diff options
Diffstat (limited to 'user/strongswan')
| -rw-r--r-- | user/strongswan/0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch | 104 | ||||
| -rw-r--r-- | user/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch | 597 | ||||
| -rw-r--r-- | user/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch | 131 | ||||
| -rw-r--r-- | user/strongswan/1003-vici-add-support-for-individual-sa-state-changes.patch | 159 | ||||
| -rw-r--r-- | user/strongswan/APKBUILD | 108 | ||||
| -rw-r--r-- | user/strongswan/charon.initd | 30 | ||||
| -rw-r--r-- | user/strongswan/strongswan.initd | 35 | ||||
| -rw-r--r-- | user/strongswan/strongswan.pre-install | 6 |
8 files changed, 1170 insertions, 0 deletions
diff --git a/user/strongswan/0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch b/user/strongswan/0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch new file mode 100644 index 000000000..cc14dab02 --- /dev/null +++ b/user/strongswan/0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch @@ -0,0 +1,104 @@ +From 5a5b26a7dce4c112f62882cfe16dc37659d766e8 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner <tobias@strongswan.org> +Date: Fri, 17 Jul 2015 11:53:58 +0200 +Subject: [PATCH 1/5] ike: Adhere to IKE_SA limit when checking out by config + +This prevents new SAs from getting created if we hit the global IKE_SA +limit (we still allow checkout_new(), which is used for rekeying). +--- + src/libcharon/sa/ike_sa_manager.c | 71 ++++++++++++++++++++------------------- + 1 file changed, 37 insertions(+), 34 deletions(-) + +diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c +index ce44207..37d49da 100644 +--- a/src/libcharon/sa/ike_sa_manager.c ++++ b/src/libcharon/sa/ike_sa_manager.c +@@ -1419,48 +1419,51 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + + DBG2(DBG_MGR, "checkout IKE_SA by config"); + +- if (!this->reuse_ikesa && peer_cfg->get_ike_version(peer_cfg) != IKEV1) +- { /* IKE_SA reuse disabled by config (not possible for IKEv1) */ +- ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE); +- charon->bus->set_sa(charon->bus, ike_sa); +- goto out; +- } +- +- enumerator = create_table_enumerator(this); +- while (enumerator->enumerate(enumerator, &entry, &segment)) ++ if (this->reuse_ikesa || peer_cfg->get_ike_version(peer_cfg) == IKEV1) + { +- if (!wait_for_entry(this, entry, segment)) ++ enumerator = create_table_enumerator(this); ++ while (enumerator->enumerate(enumerator, &entry, &segment)) + { +- continue; +- } +- if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING || +- entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED) +- { /* skip IKE_SAs which are not usable, wake other waiting threads */ +- entry->condvar->signal(entry->condvar); +- continue; +- } +- +- current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); +- if (current_peer && current_peer->equals(current_peer, peer_cfg)) +- { +- current_ike = current_peer->get_ike_cfg(current_peer); +- if (current_ike->equals(current_ike, peer_cfg->get_ike_cfg(peer_cfg))) ++ if (!wait_for_entry(this, entry, segment)) + { +- entry->checked_out = thread_current(); +- ike_sa = entry->ike_sa; +- DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config", +- ike_sa->get_unique_id(ike_sa), +- current_peer->get_name(current_peer)); +- break; ++ continue; + } ++ if (entry->ike_sa->get_state(entry->ike_sa) == IKE_DELETING || ++ entry->ike_sa->get_state(entry->ike_sa) == IKE_REKEYED) ++ { /* skip IKE_SAs which are not usable, wake other waiting threads */ ++ entry->condvar->signal(entry->condvar); ++ continue; ++ } ++ current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); ++ if (current_peer && current_peer->equals(current_peer, peer_cfg)) ++ { ++ current_ike = current_peer->get_ike_cfg(current_peer); ++ if (current_ike->equals(current_ike, ++ peer_cfg->get_ike_cfg(peer_cfg))) ++ { ++ entry->checked_out = thread_current(); ++ ike_sa = entry->ike_sa; ++ DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config", ++ ike_sa->get_unique_id(ike_sa), ++ current_peer->get_name(current_peer)); ++ break; ++ } ++ } ++ /* other threads might be waiting for this entry */ ++ entry->condvar->signal(entry->condvar); + } +- /* other threads might be waiting for this entry */ +- entry->condvar->signal(entry->condvar); ++ enumerator->destroy(enumerator); + } +- enumerator->destroy(enumerator); + + if (!ike_sa) +- { /* no IKE_SA using such a config, hand out a new */ ++ { /* no IKE_SA using such a config, or reuse disabled, hand out a new */ ++ if (this->ikesa_limit && ++ this->public.get_count(&this->public) >= this->ikesa_limit) ++ { ++ DBG1(DBG_MGR, "IKE_SA creation failed, hitting IKE_SA limit (%u)", ++ this->ikesa_limit); ++ return NULL; ++ } + ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE); + } + charon->bus->set_sa(charon->bus, ike_sa); +-- +2.5.0 + diff --git a/user/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch b/user/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch new file mode 100644 index 000000000..d9aea3c4d --- /dev/null +++ b/user/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch @@ -0,0 +1,597 @@ +From 460e0f52d88433071b27603e47995517514ef8b9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> +Date: Mon, 21 Sep 2015 13:41:58 +0300 +Subject: [PATCH] charon: add optional source and remote overrides for initiate +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This introduces support for specifying optional IKE SA specific +source and remote address for child sa initiation. This allows +to initiate wildcard connection for known address via vici. + +In addition this allows impler implementation of trap-any patches +and is a prerequisite for dmvpn support. + +Signed-off-by: Timo Teräs <timo.teras@iki.fi> +--- + src/charon-cmd/cmd/cmd_connection.c | 2 +- + src/charon-nm/nm/nm_service.c | 2 +- + src/libcharon/control/controller.c | 43 +++++++++++++++- + src/libcharon/control/controller.h | 3 ++ + src/libcharon/plugins/stroke/stroke_control.c | 5 +- + src/libcharon/plugins/vici/vici_config.c | 2 +- + src/libcharon/plugins/vici/vici_control.c | 63 ++++++++++++++++++++---- + src/libcharon/processing/jobs/start_action_job.c | 2 +- + src/libcharon/sa/ike_sa_manager.c | 51 ++++++++++++++++++- + src/libcharon/sa/ike_sa_manager.h | 8 ++- + src/libcharon/sa/trap_manager.c | 45 +++++++---------- + src/swanctl/commands/initiate.c | 40 ++++++++++++++- + 12 files changed, 218 insertions(+), 48 deletions(-) + +diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c +index 71df92f7e..13b31de8a 100644 +--- a/src/charon-cmd/cmd/cmd_connection.c ++++ b/src/charon-cmd/cmd/cmd_connection.c +@@ -436,7 +436,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this) + child_cfg = create_child_cfg(this, peer_cfg); + + if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg, +- controller_cb_empty, NULL, 0, FALSE) != SUCCESS) ++ NULL, NULL, controller_cb_empty, NULL, 0, FALSE) != SUCCESS) + { + terminate(pid); + } +diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c +index 571c0edba..e7922cf4d 100644 +--- a/src/charon-nm/nm/nm_service.c ++++ b/src/charon-nm/nm/nm_service.c +@@ 6220,7 +622,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection, + * Prepare IKE_SA + */ + ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, +- peer_cfg); ++ peer_cfg, NULL, NULL); + if (!ike_sa) + { + peer_cfg->destroy(peer_cfg); +diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c +index 8e7816b39..7d7b3bcbc 100644 +--- a/src/libcharon/control/controller.c ++++ b/src/libcharon/control/controller.c +@@ -15,6 +15,28 @@ + * for more details. + */ + ++/* ++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi> ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a copy ++ * of this software and associated documentation files (the "Software"), to deal ++ * in the Software without restriction, including without limitation the rights ++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell ++ * copies of the Software, and to permit persons to whom the Software is ++ * furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, ++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN ++ * THE SOFTWARE. ++ */ ++ + #include "controller.h" + + #include <sys/types.h> +@@ -103,6 +125,16 @@ struct interface_listener_t { + ike_sa_t *ike_sa; + + /** ++ * Our host hint. ++ */ ++ host_t *my_host; ++ ++ /** ++ * Other host hint. ++ */ ++ host_t *other_host; ++ ++ /** + * unique ID, used for various methods + */ + uint32_t id; +@@ -409,9 +441,14 @@ METHOD(job_t, initiate_execute, job_requeue_t, + ike_sa_t *ike_sa; + interface_listener_t *listener = &job->listener; + peer_cfg_t *peer_cfg = listener->peer_cfg; ++ host_t *my_host = listener->my_host; ++ host_t *other_host = listener->other_host; + + ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager, +- peer_cfg); ++ peer_cfg, my_host, other_host); ++ DESTROY_IF(my_host); ++ DESTROY_IF(other_host); ++ + if (!ike_sa) + { + listener->child_cfg->destroy(listener->child_cfg); +@@ -420,6 +457,7 @@ METHOD(job_t, initiate_execute, job_requeue_t, + listener_done(listener); + return JOB_REQUEUE_NONE; + } ++ + listener->lock->lock(listener->lock); + listener->ike_sa = ike_sa; + listener->lock->unlock(listener->lock); +@@ -492,6 +530,7 @@ METHOD(job_t, initiate_execute, job_requeue_t, + + METHOD(controller_t, initiate, status_t, + private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, ++ host_t *my_host, host_t *other_host, + controller_cb_t callback, void *param, u_int timeout, bool limits) + { + interface_job_t *job; +@@ -514,6 +553,8 @@ METHOD(controller_t, initiate, status_t, + .status = FAILED, + .child_cfg = child_cfg, + .peer_cfg = peer_cfg, ++ .my_host = my_host ? my_host->clone(my_host) : NULL, ++ .other_host = other_host ? other_host->clone(other_host) : NULL, + .lock = spinlock_create(), + .limits = limits, + }, +diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h +index 9524f53b9..7c51ba4ca 100644 +--- a/src/libcharon/control/controller.h ++++ b/src/libcharon/control/controller.h +@@ -79,6 +79,8 @@ struct controller_t { + * + * @param peer_cfg peer_cfg to use for IKE_SA setup + * @param child_cfg child_cfg to set up CHILD_SA from ++ * @param my_host optional address hint for source ++ * @param other_host optional address hint for destination + * @param cb logging callback + * @param param parameter to include in each call of cb + * @param timeout timeout in ms to wait for callbacks, 0 to disable +@@ -92,6 +94,7 @@ struct controller_t { + */ + status_t (*initiate)(controller_t *this, + peer_cfg_t *peer_cfg, child_cfg_t *child_cfg, ++ host_t *my_host, host_t *other_host, + controller_cb_t callback, void *param, u_int timeout, + bool limits); + +diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c +index ee8306772..0736a6427 100644 +--- a/src/libcharon/plugins/stroke/stroke_control.c ++++ b/src/libcharon/plugins/stroke/stroke_control.c +@@ -108,7 +108,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg + if (msg->output_verbosity < 0) + { + charon->controller->initiate(charon->controller, peer_cfg, child_cfg, +- NULL, NULL, 0, FALSE); ++ NULL, NULL, NULL, NULL, 0, FALSE); + } + else + { +@@ -116,7 +116,8 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg + status_t status; + + status = charon->controller->initiate(charon->controller, +- peer_cfg, child_cfg, (controller_cb_t)stroke_log, ++ peer_cfg, child_cfg, NULL, NULL, ++ (controller_cb_t)stroke_log, + &info, this->timeout, FALSE); + switch (status) + { +diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c +index 12497ec5e..ba954e5cb 100644 +--- a/src/libcharon/plugins/vici/vici_config.c ++++ b/src/libcharon/plugins/vici/vici_config.c +@@ -1978,7 +1978,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg, + DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg)); + charon->controller->initiate(charon->controller, + peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg), +- NULL, NULL, 0, FALSE); ++ NULL, NULL, NULL, NULL, 0, FALSE); + break; + case ACTION_ROUTE: + DBG1(DBG_CFG, "installing '%s'", child_cfg->get_name(child_cfg)); +diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c +index afee649f7..94bb2eecb 100644 +--- a/src/libcharon/plugins/vici/vici_control.c ++++ b/src/libcharon/plugins/vici/vici_control.c +@@ -16,6 +16,28 @@ + * for more details. + */ + ++/* ++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi> ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a copy ++ * of this software and associated documentation files (the "Software"), to deal ++ * in the Software without restriction, including without limitation the rights ++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell ++ * copies of the Software, and to permit persons to whom the Software is ++ * furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, ++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN ++ * THE SOFTWARE. ++ */ ++ + #include "vici_control.h" + #include "vici_builder.h" + +@@ -169,9 +191,11 @@ static child_cfg_t* find_child_cfg(char *name, char *pname, peer_cfg_t **out) + CALLBACK(initiate, vici_message_t*, + private_vici_control_t *this, char *name, u_int id, vici_message_t *request) + { ++ vici_message_t* msg; + child_cfg_t *child_cfg = NULL; + peer_cfg_t *peer_cfg; +- char *child, *ike; ++ host_t *my_host = NULL, *other_host = NULL; ++ char *child, *ike, *my_host_str, *other_host_str; + int timeout; + bool limits; + controller_cb_t log_cb = NULL; +@@ -185,6 +209,8 @@ CALLBACK(initiate, vici_message_t*, + timeout = request->get_int(request, 0, "timeout"); + limits = request->get_bool(request, FALSE, "init-limits"); + log.level = request->get_int(request, 1, "loglevel"); ++ my_host_str = request->get_str(request, NULL, "my-host"); ++ other_host_str = request->get_str(request, NULL, "other-host"); + + if (!child) + { +@@ -195,28 +221,47 @@ CALLBACK(initiate, vici_message_t*, + log_cb = (controller_cb_t)log_vici; + } + +- DBG1(DBG_CFG, "vici initiate '%s'", child); ++ if (my_host_str) ++ { ++ my_host = host_create_from_string(my_host_str, 0); ++ } ++ if (other_host_str) ++ { ++ other_host = host_create_from_string(other_host_str, 0); ++ } ++ ++ DBG1(DBG_CFG, "vici initiate '%s', me %H, other %H, limits %d", child, my_host, other_host, limits); + + child_cfg = find_child_cfg(child, ike, &peer_cfg); + if (!child_cfg) + { +- return send_reply(this, "CHILD_SA config '%s' not found", child); ++ msg = send_reply(this, "CHILD_SA config '%s' not found", child); ++ goto ret; + } +- switch (charon->controller->initiate(charon->controller, peer_cfg, +- child_cfg, log_cb, &log, timeout, limits)) ++ switch (charon->controller->initiate(charon->controller, ++ peer_cfg, child_cfg, my_host, other_host, ++ log_cb, &log, timeout, limits)) + { + case SUCCESS: +- return send_reply(this, NULL); ++ msg = send_reply(this, NULL); ++ break; + case OUT_OF_RES: +- return send_reply(this, "CHILD_SA '%s' not established after %dms", ++ msg = send_reply(this, "CHILD_SA '%s' not established after %dms", + child, timeout); ++ break; + case INVALID_STATE: +- return send_reply(this, "establishing CHILD_SA '%s' not possible " ++ msg = send_reply(this, "establishing CHILD_SA '%s' not possible " + "at the moment due to limits", child); ++ break; + case FAILED: + default: +- return send_reply(this, "establishing CHILD_SA '%s' failed", child); ++ msg = send_reply(this, "establishing CHILD_SA '%s' failed", child); ++ break; + } ++ret: ++ if (my_host) my_host->destroy(my_host); ++ if (other_host) other_host->destroy(other_host); ++ return msg; + } + + CALLBACK(terminate, vici_message_t*, +diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c +index 654ec6abe..3d5a48cb8 100644 +--- a/src/libcharon/processing/jobs/start_action_job.c ++++ b/src/libcharon/processing/jobs/start_action_job.c +@@ -61,7 +61,7 @@ METHOD(job_t, execute, job_requeue_t, + charon->controller->initiate(charon->controller, + peer_cfg->get_ref(peer_cfg), + child_cfg->get_ref(child_cfg), +- NULL, NULL, 0, FALSE); ++ NULL, NULL, NULL, NULL, 0, FALSE); + break; + case ACTION_ROUTE: + DBG1(DBG_JOB, "start action: route '%s'", name); +diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c +index 3ee233c1f..def2a6f1b 100644 +--- a/src/libcharon/sa/ike_sa_manager.c ++++ b/src/libcharon/sa/ike_sa_manager.c +@@ -17,6 +17,28 @@ + * for more details. + */ + ++/* ++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi> ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a copy ++ * of this software and associated documentation files (the "Software"), to deal ++ * in the Software without restriction, including without limitation the rights ++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell ++ * copies of the Software, and to permit persons to whom the Software is ++ * furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, ++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN ++ * THE SOFTWARE. ++ */ ++ + #include <string.h> + #include <inttypes.h> + +@@ -1408,7 +1430,8 @@ out: + } + + METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, +- private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg) ++ private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg, ++ host_t *my_host, host_t *other_host) + { + enumerator_t *enumerator; + entry_t *entry; +@@ -1417,7 +1440,17 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + ike_cfg_t *current_ike; + u_int segment; + +- DBG2(DBG_MGR, "checkout IKE_SA by config"); ++ if (my_host && my_host->get_port(my_host) == 0) ++ { ++ my_host->set_port(my_host, IKEV2_UDP_PORT); ++ } ++ if (other_host && other_host->get_port(other_host) == 0) ++ { ++ other_host->set_port(other_host, IKEV2_UDP_PORT); ++ } ++ ++ DBG2(DBG_MGR, "checkout IKE_SA by config '%s', me %H, other %H", ++ peer_cfg->get_name(peer_cfg), my_host, other_host); + + if (this->reuse_ikesa || peer_cfg->get_ike_version(peer_cfg) == IKEV1) + { +@@ -1434,6 +1457,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + entry->condvar->signal(entry->condvar); + continue; + } ++ ++ if (my_host && !my_host->ip_equals(my_host, entry->ike_sa->get_my_host(entry->ike_sa))) ++ { ++ continue; ++ } ++ if (other_host && !other_host->ip_equals(other_host, entry->ike_sa->get_other_host(entry->ike_sa))) ++ { ++ continue; ++ } ++ + current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa); + if (current_peer && current_peer->equals(current_peer, peer_cfg)) + { +@@ -1465,6 +1508,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*, + return NULL; + } + ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE); ++ if (my_host || other_host) ++ { ++ ike_sa->update_hosts(ike_sa, my_host, other_host, TRUE); ++ } + } + charon->bus->set_sa(charon->bus, ike_sa); + +diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h +index 4298c54e2..47d6e6a37 100644 +--- a/src/libcharon/sa/ike_sa_manager.h ++++ b/src/libcharon/sa/ike_sa_manager.h +@@ -93,7 +93,8 @@ struct ike_sa_manager_t { + ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message); + + /** +- * Checkout an IKE_SA for initiation by a peer_config. ++ * Checkout an IKE_SA for initiation by a peer_config and optional ++ * source and remote host addresses. + * + * To initiate, a CHILD_SA may be established within an existing IKE_SA. + * This call checks for an existing IKE_SA by comparing the configuration. +@@ -103,10 +104,13 @@ struct ike_sa_manager_t { + * the found IKE_SA is in the DELETING state. + * + * @param peer_cfg configuration used to find an existing IKE_SA ++ * @param my_host source host address for wildcard peer_cfg ++ * @param other_host remote host address for wildcard peer_cfg + * @return checked out/created IKE_SA + */ + ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this, +- peer_cfg_t *peer_cfg); ++ peer_cfg_t *peer_cfg, ++ host_t *my_host, host_t *other_host); + + /** + * Check for duplicates of the given IKE_SA. +diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c +index 40a0682f2..ea79d95ae 100644 +--- a/src/libcharon/sa/trap_manager.c ++++ b/src/libcharon/sa/trap_manager.c +@@ -421,7 +421,7 @@ METHOD(trap_manager_t, acquire, void, + peer_cfg_t *peer; + child_cfg_t *child; + ike_sa_t *ike_sa; +- host_t *host; ++ host_t *host, *my_host = NULL, *other_host = NULL; + bool wildcard, ignore = FALSE; + + this->lock->read_lock(this->lock); +@@ -497,36 +497,27 @@ METHOD(trap_manager_t, acquire, void, + this->lock->unlock(this->lock); + + if (wildcard) +- { /* the peer config would match IKE_SAs with other peers */ +- ike_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, +- peer->get_ike_version(peer), TRUE); +- if (ike_sa) +- { +- ike_cfg_t *ike_cfg; +- uint16_t port; +- uint8_t mask; +- +- ike_sa->set_peer_cfg(ike_sa, peer); +- ike_cfg = ike_sa->get_ike_cfg(ike_sa); ++ { ++ ike_cfg_t *ike_cfg; ++ uint16_t port; ++ uint8_t mask; + +- port = ike_cfg->get_other_port(ike_cfg); +- dst->to_subnet(dst, &host, &mask); +- host->set_port(host, port); +- ike_sa->set_other_host(ike_sa, host); ++ ike_cfg = peer->get_ike_cfg(peer); + +- port = ike_cfg->get_my_port(ike_cfg); +- src->to_subnet(src, &host, &mask); +- host->set_port(host, port); +- ike_sa->set_my_host(ike_sa, host); ++ port = ike_cfg->get_other_port(ike_cfg); ++ dst->to_subnet(dst, &other_host, &mask); ++ other_host->set_port(other_host, port); + +- charon->bus->set_sa(charon->bus, ike_sa); +- } +- } +- else +- { +- ike_sa = charon->ike_sa_manager->checkout_by_config( +- charon->ike_sa_manager, peer); ++ port = ike_cfg->get_my_port(ike_cfg); ++ src->to_subnet(src, &my_host, &mask); ++ my_host->set_port(my_host, port); + } ++ ike_sa = charon->ike_sa_manager->checkout_by_config( ++ charon->ike_sa_manager, peer, ++ my_host, other_host); ++ DESTROY_IF(my_host); ++ DESTROY_IF(other_host); ++ + if (ike_sa) + { + if (ike_sa->get_peer_cfg(ike_sa) == NULL) +diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c +index 8e452a6f6..b27bb8194 100644 +--- a/src/swanctl/commands/initiate.c ++++ b/src/swanctl/commands/initiate.c +@@ -13,6 +13,28 @@ + * for more details. + */ + ++/* ++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi> ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a copy ++ * of this software and associated documentation files (the "Software"), to deal ++ * in the Software without restriction, including without limitation the rights ++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell ++ * copies of the Software, and to permit persons to whom the Software is ++ * furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be included in ++ * all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, ++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN ++ * THE SOFTWARE. ++ */ ++ + #include "command.h" + + #include <errno.h> +@@ -37,7 +59,7 @@ static int initiate(vici_conn_t *conn) + vici_req_t *req; + vici_res_t *res; + command_format_options_t format = COMMAND_FORMAT_NONE; +- char *arg, *child = NULL, *ike = NULL; ++ char *arg, *child = NULL, *ike = NULL, *my_host = NULL, *other_host = NULL; + int ret = 0, timeout = 0, level = 1; + + while (TRUE) +@@ -64,6 +86,12 @@ static int initiate(vici_conn_t *conn) + case 'l': + level = atoi(arg); + continue; ++ case 'S': ++ my_host = arg; ++ continue; ++ case 'R': ++ other_host = arg; ++ continue; + case EOF: + break; + default: +@@ -87,6 +115,14 @@ static int initiate(vici_conn_t *conn) + { + vici_add_key_valuef(req, "ike", "%s", ike); + } ++ if (my_host) ++ { ++ vici_add_key_valuef(req, "my-host", "%s", my_host); ++ } ++ if (other_host) ++ { ++ vici_add_key_valuef(req, "other-host", "%s", other_host); ++ } + if (timeout) + { + vici_add_key_valuef(req, "timeout", "%d", timeout * 1000); +@@ -133,6 +169,8 @@ static void __attribute__ ((constructor))reg() + {"help", 'h', 0, "show usage information"}, + {"child", 'c', 1, "initate a CHILD_SA configuration"}, + {"ike", 'i', 1, "name of the connection to which the child belongs"}, ++ {"source", 'S', 1, "override source address"}, ++ {"remote", 'R', 1, "override remote address"}, + {"timeout", 't', 1, "timeout in seconds before detaching"}, + {"raw", 'r', 0, "dump raw response message"}, + {"pretty", 'P', 0, "dump raw response message in pretty print"}, +-- +2.12.1 + diff --git a/user/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch b/user/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch new file mode 100644 index 000000000..94814e13d --- /dev/null +++ b/user/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch @@ -0,0 +1,131 @@ +From 61556ac61b9d7c564dfe13d5cf549a53f889ae36 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> +Date: Mon, 21 Sep 2015 13:42:05 +0300 +Subject: [PATCH] vici: send certificates for ike-sa events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Timo Teräs <timo.teras@iki.fi> +--- + src/libcharon/plugins/vici/vici_query.c | 48 ++++++++++++++++++++++++++++----- + 1 file changed, 41 insertions(+), 7 deletions(-) + +diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c +index c0f4e2de9..309a11c03 100644 +--- a/src/libcharon/plugins/vici/vici_query.c ++++ b/src/libcharon/plugins/vici/vici_query.c +@@ -337,7 +337,7 @@ static void list_vips(private_vici_query_t *this, vici_builder_t *b, + * List details of an IKE_SA + */ + static void list_ike(private_vici_query_t *this, vici_builder_t *b, +- ike_sa_t *ike_sa, time_t now) ++ ike_sa_t *ike_sa, time_t now, bool add_certs) + { + time_t t; + ike_sa_id_t *id; +@@ -345,6 +345,8 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b, + proposal_t *proposal; + uint16_t alg, ks; + host_t *host; ++ auth_cfg_t *auth_cfg; ++ enumerator_t *enumerator; + + b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa)); + b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa)); +@@ -354,11 +356,43 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b, + b->add_kv(b, "local-host", "%H", host); + b->add_kv(b, "local-port", "%d", host->get_port(host)); + b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa)); ++ if (add_certs) ++ { ++ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, TRUE); ++ if (enumerator->enumerate(enumerator, &auth_cfg)) ++ { ++ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT); ++ chunk_t encoding; ++ ++ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding)) ++ { ++ b->add(b, VICI_KEY_VALUE, "local-cert-data", encoding); ++ free(encoding.ptr); ++ } ++ } ++ enumerator->destroy(enumerator); ++ } + + host = ike_sa->get_other_host(ike_sa); + b->add_kv(b, "remote-host", "%H", host); + b->add_kv(b, "remote-port", "%d", host->get_port(host)); + b->add_kv(b, "remote-id", "%Y", ike_sa->get_other_id(ike_sa)); ++ if (add_certs) ++ { ++ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE); ++ if (enumerator->enumerate(enumerator, &auth_cfg)) ++ { ++ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT); ++ chunk_t encoding; ++ ++ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding)) ++ { ++ b->add(b, VICI_KEY_VALUE, "remote-cert-data", encoding); ++ free(encoding.ptr); ++ } ++ } ++ enumerator->destroy(enumerator); ++ } + + eap = ike_sa->get_other_eap_id(ike_sa); + +@@ -476,7 +510,7 @@ CALLBACK(list_sas, vici_message_t*, + b = vici_builder_create(); + b->begin_section(b, ike_sa->get_name(ike_sa)); + +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, TRUE); + + b->begin_section(b, "child-sas"); + csas = ike_sa->create_child_sa_enumerator(ike_sa); +@@ -1624,7 +1658,7 @@ METHOD(listener_t, ike_updown, bool, + } + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, up); + b->end_section(b); + + this->dispatcher->raise_event(this->dispatcher, +@@ -1649,10 +1683,10 @@ METHOD(listener_t, ike_rekey, bool, + b = vici_builder_create(); + b->begin_section(b, old->get_name(old)); + b->begin_section(b, "old"); +- list_ike(this, b, old, now); ++ list_ike(this, b, old, now, TRUE); + b->end_section(b); + b->begin_section(b, "new"); +- list_ike(this, b, new, now); ++ list_ike(this, b, new, now, TRUE); + b->end_section(b); + b->end_section(b); + +@@ -1682,7 +1716,7 @@ METHOD(listener_t, child_updown, bool, + } + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, up); + b->begin_section(b, "child-sas"); + + b->begin_section(b, child_sa->get_name(child_sa)); +@@ -1714,7 +1748,7 @@ METHOD(listener_t, child_rekey, bool, + b = vici_builder_create(); + + b->begin_section(b, ike_sa->get_name(ike_sa)); +- list_ike(this, b, ike_sa, now); ++ list_ike(this, b, ike_sa, now, TRUE); + b->begin_section(b, "child-sas"); + + b->begin_section(b, old->get_name(old)); +-- +2.12.1 + diff --git a/user/strongswan/1003-vici-add-support-for-individual-sa-state-changes.patch b/user/strongswan/1003-vici-add-support-for-individual-sa-state-changes.patch new file mode 100644 index 000000000..06dc121e8 --- /dev/null +++ b/user/strongswan/1003-vici-add-support-for-individual-sa-state-changes.patch @@ -0,0 +1,159 @@ +From 0e4f1118e68736bb96ae23f4c6cb85f2ebbc998d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> +Date: Mon, 21 Sep 2015 13:42:11 +0300 +Subject: [PATCH] vici: add support for individual sa state changes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Useful for monitoring and tracking full SA. + +Signed-off-by: Timo Teräs <timo.teras@iki.fi> +--- + src/libcharon/plugins/vici/vici_query.c | 105 ++++++++++++++++++++++++++++++++ + 1 file changed, 105 insertions(+) + +diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c +index 309a11c03..83a5daaa7 100644 +--- a/src/libcharon/plugins/vici/vici_query.c ++++ b/src/libcharon/plugins/vici/vici_query.c +@@ -1624,8 +1624,16 @@ static void manage_commands(private_vici_query_t *this, bool reg) + this->dispatcher->manage_event(this->dispatcher, "list-cert", reg); + this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg); + this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg); ++ this->dispatcher->manage_event(this->dispatcher, "ike-state-established", reg); ++ this->dispatcher->manage_event(this->dispatcher, "ike-state-destroying", reg); + this->dispatcher->manage_event(this->dispatcher, "child-updown", reg); + this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-installing", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-installed", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-updating", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-rekeying", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-rekeyed", reg); ++ this->dispatcher->manage_event(this->dispatcher, "child-state-destroying", reg); + manage_command(this, "list-sas", list_sas, reg); + manage_command(this, "list-policies", list_policies, reg); + manage_command(this, "list-conns", list_conns, reg); +@@ -1696,6 +1704,45 @@ METHOD(listener_t, ike_rekey, bool, + return TRUE; + } + ++METHOD(listener_t, ike_state_change, bool, ++ private_vici_query_t *this, ike_sa_t *ike_sa, ike_sa_state_t state) ++{ ++ char *event; ++ vici_builder_t *b; ++ time_t now; ++ ++ switch (state) ++ { ++ case IKE_ESTABLISHED: ++ event = "ike-state-established"; ++ break; ++ case IKE_DESTROYING: ++ event = "ike-state-destroying"; ++ break; ++ default: ++ return TRUE; ++ } ++ ++ if (!this->dispatcher->has_event_listeners(this->dispatcher, event)) ++ { ++ return TRUE; ++ } ++ ++ now = time_monotonic(NULL); ++ ++ b = vici_builder_create(); ++ b->begin_section(b, ike_sa->get_name(ike_sa)); ++ list_ike(this, b, ike_sa, now, state != IKE_DESTROYING); ++ b->begin_section(b, "child-sas"); ++ b->end_section(b); ++ b->end_section(b); ++ ++ this->dispatcher->raise_event(this->dispatcher, ++ event, 0, b->finalize(b)); ++ ++ return TRUE; ++} ++ + METHOD(listener_t, child_updown, bool, + private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up) + { +@@ -1771,6 +1818,62 @@ METHOD(listener_t, child_rekey, bool, + return TRUE; + } + ++METHOD(listener_t, child_state_change, bool, ++ private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state) ++{ ++ char *event; ++ vici_builder_t *b; ++ time_t now; ++ ++ switch (state) ++ { ++ case CHILD_INSTALLING: ++ event = "child-state-installing"; ++ break; ++ case CHILD_INSTALLED: ++ event = "child-state-installed"; ++ break; ++ case CHILD_UPDATING: ++ event = "child-state-updating"; ++ break; ++ case CHILD_REKEYING: ++ event = "child-state-rekeying"; ++ break; ++ case CHILD_REKEYED: ++ event = "child-state-rekeyed"; ++ break; ++ case CHILD_DESTROYING: ++ event = "child-state-destroying"; ++ break; ++ default: ++ return TRUE; ++ } ++ ++ if (!this->dispatcher->has_event_listeners(this->dispatcher, event)) ++ { ++ return TRUE; ++ } ++ ++ now = time_monotonic(NULL); ++ ++ b = vici_builder_create(); ++ b->begin_section(b, ike_sa->get_name(ike_sa)); ++ list_ike(this, b, ike_sa, now, state != CHILD_DESTROYING); ++ b->begin_section(b, "child-sas"); ++ ++ b->begin_section(b, child_sa->get_name(child_sa)); ++ list_child(this, b, child_sa, now); ++ b->end_section(b); ++ ++ b->end_section(b); ++ b->end_section(b); ++ ++ this->dispatcher->raise_event(this->dispatcher, ++ event, 0, b->finalize(b)); ++ ++ return TRUE; ++} ++ + METHOD(vici_query_t, destroy, void, + private_vici_query_t *this) + { +@@ -1790,8 +1893,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher) + .listener = { + .ike_updown = _ike_updown, + .ike_rekey = _ike_rekey, ++ .ike_state_change = _ike_state_change, + .child_updown = _child_updown, + .child_rekey = _child_rekey, ++ .child_state_change = _child_state_change, + }, + .destroy = _destroy, + }, +-- +2.12.1 + diff --git a/user/strongswan/APKBUILD b/user/strongswan/APKBUILD new file mode 100644 index 000000000..29390b652 --- /dev/null +++ b/user/strongswan/APKBUILD @@ -0,0 +1,108 @@ +# Contributor: Jesse Young <jlyo@jlyo.org> +# Contributor: Natanael Copa <ncopa@alpinelinux.org> +# Maintainer: Lee Starnes <lee@canned-death.us> +pkgname=strongswan +pkgver=5.7.1 +_pkgver=${pkgver//_rc/rc} +pkgrel=0 +pkgdesc="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE" +url="https://www.strongswan.org/" +arch="all" +pkgusers="ipsec" +pkggroups="ipsec" +license="GPL-2.0 AND RSA-MD5 AND RSA-PKCS11 AND DES" +depends="iproute2" +depends_dev="" +makedepends="$depends_dev linux-headers python3 sqlite-dev openssl-dev curl-dev + gmp-dev libcap-dev" +install="$pkgname.pre-install" +subpackages="$pkgname-doc $pkgname-dbg $pkgname-openrc" +source="https://download.strongswan.org/$pkgname-$_pkgver.tar.bz2 + 0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch + 1001-charon-add-optional-source-and-remote-overrides-for-.patch + 1002-vici-send-certificates-for-ike-sa-events.patch + 1003-vici-add-support-for-individual-sa-state-changes.patch + + strongswan.initd + charon.initd + " +builddir="$srcdir/$pkgname-$_pkgver" + +# secfixes: +# 5.7.1-r0: +# - CVE-2018-17540 + +build() { + cd "$builddir" + + # notes about configuration: + # - try to keep options in ./configure --help order + # - apk depends on openssl, so we use that + # - openssl provides ciphers, randomness, etc + # -> disable all redundant in-tree copies + + ./configure --prefix=/usr \ + --sysconfdir=/etc \ + --libexecdir=/usr/lib \ + --with-ipsecdir=/usr/lib/strongswan \ + --with-capabilities=libcap \ + --with-user=ipsec \ + --with-group=ipsec \ + --enable-curl \ + --disable-ldap \ + --disable-aes \ + --disable-des \ + --disable-rc2 \ + --disable-md5 \ + --disable-sha1 \ + --disable-sha2 \ + --enable-gmp \ + --disable-hmac \ + --disable-mysql \ + --enable-sqlite \ + --enable-eap-sim \ + --enable-eap-sim-file \ + --enable-eap-aka \ + --enable-eap-aka-3gpp2 \ + --enable-eap-simaka-pseudonym \ + --enable-eap-simaka-reauth \ + --enable-eap-identity \ + --enable-eap-md5 \ + --enable-eap-tls \ + --disable-eap-gtc \ + --enable-eap-mschapv2 \ + --enable-eap-radius \ + --enable-xauth-eap \ + --enable-farp \ + --enable-vici \ + --enable-attr-sql \ + --enable-dhcp \ + --enable-openssl \ + --enable-unity \ + --enable-ha \ + --enable-cmd \ + --enable-swanctl \ + --enable-shared \ + --disable-static + make +} + +check() { + cd "$builddir" + env TESTS_SUITES_EXCLUDE=printf make check +} + +package() { + cd "$builddir" + make DESTDIR="$pkgdir" install + install -m755 -D "$srcdir/$pkgname.initd" "$pkgdir/etc/init.d/$pkgname" + install -m755 -D "$srcdir/charon.initd" "$pkgdir/etc/init.d/charon" +} + +sha512sums="43102814434bee7c27a5956be59099cc4ffb9bb5b0d6382ce4c6a80d1d82ed6639f698f5f5544b9ca563554a344638c953525b0e2d39bc6b71b19055c80e07fc strongswan-5.7.1.tar.bz2 +193d845e2751c23d98cdf84134c7803f2e412197669c6d6c1c9974041608d154b85594ed3d9ffb923ca22a4d5926c7f2373787ddc7da47b52019e284a1d13211 0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch +21db8f153f535ef13cc7c9c011f9b90b8c794e0072bd93fda6a0a56dc00d32d04e186b1a72a87a85613b7e511eed5cb96623abf0721c67dd5c96446db969a185 1001-charon-add-optional-source-and-remote-overrides-for-.patch +f7d98fb99b4855e8bfbb7369292c170536b1987e717feeda71f64ab71b35538e7d462609a773c6a6ed08c8e6ee7a186df12e1ea7d64b9dac0b17d4c7af17dab3 1002-vici-send-certificates-for-ike-sa-events.patch +a4235cd07e17ad3441dc391ded11ee9f4debdffa1e8218809731e73a545ca6fcdc0bb87239d41b1102b0b6719a4d31d43758972d2193ebe298b275285de2ce54 1003-vici-add-support-for-individual-sa-state-changes.patch +8b61e3ffbb39b837733e602ec329e626dc519bf7308d3d4192b497d18f38176789d23ef5afec51f8463ee1ddaf4d74546b965c03184132e217cbc27017e886c9 strongswan.initd +1c44c801f66305c0331f76e580c0d60f1b7d5cd3cc371be55826b06c3899f542664628a912a7fb48626e34d864f72ca5dcd34b2f0d507c4f19c510d0047054c1 charon.initd" diff --git a/user/strongswan/charon.initd b/user/strongswan/charon.initd new file mode 100644 index 000000000..6f79679c0 --- /dev/null +++ b/user/strongswan/charon.initd @@ -0,0 +1,30 @@ +#!/sbin/openrc-run + +description="strongSwan charon IKE daemon" +command="/usr/lib/strongswan/charon" +pidfile="/var/run/charon.pid" +start_stop_daemon_args="--background" +extra_started_commands="reload fullstatus" + +depend() { + need net + after firewall + provide ipsec +} + +start_post() { + ebegin "Loading ${name:-$RC_SVCNAME} configuration" + sleep 0.2 + swanctl --load-all &>/dev/null + eend $? +} + +reload() { + swanctl --reload-settings + swanctl --load-all +} + +fullstatus() { + swanctl --list-conns + swanctl --list-sas +} diff --git a/user/strongswan/strongswan.initd b/user/strongswan/strongswan.initd new file mode 100644 index 000000000..78fecb0ee --- /dev/null +++ b/user/strongswan/strongswan.initd @@ -0,0 +1,35 @@ +#!/sbin/openrc-run + +extra_started_commands="fullstatus" + +depend() { + need net + after firewall + provide ipsec +} + +start() { + ebegin "Starting StrongSwan" + ipsec start + eend $? +} + +stop () { + ebegin "Stopping StrongSwan" + ipsec stop + eend $? +} + +restart() { + ebegin "Restarting StrongSwan" + svc_stop + sleep 2 + svc_start + eend $? +} + +fullstatus() { + ebegin "StrongSwan Status (verbose):" + ipsec statusall + eend $? +} diff --git a/user/strongswan/strongswan.pre-install b/user/strongswan/strongswan.pre-install new file mode 100644 index 000000000..da43ede66 --- /dev/null +++ b/user/strongswan/strongswan.pre-install @@ -0,0 +1,6 @@ +#!/bin/sh + +addgroup -S ipsec 2>/dev/null +adduser -S -D -H -h /var/empty -s /sbin/nologin -G ipsec -g ipsec ipsec 2>/dev/null + +exit 0 |