rpms/ipsec-tools/devel ipsec-tools-0.7.1-natt-linux.patch, NONE, 1.1 ipsec-tools.spec, 1.58, 1.59 ipsec-tools-0.7.1-purge.patch, 1.1, NONE

[Tomáš Mráz (tmraz)]

Author: tmraz

Update of /cvs/pkgs/rpms/ipsec-tools/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv28598

Modified Files:
	ipsec-tools.spec 
Added Files:
	ipsec-tools-0.7.1-natt-linux.patch 
Removed Files:
	ipsec-tools-0.7.1-purge.patch 
Log Message:
* Sun Aug 10 2008 Tomas Mraz <tmraz at redhat.com> - 0.7.1-4
- Even better fix for IPSEC SA purging avoiding code duplication
  (original idea by Darrel Goeddel)


ipsec-tools-0.7.1-natt-linux.patch:

--- NEW FILE ipsec-tools-0.7.1-natt-linux.patch ---
diff -up ipsec-tools-0.7.1/src/racoon/pfkey.c.natt-linux ipsec-tools-0.7.1/src/racoon/pfkey.c
--- ipsec-tools-0.7.1/src/racoon/pfkey.c.natt-linux	2008-07-30 21:34:33.000000000 +0200
+++ ipsec-tools-0.7.1/src/racoon/pfkey.c	2008-08-10 17:28:47.000000000 +0200
@@ -290,6 +290,13 @@ pfkey_dump_sadb(satype)
 	struct sadb_msg *msg = NULL;
 	size_t bl, ml;
 	int len;
+#if defined(__linux__) && defined(ENABLE_NATT)
+	caddr_t mhp[SADB_EXT_MAX + 1];
+	struct sadb_sa *sa;
+	struct sockaddr *src, *dst;
+	struct sadb_x_nat_t_type *natt_type;
+	struct sadb_x_nat_t_port *natt_port;
+#endif
 
 	if ((s = privsep_pfkey_open()) < 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -325,6 +332,45 @@ pfkey_dump_sadb(satype)
 		    continue;
 		}
 		
+#if defined(__linux__) && defined(ENABLE_NATT)
+		/*
+		 * NetBSD returns the NAT-T ports in the src and dst sockaddrs
+		 * in addition to the SADB_X_EXT_NAT_T_*PORT structs.
+		 *
+		 * Linux only returns them in the SADB_X_EXT_NAT_T_*PORT
+		 * structs. The racoon codebase is making the assumption that
+		 * the NAT-T ports are reflected by the ports in the src and
+		 * dst sockaddrs. We stick that information into those structs
+		 * here to meet the assumptions elsewhere.
+		 */
+		if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
+		    plog(LLV_ERROR, LOCATION, NULL,
+			"pfkey_check (%s)\n", ipsec_strerror());
+		    goto no_fixup;
+		}
+
+		sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
+		if (!sa || !mhp[SADB_EXT_ADDRESS_SRC] || !mhp[SADB_EXT_ADDRESS_DST]) {
+		    goto no_fixup;
+		}
+
+		src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
+		dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
+
+		natt_type = (struct sadb_x_nat_t_type *)(mhp[SADB_X_EXT_NAT_T_TYPE]);
+
+		if (natt_type && natt_type->sadb_x_nat_t_type_type) {
+		    /* set the src and dst ports */
+		    natt_port = (struct sadb_x_nat_t_port *)(mhp[SADB_X_EXT_NAT_T_SPORT]);
+		    if (natt_port != NULL && extract_port(src) == 0)
+			set_port(src, ntohs(natt_port->sadb_x_nat_t_port_port));
+
+		    natt_port = (void *)mhp[SADB_X_EXT_NAT_T_DPORT];
+		    if (natt_port != NULL && extract_port(dst) == 0)
+			set_port(dst, ntohs(natt_port->sadb_x_nat_t_port_port));
+		}
+no_fixup:
+#endif /* __linux__ && ENABLE_NATT */
 
 		ml = msg->sadb_msg_len << 3;
 		bl = buf ? buf->l : 0;
diff -up ipsec-tools-0.7.1/src/racoon/isakmp_inf.c.natt-linux ipsec-tools-0.7.1/src/racoon/isakmp_inf.c
--- ipsec-tools-0.7.1/src/racoon/isakmp_inf.c.natt-linux	2008-07-11 10:08:42.000000000 +0200
+++ ipsec-tools-0.7.1/src/racoon/isakmp_inf.c	2008-08-10 17:22:24.000000000 +0200
@@ -1143,10 +1143,6 @@ purge_ipsec_spi(dst0, proto, spi, n)
 	u_int64_t created;
 	size_t i;
 	caddr_t mhp[SADB_EXT_MAX + 1];
-#ifdef ENABLE_NATT
-	struct sadb_x_nat_t_type *natt_type;
-	struct sadb_x_nat_t_port *natt_port;
-#endif
 
 	plog(LLV_DEBUG2, LOCATION, NULL,
 		 "purge_ipsec_spi:\n");
@@ -1199,20 +1195,6 @@ purge_ipsec_spi(dst0, proto, spi, n)
 			msg = next;
 			continue;
 		}
-#ifdef ENABLE_NATT
-		natt_type = (void *)mhp[SADB_X_EXT_NAT_T_TYPE];
-		if (natt_type && natt_type->sadb_x_nat_t_type_type) {
-			/* NAT-T is enabled for this SADB entry; copy
-			 * the ports from NAT-T extensions */
-			natt_port = (void *)mhp[SADB_X_EXT_NAT_T_SPORT];
-			if (extract_port(src) == 0 && natt_port != NULL)
-				set_port(src, ntohs(natt_port->sadb_x_nat_t_port_port));
-
-			natt_port = (void *)mhp[SADB_X_EXT_NAT_T_DPORT];
-			if (extract_port(dst) == 0 && natt_port != NULL)
-				set_port(dst, ntohs(natt_port->sadb_x_nat_t_port_port));
-		}
-#endif
 		plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(src));
 		plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(dst));
 


Index: ipsec-tools.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ipsec-tools/devel/ipsec-tools.spec,v
retrieving revision 1.58
retrieving revision 1.59
diff -u -r1.58 -r1.59
--- ipsec-tools.spec	8 Aug 2008 21:01:19 -0000	1.58
+++ ipsec-tools.spec	10 Aug 2008 15:40:05 -0000	1.59
@@ -1,6 +1,6 @@
 Name: ipsec-tools
 Version: 0.7.1
-Release: 3%{?dist}
+Release: 4%{?dist}
 Summary: Tools for configuring and using IPSEC
 License: BSD
 Group: System Environment/Base
@@ -16,7 +16,7 @@
 Patch5: ipsec-tools-0.7-iface.patch
 Patch6: ipsec-tools-0.7-dupsplit.patch
 Patch9: ipsec-tools-0.7-splitcidr.patch
-Patch10: ipsec-tools-0.7.1-purge.patch
+Patch10: ipsec-tools-0.7.1-natt-linux.patch
 
 BuildRequires: openssl-devel, krb5-devel, bison, flex, automake, libtool
 BuildRequires: libselinux-devel >= 1.30.28-2
@@ -39,7 +39,7 @@
 %patch5 -p1 -b .iface
 %patch6 -p1 -b .dupsplit
 %patch9 -p1 -b .splitcidr
-%patch10 -p1 -b .purge
+%patch10 -p1 -b .natt-linux
 
 ./bootstrap
 
@@ -118,6 +118,10 @@
 %config(noreplace) /etc/racoon/racoon.conf
 
 %changelog
+* Sun Aug 10 2008 Tomas Mraz <tmraz at redhat.com> - 0.7.1-4
+- Even better fix for IPSEC SA purging avoiding code duplication
+  (original idea by Darrel Goeddel)
+
 * Fri Aug  8 2008 Tomas Mraz <tmraz at redhat.com> - 0.7.1-3
 - Fix IPSEC SA purge with NAT_T enabled
 


--- ipsec-tools-0.7.1-purge.patch DELETED ---