iqmp); ++ $$ = rsa_tmp; ++ memset(rsa_cur, 0, sizeof(struct my_rsa_st)); + } + | TAG_PUB BASE64 + { +@@ -351,10 +367,12 @@ prsa_parse_file(struct genlist *list, char *fname, enum rsa_key_type type) + prsa_cur_fname = fname; + prsa_cur_list = list; + prsa_cur_type = type; +- rsa_cur = RSA_new(); ++ rsa_cur = malloc(sizeof(struct my_rsa_st)); ++ memset(rsa_cur, 0, sizeof(struct my_rsa_st)); + ret = prsaparse(); + if (rsa_cur) { +- RSA_free(rsa_cur); ++ memset(rsa_cur, 0, sizeof(struct my_rsa_st)); ++ free(rsa_cur); + rsa_cur = NULL; + } + fclose (fp); +--- src/racoon/rsalist.c ++++ src/racoon/rsalist.c +@@ -52,6 +52,7 @@ + #include "genlist.h" + #include "remoteconf.h" + #include "crypto_openssl.h" ++#include "openssl_compat.h" + + #ifndef LIST_FIRST + #define LIST_FIRST(head) ((head)->lh_first) +@@ -98,7 +99,9 @@ rsa_key_dup(struct rsa_key *key) + return NULL; + + if (key->rsa) { +- new->rsa = key->rsa->d != NULL ? RSAPrivateKey_dup(key->rsa) : RSAPublicKey_dup(key->rsa); ++ const BIGNUM *d; ++ RSA_get0_key(key->rsa, NULL, NULL, &d); ++ new->rsa = (d != NULL ? RSAPrivateKey_dup(key->rsa) : RSAPublicKey_dup(key->rsa)); + if (new->rsa == NULL) + goto dup_error; + } diff --git a/security/ipsec-tools/files/natt.diff b/security/ipsec-tools/files/natt.diff new file mode 100644 index 000000000000..ff0daa44475c --- /dev/null +++ b/security/ipsec-tools/files/natt.diff @@ -0,0 +1,155 @@ +--- src/libipsec/libpfkey.h ++++ src/libipsec/libpfkey.h +@@ -85,7 +85,7 @@ struct pfkey_send_sa_args { + u_int32_t seq; + u_int8_t l_natt_type; + u_int16_t l_natt_sport, l_natt_dport; +- struct sockaddr *l_natt_oa; ++ struct sockaddr *l_natt_oai, *l_natt_oar; + u_int16_t l_natt_frag; + u_int8_t ctxdoi, ctxalg; /* Security context DOI and algorithm */ + caddr_t ctxstr; /* Security context string */ +--- src/libipsec/pfkey.c ++++ src/libipsec/pfkey.c +@@ -1335,9 +1335,12 @@ pfkey_send_x1(struct pfkey_send_sa_args + len += sizeof(struct sadb_x_nat_t_type); + len += sizeof(struct sadb_x_nat_t_port); + len += sizeof(struct sadb_x_nat_t_port); +- if (sa_parms->l_natt_oa) ++ if (sa_parms->l_natt_oai) + len += sizeof(struct sadb_address) + +- PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oa)); ++ PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oai)); ++ if (sa_parms->l_natt_oar) ++ len += sizeof(struct sadb_address) + ++ PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oar)); + #ifdef SADB_X_EXT_NAT_T_FRAG + if (sa_parms->l_natt_frag) + len += sizeof(struct sadb_x_nat_t_frag); +@@ -1452,10 +1455,21 @@ pfkey_send_x1(struct pfkey_send_sa_args + return -1; + } + +- if (sa_parms->l_natt_oa) { +- p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OA, +- sa_parms->l_natt_oa, +- (u_int)PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oa)), ++ if (sa_parms->l_natt_oai) { ++ p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OAI, ++ sa_parms->l_natt_oai, ++ (u_int)PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oai)), ++ IPSEC_ULPROTO_ANY); ++ if (!p) { ++ free(newmsg); ++ return -1; ++ } ++ } ++ ++ if (sa_parms->l_natt_oar) { ++ p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OAR, ++ sa_parms->l_natt_oar, ++ (u_int)PFKEY_ALIGN8(sysdep_sa_len(sa_parms->l_natt_oar)), + IPSEC_ULPROTO_ANY); + if (!p) { + free(newmsg); +@@ -2034,7 +2048,8 @@ pfkey_align(struct sadb_msg *msg, caddr_ + case SADB_X_EXT_NAT_T_TYPE: + case SADB_X_EXT_NAT_T_SPORT: + case SADB_X_EXT_NAT_T_DPORT: +- case SADB_X_EXT_NAT_T_OA: ++ case SADB_X_EXT_NAT_T_OAI: ++ case SADB_X_EXT_NAT_T_OAR: + #endif + #ifdef SADB_X_EXT_TAG + case SADB_X_EXT_TAG: +@@ -2592,7 +2607,7 @@ pfkey_send_update_nat(int so, u_int saty + psaa.l_natt_type = l_natt_type; + psaa.l_natt_sport = l_natt_sport; + psaa.l_natt_dport = l_natt_dport; +- psaa.l_natt_oa = l_natt_oa; ++ psaa.l_natt_oar = l_natt_oa; + psaa.l_natt_frag = l_natt_frag; + + return pfkey_send_update2(&psaa); +@@ -2667,7 +2682,7 @@ pfkey_send_add_nat(int so, u_int satype, + psaa.l_natt_type = l_natt_type; + psaa.l_natt_sport = l_natt_sport; + psaa.l_natt_dport = l_natt_dport; +- psaa.l_natt_oa = l_natt_oa; ++ psaa.l_natt_oai = l_natt_oa; + psaa.l_natt_frag = l_natt_frag; + + return pfkey_send_add2(&psaa); +--- src/racoon/isakmp_quick.c ++++ src/racoon/isakmp_quick.c +@@ -2390,6 +2390,34 @@ + spidx.src.ss_family, spidx.dst.ss_family, + _XIDT(iph2->id_p),idi2type); + } ++#ifdef ENABLE_NATT ++ if (iph2->ph1->natt_flags & NAT_DETECTED_PEER ++ && _XIDT(iph2->id) != IPSECDOI_ID_IPV4_ADDR_SUBNET ++ && _XIDT(iph2->id) != IPSECDOI_ID_IPV6_ADDR_SUBNET) { ++ u_int16_t port; ++ ++ port = extract_port(&spidx.src); ++ memcpy(&spidx.src, iph2->ph1->remote, ++ sysdep_sa_len(iph2->ph1->remote)); ++ set_port(&spidx.src, port); ++ switch (spidx.src.ss_family) { ++ case AF_INET: ++ spidx.prefs = sizeof(struct in_addr) << 3; ++ break; ++#ifdef INET6 ++ case AF_INET6: ++ spidx.prefs = sizeof(struct in6_addr) << 3; ++ break; ++#endif ++ default: ++ spidx.prefs = 0; ++ break; ++ } ++ plog(LLV_DEBUG, LOCATION, ++ NULL, "use NAT address %s as src\n", ++ saddr2str((struct sockaddr *)&spidx.src)); ++ } ++#endif + } else { + plog(LLV_DEBUG, LOCATION, NULL, + "get a source address of SP index from Phase 1" +--- src/racoon/nattraversal.c ++++ src/racoon/nattraversal.c +@@ -436,10 +436,7 @@ natt_keepalive_add_ph1 (struct ph1handle + { + int ret = 0; + +- /* Should only the NATed host send keepalives? +- If yes, add '(iph1->natt_flags & NAT_DETECTED_ME)' +- to the following condition. */ +- if (iph1->natt_flags & NAT_DETECTED && ++ if (iph1->natt_flags & NAT_DETECTED_ME && + ! (iph1->natt_flags & NAT_KA_QUEUED)) { + ret = natt_keepalive_add (iph1->local, iph1->remote); + if (ret == 0) +--- src/racoon/pfkey.c ++++ src/racoon/pfkey.c +@@ -1190,7 +1190,10 @@ pk_sendupdate(iph2) + sa_args.l_natt_type = iph2->ph1->natt_options->encaps_type; + sa_args.l_natt_sport = extract_port(iph2->ph1->remote); + sa_args.l_natt_dport = extract_port(iph2->ph1->local); +- sa_args.l_natt_oa = iph2->natoa_src; ++ /* if (iph2->ph1->natt_flags & NAT_DETECTED_PEER) */ ++ sa_args.l_natt_oai = iph2->natoa_dst; ++ /* if (iph2->ph1->natt_flags & NAT_DETECTED_ME) */ ++ sa_args.l_natt_oar = iph2->natoa_src; + #ifdef SADB_X_EXT_NAT_T_FRAG + sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag; + #endif +@@ -1477,7 +1480,6 @@ pk_sendadd(iph2) + sa_args.l_natt_type = UDP_ENCAP_ESPINUDP; + sa_args.l_natt_sport = extract_port(iph2->ph1->local); + sa_args.l_natt_dport = extract_port(iph2->ph1->remote); +- sa_args.l_natt_oa = iph2->natoa_dst; + #ifdef SADB_X_EXT_NAT_T_FRAG + sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag; + #endif diff --git a/security/ipsec-tools/files/patch-handler.c b/security/ipsec-tools/files/patch-handler.c new file mode 100644 index 000000000000..7facd6499311 --- /dev/null +++ b/security/ipsec-tools/files/patch-handler.c @@ -0,0 +1,22 @@ +Index: src/racoon/handler.h +=================================================================== +RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/handler.h,v +retrieving revision 1.25 +retrieving revision 1.26 +diff -p -u -r1.25 -r1.26 +--- src/racoon/handler.h 17 Nov 2010 10:40:41 -0000 1.25 ++++ src/racoon/handler.h 24 Jan 2017 19:23:56 -0000 1.26 +@@ -1,4 +1,4 @@ +-/* $NetBSD: handler.h,v 1.25 2010/11/17 10:40:41 tteras Exp $ */ ++/* $NetBSD: handler.h,v 1.26 2017/01/24 19:23:56 christos Exp $ */ + + /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */ + +@@ -141,6 +141,7 @@ struct ph1handle { + #endif + #ifdef ENABLE_FRAG + int frag; /* IKE phase 1 fragmentation */ ++ int frag_last_index; + struct isakmp_frag_item *frag_chain; /* Received fragments */ + #endif + diff --git a/security/ipsec-tools/files/patch-isakmp.c b/security/ipsec-tools/files/patch-isakmp.c new file mode 100644 index 000000000000..50d6cd043d56 --- /dev/null +++ b/security/ipsec-tools/files/patch-isakmp.c @@ -0,0 +1,30 @@ +Index: src/racoon/isakmp.c +=================================================================== +RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp.c,v +retrieving revision 1.75 +retrieving revision 1.76 +diff -p -u -r1.75 -r1.76 +--- src/racoon/isakmp.c 9 Mar 2016 22:27:17 -0000 1.75 ++++ src/racoon/isakmp.c 24 Jan 2017 19:23:56 -0000 1.76 +@@ -1,4 +1,4 @@ +-/* $NetBSD: isakmp.c,v 1.75 2016/03/09 22:27:17 christos Exp $ */ ++/* $NetBSD: isakmp.c,v 1.76 2017/01/24 19:23:56 christos Exp $ */ + + /* Id: isakmp.c,v 1.74 2006/05/07 21:32:59 manubsd Exp */ + +@@ -1077,6 +1077,7 @@ isakmp_ph1begin_i(rmconf, remote, local) + iph1->frag = 1; + else + iph1->frag = 0; ++ iph1->frag_last_index = 0; + iph1->frag_chain = NULL; + #endif + iph1->approval = NULL; +@@ -1181,6 +1182,7 @@ isakmp_ph1begin_r(msg, remote, local, et + #endif + #ifdef ENABLE_FRAG + iph1->frag = 0; ++ iph1->frag_last_index = 0; + iph1->frag_chain = NULL; + #endif + iph1->approval = NULL; diff --git a/security/ipsec-tools/files/patch-isakmp_frag.c b/security/ipsec-tools/files/patch-isakmp_frag.c new file mode 100644 index 000000000000..8273a3c5ddad --- /dev/null +++ b/security/ipsec-tools/files/patch-isakmp_frag.c @@ -0,0 +1,151 @@ +Index: src/racoon/isakmp_frag.c +=================================================================== +RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c,v +retrieving revision 1.5 +retrieving revision 1.7 +diff -p -u -r1.5 -r1.7 +--- src/racoon/isakmp_frag.c 22 Apr 2009 11:24:20 -0000 1.5 ++++ src/racoon/isakmp_frag.c 23 Jul 2017 05:40:27 -0000 1.7 +@@ -1,4 +1,4 @@ +-/* $NetBSD: isakmp_frag.c,v 1.5 2009/04/22 11:24:20 tteras Exp $ */ ++/* $NetBSD: isakmp_frag.c,v 1.7 2017/07/23 05:40:27 christos Exp $ */ + + /* Id: isakmp_frag.c,v 1.4 2004/11/13 17:31:36 manubsd Exp */ + +@@ -173,6 +173,43 @@ vendorid_frag_cap(gen) + return ntohl(hp[MD5_DIGEST_LENGTH / sizeof(*hp)]); + } + ++static int ++isakmp_frag_insert(struct ph1handle *iph1, struct isakmp_frag_item *item) ++{ ++ struct isakmp_frag_item *pitem = NULL; ++ struct isakmp_frag_item *citem = iph1->frag_chain; ++ ++ /* no frag yet, just insert at beginning of list */ ++ if (iph1->frag_chain == NULL) { ++ iph1->frag_chain = item; ++ return 0; ++ } ++ ++ do { ++ /* duplicate fragment number, abort (CVE-2016-10396) */ ++ if (citem->frag_num == item->frag_num) ++ return -1; ++ ++ /* need to insert before current item */ ++ if (citem->frag_num > item->frag_num) { ++ if (pitem != NULL) ++ pitem->frag_next = item; ++ else ++ /* insert at the beginning of the list */ ++ iph1->frag_chain = item; ++ item->frag_next = citem; ++ return 0; ++ } ++ ++ pitem = citem; ++ citem = citem->frag_next; ++ } while (citem != NULL); ++ ++ /* we reached the end of the list, insert */ ++ pitem->frag_next = item; ++ return 0; ++} ++ + int + isakmp_frag_extract(iph1, msg) + struct ph1handle *iph1; +@@ -224,39 +261,43 @@ isakmp_frag_extract(iph1, msg) + item->frag_next = NULL; + item->frag_packet = buf; + +- /* Look for the last frag while inserting the new item in the chain */ +- if (item->frag_last) +- last_frag = item->frag_num; ++ /* Check for the last frag before inserting the new item in the chain */ ++ if (item->frag_last) { ++ /* if we have the last fragment, indices must match */ ++ if (iph1->frag_last_index != 0 && ++ item->frag_last != iph1->frag_last_index) { ++ plog(LLV_ERROR, LOCATION, NULL, ++ "Repeated last fragment index mismatch\n"); ++ racoon_free(item); ++ vfree(buf); ++ return -1; ++ } + +- if (iph1->frag_chain == NULL) { +- iph1->frag_chain = item; +- } else { +- struct isakmp_frag_item *current; ++ last_frag = iph1->frag_last_index = item->frag_num; ++ } + +- current = iph1->frag_chain; +- while (current->frag_next) { +- if (current->frag_last) +- last_frag = item->frag_num; +- current = current->frag_next; +- } +- current->frag_next = item; ++ /* insert fragment into chain */ ++ if (isakmp_frag_insert(iph1, item) == -1) { ++ plog(LLV_ERROR, LOCATION, NULL, ++ "Repeated fragment index mismatch\n"); ++ racoon_free(item); ++ vfree(buf); ++ return -1; + } + +- /* If we saw the last frag, check if the chain is complete */ ++ /* If we saw the last frag, check if the chain is complete ++ * we have a sorted list now, so just walk through */ + if (last_frag != 0) { ++ item = iph1->frag_chain; + for (i = 1; i <= last_frag; i++) { +- item = iph1->frag_chain; +- do { +- if (item->frag_num == i) +- break; +- item = item->frag_next; +- } while (item != NULL); +- ++ if (item->frag_num != i) ++ break; ++ item = item->frag_next; + if (item == NULL) /* Not found */ + break; + } + +- if (item != NULL) /* It is complete */ ++ if (i > last_frag) /* It is complete */ + return 1; + } + +@@ -291,15 +332,9 @@ isakmp_frag_reassembly(iph1) + } + data = buf->v; + ++ item = iph1->frag_chain; + for (i = 1; i <= frag_count; i++) { +- item = iph1->frag_chain; +- do { +- if (item->frag_num == i) +- break; +- item = item->frag_next; +- } while (item != NULL); +- +- if (item == NULL) { ++ if (item->frag_num != i) { + plog(LLV_ERROR, LOCATION, NULL, + "Missing fragment #%d\n", i); + vfree(buf); +@@ -308,6 +343,7 @@ isakmp_frag_reassembly(iph1) + } + memcpy(data, item->frag_packet->v, item->frag_packet->l); + data += item->frag_packet->l; ++ item = item->frag_next; + } + + out: diff --git a/security/ipsec-tools/files/patch-isakmp_inf.c b/security/ipsec-tools/files/patch-isakmp_inf.c new file mode 100644 index 000000000000..97b8bd40c56c --- /dev/null +++ b/security/ipsec-tools/files/patch-isakmp_inf.c @@ -0,0 +1,22 @@ +Index: src/racoon/isakmp_inf.c +=================================================================== +RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp_inf.c,v +retrieving revision 1.50 +retrieving revision 1.51 +diff -p -u -r1.50 -r1.51 +--- src/racoon/isakmp_inf.c 12 Apr 2013 09:53:10 -0000 1.50 ++++ src/racoon/isakmp_inf.c 24 Jan 2017 19:23:56 -0000 1.51 +@@ -1,4 +1,4 @@ +-/* $NetBSD: isakmp_inf.c,v 1.50 2013/04/12 09:53:10 tteras Exp $ */ ++/* $NetBSD: isakmp_inf.c,v 1.51 2017/01/24 19:23:56 christos Exp $ */ + + /* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */ + +@@ -720,6 +720,7 @@ isakmp_info_send_nx(isakmp, remote, loca + #endif + #ifdef ENABLE_FRAG + iph1->frag = 0; ++ iph1->frag_last_index = 0; + iph1->frag_chain = NULL; + #endif + diff --git a/security/ipsec-tools/files/patch-isakmpinit b/security/ipsec-tools/files/patch-isakmpinit new file mode 100644 index 000000000000..3723a322139d --- /dev/null +++ b/security/ipsec-tools/files/patch-isakmpinit @@ -0,0 +1,64 @@ +--- src/racoon/isakmp_var.h.orig 2010-11-12 16:36:37.000000000 +0600 ++++ src/racoon/isakmp_var.h 2018-04-27 22:15:58.249644000 +0700 +@@ -128,7 +128,7 @@ + #endif + + extern int copy_ph1addresses __P(( struct ph1handle *, +- struct remoteconf *, struct sockaddr *, struct sockaddr *)); ++ struct remoteconf *, struct sockaddr *, struct sockaddr *, int)); + extern void log_ph1established __P((const struct ph1handle *)); + + extern void script_hook __P((struct ph1handle *, int)); +--- src/racoon/isakmp.c.orig 2018-04-27 22:13:23.465260000 +0700 ++++ src/racoon/isakmp.c 2018-04-27 22:20:44.865139000 +0700 +@@ -1075,7 +1075,7 @@ isakmp_ph1begin_i(rmconf, remote, local) + iph1->approval = NULL; + + /* XXX copy remote address */ +- if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) { ++ if (copy_ph1addresses(iph1, rmconf, remote, local, 1) < 0) { + delph1(iph1); + return NULL; + } +@@ -1190,7 +1190,7 @@ isakmp_ph1begin_r(msg, remote, local, et + + /* copy remote address; remote and local always contain + * port numbers so rmconf is not needed */ +- if (copy_ph1addresses(iph1, NULL, remote, local) < 0) { ++ if (copy_ph1addresses(iph1, NULL, remote, local, 0) < 0) { + delph1(iph1); + return -1; + } +@@ -2906,10 +2906,11 @@ isakmp_printpacket(msg, from, my, decode + #endif /*HAVE_PRINT_ISAKMP_C*/ + + int +-copy_ph1addresses(iph1, rmconf, remote, local) ++copy_ph1addresses(iph1, rmconf, remote, local, initiator) + struct ph1handle *iph1; + struct remoteconf *rmconf; + struct sockaddr *remote, *local; ++ int initiator; + { + u_int16_t port; + +@@ -2925,7 +2926,7 @@ copy_ph1addresses(iph1, rmconf, remote, + * if remote has port # (in case of responder - from recvfrom(2)) + * respect content of "remote". + */ +- if (extract_port(iph1->remote) == 0) { ++ if (initiator || extract_port(iph1->remote) == 0) { + port = 0; + if (rmconf != NULL) + port = extract_port(rmconf->remote); +--- src/racoon/isakmp_inf.c.orig 2018-04-27 22:13:23.482870000 +0700 ++++ src/racoon/isakmp_inf.c 2018-04-27 22:21:27.080881000 +0700 +@@ -725,7 +725,7 @@ isakmp_info_send_nx(isakmp, remote, loca + #endif + + /* copy remote address */ +- if (copy_ph1addresses(iph1, NULL, remote, local) < 0) ++ if (copy_ph1addresses(iph1, NULL, remote, local, 0) < 0) + goto end; + + tlen = sizeof(*n) + spisiz; diff --git a/security/ipsec-tools/files/patch-reqid.diff b/security/ipsec-tools/files/patch-reqid.diff new file mode 100644 index 000000000000..5f273d115307 --- /dev/null +++ b/security/ipsec-tools/files/patch-reqid.diff @@ -0,0 +1,176 @@ +--- src/racoon/cfparse.y 22 Aug 2006 18:17:17 -0000 1.66 ++++ src/racoon/cfparse.y 13 May 2018 01:53:57 -0000 +@@ -284,7 +284,7 @@ static int process_rmconf() + /* algorithm */ + %token ALGORITHM_CLASS ALGORITHMTYPE STRENGTHTYPE + /* sainfo */ +-%token SAINFO FROM ++%token SAINFO FROM REQID + /* remote */ + %token REMOTE ANONYMOUS CLIENTADDR INHERIT REMOTE_ADDRESS + %token EXCHANGE_MODE EXCHANGETYPE DOI DOITYPE SITUATION SITUATIONTYPE +@@ -1571,6 +1571,11 @@ sainfo_spec + | REMOTEID NUMBER + { + cur_sainfo->remoteid = $2; ++ } ++ EOS ++ | REQID NUMBER ++ { ++ cur_sainfo->reqid = $2; + } + EOS + | LIFETIME LIFETYPE_TIME NUMBER unittype_time +--- src/racoon/cftoken.l 22 Aug 2006 18:17:17 -0000 1.53 ++++ src/racoon/cftoken.l 13 May 2018 01:53:57 -0000 +@@ -290,6 +290,7 @@ + identifier { YYD; yywarn("it is obsoleted. use \"my_identifier\"."); return(IDENTIFIER); } + my_identifier { YYD; return(MY_IDENTIFIER); } + lifetime { YYD; return(LIFETIME); } ++reqid { YYD; return(REQID); } + time { YYD; return(LIFETYPE_TIME); } + byte { YYD; return(LIFETYPE_BYTE); } + encryption_algorithm { YYD; yylval.num = algclass_ipsec_enc; return(ALGORITHM_CLASS); } +--- src/racoon/proposal.c 27 Apr 2006 03:41:54 -0000 1.19 ++++ src/racoon/proposal.c 13 May 2018 01:53:58 -0000 +@@ -1253,8 +1253,8 @@ set_proposal_from_proposal(iph2) + if(g_nextreqid >= IPSEC_MANUAL_REQID_MAX) + g_nextreqid = 1; + }else{ +- newpr->reqid_in = 0; +- newpr->reqid_out = 0; ++ newpr->reqid_in = iph2->sainfo->reqid; ++ newpr->reqid_out = iph2->sainfo->reqid; + } + + if (set_satrnsbysainfo(newpr, iph2->sainfo) < 0) +--- src/racoon/sainfo.c 11 Aug 2006 16:07:05 -0000 1.9 ++++ src/racoon/sainfo.c 13 May 2018 01:53:58 -0000 +@@ -383,8 +383,8 @@ sainfo2str(si) + else + id_i = ipsecdoi_id2str(si->id_i); + +- snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u", +- idloc, idrmt, id_i, si->remoteid); ++ snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u, reqid=%u", ++ idloc, idrmt, id_i, si->remoteid, si->reqid); + + racoon_free(idloc); + racoon_free(idrmt); +--- src/racoon/sainfo.h 9 Jul 2006 17:19:38 -0000 1.5 ++++ src/racoon/sainfo.h 13 May 2018 01:53:58 -0000 +@@ -51,6 +51,7 @@ + time_t lifetime; + int lifebyte; + int pfs_group; /* only use when pfs is required. */ ++ uint32_t reqid; + vchar_t *id_i; /* identifier of the authorized initiator */ + struct sainfoalg *algs[MAXALGCLASS]; + +--- src/racoon/policy.h 2018-05-13 07:42:14.828102000 +0300 ++++ src/racoon/policy.h 2018-05-13 07:41:44.807564000 +0300 +@@ -66,6 +66,7 @@ struct policyindex { + u_int16_t ul_proto; /* upper layer Protocol */ + u_int32_t priority; /* priority for the policy */ + u_int64_t created; /* Used for generated SPD entries deletion */ ++ u_int32_t reqid; /* Reqid used for if_ipsec(4) */ + #ifdef HAVE_SECCTX + struct security_ctx sec_ctx; /* Security Context */ + #endif +--- src/racoon/isakmp_quick.c 2018-05-13 08:07:07.378039000 +0300 ++++ src/racoon/isakmp_quick.c 2018-05-13 08:11:12.268612000 +0300 +@@ -2473,6 +2473,7 @@ get_proposal_r(iph2) + #endif /* HAVE_SECCTX */ + + /* get inbound policy */ ++ spidx.reqid = iph2->sainfo->reqid; + sp_in = getsp_r(&spidx); + if (sp_in == NULL) { + if (iph2->ph1->rmconf->gen_policy) { +@@ -2521,6 +2522,7 @@ get_proposal_r(iph2) + spidx.prefs = spidx.prefd; + spidx.prefd = pref; + ++ spidx.reqid = iph2->sainfo->reqid; + sp_out = getsp_r(&spidx); + if (!sp_out) { + plog(LLV_WARNING, LOCATION, NULL, +--- src/racoon/pfkey.c 2018-05-13 08:12:05.730604000 +0300 ++++ src/racoon/pfkey.c 2018-05-13 08:48:02.708803000 +0300 +@@ -1888,6 +1888,10 @@ pk_recvacquire(mhp) + spidx.prefs = sp_out->spidx.prefd; + spidx.prefd = sp_out->spidx.prefs; + spidx.ul_proto = sp_out->spidx.ul_proto; ++#ifdef IPSEC_POLICYSCOPE_IFNET ++ /* XXX: reuse reqid from outbound policy */ ++ spidx.reqid = sp_out->spidx.reqid; ++#endif + + #ifdef HAVE_SECCTX + if (m_sec_ctx) { +@@ -2787,6 +2791,25 @@ pk_recvspddump(mhp) + } + #endif /* HAVE_SECCTX */ + ++#ifdef IPSEC_POLICYSCOPE_IFNET ++ if (xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET) { ++ struct sadb_x_ipsecrequest *xisr; ++ ++ if (PFKEY_EXTLEN(xpl) < sizeof(*xpl)) { ++ plog(LLV_ERROR, LOCATION, NULL, ++ "invalid xpl msg length.\n"); ++ return (-1); ++ } ++ xisr = (struct sadb_x_ipsecrequest *)(xpl + 1); ++ if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr)) { ++ plog(LLV_ERROR, LOCATION, NULL, ++ "invalid xisr msg length.\n"); ++ return (-1); ++ } ++ spidx.reqid = xisr->sadb_x_ipsecrequest_reqid; ++ } ++#endif /* IPSEC_POLICYSCOPE_IFNET */ ++ + sp = getsp(&spidx); + if (sp != NULL) { + plog(LLV_ERROR, LOCATION, NULL, +@@ -3909,6 +3932,15 @@ addnewsp(mhp, local, remote) + created, + &new->spidx); + #endif ++ ++#ifdef IPSEC_POLICYSCOPE_IFNET ++ if (xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET) { ++ struct sadb_x_ipsecrequest *xisr; ++ ++ xisr = (struct sadb_x_ipsecrequest *)(xpl + 1); ++ new->spidx.reqid = xisr->sadb_x_ipsecrequest_reqid; ++ } ++#endif /* IPSEC_POLICYSCOPE_IFNET */ + + #ifdef HAVE_SECCTX + if (mhp[SADB_X_EXT_SEC_CTX] != NULL) { +--- src/racoon/policy.c 2018-05-13 07:17:32.815475000 +0300 ++++ src/racoon/policy.c 2018-05-13 07:44:40.838093000 +0300 +@@ -197,7 +197,8 @@ cmpspidxstrict(a, b) + if (a->dir != b->dir + || a->prefs != b->prefs + || a->prefd != b->prefd +- || a->ul_proto != b->ul_proto) ++ || a->ul_proto != b->ul_proto ++ || a->reqid != b->reqid) + return 1; + + if (cmpsaddr((struct sockaddr *) &a->src, +@@ -482,8 +483,9 @@ spidx2str(spidx) + p += i; + blen -= i; + +- i = snprintf(p, blen, "proto=%s dir=%s", +- s_proto(spidx->ul_proto), s_direction(spidx->dir)); ++ i = snprintf(p, blen, "proto=%s dir=%s reqid=%u", ++ s_proto(spidx->ul_proto), s_direction(spidx->dir), ++ spidx->reqid); + + #ifdef HAVE_SECCTX + if (spidx->sec_ctx.ctx_strlen) { diff --git a/security/ipsec-tools/files/patch-src-racoon-isakmp_cfg.c b/security/ipsec-tools/files/patch-src-racoon-isakmp_cfg.c new file mode 100644 index 000000000000..4d1ad96b321d --- /dev/null +++ b/security/ipsec-tools/files/patch-src-racoon-isakmp_cfg.c @@ -0,0 +1,28 @@ +--- src/racoon/isakmp_cfg.c ++++ src/racoon/isakmp_cfg.c +@@ -38,7 +38,9 @@ + #include + #include + ++#if __FreeBSD_version >= 900007 + #include ++#endif + #if defined(__APPLE__) && defined(__MACH__) + #include + #endif +@@ -1663,6 +1665,7 @@ + char *usr; + int inout; + { ++#if __FreeBSD_version >= 900007 + int error = 0; + struct utmpx ut; + char addr[NI_MAXHOST]; +@@ -1706,6 +1709,7 @@ + plog(LLV_ERROR, LOCATION, NULL, "Unepected inout\n"); + break; + } ++#endif + + return 0; + } diff --git a/security/ipsec-tools/files/patch-src_racoon_gssapi.c b/security/ipsec-tools/files/patch-src_racoon_gssapi.c new file mode 100644 index 000000000000..1310b7ecd893 --- /dev/null +++ b/security/ipsec-tools/files/patch-src_racoon_gssapi.c @@ -0,0 +1,14 @@ +--- src/racoon/gssapi.c.orig 2015-05-19 16:38:06 UTC ++++ src/racoon/gssapi.c +@@ -192,6 +192,11 @@ gssapi_init(struct ph1handle *iph1) + gss_name_t princ, canon_princ; + OM_uint32 maj_stat, min_stat; + ++ if (iph1->rmconf == NULL) { ++ plog(LLV_ERROR, LOCATION, NULL, "no remote config\n"); ++ return -1; ++ } ++ + gps = racoon_calloc(1, sizeof (struct gssapi_ph1_state)); + if (gps == NULL) { + plog(LLV_ERROR, LOCATION, NULL, "racoon_calloc failed\n"); diff --git a/security/ipsec-tools/files/racoon.in b/security/ipsec-tools/files/racoon.in new file mode 100644 index 000000000000..d366a3aaadca --- /dev/null +++ b/security/ipsec-tools/files/racoon.in @@ -0,0 +1,51 @@ +#!/bin/sh + +# PROVIDE: racoon +# REQUIRE: LOGIN +# KEYWORD: shutdown +# +# Define these racoon_* variables in one of these files: +# /etc/rc.conf +# /etc/rc.conf.local +# /etc/rc.conf.d/racoon +# +# DO NOT CHANGE THESE DEFAULT VALUES HERE + +. /etc/rc.subr + +name="racoon" +rcvar=racoon_enable + +load_rc_config $name + +racoon_enable=${racoon_enable:-"NO"} # Disable by default +racoon_dirs=${racoon_dirs:-"%%STATEDIR%%"} # For controlling socket +racoon_create_dirs=${racoon_create_dirs:-"NO"} # Create $racoon_dirs +#racoon_flags="" # Flags to racoon program + +command="%%PREFIX%%/sbin/${name}" +pidfile="/var/run/${name}.pid" + +start_precmd="${name}_prestart" +stop_postcmd="${name}_cleanup" + +socketfile="%%STATEDIR%%/${name}.sock" +required_files="%%PREFIX%%/etc/${name}/${name}.conf" +required_modules="%%REQUIREMOD%%" + +racoon_cleanup() +{ + /bin/rm -f ${pidfile} + /bin/rm -f ${socketfile} +} + +racoon_prestart() +{ + racoon_cleanup + + if checkyesno "${name}_create_dirs"; then + install -m 0755 -d $racoon_dirs + fi +} + +run_rc_command "$1" diff --git a/security/ipsec-tools/files/wildcard-psk-oakley.c.diff b/security/ipsec-tools/files/wildcard-psk-oakley.c.diff new file mode 100644 index 000000000000..ca32e5dc4e02 --- /dev/null +++ b/security/ipsec-tools/files/wildcard-psk-oakley.c.diff @@ -0,0 +1,22 @@ +--- src/racoon/oakley.c.orig 2012-08-29 18:35:09.000000000 +0700 ++++ src/racoon/oakley.c 2019-07-01 11:03:18.864245000 +0700 +@@ -2400,7 +2400,19 @@ oakley_skeyid(iph1) + case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R: + #endif + if (iph1->etype != ISAKMP_ETYPE_IDENT) { ++ struct ipsecdoi_id_b *id_b; ++ ++ id_b = (struct ipsecdoi_id_b *)iph1->id_p->v; ++ if (id_b->type != IPSECDOI_ID_IPV4_ADDR && ++ id_b->type != IPSECDOI_ID_IPV6_ADDR) + iph1->authstr = getpskbyname(iph1->id_p); ++ else { ++ struct sockaddr addr; ++ u_int16_t ul_proto; ++ u_int8_t prefix; ++ if (!ipsecdoi_id2sockaddr(iph1->id_p, &addr, &prefix, &ul_proto)) ++ iph1->authstr = getpskbyaddr(&addr); ++ } + if (iph1->authstr == NULL) { + if (iph1->rmconf->verify_identifier) { + plog(LLV_ERROR, LOCATION, iph1->remote, diff --git a/security/ipsec-tools/files/wildcard-psk.diff b/security/ipsec-tools/files/wildcard-psk.diff new file mode 100644 index 000000000000..03571ea34753 --- /dev/null +++ b/security/ipsec-tools/files/wildcard-psk.diff @@ -0,0 +1,12 @@ +--- src/racoon/localconf.c 9 Sep 2006 16:22:09 -0000 1.4 ++++ src/racoon/localconf.c 11 Jul 2008 20:58:55 -0000 +@@ -211,7 +211,8 @@ getpsk(str, len) + if (*p == '\0') + continue; /* no 2nd parameter */ + p--; +- if (strncmp(buf, str, len) == 0 && buf[len] == '\0') { ++ if (strcmp(buf, "*") == 0 ++ || (strncmp(buf, str, len) == 0 && buf[len] == '\0')) { + p++; + keylen = 0; + for (q = p; *q != '\0' && *q != '\n'; q++) diff --git a/security/ipsec-tools/pkg-descr b/security/ipsec-tools/pkg-descr new file mode 100644 index 000000000000..71b3503a7a67 --- /dev/null +++ b/security/ipsec-tools/pkg-descr @@ -0,0 +1,22 @@ +racoon speaks IKE (ISAKMP/Oakley) key management protocol, to +establish security association with other hosts. + +This is the IPSec-tools version of racoon. + +Enchancements: +- Support of NAT-T and IKE fragmentation. +- Support of many authentication algorithms. +- Tons of bugfixes. + +Known issues: +- Non-threaded implementation. Simultaneous key negotiation performance + should be improved. +- Cannot negotiate keys for per-socket policy. +- Cryptic configuration syntax - blame IPsec specification too... +- Needs more documentation. + +Design choice, not a bug: +- racoon negotiate IPsec keys only. It does not negotiate policy. Policy must + be configured into the kernel separately from racoon. If you want to + support roaming clients, you may need to have a mechanism to put policy + for the roaming client after phase 1 finishes. diff --git a/security/ipsec-tools/pkg-plist b/security/ipsec-tools/pkg-plist new file mode 100644 index 000000000000..decefc478ed7 --- /dev/null +++ b/security/ipsec-tools/pkg-plist @@ -0,0 +1,37 @@ +sbin/plainrsa-gen +sbin/racoon +sbin/racoonctl +sbin/setkey +include/libipsec/libpfkey.h +include/racoon/admin.h +include/racoon/evt.h +include/racoon/gcmalloc.h +include/racoon/ipsec_doi.h +include/racoon/isakmp.h +include/racoon/isakmp_cfg.h +include/racoon/isakmp_unity.h +include/racoon/isakmp_var.h +include/racoon/isakmp_xauth.h +include/racoon/misc.h +include/racoon/racoonctl.h +include/racoon/schedule.h +include/racoon/sockmisc.h +include/racoon/var.h +include/racoon/vmbuf.h +lib/libipsec.a +lib/libipsec.so +lib/libipsec.so.0 +lib/libipsec.so.0.0.1 +lib/libracoon.a +lib/libracoon.so +lib/libracoon.so.0 +lib/libracoon.so.0.0.0 +share/man/man3/ipsec_set_policy.3.gz +share/man/man3/ipsec_strerror.3.gz +share/man/man5/racoon.conf.5.gz +share/man/man8/plainrsa-gen.8.gz +share/man/man8/racoon.8.gz +share/man/man8/racoonctl.8.gz +share/man/man8/setkey.8.gz +@dir etc/racoon +@dir %%STATEDIR%%