denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pluto now supports SQL-based virtual IP pools

Browse Source
This commit is contained in:
Andreas Steffen
2009-10-14 14:30:14 +02:00
parent 601bc1df20
commit 270bb348e3
16 changed files with 441 additions and 244 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starter/args.c
+1 -1
View File
@@ -246,7 +246,7 @@ static const token_info_t token_info[] =
{ ARG_STR, offsetof(starter_end_t, subnet), NULL },
{ ARG_MISC, 0, NULL /* KW_SUBNETWITHIN */ },
{ ARG_MISC, 0, NULL /* KW_PROTOPORT */ },
{ ARG_STR, offsetof(starter_end_t, srcip), NULL },
{ ARG_MISC, 0, NULL /* KW_SOURCEIP */ },
{ ARG_MISC, 0, NULL /* KW_NATIP */ },
{ ARG_ENUM, offsetof(starter_end_t, firewall), LST_bool },
{ ARG_ENUM, offsetof(starter_end_t, hostaccess), LST_bool },
src/starter/confread.c
+42 -18
View File
@@ -136,9 +136,8 @@ load_setup(starter_config_t *cfg, config_parsed_t *cfgp)
}
}
static void
kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token
, kw_list_t *kw, char *conn_name, starter_config_t *cfg)
static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
kw_list_t *kw, char *conn_name, starter_config_t *cfg)
{
err_t ugh = NULL;
bool assigned = FALSE;
@@ -188,31 +187,54 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token
plog("# natip and sourceip cannot be defined at the same time");
goto err;
}
if (streq(value, "%modeconfig") || streq(value, "%modecfg") ||
streq(value, "%config") || streq(value, "%cfg"))
if (value[0] == '%')
{
free(end->srcip);
end->srcip = NULL;
if (streq(value, "%modeconfig") || streq(value, "%modecfg") ||
streq(value, "%config") || streq(value, "%cfg"))
{
/* request ip via config payload */
end->sourceip = NULL;
end->sourceip_mask = 1;
}
else
{ /* %poolname, strip %, serve ip requests */
end->sourceip = clone_str(value+1);
end->sourceip_mask = 0;
}
end->modecfg = TRUE;
}
else
{
char *pos;
ip_address addr;
ip_subnet net;
conn->tunnel_addr_family = ip_version(value);
if (strchr(value, '/'))
pos = strchr(value, '/');
if (pos)
{ /* CIDR notation, address pool */
ugh = ttosubnet(value, 0, conn->tunnel_addr_family, &net);
if (ugh != NULL)
{
plog("# bad subnet: %s=%s [%s]", name, value, ugh);
goto err;
}
*pos = '\0';
end->sourceip = clone_str(value);
end->sourceip_mask = atoi(pos + 1);
}
else if (value[0] != '%')
{ /* old style fixed srcip, a %poolname otherwise */
else
{ /* fixed srcip */
ugh = ttoaddr(value, 0, conn->tunnel_addr_family, &addr);
}
if (ugh != NULL)
{
plog("# bad addr: %s=%s [%s]", name, value, ugh);
goto err;
if (ugh != NULL)
{
plog("# bad addr: %s=%s [%s]", name, value, ugh);
goto err;
}
end->sourceip = clone_str(value);
end->sourceip_mask = (conn->tunnel_addr_family == AF_INET) ?
32 : 128;
}
}
conn->policy |= POLICY_TUNNEL;
@@ -302,7 +324,9 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token
if (streq(value, "%defaultroute"))
{
if (cfg->defaultroute.defined)
{
end->nexthop = cfg->defaultroute.nexthop;
}
else
{
plog("# default route not known: %s=%s", name, value);
@@ -346,7 +370,7 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token
end->has_port_wildcard = has_port_wildcard;
break;
case KW_NATIP:
if (end->srcip)
if (end->sourceip)
{
plog("# natip and sourceip cannot be defined at the same time");
goto err;
@@ -358,7 +382,7 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token
if (cfg->defaultroute.defined)
{
addrtot(&cfg->defaultroute.addr, 0, buf, sizeof(buf));
end->srcip = clone_str(buf);
end->sourceip = clone_str(buf);
}
else
{
@@ -377,7 +401,7 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token
plog("# bad addr: %s=%s [%s]", name, value, ugh);
goto err;
}
end->srcip = clone_str(value);
end->sourceip = clone_str(value);
}
end->has_natip = TRUE;
conn->policy |= POLICY_TUNNEL;
src/starter/confread.h
+2 -1
View File
@@ -82,7 +82,8 @@ struct starter_end {
char *updown;
u_int16_t port;
u_int8_t protocol;
char *srcip;
char *sourceip;
int sourceip_mask;
};
typedef struct also also_t;
src/starter/starterstroke.c
+2 -34
View File
@@ -187,45 +187,13 @@ static void starter_stroke_add_end(stroke_msg_t *msg, stroke_end_t *msg_end, sta
ip_address2string(&conn_end->addr, buffer, sizeof(buffer));
msg_end->address = push_string(msg, buffer);
msg_end->subnets = push_string(msg, conn_end->subnet);
msg_end->sourceip = push_string(msg, conn_end->sourceip);
msg_end->sourceip_mask = conn_end->sourceip_mask;
msg_end->sendcert = conn_end->sendcert;
msg_end->hostaccess = conn_end->hostaccess;
msg_end->tohost = !conn_end->has_client;
msg_end->protocol = conn_end->protocol;
msg_end->port = conn_end->port;
if (conn_end->srcip)
{
if (conn_end->srcip[0] == '%')
{ /* %poolname, strip % */
msg_end->sourceip_size = 0;
msg_end->sourceip = push_string(msg, conn_end->srcip + 1);
}
else
{
char *pos = strchr(conn_end->srcip, '/');
if (pos)
{ /* CIDR subnet definition */
snprintf(buffer, pos - conn_end->srcip + 1, "%s", conn_end->srcip);
msg_end->sourceip = push_string(msg, buffer);
msg_end->sourceip_size = atoi(pos + 1);
}
else
{ /* a single address */
msg_end->sourceip = push_string(msg, conn_end->srcip);
if (strchr(conn_end->srcip, ':'))
{ /* IPv6 */
msg_end->sourceip_size = 128;
}
else
{ /* IPv4 */
msg_end->sourceip_size = 32;
}
}
}
}
else if (conn_end->modecfg)
{
msg_end->sourceip_size = 1;
}
}
int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn)
src/starter/starterwhack.c
+53 -68
View File
@@ -33,8 +33,7 @@
#define ip_version(string) (strchr(string, '.') ? AF_INET : AF_INET6)
static int
pack_str (char **p, char **next, char **roof)
static int pack_str (char **p, char **next, char **roof)
{
const char *s = (*p==NULL) ? "" : *p; /* note: NULL becomes ""! */
size_t len = strlen(s) + 1;
@@ -52,8 +51,7 @@ pack_str (char **p, char **next, char **roof)
}
}
static int
send_whack_msg (whack_message_t *msg)
static int send_whack_msg (whack_message_t *msg)
{
struct sockaddr_un ctl_addr;
int sock;
@@ -67,37 +65,41 @@ send_whack_msg (whack_message_t *msg)
str_next = (char *)msg->string;
str_roof = (char *)&msg->string[sizeof(msg->string)];
if (!pack_str(&msg->name, &str_next, &str_roof)
|| !pack_str(&msg->left.id, &str_next, &str_roof)
|| !pack_str(&msg->left.cert, &str_next, &str_roof)
|| !pack_str(&msg->left.ca, &str_next, &str_roof)
|| !pack_str(&msg->left.groups, &str_next, &str_roof)
|| !pack_str(&msg->left.updown, &str_next, &str_roof)
|| !pack_str(&msg->left.virt, &str_next, &str_roof)
|| !pack_str(&msg->right.id, &str_next, &str_roof)
|| !pack_str(&msg->right.cert, &str_next, &str_roof)
|| !pack_str(&msg->right.ca, &str_next, &str_roof)
|| !pack_str(&msg->right.groups, &str_next, &str_roof)
|| !pack_str(&msg->right.updown, &str_next, &str_roof)
|| !pack_str(&msg->right.virt, &str_next, &str_roof)
|| !pack_str(&msg->keyid, &str_next, &str_roof)
|| !pack_str(&msg->myid, &str_next, &str_roof)
|| !pack_str(&msg->cacert, &str_next, &str_roof)
|| !pack_str(&msg->ldaphost, &str_next, &str_roof)
|| !pack_str(&msg->ldapbase, &str_next, &str_roof)
|| !pack_str(&msg->crluri, &str_next, &str_roof)
|| !pack_str(&msg->crluri2, &str_next, &str_roof)
|| !pack_str(&msg->ocspuri, &str_next, &str_roof)
|| !pack_str(&msg->ike, &str_next, &str_roof)
|| !pack_str(&msg->esp, &str_next, &str_roof)
|| !pack_str(&msg->sc_data, &str_next, &str_roof)
|| (str_roof - str_next < msg->keyval.len))
if (!pack_str(&msg->name, &str_next, &str_roof)
|| !pack_str(&msg->left.id, &str_next, &str_roof)
|| !pack_str(&msg->left.cert, &str_next, &str_roof)
|| !pack_str(&msg->left.ca, &str_next, &str_roof)
|| !pack_str(&msg->left.groups, &str_next, &str_roof)
|| !pack_str(&msg->left.updown, &str_next, &str_roof)
|| !pack_str(&msg->left.sourceip, &str_next, &str_roof)
|| !pack_str(&msg->left.virt, &str_next, &str_roof)
|| !pack_str(&msg->right.id, &str_next, &str_roof)
|| !pack_str(&msg->right.cert, &str_next, &str_roof)
|| !pack_str(&msg->right.ca, &str_next, &str_roof)
|| !pack_str(&msg->right.groups, &str_next, &str_roof)
|| !pack_str(&msg->right.updown, &str_next, &str_roof)
|| !pack_str(&msg->right.sourceip, &str_next, &str_roof)
|| !pack_str(&msg->right.virt, &str_next, &str_roof)
|| !pack_str(&msg->keyid, &str_next, &str_roof)
|| !pack_str(&msg->myid, &str_next, &str_roof)
|| !pack_str(&msg->cacert, &str_next, &str_roof)
|| !pack_str(&msg->ldaphost, &str_next, &str_roof)
|| !pack_str(&msg->ldapbase, &str_next, &str_roof)
|| !pack_str(&msg->crluri, &str_next, &str_roof)
|| !pack_str(&msg->crluri2, &str_next, &str_roof)
|| !pack_str(&msg->ocspuri, &str_next, &str_roof)
|| !pack_str(&msg->ike, &str_next, &str_roof)
|| !pack_str(&msg->esp, &str_next, &str_roof)
|| !pack_str(&msg->sc_data, &str_next, &str_roof)
|| (str_roof - str_next < msg->keyval.len))
{
plog("send_wack_msg(): can't pack strings");
return -1;
}
if (msg->keyval.ptr)
{
memcpy(str_next, msg->keyval.ptr, msg->keyval.len);
}
msg->keyval.ptr = NULL;
str_next += msg->keyval.len;
len = str_next - (char *)msg;
@@ -130,15 +132,13 @@ send_whack_msg (whack_message_t *msg)
return 0;
}
static void
init_whack_msg(whack_message_t *msg)
static void init_whack_msg(whack_message_t *msg)
{
memset(msg, 0, sizeof(whack_message_t));
msg->magic = WHACK_MAGIC;
}
static char *
connection_name(starter_conn_t *conn)
static char *connection_name(starter_conn_t *conn)
{
/* if connection name is '%auto', create a new name like conn_xxxxx */
static char buf[32];
@@ -151,34 +151,26 @@ connection_name(starter_conn_t *conn)
return conn->name;
}
static void
set_whack_end(whack_end_t *w, starter_end_t *end, sa_family_t family)
static void set_whack_end(whack_end_t *w, starter_end_t *end, sa_family_t family)
{
if (end->srcip && end->srcip[0] != '%')
{
int len = 0;
char *pos;
pos = strchr(end->srcip, '/');
if (pos)
{
/* use first address only for pluto */
len = pos - end->srcip;
}
w->has_srcip = !end->has_natip;
ttoaddr(end->srcip, len, ip_version(end->srcip), &w->host_srcip);
}
else
{
anyaddr(AF_INET, &w->host_srcip);
}
w->id = end->id;
w->cert = end->cert;
w->ca = end->ca;
w->groups = end->groups;
w->host_addr = end->addr;
w->has_client = end->has_client;
w->sourceip = end->sourceip;
w->sourceip_mask = end->sourceip_mask;
if (end->sourceip && end->sourceip_mask > 0)
{
ttoaddr(end->sourceip, 0, ip_version(end->sourceip), &w->host_srcip);
w->has_srcip = !end->has_natip;
}
else
{
anyaddr(AF_INET, &w->host_srcip);
}
if (family == AF_INET6 && isanyaddr(&end->nexthop))
{
@@ -266,8 +258,7 @@ starter_whack_add_pubkey (starter_conn_t *conn, starter_end_t *end
return 0;
}
int
starter_whack_add_conn(starter_conn_t *conn)
int starter_whack_add_conn(starter_conn_t *conn)
{
whack_message_t msg;
int r;
@@ -332,8 +323,7 @@ starter_whack_add_conn(starter_conn_t *conn)
return r;
}
int
starter_whack_del_conn(starter_conn_t *conn)
int starter_whack_del_conn(starter_conn_t *conn)
{
whack_message_t msg;
@@ -343,8 +333,7 @@ starter_whack_del_conn(starter_conn_t *conn)
return send_whack_msg(&msg);
}
int
starter_whack_route_conn(starter_conn_t *conn)
int starter_whack_route_conn(starter_conn_t *conn)
{
whack_message_t msg;
@@ -354,8 +343,7 @@ starter_whack_route_conn(starter_conn_t *conn)
return send_whack_msg(&msg);
}
int
starter_whack_initiate_conn(starter_conn_t *conn)
int starter_whack_initiate_conn(starter_conn_t *conn)
{
whack_message_t msg;
@@ -366,8 +354,7 @@ starter_whack_initiate_conn(starter_conn_t *conn)
return send_whack_msg(&msg);
}
int
starter_whack_listen(void)
int starter_whack_listen(void)
{
whack_message_t msg;
init_whack_msg(&msg);
@@ -384,8 +371,7 @@ int starter_whack_shutdown(void)
return send_whack_msg(&msg);
}
int
starter_whack_add_ca(starter_ca_t *ca)
int starter_whack_add_ca(starter_ca_t *ca)
{
whack_message_t msg;
@@ -404,8 +390,7 @@ starter_whack_add_ca(starter_ca_t *ca)
return send_whack_msg(&msg);
}
int
starter_whack_del_ca(starter_ca_t *ca)
int starter_whack_del_ca(starter_ca_t *ca)
{
whack_message_t msg;