Merge branch 'multi-vip'

Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.

src/libcharon/plugins/stroke/Makefile.am

@@ -21,6 +21,7 @@ libstrongswan_stroke_la_SOURCES = \
 	stroke_cred.h stroke_cred.c \
 	stroke_ca.h stroke_ca.c \
 	stroke_attribute.h stroke_attribute.c \
+	stroke_handler.h stroke_handler.c \
 	stroke_list.h stroke_list.c
 
 libstrongswan_stroke_la_LDFLAGS = -module -avoid-version

src/libcharon/plugins/stroke/stroke_attribute.c

@@ -17,7 +17,6 @@
 #include "stroke_attribute.h"
 
 #include <daemon.h>
-#include <attributes/mem_pool.h>
 #include <utils/linked_list.h>
 #include <threading/rwlock.h>
 
@@ -38,12 +37,37 @@ struct private_stroke_attribute_t {
 	 */
 	linked_list_t *pools;
 
+	/**
+	 * List of connection specific attributes, as attributes_t
+	 */
+	linked_list_t *attrs;
+
 	/**
 	 * rwlock to lock access to pools
 	 */
 	rwlock_t *lock;
 };
 
+/**
+ * Attributes assigned to a connection
+ */
+typedef struct {
+	/** name of the connection */
+	char *name;
+	/** list of DNS attributes, as host_t */
+	linked_list_t *dns;
+} attributes_t;
+
+/**
+ * Destroy an attributes_t entry
+ */
+static void attributes_destroy(attributes_t *this)
+{
+	this->dns->destroy_offset(this->dns, offsetof(host_t, destroy));
+	free(this->name);
+	free(this);
+}
+
 /**
  * find a pool by name
  */
@@ -66,11 +90,12 @@ static mem_pool_t *find_pool(private_stroke_attribute_t *this, char *name)
 }
 
 METHOD(attribute_provider_t, acquire_address, host_t*,
-	   private_stroke_attribute_t *this, char *name, identification_t *id,
-	   host_t *requested)
+	private_stroke_attribute_t *this, char *name, identification_t *id,
+	host_t *requested)
 {
 	mem_pool_t *pool;
 	host_t *addr = NULL;
+
 	this->lock->read_lock(this->lock);
 	pool = find_pool(this, name);
 	if (pool)
@@ -82,11 +107,12 @@ METHOD(attribute_provider_t, acquire_address, host_t*,
 }
 
 METHOD(attribute_provider_t, release_address, bool,
-	   private_stroke_attribute_t *this, char *name, host_t *address,
-	   identification_t *id)
+	private_stroke_attribute_t *this, char *name, host_t *address,
+	identification_t *id)
 {
 	mem_pool_t *pool;
 	bool found = FALSE;
+
 	this->lock->read_lock(this->lock);
 	pool = find_pool(this, name);
 	if (pool)
@@ -97,56 +123,162 @@ METHOD(attribute_provider_t, release_address, bool,
 	return found;
 }
 
-METHOD(stroke_attribute_t, add_pool, void,
-	   private_stroke_attribute_t *this, stroke_msg_t *msg)
+/**
+ * Filter function to convert host to DNS configuration attributes
+ */
+static bool attr_filter(void *lock, host_t **in,
+						configuration_attribute_type_t *type,
+						void *dummy, chunk_t *data)
 {
-	if (msg->add_conn.other.sourceip_mask)
+	host_t *host = *in;
+
+	switch (host->get_family(host))
 	{
-		mem_pool_t *pool;
-		host_t *base = NULL;
-		u_int32_t bits = 0;
-
-		/* if %config, add an empty pool, otherwise */
-		if (msg->add_conn.other.sourceip)
-		{
-			DBG1(DBG_CFG, "adding virtual IP address pool '%s': %s/%d",
-				 msg->add_conn.name, msg->add_conn.other.sourceip,
-				 msg->add_conn.other.sourceip_mask);
-			base = host_create_from_string(msg->add_conn.other.sourceip, 0);
-			if (!base)
-			{
-				DBG1(DBG_CFG, "virtual IP address invalid, discarded");
-				return;
-			}
-			bits = msg->add_conn.other.sourceip_mask;
-		}
-		pool = mem_pool_create(msg->add_conn.name, base, bits);
-		DESTROY_IF(base);
-
-		this->lock->write_lock(this->lock);
-		this->pools->insert_last(this->pools, pool);
-		this->lock->unlock(this->lock);
+		case AF_INET:
+			*type = INTERNAL_IP4_DNS;
+			break;
+		case AF_INET6:
+			*type = INTERNAL_IP6_DNS;
+			break;
+		default:
+			return FALSE;
 	}
+	*data = host->get_address(host);
+	return TRUE;
 }
 
-METHOD(stroke_attribute_t, del_pool, void,
-	   private_stroke_attribute_t *this, stroke_msg_t *msg)
+METHOD(attribute_provider_t, create_attribute_enumerator, enumerator_t*,
+	private_stroke_attribute_t *this, linked_list_t *pools,
+	identification_t *id, linked_list_t *vips)
+{
+	ike_sa_t *ike_sa;
+	peer_cfg_t *peer_cfg;
+	enumerator_t *enumerator;
+	attributes_t *attr;
+
+	ike_sa = charon->bus->get_sa(charon->bus);
+	if (ike_sa)
+	{
+		peer_cfg = ike_sa->get_peer_cfg(ike_sa);
+		this->lock->read_lock(this->lock);
+		enumerator = this->attrs->create_enumerator(this->attrs);
+		while (enumerator->enumerate(enumerator, &attr))
+		{
+			if (streq(attr->name, peer_cfg->get_name(peer_cfg)))
+			{
+				enumerator->destroy(enumerator);
+				return enumerator_create_filter(
+									attr->dns->create_enumerator(attr->dns),
+									(void*)attr_filter, this->lock,
+									(void*)this->lock->unlock);
+			}
+		}
+		enumerator->destroy(enumerator);
+		this->lock->unlock(this->lock);
+	}
+	return enumerator_create_empty();
+}
+
+METHOD(stroke_attribute_t, add_pool, void,
+	private_stroke_attribute_t *this, mem_pool_t *pool)
 {
 	enumerator_t *enumerator;
-	mem_pool_t *pool;
+	mem_pool_t *current;
+	host_t *base;
+	int size;
+
+	base = pool->get_base(pool);
+	size = pool->get_size(pool);
 
 	this->lock->write_lock(this->lock);
+
 	enumerator = this->pools->create_enumerator(this->pools);
-	while (enumerator->enumerate(enumerator, &pool))
+	while (enumerator->enumerate(enumerator, &current))
 	{
-		if (streq(msg->del_conn.name, pool->get_name(pool)))
+		if (base && current->get_base(current) &&
+			base->ip_equals(base, current->get_base(current)) &&
+			size == current->get_size(current))
 		{
-			this->pools->remove_at(this->pools, enumerator);
 			pool->destroy(pool);
+			pool = NULL;
+			DBG1(DBG_CFG, "reusing virtual IP address pool %H/%d", base, size);
 			break;
 		}
 	}
 	enumerator->destroy(enumerator);
+
+	if (pool)
+	{
+		if (base)
+		{
+			DBG1(DBG_CFG, "adding virtual IP address pool %H/%d", base, size);
+		}
+		this->pools->insert_last(this->pools, pool);
+	}
+
+	this->lock->unlock(this->lock);
+}
+
+METHOD(stroke_attribute_t, add_dns, void,
+	private_stroke_attribute_t *this, stroke_msg_t *msg)
+{
+	if (msg->add_conn.other.dns)
+	{
+		enumerator_t *enumerator;
+		attributes_t *attr = NULL;
+		host_t *host;
+		char *token;
+
+		enumerator = enumerator_create_token(msg->add_conn.other.dns, ",", " ");
+		while (enumerator->enumerate(enumerator, &token))
+		{
+			host = host_create_from_string(token, 0);
+			if (host)
+			{
+				if (!attr)
+				{
+					INIT(attr,
+						.name = strdup(msg->add_conn.name),
+						.dns = linked_list_create(),
+					);
+				}
+				attr->dns->insert_last(attr->dns, host);
+			}
+			else
+			{
+				DBG1(DBG_CFG, "ignoring invalid DNS address '%s'", token);
+			}
+		}
+		enumerator->destroy(enumerator);
+		if (attr)
+		{
+			this->lock->write_lock(this->lock);
+			this->attrs->insert_last(this->attrs, attr);
+			this->lock->unlock(this->lock);
+		}
+	}
+}
+
+METHOD(stroke_attribute_t, del_dns, void,
+	private_stroke_attribute_t *this, stroke_msg_t *msg)
+{
+	enumerator_t *enumerator;
+	attributes_t *attr;
+
+	this->lock->write_lock(this->lock);
+
+	enumerator = this->attrs->create_enumerator(this->attrs);
+	while (enumerator->enumerate(enumerator, &attr))
+	{
+		if (streq(msg->del_conn.name, attr->name))
+		{
+			this->attrs->remove_at(this->attrs, enumerator);
+			attributes_destroy(attr);
+			break;
+		}
+	}
+	enumerator->destroy(enumerator);
+
 	this->lock->unlock(this->lock);
 }
 
@@ -158,6 +290,11 @@ static bool pool_filter(void *lock, mem_pool_t **poolp, const char **name,
 						void *d3, u_int *offline)
 {
 	mem_pool_t *pool = *poolp;
+
+	if (pool->get_size(pool) == 0)
+	{
+		return FALSE;
+	}
 	*name = pool->get_name(pool);
 	*size = pool->get_size(pool);
 	*online = pool->get_online(pool);
@@ -166,7 +303,7 @@ static bool pool_filter(void *lock, mem_pool_t **poolp, const char **name,
 }
 
 METHOD(stroke_attribute_t, create_pool_enumerator, enumerator_t*,
-	   private_stroke_attribute_t *this)
+	private_stroke_attribute_t *this)
 {
 	this->lock->read_lock(this->lock);
 	return enumerator_create_filter(this->pools->create_enumerator(this->pools),
@@ -175,7 +312,7 @@ METHOD(stroke_attribute_t, create_pool_enumerator, enumerator_t*,
 }
 
 METHOD(stroke_attribute_t, create_lease_enumerator, enumerator_t*,
-	   private_stroke_attribute_t *this, char *name)
+	private_stroke_attribute_t *this, char *name)
 {
 	mem_pool_t *pool;
 	this->lock->read_lock(this->lock);
@@ -190,10 +327,11 @@ METHOD(stroke_attribute_t, create_lease_enumerator, enumerator_t*,
 }
 
 METHOD(stroke_attribute_t, destroy, void,
-	   private_stroke_attribute_t *this)
+	private_stroke_attribute_t *this)
 {
 	this->lock->destroy(this->lock);
 	this->pools->destroy_offset(this->pools, offsetof(mem_pool_t, destroy));
+	this->attrs->destroy_function(this->attrs, (void*)attributes_destroy);
 	free(this);
 }
 
@@ -209,15 +347,17 @@ stroke_attribute_t *stroke_attribute_create()
 			.provider = {
 				.acquire_address = _acquire_address,
 				.release_address = _release_address,
-				.create_attribute_enumerator = enumerator_create_empty,
+				.create_attribute_enumerator = _create_attribute_enumerator,
 			},
 			.add_pool = _add_pool,
-			.del_pool = _del_pool,
+			.add_dns = _add_dns,
+			.del_dns = _del_dns,
 			.create_pool_enumerator = _create_pool_enumerator,
 			.create_lease_enumerator = _create_lease_enumerator,
 			.destroy = _destroy,
 		},
 		.pools = linked_list_create(),
+		.attrs = linked_list_create(),
 		.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
 	);
 

src/libcharon/plugins/stroke/stroke_attribute.h

@@ -23,6 +23,7 @@
 
 #include <stroke_msg.h>
 #include <attributes/attribute_provider.h>
+#include <attributes/mem_pool.h>
 
 typedef struct stroke_attribute_t stroke_attribute_t;
 
@@ -37,18 +38,28 @@ struct stroke_attribute_t {
 	attribute_provider_t provider;
 
 	/**
-	 * Add a virtual IP address pool.
+	 * Add a memory pool to this virtual IP backend.
 	 *
-	 * @param msg		stroke message
+	 * The pool gets owned by the provider, or destroyed if such a pool
+	 * is already registered.
+	 *
+	 * @param pool		virtual IP pool to add
 	 */
-	void (*add_pool)(stroke_attribute_t *this, stroke_msg_t *msg);
+	void (*add_pool)(stroke_attribute_t *this, mem_pool_t *pool);
 
 	/**
-	 * Remove a virtual IP address pool.
+	 * Add connection specific DNS servers.
 	 *
-	 * @param msg		stroke message
+	 * @param msg		stroke add message
 	 */
-	void (*del_pool)(stroke_attribute_t *this, stroke_msg_t *msg);
+	void (*add_dns)(stroke_attribute_t *this, stroke_msg_t *msg);
+
+	/**
+	 * Remove connection specific DNS servers.
+	 *
+	 * @param msg		stroke del message
+	 */
+	void (*del_dns)(stroke_attribute_t *this, stroke_msg_t *msg);
 
 	/**
 	 * Create an enumerator over installed pools.

src/libcharon/plugins/stroke/stroke_config.c

@@ -52,6 +52,11 @@ struct private_stroke_config_t {
 	 * credentials
 	 */
 	stroke_cred_t *cred;
+
+	/**
+	 * Virtual IP pool / DNS backend
+	 */
+	stroke_attribute_t *attributes;
 };
 
 METHOD(backend_t, create_peer_cfg_enumerator, enumerator_t*,
@@ -618,7 +623,6 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 {
 	identification_t *peer_id = NULL;
 	peer_cfg_t *mediated_by = NULL;
-	host_t *vip = NULL;
 	unique_policy_t unique;
 	u_int32_t rekey = 0, reauth = 0, over, jitter;
 	peer_cfg_t *peer_cfg;
@@ -677,49 +681,6 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 	{
 		rekey = msg->add_conn.rekey.ike_lifetime - over;
 	}
-	if (msg->add_conn.me.sourceip_mask)
-	{
-		if (msg->add_conn.me.sourceip)
-		{
-			vip = host_create_from_string(msg->add_conn.me.sourceip, 0);
-		}
-		if (!vip)
-		{	/* if it is set to something like %poolname, request an address */
-			if (msg->add_conn.me.subnets)
-			{	/* use the same family as in local subnet, if any */
-				if (strchr(msg->add_conn.me.subnets, '.'))
-				{
-					vip = host_create_any(AF_INET);
-				}
-				else
-				{
-					vip = host_create_any(AF_INET6);
-				}
-			}
-			else if (msg->add_conn.other.subnets)
-			{	/* use the same family as in remote subnet, if any */
-				if (strchr(msg->add_conn.other.subnets, '.'))
-				{
-					vip = host_create_any(AF_INET);
-				}
-				else
-				{
-					vip = host_create_any(AF_INET6);
-				}
-			}
-			else
-			{
-				if (strchr(ike_cfg->get_my_addr(ike_cfg, NULL), ':'))
-				{
-					vip = host_create_any(AF_INET6);
-				}
-				else
-				{
-					vip = host_create_any(AF_INET);
-				}
-			}
-		}
-	}
 	switch (msg->add_conn.unique)
 	{
 		case 1: /* yes */
@@ -747,10 +708,126 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 		msg->add_conn.rekey.tries, rekey, reauth, jitter, over,
 		msg->add_conn.mobike, msg->add_conn.aggressive,
 		msg->add_conn.dpd.delay, msg->add_conn.dpd.timeout,
-		vip, msg->add_conn.other.sourceip_mask ?
-							msg->add_conn.name : msg->add_conn.other.sourceip,
 		msg->add_conn.ikeme.mediation, mediated_by, peer_id);
 
+	if (msg->add_conn.other.sourceip)
+	{
+		enumerator_t *enumerator;
+		char *token;
+
+		enumerator = enumerator_create_token(msg->add_conn.other.sourceip,
+											 ",", " ");
+		while (enumerator->enumerate(enumerator, &token))
+		{
+			if (streq(token, "%modeconfig") || streq(token, "%modecfg") ||
+				streq(token, "%config") || streq(token, "%cfg") ||
+				streq(token, "%config4") || streq(token, "%config6"))
+			{
+				/* empty pool, uses connection name */
+				this->attributes->add_pool(this->attributes,
+								mem_pool_create(msg->add_conn.name, NULL, 0));
+				peer_cfg->add_pool(peer_cfg, msg->add_conn.name);
+			}
+			else if (*token == '%')
+			{
+				/* external named pool */
+				peer_cfg->add_pool(peer_cfg, token + 1);
+			}
+			else
+			{
+				/* in-memory pool, named using CIDR notation */
+				host_t *base;
+				int bits;
+
+				base = host_create_from_subnet(token, &bits);
+				if (base)
+				{
+					this->attributes->add_pool(this->attributes,
+										mem_pool_create(token, base, bits));
+					peer_cfg->add_pool(peer_cfg, token);
+					base->destroy(base);
+				}
+				else
+				{
+					DBG1(DBG_CFG, "IP pool %s invalid, ignored", token);
+				}
+			}
+		}
+		enumerator->destroy(enumerator);
+	}
+
+	if (msg->add_conn.me.sourceip)
+	{
+		enumerator_t *enumerator;
+		char *token;
+
+		enumerator = enumerator_create_token(msg->add_conn.me.sourceip, ",", " ");
+		while (enumerator->enumerate(enumerator, &token))
+		{
+			host_t *vip = NULL;
+
+			if (streq(token, "%modeconfig") || streq(token, "%modecfg") ||
+				streq(token, "%config") || streq(token, "%cfg"))
+			{	/* try to deduce an address family */
+				if (msg->add_conn.me.subnets)
+				{	/* use the same family as in local subnet, if any */
+					if (strchr(msg->add_conn.me.subnets, '.'))
+					{
+						vip = host_create_any(AF_INET);
+					}
+					else
+					{
+						vip = host_create_any(AF_INET6);
+					}
+				}
+				else if (msg->add_conn.other.subnets)
+				{	/* use the same family as in remote subnet, if any */
+					if (strchr(msg->add_conn.other.subnets, '.'))
+					{
+						vip = host_create_any(AF_INET);
+					}
+					else
+					{
+						vip = host_create_any(AF_INET6);
+					}
+				}
+				else
+				{
+					if (strchr(ike_cfg->get_my_addr(ike_cfg, NULL), ':'))
+					{
+						vip = host_create_any(AF_INET6);
+					}
+					else
+					{
+						vip = host_create_any(AF_INET);
+					}
+				}
+			}
+			else if (streq(token, "%config4"))
+			{
+				vip = host_create_any(AF_INET);
+			}
+			else if (streq(token, "%config6"))
+			{
+				vip = host_create_any(AF_INET6);
+			}
+			else
+			{
+				vip = host_create_from_string(token, 0);
+				if (vip)
+				{
+					DBG1(DBG_CFG, "ignored invalid subnet token: %s", token);
+				}
+			}
+
+			if (vip)
+			{
+				peer_cfg->add_virtual_ip(peer_cfg, vip);
+			}
+		}
+		enumerator->destroy(enumerator);
+	}
+
 	/* build leftauth= */
 	auth_cfg = build_auth_cfg(this, msg, TRUE, TRUE);
 	if (auth_cfg)
@@ -1209,7 +1286,8 @@ METHOD(stroke_config_t, destroy, void,
 /*
  * see header file
  */
-stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred)
+stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred,
+									  stroke_attribute_t *attributes)
 {
 	private_stroke_config_t *this;
 
@@ -1229,6 +1307,7 @@ stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred)
 		.mutex = mutex_create(MUTEX_TYPE_RECURSIVE),
 		.ca = ca,
 		.cred = cred,
+		.attributes = attributes,
 	);
 
 	return &this->public;

src/libcharon/plugins/stroke/stroke_config.h

@@ -26,6 +26,7 @@
 #include <stroke_msg.h>
 #include "stroke_ca.h"
 #include "stroke_cred.h"
+#include "stroke_attribute.h"
 
 typedef struct stroke_config_t stroke_config_t;
 
@@ -71,6 +72,7 @@ struct stroke_config_t {
 /**
  * Create a stroke_config instance.
  */
-stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred);
+stroke_config_t *stroke_config_create(stroke_ca_t *ca, stroke_cred_t *cred,
+									  stroke_attribute_t *attributes);
 
 #endif /** STROKE_CONFIG_H_ @}*/

src/libcharon/plugins/stroke/stroke_control.c

@@ -407,10 +407,10 @@ METHOD(stroke_control_t, rekey, void,
 METHOD(stroke_control_t, terminate_srcip, void,
 	private_stroke_control_t *this, stroke_msg_t *msg, FILE *out)
 {
-	enumerator_t *enumerator;
+	enumerator_t *enumerator, *vips;
 	ike_sa_t *ike_sa;
 	host_t *start = NULL, *end = NULL, *vip;
-	chunk_t chunk_start, chunk_end = chunk_empty, chunk_vip;
+	chunk_t chunk_start, chunk_end = chunk_empty, chunk;
 
 	if (msg->terminate_srcip.start)
 	{
@@ -438,33 +438,40 @@ METHOD(stroke_control_t, terminate_srcip, void,
 													charon->controller, TRUE);
 	while (enumerator->enumerate(enumerator, &ike_sa))
 	{
-		vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
-		if (!vip)
-		{
-			continue;
-		}
-		if (!end)
-		{
-			if (!vip->ip_equals(vip, start))
-			{
-				continue;
-			}
-		}
-		else
-		{
-			chunk_vip = vip->get_address(vip);
-			if (chunk_vip.len != chunk_start.len ||
-				chunk_vip.len != chunk_end.len ||
-				memcmp(chunk_vip.ptr, chunk_start.ptr, chunk_vip.len) < 0 ||
-				memcmp(chunk_vip.ptr, chunk_end.ptr, chunk_vip.len) > 0)
-			{
-				continue;
-			}
-		}
+		bool match = FALSE;
 
-		/* schedule delete asynchronously */
-		lib->processor->queue_job(lib->processor, (job_t*)
+		vips = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
+		while (vips->enumerate(vips, &vip))
+		{
+			if (!end)
+			{
+				if (vip->ip_equals(vip, start))
+				{
+					match = TRUE;
+					break;
+				}
+			}
+			else
+			{
+				chunk = vip->get_address(vip);
+				if (chunk.len == chunk_start.len &&
+					chunk.len == chunk_end.len &&
+					memcmp(chunk.ptr, chunk_start.ptr, chunk.len) >= 0 &&
+					memcmp(chunk.ptr, chunk_end.ptr, chunk.len) <= 0)
+				{
+					match = TRUE;
+					break;
+				}
+			}
+		}
+		vips->destroy(vips);
+
+		if (match)
+		{
+			/* schedule delete asynchronously */
+			lib->processor->queue_job(lib->processor, (job_t*)
 						delete_ike_sa_job_create(ike_sa->get_id(ike_sa), TRUE));
+		}
 	}
 	enumerator->destroy(enumerator);
 	start->destroy(start);

src/libcharon/plugins/stroke/stroke_handler.c

@@ -0,0 +1,231 @@
+/*
+ * Copyright (C) 2012 Martin Willi
+ * Copyright (C) 2012 revosec AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "stroke_handler.h"
+
+#include <daemon.h>
+#include <utils/linked_list.h>
+#include <threading/rwlock.h>
+
+typedef struct private_stroke_handler_t private_stroke_handler_t;
+
+/**
+ * Private data of an stroke_handler_t object.
+ */
+struct private_stroke_handler_t {
+
+	/**
+	 * Public stroke_handler_t interface.
+	 */
+	stroke_handler_t public;
+
+	/**
+	 * List of connection specific attributes, as attributes_t
+	 */
+	linked_list_t *attrs;
+
+	/**
+	 * rwlock to lock access to pools
+	 */
+	rwlock_t *lock;
+};
+
+/**
+ * Attributes assigned to a connection
+ */
+typedef struct {
+	/** name of the connection */
+	char *name;
+	/** list of DNS attributes, as host_t */
+	linked_list_t *dns;
+} attributes_t;
+
+/**
+ * Destroy an attributes_t entry
+ */
+static void attributes_destroy(attributes_t *this)
+{
+	this->dns->destroy_offset(this->dns, offsetof(host_t, destroy));
+	free(this->name);
+	free(this);
+}
+
+/**
+ * Filter function to convert host to DNS configuration attributes
+ */
+static bool attr_filter(void *lock, host_t **in,
+						configuration_attribute_type_t *type,
+						void *dummy, chunk_t *data)
+{
+	host_t *host = *in;
+
+	switch (host->get_family(host))
+	{
+		case AF_INET:
+			*type = INTERNAL_IP4_DNS;
+			break;
+		case AF_INET6:
+			*type = INTERNAL_IP6_DNS;
+			break;
+		default:
+			return FALSE;
+	}
+	if (host->is_anyaddr(host))
+	{
+		*data = chunk_empty;
+	}
+	else
+	{
+		*data = host->get_address(host);
+	}
+	return TRUE;
+}
+
+METHOD(attribute_handler_t, create_attribute_enumerator, enumerator_t*,
+	private_stroke_handler_t *this, identification_t *server,
+	linked_list_t *vips)
+{
+	ike_sa_t *ike_sa;
+	peer_cfg_t *peer_cfg;
+	enumerator_t *enumerator;
+	attributes_t *attr;
+
+	ike_sa = charon->bus->get_sa(charon->bus);
+	if (ike_sa)
+	{
+		peer_cfg = ike_sa->get_peer_cfg(ike_sa);
+		this->lock->read_lock(this->lock);
+		enumerator = this->attrs->create_enumerator(this->attrs);
+		while (enumerator->enumerate(enumerator, &attr))
+		{
+			if (streq(attr->name, peer_cfg->get_name(peer_cfg)))
+			{
+				enumerator->destroy(enumerator);
+				return enumerator_create_filter(
+									attr->dns->create_enumerator(attr->dns),
+									(void*)attr_filter, this->lock,
+									(void*)this->lock->unlock);
+			}
+		}
+		enumerator->destroy(enumerator);
+		this->lock->unlock(this->lock);
+	}
+	return enumerator_create_empty();
+}
+
+METHOD(stroke_handler_t, add_attributes, void,
+	private_stroke_handler_t *this, stroke_msg_t *msg)
+{
+	if (msg->add_conn.me.dns)
+	{
+		enumerator_t *enumerator;
+		attributes_t *attr = NULL;
+		host_t *host;
+		char *token;
+
+		enumerator = enumerator_create_token(msg->add_conn.me.dns, ",", " ");
+		while (enumerator->enumerate(enumerator, &token))
+		{
+			if (streq(token, "%config") || streq(token, "%config4"))
+			{
+				host = host_create_any(AF_INET);
+			}
+			else if (streq(token, "%config6"))
+			{
+				host = host_create_any(AF_INET6);
+			}
+			else
+			{
+				host = host_create_from_string(token, 0);
+			}
+			if (host)
+			{
+				if (!attr)
+				{
+					INIT(attr,
+						.name = strdup(msg->add_conn.name),
+						.dns = linked_list_create(),
+					);
+				}
+				attr->dns->insert_last(attr->dns, host);
+			}
+			else
+			{
+				DBG1(DBG_CFG, "ignoring invalid DNS address '%s'", token);
+			}
+		}
+		enumerator->destroy(enumerator);
+		if (attr)
+		{
+			this->lock->write_lock(this->lock);
+			this->attrs->insert_last(this->attrs, attr);
+			this->lock->unlock(this->lock);
+		}
+	}
+}
+
+METHOD(stroke_handler_t, del_attributes, void,
+	private_stroke_handler_t *this, stroke_msg_t *msg)
+{
+	enumerator_t *enumerator;
+	attributes_t *attr;
+
+	this->lock->write_lock(this->lock);
+	enumerator = this->attrs->create_enumerator(this->attrs);
+	while (enumerator->enumerate(enumerator, &attr))
+	{
+		if (streq(msg->del_conn.name, attr->name))
+		{
+			this->attrs->remove_at(this->attrs, enumerator);
+			attributes_destroy(attr);
+			break;
+		}
+	}
+	enumerator->destroy(enumerator);
+	this->lock->unlock(this->lock);
+}
+
+METHOD(stroke_handler_t, destroy, void,
+	private_stroke_handler_t *this)
+{
+	this->lock->destroy(this->lock);
+	this->attrs->destroy_function(this->attrs, (void*)attributes_destroy);
+	free(this);
+}
+
+/**
+ * See header
+ */
+stroke_handler_t *stroke_handler_create()
+{
+	private_stroke_handler_t *this;
+
+	INIT(this,
+		.public = {
+			.handler = {
+				.handle = (void*)return_false,
+				.release = (void*)return_false,
+				.create_attribute_enumerator = _create_attribute_enumerator,
+			},
+			.add_attributes = _add_attributes,
+			.del_attributes = _del_attributes,
+			.destroy = _destroy,
+		},
+		.attrs = linked_list_create(),
+		.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
+	);
+
+	return &this->public;
+}

src/libcharon/plugins/stroke/stroke_handler.h

@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Martin Willi
+ * Copyright (C) 2012 revosec AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup stroke_handler stroke_handler
+ * @{ @ingroup stroke
+ */
+
+#ifndef STROKE_HANDLER_H_
+#define STROKE_HANDLER_H_
+
+#include <stroke_msg.h>
+#include <attributes/attribute_handler.h>
+
+typedef struct stroke_handler_t stroke_handler_t;
+
+/**
+ * Handler requesting DNS attributes as defined with leftdns option.
+ */
+struct stroke_handler_t {
+
+	/**
+	 * Implements the attribute_handler_t interface
+	 */
+	attribute_handler_t handler;
+
+	/**
+	 * Add connection specific configuration attributes.
+	 *
+	 * @param msg		stroke message
+	 */
+	void (*add_attributes)(stroke_handler_t *this, stroke_msg_t *msg);
+
+	/**
+	 * Remove connection specific configuration attributes.
+	 *
+	 * @param msg		stroke message
+	 */
+	void (*del_attributes)(stroke_handler_t *this, stroke_msg_t *msg);
+
+	/**
+	 * Destroy a stroke_handler_t.
+	 */
+	void (*destroy)(stroke_handler_t *this);
+};
+
+/**
+ * Create a stroke_handler instance.
+ */
+stroke_handler_t *stroke_handler_create();
+
+#endif /** STROKE_HANDLER_H_ @}*/

src/libcharon/plugins/stroke/stroke_socket.c

@@ -37,6 +37,7 @@
 #include "stroke_cred.h"
 #include "stroke_ca.h"
 #include "stroke_attribute.h"
+#include "stroke_handler.h"
 #include "stroke_list.h"
 
 /**
@@ -98,6 +99,11 @@ struct private_stroke_socket_t {
 	 */
 	stroke_attribute_t *attribute;
 
+	/**
+	 * attribute handler (requests only)
+	 */
+	stroke_handler_t *handler;
+
 	/**
 	 * controller to control daemon
 	 */
@@ -171,6 +177,7 @@ static void pop_end(stroke_msg_t *msg, const char* label, stroke_end_t *end)
 	pop_string(msg, &end->address);
 	pop_string(msg, &end->subnets);
 	pop_string(msg, &end->sourceip);
+	pop_string(msg, &end->dns);
 	pop_string(msg, &end->auth);
 	pop_string(msg, &end->auth2);
 	pop_string(msg, &end->id);
@@ -188,6 +195,7 @@ static void pop_end(stroke_msg_t *msg, const char* label, stroke_end_t *end)
 	DBG2(DBG_CFG, "  %s=%s", label, end->address);
 	DBG2(DBG_CFG, "  %ssubnet=%s", label, end->subnets);
 	DBG2(DBG_CFG, "  %ssourceip=%s", label, end->sourceip);
+	DBG2(DBG_CFG, "  %sdns=%s", label, end->dns);
 	DBG2(DBG_CFG, "  %sauth=%s", label, end->auth);
 	DBG2(DBG_CFG, "  %sauth2=%s", label, end->auth2);
 	DBG2(DBG_CFG, "  %sid=%s", label, end->id);
@@ -235,7 +243,8 @@ static void stroke_add_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
 	DBG2(DBG_CFG, "  keyexchange=ikev%u", msg->add_conn.version);
 
 	this->config->add(this->config, msg);
-	this->attribute->add_pool(this->attribute, msg);
+	this->attribute->add_dns(this->attribute, msg);
+	this->handler->add_attributes(this->handler, msg);
 }
 
 /**
@@ -247,7 +256,8 @@ static void stroke_del_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
 	DBG1(DBG_CFG, "received stroke: delete connection '%s'", msg->del_conn.name);
 
 	this->config->del(this->config, msg);
-	this->attribute->del_pool(this->attribute, msg);
+	this->attribute->del_dns(this->attribute, msg);
+	this->handler->del_attributes(this->handler, msg);
 }
 
 /**
@@ -787,10 +797,12 @@ METHOD(stroke_socket_t, destroy, void,
 	lib->credmgr->remove_set(lib->credmgr, &this->cred->set);
 	charon->backends->remove_backend(charon->backends, &this->config->backend);
 	hydra->attributes->remove_provider(hydra->attributes, &this->attribute->provider);
+	hydra->attributes->remove_handler(hydra->attributes, &this->handler->handler);
 	this->cred->destroy(this->cred);
 	this->ca->destroy(this->ca);
 	this->config->destroy(this->config);
 	this->attribute->destroy(this->attribute);
+	this->handler->destroy(this->handler);
 	this->control->destroy(this->control);
 	this->list->destroy(this->list);
 	free(this);
@@ -817,8 +829,9 @@ stroke_socket_t *stroke_socket_create()
 
 	this->cred = stroke_cred_create();
 	this->attribute = stroke_attribute_create();
+	this->handler = stroke_handler_create();
 	this->ca = stroke_ca_create(this->cred);
-	this->config = stroke_config_create(this->ca, this->cred);
+	this->config = stroke_config_create(this->ca, this->cred, this->attribute);
 	this->control = stroke_control_create();
 	this->list = stroke_list_create(this->attribute);
 
@@ -833,6 +846,7 @@ stroke_socket_t *stroke_socket_create()
 	lib->credmgr->add_set(lib->credmgr, &this->cred->set);
 	charon->backends->add_backend(charon->backends, &this->config->backend);
 	hydra->attributes->add_provider(hydra->attributes, &this->attribute->provider);
+	hydra->attributes->add_handler(hydra->attributes, &this->handler->handler);
 
 	lib->processor->queue_job(lib->processor,
 		(job_t*)callback_job_create_with_prio((callback_job_cb_t)receive, this,