Attachment 152084 Details for Bug 235475 – ipsec-tools loopback patch

ipsec-tools loopback patch

ipsec-tools-0.6.6-loopback.patch (text/plain), 1.66 KB, created by Joe Nall on 2007-04-10 03:31:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Joe Nall

Created: 2007-04-10 03:31:22 UTC

Size: 1.66 KB

patch

obsolete

>--- ipsec-tools-0.6.6.orig/src/racoon//pfkey.c	2007-01-15 18:54:37.000000000 -0600
>+++ ipsec-tools-0.6.6/src/racoon/pfkey.c	2007-01-22 00:08:08.000000000 -0600
>@@ -99,6 +99,7 @@
> #include "nattraversal.h"
> #include "crypto_openssl.h"
> #include "grabmyaddr.h"
>+#include "sockmisc.h"
> 
> #if defined(SADB_X_EALG_RIJNDAELCBC) && !defined(SADB_X_EALG_AESCBC)
> #define SADB_X_EALG_AESCBC  SADB_X_EALG_RIJNDAELCBC
>@@ -1780,6 +1781,42 @@ pk_recvacquire(mhp)
> 		}
> 	}
> 
>+#ifdef HAVE_SECCTX 
>+	/*
>+	 * If src = dst, ISAKMP will fail because the ph db design
>+	 * assumes that it has only has to keep state for one side
>+	 * of the negotiation.
>+	 * Add an SA here and skip ISAKMP.
>+	 */
>+	if (cmpsaddrstrict(src, dst) == 0 && m_sec_ctx != NULL) {
>+		u_int wsize = 4;
>+		plog(LLV_DEBUG, LOCATION, NULL,
>+			"Talking to self, add loopback SA without ISAKMP: %s\n",
>+			saddr2str_fromto("from %s to %s", src, dst));
>+
>+		if (pfkey_send_add(
>+				lcconf->sock_pfkey,
>+				SADB_SATYPE_ESP,
>+				IPSECDOI_ATTR_ENC_MODE_ANY,
>+				src,
>+				dst,
>+				rand(),	/* additional magic required, should use GETSPI ...*/
>+				0,	/* reqid */
>+				wsize,
>+				NULL,	/* no keymat */
>+				SADB_EALG_NULL, 0, SADB_AALG_NONE, 0, 0,	/* No encryption or authentication */
>+				0, 0, 3600 * 12, 0, msg->sadb_msg_seq,
>+				m_sec_ctx->sadb_x_ctx_doi,
>+				m_sec_ctx->sadb_x_ctx_alg,
>+				(char *)m_sec_ctx + sizeof(struct sadb_x_sec_ctx),
>+				m_sec_ctx->sadb_x_ctx_len) < 0) {
>+			plog(LLV_ERROR, LOCATION, NULL, "adding loopback SA failed: %s\n", ipsec_strerror());
>+			return -1;
>+		}
>+		return 0;
>+	}
>+#endif /* HAVE_SECCTX */
>+
> 	/*
> 	 * If there is a phase 2 handler against the policy identifier in
> 	 * the acquire message, and if
>

Actions: View

Attachments on bug 235475: 151821 | 151825 | 151880 | 152078 | 152084 | 152194 | 152196 | 152289 | 152320 | 152503 | 152618