supporting multiple comma seperated subnets in left/rightsubnet definition

e.g. leftsubnet=10.2.0.0/16,10.4.0.0/16

src/starter/cmp.c

@@ -47,7 +47,7 @@ starter_cmp_end(starter_end_t *c1, starter_end_t *c2)
     }
     ADDCMP(nexthop);
     STRCMP(srcip);
-    SUBCMP(subnet);
+    STRCMP(subnet);
     VARCMP(has_client);
     VARCMP(has_client_wildcard);
     VARCMP(has_port_wildcard);

src/starter/confread.c

@@ -32,7 +32,7 @@
 #include "interfaces.h"
 
 /* strings containing a colon are interpreted as an IPv6 address */
-#define ip_version(string)	(strchr(string, ':') != NULL)? AF_INET6 : AF_INET;
+#define ip_version(string)	(strchr(string, '.') ? AF_INET : AF_INET6)
 
 static const char ike_defaults[] = "aes128-sha-modp2048";
 static const char esp_defaults[] = "aes128-sha1, 3des-md5";
@@ -189,7 +189,6 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token
 			conn->policy |= POLICY_GROUP | POLICY_TUNNEL;
 			anyaddr(conn->addr_family, &end->addr);
 			anyaddr(conn->tunnel_addr_family, &any);
-			initsubnet(&any, 0, '0', &end->subnet);
 			end->has_client = TRUE;
 		}
 		else
@@ -251,22 +250,44 @@ kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token
 		}
 		else
 		{
+			ip_subnet net;
+			char *pos;
+			int len = 0;
+			
 			end->has_client = TRUE;
 			conn->tunnel_addr_family = ip_version(value);
-			ugh = ttosubnet(value, 0, conn->tunnel_addr_family, &end->subnet);
+			
+			pos = strchr(value, ',');
+			if (pos)
+			{
+				len = pos - value;
+			}
+			ugh = ttosubnet(value, len, ip_version(value), &net);
 			if (ugh != NULL)
 			{
 				plog("# bad subnet: %s=%s [%s]", name, value, ugh);
 				goto err;
 			}
+			end->subnet = clone_str(value, "subnet");
 		}
 		break;
 	case KW_SUBNETWITHIN:
+	{
+		ip_subnet net;
+		
 		end->has_client = TRUE;
 		end->has_client_wildcard = TRUE;
 		conn->tunnel_addr_family = ip_version(value);
-		ugh = ttosubnet(value, 0, conn->tunnel_addr_family, &end->subnet);
+
+		ugh = ttosubnet(value, 0, ip_version(value), &net);
+		if (ugh != NULL)
+		{
+			plog("# bad subnet: %s=%s [%s]", name, value, ugh);
+			goto err;
+		}
+		end->subnet = clone_str(value, "subnetwithin");
 		break;
+	}
 	case KW_PROTOPORT:
 		ugh = ttoprotoport(value, 0, &end->protocol, &end->port, &has_port_wildcard);
 		end->has_port_wildcard = has_port_wildcard;
@@ -827,6 +848,12 @@ free_also(also_t *head)
 static void
 confread_free_conn(starter_conn_t *conn)
 {
+	pfree(conn->left.subnet);
+	pfree(conn->right.subnet);
+	pfree(conn->left.virt);
+	pfree(conn->right.virt);
+	pfree(conn->left.srcip);
+	pfree(conn->right.srcip);
 	free_args(KW_END_FIRST, KW_END_LAST,  (char *)&conn->left);
 	free_args(KW_END_FIRST, KW_END_LAST,  (char *)&conn->right);
 	free_args(KW_CONN_NAME, KW_CONN_LAST, (char *)conn);

src/starter/confread.h

@@ -65,7 +65,7 @@ struct starter_end {
 	char		*iface;
 	ip_address	addr;
 	ip_address	nexthop;
-	ip_subnet	subnet;
+	char 		*subnet;
 	bool		has_client;
 	bool		has_client_wildcard;
 	bool		has_port_wildcard;

src/starter/ipsec.conf.5

@@ -646,7 +646,9 @@ private subnet behind the left participant, expressed as
 if omitted, essentially assumed to be \fIleft\fB/32\fR,
 signifying that the left end of the connection goes to the left participant
 only. When using IKEv2, the configured subnet of the peers may differ, the
-protocol narrows it to the greates common subnet.
+protocol narrows it to the greatest common subnet. Further, IKEv2 supports
+multiple subnets separated by commas. IKEv1 only interprets the first subnet
+of such a definition.
 .TP
 .B leftsubnetwithin
 the peer can propose any subnet or single IP address that fits within the

src/starter/starterstroke.c

@@ -161,9 +161,7 @@ static void starter_stroke_add_end(stroke_msg_t *msg, stroke_end_t *msg_end, sta
 	msg_end->updown = push_string(msg, conn_end->updown);
 	ip_address2string(&conn_end->addr, buffer, sizeof(buffer));
 	msg_end->address = push_string(msg, buffer);
-	ip_address2string(&conn_end->subnet.addr, buffer, sizeof(buffer));
-	msg_end->subnet = push_string(msg, buffer);
-	msg_end->subnet_mask = conn_end->subnet.maskbits;
+	msg_end->subnets = push_string(msg, conn_end->subnet);
 	msg_end->sendcert = conn_end->sendcert;
 	msg_end->hostaccess = conn_end->hostaccess;
 	msg_end->tohost = !conn_end->has_client;

src/starter/starterwhack.c

@@ -32,6 +32,8 @@
 #include "confread.h"
 #include "files.h"
 
+#define ip_version(string)	(strchr(string, '.') ? AF_INET : AF_INET6)
+
 static int
 pack_str (char **p, char **next, char **roof)
 {
@@ -153,22 +155,22 @@ set_whack_end(whack_end_t *w, starter_end_t *end, sa_family_t family)
     if (end->srcip && end->srcip[0] != '%')
     {
 	int len = 0;
-	char *pos, *v6;
+	char *pos;
 
 	pos = strchr(end->srcip, '/');
-	v6 = strchr(end->srcip, ':');
 	if (pos)
 	{
 	    /* use first address only for pluto */
 	    len = pos - end->srcip;
 	}
 	w->has_srcip = !end->has_natip;
-	ttoaddr(end->srcip, len, v6 ? AF_INET6 : AF_INET, &w->host_srcip);
+	ttoaddr(end->srcip, len, ip_version(end->srcip), &w->host_srcip);
     }
     else
     {
 	anyaddr(AF_INET, &w->host_srcip);	
-    }    
+    }
+    
     w->id                  = end->id;
     w->cert                = end->cert;
     w->ca                  = end->ca;
@@ -183,7 +185,17 @@ set_whack_end(whack_end_t *w, starter_end_t *end, sa_family_t family)
     w->host_nexthop        = end->nexthop;
 
     if (w->has_client)
-	w->client          = end->subnet;
+    {
+	char *pos;
+	int len = 0;
+
+	pos = strchr(end->subnet, ',');
+	if (pos)
+	{
+	    len = pos - end->subnet;
+	}
+	ttosubnet(end->subnet, len, ip_version(end->subnet), &w->client);
+    }
     else
 	w->client.addr.u.v4.sin_family = addrtypeof(&w->host_addr);