1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
|
--- src/racoon/cfparse.y 22 Aug 2006 18:17:17 -0000 1.66
+++ src/racoon/cfparse.y 13 May 2018 01:53:57 -0000
@@ -284,7 +284,7 @@ static int process_rmconf()
/* algorithm */
%token ALGORITHM_CLASS ALGORITHMTYPE STRENGTHTYPE
/* sainfo */
-%token SAINFO FROM
+%token SAINFO FROM REQID
/* remote */
%token REMOTE ANONYMOUS CLIENTADDR INHERIT REMOTE_ADDRESS
%token EXCHANGE_MODE EXCHANGETYPE DOI DOITYPE SITUATION SITUATIONTYPE
@@ -1571,6 +1571,11 @@ sainfo_spec
| REMOTEID NUMBER
{
cur_sainfo->remoteid = $2;
+ }
+ EOS
+ | REQID NUMBER
+ {
+ cur_sainfo->reqid = $2;
}
EOS
| LIFETIME LIFETYPE_TIME NUMBER unittype_time
--- src/racoon/cftoken.l 22 Aug 2006 18:17:17 -0000 1.53
+++ src/racoon/cftoken.l 13 May 2018 01:53:57 -0000
@@ -290,6 +290,7 @@
<S_SAINFS>identifier { YYD; yywarn("it is obsoleted. use \"my_identifier\"."); return(IDENTIFIER); }
<S_SAINFS>my_identifier { YYD; return(MY_IDENTIFIER); }
<S_SAINFS>lifetime { YYD; return(LIFETIME); }
+<S_SAINFS>reqid { YYD; return(REQID); }
<S_SAINFS>time { YYD; return(LIFETYPE_TIME); }
<S_SAINFS>byte { YYD; return(LIFETYPE_BYTE); }
<S_SAINFS>encryption_algorithm { YYD; yylval.num = algclass_ipsec_enc; return(ALGORITHM_CLASS); }
--- src/racoon/proposal.c 27 Apr 2006 03:41:54 -0000 1.19
+++ src/racoon/proposal.c 13 May 2018 01:53:58 -0000
@@ -1253,8 +1253,8 @@ set_proposal_from_proposal(iph2)
if(g_nextreqid >= IPSEC_MANUAL_REQID_MAX)
g_nextreqid = 1;
}else{
- newpr->reqid_in = 0;
- newpr->reqid_out = 0;
+ newpr->reqid_in = iph2->sainfo->reqid;
+ newpr->reqid_out = iph2->sainfo->reqid;
}
if (set_satrnsbysainfo(newpr, iph2->sainfo) < 0)
--- src/racoon/sainfo.c 11 Aug 2006 16:07:05 -0000 1.9
+++ src/racoon/sainfo.c 13 May 2018 01:53:58 -0000
@@ -383,8 +383,8 @@ sainfo2str(si)
else
id_i = ipsecdoi_id2str(si->id_i);
- snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u",
- idloc, idrmt, id_i, si->remoteid);
+ snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u, reqid=%u",
+ idloc, idrmt, id_i, si->remoteid, si->reqid);
racoon_free(idloc);
racoon_free(idrmt);
--- src/racoon/sainfo.h 9 Jul 2006 17:19:38 -0000 1.5
+++ src/racoon/sainfo.h 13 May 2018 01:53:58 -0000
@@ -51,6 +51,7 @@
time_t lifetime;
int lifebyte;
int pfs_group; /* only use when pfs is required. */
+ uint32_t reqid;
vchar_t *id_i; /* identifier of the authorized initiator */
struct sainfoalg *algs[MAXALGCLASS];
--- src/racoon/policy.h 2018-05-13 07:42:14.828102000 +0300
+++ src/racoon/policy.h 2018-05-13 07:41:44.807564000 +0300
@@ -66,6 +66,7 @@ struct policyindex {
u_int16_t ul_proto; /* upper layer Protocol */
u_int32_t priority; /* priority for the policy */
u_int64_t created; /* Used for generated SPD entries deletion */
+ u_int32_t reqid; /* Reqid used for if_ipsec(4) */
#ifdef HAVE_SECCTX
struct security_ctx sec_ctx; /* Security Context */
#endif
--- src/racoon/isakmp_quick.c 2018-05-13 08:07:07.378039000 +0300
+++ src/racoon/isakmp_quick.c 2018-05-13 08:11:12.268612000 +0300
@@ -2473,6 +2473,7 @@ get_proposal_r(iph2)
#endif /* HAVE_SECCTX */
/* get inbound policy */
+ spidx.reqid = iph2->sainfo->reqid;
sp_in = getsp_r(&spidx);
if (sp_in == NULL) {
if (iph2->ph1->rmconf->gen_policy) {
@@ -2521,6 +2522,7 @@ get_proposal_r(iph2)
spidx.prefs = spidx.prefd;
spidx.prefd = pref;
+ spidx.reqid = iph2->sainfo->reqid;
sp_out = getsp_r(&spidx);
if (!sp_out) {
plog(LLV_WARNING, LOCATION, NULL,
--- src/racoon/pfkey.c 2018-05-13 08:12:05.730604000 +0300
+++ src/racoon/pfkey.c 2018-05-13 08:48:02.708803000 +0300
@@ -1888,6 +1888,10 @@ pk_recvacquire(mhp)
spidx.prefs = sp_out->spidx.prefd;
spidx.prefd = sp_out->spidx.prefs;
spidx.ul_proto = sp_out->spidx.ul_proto;
+#ifdef IPSEC_POLICYSCOPE_IFNET
+ /* XXX: reuse reqid from outbound policy */
+ spidx.reqid = sp_out->spidx.reqid;
+#endif
#ifdef HAVE_SECCTX
if (m_sec_ctx) {
@@ -2787,6 +2791,25 @@ pk_recvspddump(mhp)
}
#endif /* HAVE_SECCTX */
+#ifdef IPSEC_POLICYSCOPE_IFNET
+ if (xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET) {
+ struct sadb_x_ipsecrequest *xisr;
+
+ if (PFKEY_EXTLEN(xpl) < sizeof(*xpl)) {
+ plog(LLV_ERROR, LOCATION, NULL,
+ "invalid xpl msg length.\n");
+ return (-1);
+ }
+ xisr = (struct sadb_x_ipsecrequest *)(xpl + 1);
+ if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr)) {
+ plog(LLV_ERROR, LOCATION, NULL,
+ "invalid xisr msg length.\n");
+ return (-1);
+ }
+ spidx.reqid = xisr->sadb_x_ipsecrequest_reqid;
+ }
+#endif /* IPSEC_POLICYSCOPE_IFNET */
+
sp = getsp(&spidx);
if (sp != NULL) {
plog(LLV_ERROR, LOCATION, NULL,
@@ -3909,6 +3932,15 @@ addnewsp(mhp, local, remote)
created,
&new->spidx);
#endif
+
+#ifdef IPSEC_POLICYSCOPE_IFNET
+ if (xpl->sadb_x_policy_scope == IPSEC_POLICYSCOPE_IFNET) {
+ struct sadb_x_ipsecrequest *xisr;
+
+ xisr = (struct sadb_x_ipsecrequest *)(xpl + 1);
+ new->spidx.reqid = xisr->sadb_x_ipsecrequest_reqid;
+ }
+#endif /* IPSEC_POLICYSCOPE_IFNET */
#ifdef HAVE_SECCTX
if (mhp[SADB_X_EXT_SEC_CTX] != NULL) {
--- src/racoon/policy.c 2018-05-13 07:17:32.815475000 +0300
+++ src/racoon/policy.c 2018-05-13 07:44:40.838093000 +0300
@@ -197,7 +197,8 @@ cmpspidxstrict(a, b)
if (a->dir != b->dir
|| a->prefs != b->prefs
|| a->prefd != b->prefd
- || a->ul_proto != b->ul_proto)
+ || a->ul_proto != b->ul_proto
+ || a->reqid != b->reqid)
return 1;
if (cmpsaddr((struct sockaddr *) &a->src,
@@ -482,8 +483,9 @@ spidx2str(spidx)
p += i;
blen -= i;
- i = snprintf(p, blen, "proto=%s dir=%s",
- s_proto(spidx->ul_proto), s_direction(spidx->dir));
+ i = snprintf(p, blen, "proto=%s dir=%s reqid=%u",
+ s_proto(spidx->ul_proto), s_direction(spidx->dir),
+ spidx->reqid);
#ifdef HAVE_SECCTX
if (spidx->sec_ctx.ctx_strlen) {
|
