main/ipsec-tools: update to 2010-10-22 snapshot

remove patches committed upstream. and add a patch for dpd related
minor fix.

6 files changed, 91 insertions, 790 deletions

diff --git a/main/ipsec-tools/60-debug-quick.patch b/main/ipsec-tools/60-debug-quick.patch
deleted file mode 100644
index a5c3346ee9..0000000000
--- a/main/ipsec-tools/60-debug-quick.patch
+++ /dev/null
@@ -1,211 +0,0 @@
-debugging prints for quick mode errors
-
-From: Timo Teras <timo.teras@iki.fi>
-
-
----
-
- src/racoon/isakmp.c       |   21 ++++++++++++++-------
- src/racoon/isakmp_quick.c |   46 ++++++++++++++++++++++++++++++++++++++-------
- 2 files changed, 53 insertions(+), 14 deletions(-)
-
-
-diff --git a/src/racoon/isakmp.c b/src/racoon/isakmp.c
-index 2dfda2f..87ce598 100644
---- a/src/racoon/isakmp.c
-+++ b/src/racoon/isakmp.c
-@@ -817,7 +817,8 @@ ph1_main(iph1, msg)
- 
-                if (iph1->side == RESPONDER && iph1->status == PHASE1ST_START) {
-                        plog(LLV_ERROR, LOCATION, iph1->remote,
--                               "failed to pre-process packet.\n");
-+                               "failed to pre-process ph1 packet (side: %d, status %d).\n",
-+                               iph1->side, iph1->status);
-                        return -1;
-                } else {
-                        /* ignore the error and keep phase 1 handler */
-@@ -845,7 +846,8 @@ ph1_main(iph1, msg)
-                        [iph1->side]
-                        [iph1->status])(iph1, msg) != 0) {
-                plog(LLV_ERROR, LOCATION, iph1->remote,
--                       "failed to process packet.\n");
-+                       "failed to process ph1 packet (side: %d, status: %d).\n",
-+                       iph1->side, iph1->status);
-                return -1;
-        }
- 
-@@ -997,7 +999,8 @@ quick_main(iph2, msg)
-                            [iph2->status])(iph2, msg);
-        if (error != 0) {
-                plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
--                       "failed to pre-process packet.\n");
-+                       "failed to pre-process ph2 packet (side: %d, status %d).\n",
-+                       iph2->side, iph2->status);
-                if (error == ISAKMP_INTERNAL_ERROR)
-                        return 0;
-                isakmp_info_send_n1(iph2->ph1, error, NULL);
-@@ -1025,7 +1028,8 @@ quick_main(iph2, msg)
-                        [iph2->side]
-                        [iph2->status])(iph2, msg) != 0) {
-                plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
--                       "failed to process packet.\n");
-+                       "failed to process ph2 packet (side: %d, status: %d).\n",
-+                       iph2->side, iph2->status);
-                return -1;
-        }
- 
-@@ -1233,7 +1237,8 @@ isakmp_ph1begin_r(msg, remote, local, etype)
-                        [iph1->side]
-                        [iph1->status])(iph1, msg) < 0) {
-                plog(LLV_ERROR, LOCATION, remote,
--                       "failed to process packet.\n");
-+                       "failed to process ph1 packet (side: %d, status: %d).\n",
-+                       iph1->side, iph1->status);
-                remph1(iph1);
-                delph1(iph1);
-                return -1;
-@@ -1386,7 +1391,8 @@ isakmp_ph2begin_r(iph1, msg)
-                           [iph2->status])(iph2, msg);
-        if (error != 0) {
-                plog(LLV_ERROR, LOCATION, iph1->remote,
--                       "failed to pre-process packet.\n");
-+                       "failed to pre-process ph2 packet (side: %d, status: %d).\n",
-+                       iph2->side, iph2->status);
-                if (error != ISAKMP_INTERNAL_ERROR)
-                        isakmp_info_send_n1(iph2->ph1, error, NULL);
-                /*
-@@ -1404,7 +1410,8 @@ isakmp_ph2begin_r(iph1, msg)
-                        [iph2->side]
-                        [iph2->status])(iph2, msg) < 0) {
-                plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
--                       "failed to process packet.\n");
-+                       "failed to process ph2 packet (side: %d, status: %d).\n",
-+                       iph2->side, iph2->status);
-                /* don't release handler */
-                return -1;
-        }
-diff --git a/src/racoon/isakmp_quick.c b/src/racoon/isakmp_quick.c
-index 46c84c1..2657407 100644
---- a/src/racoon/isakmp_quick.c
-+++ b/src/racoon/isakmp_quick.c
-@@ -495,18 +495,27 @@ quick_i2recv(iph2, msg0)
-                                        "isn't supported.\n");
-                                break;
-                        }
--                       if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0)
-+                       if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0) {
-+                               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                                       "duplicate ISAKMP_NPTYPE_SA.\n");
-                                goto end;
-+                       }
-                        break;
- 
-                case ISAKMP_NPTYPE_NONCE:
--                       if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
-+                       if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0) {
-+                               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                                       "duplicate ISAKMP_NPTYPE_NONCE.\n");
-                                goto end;
-+                       }
-                        break;
- 
-                case ISAKMP_NPTYPE_KE:
--                       if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
-+                       if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0) {
-+                               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                                       "duplicate ISAKMP_NPTYPE_KE.\n");
-                                goto end;
-+                       }
-                        break;
- 
-                case ISAKMP_NPTYPE_ID:
-@@ -517,6 +526,8 @@ quick_i2recv(iph2, msg0)
-                                if (isakmp_p2ph(&idcr, pa->ptr) < 0)
-                                        goto end;
-                        } else {
-+                               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                                       "too many ISAKMP_NPTYPE_ID payloads.\n");
-                                goto end;
-                        }
-                        break;
-@@ -557,6 +568,8 @@ quick_i2recv(iph2, msg0)
-                                iph2->natoa_dst = daddr;
-                        else {
-                                racoon_free(daddr);
-+                               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                                       "too many ISAKMP_NPTYPE_NATOA payloads.\n");
-                                goto end;
-                        }
-                    }
-@@ -718,6 +731,8 @@ quick_i2recv(iph2, msg0)
- 
-        /* validity check SA payload sent from responder */
-        if (ipsecdoi_checkph2proposal(iph2) < 0) {
-+               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                       "proposal check failed.\n");
-                error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
-                goto end;
-        }
-@@ -1077,8 +1092,11 @@ quick_r1recv(iph2, msg0)
-        }
-        /* decrypt packet */
-        msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
--       if (msg == NULL)
-+       if (msg == NULL) {
-+               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                       "Packet decryption failed.\n");
-                goto end;
-+       }
- 
-        /* create buffer for using to validate HASH(1) */
-        /*
-@@ -1162,18 +1180,27 @@ quick_r1recv(iph2, msg0)
-                                        "Multi SAs isn't supported.\n");
-                                goto end;
-                        }
--                       if (isakmp_p2ph(&iph2->sa, pa->ptr) < 0)
-+                       if (isakmp_p2ph(&iph2->sa, pa->ptr) < 0) {
-+                               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                                       "duplicate ISAKMP_NPTYPE_SA.\n");
-                                goto end;
-+                       }
-                        break;
- 
-                case ISAKMP_NPTYPE_NONCE:
--                       if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
-+                       if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0) {
-+                               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                                       "duplicate ISAKMP_NPTYPE_NONCE.\n");
-                                goto end;
-+                       }
-                        break;
- 
-                case ISAKMP_NPTYPE_KE:
--                       if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
-+                       if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0) {
-+                               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                                       "duplicate ISAKMP_NPTYPE_KE.\n");
-                                goto end;
-+                       }
-                        break;
- 
-                case ISAKMP_NPTYPE_ID:
-@@ -1241,6 +1268,9 @@ quick_r1recv(iph2, msg0)
-                                iph2->natoa_src = daddr;
-                        else {
-                                racoon_free(daddr);
-+                               plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                                       "received too many NAT-OA payloads.\n");
-+                               error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
-                                goto end;
-                        }
-                    }
-@@ -1333,6 +1363,8 @@ quick_r1recv(iph2, msg0)
-        case 0:
-                /* select single proposal or reject it. */
-                if (ipsecdoi_selectph2proposal(iph2) < 0) {
-+                       plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-+                               "no proposal chosen.\n");
-                        error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
-                        goto end;
-                }
diff --git a/main/ipsec-tools/90-dpd-window-fix.patch b/main/ipsec-tools/90-dpd-window-fix.patch
new file mode 100644
index 0000000000..d3ac9a9aa2
--- /dev/null
+++ b/main/ipsec-tools/90-dpd-window-fix.patch
@@ -0,0 +1,85 @@
+Index: src/racoon/isakmp_inf.c
+===================================================================
+RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp_inf.c,v
+retrieving revision 1.41
+diff -u -r1.41 isakmp_inf.c
+--- a/src/racoon/isakmp_inf.c   3 Jul 2009 06:41:46 -0000       1.41
++++ b/src/racoon/isakmp_inf.c   5 May 2010 15:56:38 -0000
+@@ -1450,17 +1450,16 @@
+        struct isakmp_pl_ru *ru;
+        u_int32_t msgid;
+ {
++       u_int32_t seq;
+ 
+        plog(LLV_DEBUG, LOCATION, iph1->remote,
+                 "DPD R-U-There-Ack received\n");
+ 
+-       /* XXX Maintain window of acceptable sequence numbers ?
+-        * => ru->data <= iph2->dpd_seq &&
+-        *    ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */
+-       if (ntohl(ru->data) != iph1->dpd_seq-1) {
++       seq = ntohl(ru->data);
++       if (seq <= iph1->dpd_last_ack || seq > iph1->dpd_seq) {
+                plog(LLV_ERROR, LOCATION, iph1->remote,
+-                        "Wrong DPD sequence number (%d, %d expected).\n", 
+-                        ntohl(ru->data), iph1->dpd_seq-1);
++                        "Wrong DPD sequence number (%d; last_ack=%d, seq=%d).\n", 
++                        seq, iph1->dpd_last_ack, iph1->dpd_seq);
+                return 0;
+        }
+ 
+@@ -1472,6 +1471,7 @@
+        }
+ 
+        iph1->dpd_fails = 0;
++       iph1->dpd_last_ack = seq;
+        sched_cancel(&iph1->dpd_r_u);
+        isakmp_sched_r_u(iph1, 0);
+ 
+@@ -1535,12 +1535,13 @@
+        memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t));
+        memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t));
+ 
+-       if (iph1->dpd_seq == 0){
++       if (iph1->dpd_seq == 0) {
+                /* generate a random seq which is not too big */
+-               srand(time(NULL));
+-               iph1->dpd_seq = rand() & 0x0fff;
++               iph1->dpd_seq = iph1->dpd_last_ack = rand() & 0x0fff;
+        }
+ 
++       iph1->dpd_seq++;
++       iph1->dpd_fails++;
+        ru->data = htonl(iph1->dpd_seq);
+ 
+        error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
+@@ -1549,12 +1550,6 @@
+        plog(LLV_DEBUG, LOCATION, iph1->remote,
+                 "DPD R-U-There sent (%d)\n", error);
+ 
+-       /* will be decreased if ACK received... */
+-       iph1->dpd_fails++;
+-
+-       /* XXX should be increased only when ACKed ? */
+-       iph1->dpd_seq++;
+-
+        /* Reschedule the r_u_there with a short delay,
+         * will be deleted/rescheduled if ACK received before */
+        isakmp_sched_r_u(iph1, 1);
+Index: src/racoon/handler.h
+===================================================================
+RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/handler.h,v
+retrieving revision 1.22
+diff -u -r1.22 handler.h
+--- a/src/racoon/handler.h      3 Sep 2009 09:29:07 -0000       1.22
++++ b/src/racoon/handler.h      5 May 2010 15:56:39 -0000
+@@ -202,7 +202,8 @@
+ 
+ #ifdef ENABLE_DPD
+        int             dpd_support;    /* Does remote supports DPD ? */
+-       u_int16_t       dpd_seq;                /* DPD seq number to receive */
++       u_int32_t       dpd_last_ack;
++       u_int32_t       dpd_seq;                /* DPD seq number to receive */
+        u_int8_t        dpd_fails;              /* number of failures */
+        struct sched    dpd_r_u;
+ #endif
diff --git a/main/ipsec-tools/90-openssl-oneshot.patch b/main/ipsec-tools/90-openssl-oneshot.patch
deleted file mode 100644
index ece12a52dd..0000000000
--- a/main/ipsec-tools/90-openssl-oneshot.patch
+++ /dev/null
@@ -1,210 +0,0 @@
-Index: src/racoon/crypto_openssl.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c,v
-retrieving revision 1.19
-diff -u -r1.19 crypto_openssl.c
---- a/src/racoon/crypto_openssl.c       29 Apr 2009 10:50:01 -0000      1.19
-+++ b/src/racoon/crypto_openssl.c       4 Jun 2010 09:13:18 -0000
-@@ -1800,6 +1800,42 @@
-        return (caddr_t)c;
- }
- 
-+static vchar_t *eay_hmac_one(key, data, type)
-+       vchar_t *key, *data;
-+       const EVP_MD *type;
-+{
-+       vchar_t *res;
-+
-+       if ((res = vmalloc(EVP_MD_size(type))) == 0)
-+               return NULL;
-+
-+       if (!HMAC(type, (void *) key->v, key->l,
-+                 (void *) data->v, data->l, (void *) res->v, NULL)) {
-+               vfree(res);
-+               return NULL;
-+       }
-+
-+       return res;
-+}
-+
-+static vchar_t *eay_digest_one(data, type)
-+       vchar_t *data;
-+       const EVP_MD *type;
-+{
-+       vchar_t *res;
-+
-+       if ((res = vmalloc(EVP_MD_size(type))) == 0)
-+               return NULL;
-+
-+       if (!EVP_Digest((void *) data->v, data->l,
-+                       (void *) res->v, NULL, type, NULL)) {
-+               vfree(res);
-+               return NULL;
-+       }
-+
-+       return res;
-+}
-+
- #ifdef WITH_SHA2
- /*
-  * HMAC SHA2-512
-@@ -1808,14 +1844,7 @@
- eay_hmacsha2_512_one(key, data)
-        vchar_t *key, *data;
- {
--       vchar_t *res;
--       caddr_t ctx;
--
--       ctx = eay_hmacsha2_512_init(key);
--       eay_hmacsha2_512_update(ctx, data);
--       res = eay_hmacsha2_512_final(ctx);
--
--       return(res);
-+       return eay_hmac_one(key, data, EVP_sha2_512());
- }
- 
- caddr_t
-@@ -1865,14 +1894,7 @@
- eay_hmacsha2_384_one(key, data)
-        vchar_t *key, *data;
- {
--       vchar_t *res;
--       caddr_t ctx;
--
--       ctx = eay_hmacsha2_384_init(key);
--       eay_hmacsha2_384_update(ctx, data);
--       res = eay_hmacsha2_384_final(ctx);
--
--       return(res);
-+       return eay_hmac_one(key, data, EVP_sha2_384());
- }
- 
- caddr_t
-@@ -1922,14 +1944,7 @@
- eay_hmacsha2_256_one(key, data)
-        vchar_t *key, *data;
- {
--       vchar_t *res;
--       caddr_t ctx;
--
--       ctx = eay_hmacsha2_256_init(key);
--       eay_hmacsha2_256_update(ctx, data);
--       res = eay_hmacsha2_256_final(ctx);
--
--       return(res);
-+       return eay_hmac_one(key, data, EVP_sha2_256());
- }
- 
- caddr_t
-@@ -1980,14 +1995,7 @@
- eay_hmacsha1_one(key, data)
-        vchar_t *key, *data;
- {
--       vchar_t *res;
--       caddr_t ctx;
--
--       ctx = eay_hmacsha1_init(key);
--       eay_hmacsha1_update(ctx, data);
--       res = eay_hmacsha1_final(ctx);
--
--       return(res);
-+       return eay_hmac_one(key, data, EVP_sha1());
- }
- 
- caddr_t
-@@ -2037,14 +2045,7 @@
- eay_hmacmd5_one(key, data)
-        vchar_t *key, *data;
- {
--       vchar_t *res;
--       caddr_t ctx;
--
--       ctx = eay_hmacmd5_init(key);
--       eay_hmacmd5_update(ctx, data);
--       res = eay_hmacmd5_final(ctx);
--
--       return(res);
-+       return eay_hmac_one(key, data, EVP_md5());
- }
- 
- caddr_t
-@@ -2130,14 +2131,7 @@
- eay_sha2_512_one(data)
-        vchar_t *data;
- {
--       caddr_t ctx;
--       vchar_t *res;
--
--       ctx = eay_sha2_512_init();
--       eay_sha2_512_update(ctx, data);
--       res = eay_sha2_512_final(ctx);
--
--       return(res);
-+       return eay_digest_one(data, EVP_sha512());
- }
- 
- int
-@@ -2190,14 +2184,7 @@
- eay_sha2_384_one(data)
-        vchar_t *data;
- {
--       caddr_t ctx;
--       vchar_t *res;
--
--       ctx = eay_sha2_384_init();
--       eay_sha2_384_update(ctx, data);
--       res = eay_sha2_384_final(ctx);
--
--       return(res);
-+       return eay_digest_one(data, EVP_sha2_384());
- }
- 
- int
-@@ -2250,14 +2237,7 @@
- eay_sha2_256_one(data)
-        vchar_t *data;
- {
--       caddr_t ctx;
--       vchar_t *res;
--
--       ctx = eay_sha2_256_init();
--       eay_sha2_256_update(ctx, data);
--       res = eay_sha2_256_final(ctx);
--
--       return(res);
-+       return eay_digest_one(data, EVP_sha2_256());
- }
- 
- int
-@@ -2309,14 +2289,7 @@
- eay_sha1_one(data)
-        vchar_t *data;
- {
--       caddr_t ctx;
--       vchar_t *res;
--
--       ctx = eay_sha1_init();
--       eay_sha1_update(ctx, data);
--       res = eay_sha1_final(ctx);
--
--       return(res);
-+       return eay_digest_one(data, EVP_sha1());
- }
- 
- int
-@@ -2367,14 +2340,7 @@
- eay_md5_one(data)
-        vchar_t *data;
- {
--       caddr_t ctx;
--       vchar_t *res;
--
--       ctx = eay_md5_init();
--       eay_md5_update(ctx, data);
--       res = eay_md5_final(ctx);
--
--       return(res);
-+       return eay_digest_one(data, EVP_md5());
- }
- 
- int
diff --git a/main/ipsec-tools/APKBUILD b/main/ipsec-tools/APKBUILD
index dc5fca1b55..7421b05d77 100644
--- a/main/ipsec-tools/APKBUILD
+++ b/main/ipsec-tools/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ipsec-tools
-pkgver=0.8_alpha20090903
-_myver=0.8-alpha20090903
-pkgrel=11
+pkgver=0.8_alpha20101022
+_myver=0.8-alpha20101022
+pkgrel=0
 pkgdesc="User-space IPsec tools for various IPsec implementations"
 url="http://ipsec-tools.sourceforge.net/"
 license="BSD"
@@ -13,12 +13,9 @@ source="http://downloads.sourceforge.net/$pkgname/$pkgname-$_myver.tar.gz
         racoon.initd
         racoon.confd
         50-reverse-connect.patch
-        60-debug-quick.patch
-        initial-contact-fix.diff
-        fd-priorities.patch
         70-rcvbuf-size.patch
         75-racoonctl-rcvbuf.patch
-        90-openssl-oneshot.patch
+        90-dpd-window-fix.patch
         "
 
 _builddir="$srcdir"/$pkgname-$_myver
@@ -28,7 +25,6 @@ prepare() {
                 msg "Applying $i..."
                 patch -p1 -i $i || return 1
         done
-        patch -p0 -i "$srcdir"/initial-contact-fix.diff || return 1
 
         sed -i 's:-Werror::g' configure
 }
@@ -59,13 +55,10 @@ package() {
         install -D -m644 ../racoon.confd "$pkgdir"/etc/conf.d/racoon
 }
 
-md5sums="8ec28d4e89c0f5e49ae2caa7463fbcfd  ipsec-tools-0.8-alpha20090903.tar.gz
+md5sums="1492b83edc944b5d32d2eff51e33399e  ipsec-tools-0.8-alpha20101022.tar.gz
 74f12ed04ed273a738229c0bfbf829cc  racoon.initd
 2d00250cf72da7f2f559c91b65a48747  racoon.confd
 13bda94a598aabf593280e04ea16065d  50-reverse-connect.patch
-baa13d7f0f48955c792f7fcd42a8587a  60-debug-quick.patch
-69e06c5cc3a0c1cc8b10ddc89d1e644b  initial-contact-fix.diff
-c1e8b8dc80ef4b5d79fece52a4865e68  fd-priorities.patch
 f40c78e4ca4b92d2bf74e4fcf3a8d91f  70-rcvbuf-size.patch
 2d5d24c4a3684a38584f88720f71c7d6  75-racoonctl-rcvbuf.patch
-11e2c21e443edab17725f74ffeaddb76  90-openssl-oneshot.patch"
+0391a6967ad19673588302bc8b17e0e2  90-dpd-window-fix.patch"
diff --git a/main/ipsec-tools/fd-priorities.patch b/main/ipsec-tools/fd-priorities.patch
deleted file mode 100644
index 68fc4b3455..0000000000
--- a/main/ipsec-tools/fd-priorities.patch
+++ /dev/null
@@ -1,285 +0,0 @@
-? .msg
-? ChangeLog
-? alpine-config
-? commiters.txt
-? fd-priorities-2.patch
-? fd-priorities.patch
-? ipsec-tools-0.8-alpha20090820.tar.bz2
-? ipsec-tools-0.8-alpha20090903.tar.bz2
-? local-changes.diff
-? patch-to-support-cast128-cbc-algorithm.patch
-? racoon.txt
-? rpm/Makefile
-? rpm/Makefile.in
-? rpm/ipsec-tools.spec
-? rpm/suse/Makefile
-? rpm/suse/Makefile.in
-? rpm/suse/ipsec-tools.spec
-? src/Makefile
-? src/Makefile.in
-? src/include-glibc/.includes
-? src/include-glibc/Makefile
-? src/include-glibc/Makefile.in
-? src/libipsec/.deps
-? src/libipsec/.libs
-? src/libipsec/Makefile
-? src/libipsec/Makefile.in
-? src/libipsec/ipsec_dump_policy.lo
-? src/libipsec/ipsec_get_policylen.lo
-? src/libipsec/ipsec_strerror.lo
-? src/libipsec/key_debug.lo
-? src/libipsec/libipsec.la
-? src/libipsec/pfkey.lo
-? src/libipsec/pfkey_dump.lo
-? src/libipsec/policy_parse.c
-? src/libipsec/policy_parse.h
-? src/libipsec/policy_parse.lo
-? src/libipsec/policy_token.c
-? src/libipsec/policy_token.lo
-? src/racoon/.deps
-? src/racoon/.libs
-? src/racoon/Makefile
-? src/racoon/Makefile.in
-? src/racoon/cfparse.c
-? src/racoon/cfparse.h
-? src/racoon/cftoken.c
-? src/racoon/eaytest
-? src/racoon/libracoon.la
-? src/racoon/libracoon_la-kmpstat.lo
-? src/racoon/libracoon_la-misc.lo
-? src/racoon/libracoon_la-sockmisc.lo
-? src/racoon/libracoon_la-vmbuf.lo
-? src/racoon/plainrsa-gen
-? src/racoon/prsa_par.c
-? src/racoon/prsa_par.h
-? src/racoon/prsa_tok.c
-? src/racoon/racoon
-? src/racoon/racoonctl
-? src/racoon/samples/psk.txt
-? src/racoon/samples/racoon.conf
-? src/setkey/.deps
-? src/setkey/.libs
-? src/setkey/Makefile
-? src/setkey/Makefile.in
-? src/setkey/parse.c
-? src/setkey/parse.h
-? src/setkey/setkey
-? src/setkey/token.c
-Index: src/racoon/admin.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/admin.c,v
-retrieving revision 1.32
-diff -u -r1.32 admin.c
---- a/src/racoon/admin.c        3 Sep 2009 09:29:07 -0000       1.32
-+++ b/src/racoon/admin.c        9 Mar 2010 07:50:46 -0000
-@@ -734,7 +734,7 @@
-                return -1;
-        }
- 
--       monitor_fd(lcconf->sock_admin, admin_handler, NULL);
-+       monitor_fd(lcconf->sock_admin, admin_handler, NULL, 0);
-        plog(LLV_DEBUG, LOCATION, NULL,
-             "open %s as racoon management.\n", sunaddr.sun_path);
- 
-Index: src/racoon/evt.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/evt.c,v
-retrieving revision 1.9
-diff -u -r1.9 evt.c
---- a/src/racoon/evt.c  23 Jan 2009 08:05:58 -0000      1.9
-+++ b/src/racoon/evt.c  9 Mar 2010 07:50:46 -0000
-@@ -373,7 +373,7 @@
- 
-        LIST_INSERT_HEAD(list, l, ll_chain);
-        l->fd = fd;
--       monitor_fd(l->fd, evt_unsubscribe_cb, l);
-+       monitor_fd(l->fd, evt_unsubscribe_cb, l, 0);
- 
-        plog(LLV_DEBUG, LOCATION, NULL,
-             "[%d] admin connection is polling events\n", fd);
-Index: src/racoon/grabmyaddr.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/grabmyaddr.c,v
-retrieving revision 1.23
-diff -u -r1.23 grabmyaddr.c
---- a/src/racoon/grabmyaddr.c   3 Jul 2009 06:41:46 -0000       1.23
-+++ b/src/racoon/grabmyaddr.c   9 Mar 2010 07:50:46 -0000
-@@ -296,7 +296,7 @@
-                lcconf->rtsock = kernel_open_socket();
-                if (lcconf->rtsock < 0)
-                        return -1;
--               monitor_fd(lcconf->rtsock, kernel_receive, NULL);
-+               monitor_fd(lcconf->rtsock, kernel_receive, NULL, 0);
-        } else {
-                lcconf->rtsock = -1;
-                if (!myaddr_open_all_configured(NULL))
-Index: src/racoon/isakmp.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp.c,v
-retrieving revision 1.60
-diff -u -r1.60 isakmp.c
---- a/src/racoon/isakmp.c       3 Sep 2009 09:29:07 -0000       1.60
-+++ b/src/racoon/isakmp.c       9 Mar 2010 07:50:48 -0000
-@@ -1720,7 +1720,7 @@
-             "%s used as isakmp port (fd=%d)\n",
-             saddr2str(addr), fd);
- 
--       monitor_fd(fd, isakmp_handler, NULL);
-+       monitor_fd(fd, isakmp_handler, NULL, 1);
-        return fd;
- 
- err:
-Index: src/racoon/pfkey.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/pfkey.c,v
-retrieving revision 1.52
-diff -u -r1.52 pfkey.c
---- a/src/racoon/pfkey.c        9 Feb 2010 23:05:16 -0000       1.52
-+++ b/src/racoon/pfkey.c        9 Mar 2010 07:50:49 -0000
-@@ -487,7 +487,7 @@
-                return -1;
-        }
- #endif
--       monitor_fd(lcconf->sock_pfkey, pfkey_handler, NULL);
-+       monitor_fd(lcconf->sock_pfkey, pfkey_handler, NULL, 0);
-        return 0;
- }
- 
-Index: src/racoon/session.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/session.c,v
-retrieving revision 1.27
-diff -u -r1.27 session.c
---- a/src/racoon/session.c      4 Mar 2010 15:13:53 -0000       1.27
-+++ b/src/racoon/session.c      9 Mar 2010 07:50:50 -0000
-@@ -103,8 +103,13 @@
- struct fd_monitor {
-        int (*callback)(void *ctx, int fd);
-        void *ctx;
-+       int prio;
-+       int fd;
-+       TAILQ_ENTRY(fd_monitor) chain;
- };
- 
-+#define NUM_PRIORITIES 2
-+
- static void close_session __P((void));
- static void initfds __P((void));
- static void init_signal __P((void));
-@@ -115,13 +120,14 @@
- 
- static fd_set preset_mask, active_mask;
- static struct fd_monitor fd_monitors[FD_SETSIZE];
-+static TAILQ_HEAD(fd_monitor_list, fd_monitor) fd_monitor_tree[NUM_PRIORITIES];
- static int nfds = 0;
- 
- static volatile sig_atomic_t sigreq[NSIG + 1];
- static struct sched scflushsa = SCHED_INITIALIZER();
- 
- void
--monitor_fd(int fd, int (*callback)(void *, int), void *ctx)
-+monitor_fd(int fd, int (*callback)(void *, int), void *ctx, int priority)
- {
-        if (fd < 0 || fd >= FD_SETSIZE) {
-                plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun");
-@@ -131,9 +137,17 @@
-        FD_SET(fd, &preset_mask);
-        if (fd > nfds)
-                nfds = fd;
-+       if (priority <= 0)
-+               priority = 0;
-+       if (priority >= NUM_PRIORITIES)
-+               priority = NUM_PRIORITIES - 1;
- 
-        fd_monitors[fd].callback = callback;
-        fd_monitors[fd].ctx = ctx;
-+       fd_monitors[fd].prio = priority;
-+       fd_monitors[fd].fd = fd;
-+       TAILQ_INSERT_TAIL(&fd_monitor_tree[priority],
-+                         &fd_monitors[fd], chain);
- }
- 
- void
-@@ -144,10 +158,15 @@
-                exit(1);
-        }
- 
-+       if (fd_monitors[fd].callback == NULL)
-+               return;
-+
-        FD_CLR(fd, &preset_mask);
-        FD_CLR(fd, &active_mask);
-        fd_monitors[fd].callback = NULL;
-        fd_monitors[fd].ctx = NULL;
-+       TAILQ_REMOVE(&fd_monitor_tree[fd_monitors[fd].prio],
-+                    &fd_monitors[fd], chain);
- }
- 
- int
-@@ -158,11 +177,15 @@
-        char pid_file[MAXPATHLEN];
-        FILE *fp;
-        pid_t racoon_pid = 0;
--       int i;
-+       int i, count;
-+       struct fd_monitor *fdm;
- 
-        nfds = 0;
-        FD_ZERO(&preset_mask);
- 
-+       for (i = 0; i < NUM_PRIORITIES; i++)
-+               TAILQ_INIT(&fd_monitor_tree[i]);
-+
-        /* initialize schedular */
-        sched_init();
-        init_signal();
-@@ -291,16 +314,24 @@
-                        /*NOTREACHED*/
-                }
- 
--               for (i = 0; i <= nfds; i++) {
--                       if (!FD_ISSET(i, &active_mask))
--                               continue;
--
--                       if (fd_monitors[i].callback != NULL)
--                               fd_monitors[i].callback(fd_monitors[i].ctx, i);
--                       else
--                               plog(LLV_ERROR, LOCATION, NULL,
--                                    "fd %d set, but no active callback\n", i);
-+               count = 0;
-+               for (i = 0; i < NUM_PRIORITIES; i++) {
-+                       TAILQ_FOREACH(fdm, &fd_monitor_tree[i], chain) {
-+                               if (!FD_ISSET(fdm->fd, &active_mask))
-+                                       continue;
-+
-+                               FD_CLR(fdm->fd, &active_mask);
-+                               if (fdm->callback != NULL) {
-+                                       fdm->callback(fdm->ctx, fdm->fd);
-+                                       count++;
-+                               } else
-+                                       plog(LLV_ERROR, LOCATION, NULL,
-+                                       "fd %d set, but no active callback\n", i);
-+                       }
-+                       if (count != 0)
-+                               break;
-                }
-+
-        }
- }
- 
-Index: src/racoon/session.h
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/session.h,v
-retrieving revision 1.8
-diff -u -r1.8 session.h
---- a/src/racoon/session.h      23 Jan 2009 08:05:58 -0000      1.8
-+++ b/src/racoon/session.h      9 Mar 2010 07:50:50 -0000
-@@ -37,7 +37,7 @@
- extern int session __P((void));
- extern RETSIGTYPE signal_handler __P((int));
- 
--extern void monitor_fd __P((int fd, int (*callback)(void *, int), void *ctx));
-+extern void monitor_fd __P((int fd, int (*callback)(void *, int), void *ctx, int priority));
- extern void unmonitor_fd __P((int fd));
- 
- #endif /* _SESSION_H */
diff --git a/main/ipsec-tools/initial-contact-fix.diff b/main/ipsec-tools/initial-contact-fix.diff
deleted file mode 100644
index 370418be09..0000000000
--- a/main/ipsec-tools/initial-contact-fix.diff
+++ /dev/null
@@ -1,71 +0,0 @@
-Index: src/racoon/admin.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/admin.c,v
-retrieving revision 1.32
-diff -u -r1.32 admin.c
---- src/racoon/admin.c  3 Sep 2009 09:29:07 -0000       1.32
-+++ src/racoon/admin.c  10 Dec 2009 14:38:47 -0000
-@@ -299,9 +299,8 @@
-                break;
- 
-        case ADMIN_DELETE_SA: {
--               struct ph1handle *iph1;
--               struct ph1selector sel;
-                char *loc, *rem;
-+               struct ph1selector sel;
- 
-                memset(&sel, 0, sizeof(sel));
-                sel.local = (struct sockaddr *)
-@@ -319,6 +318,7 @@
-                plog(LLV_INFO, LOCATION, NULL,
-                     "admin delete-sa %s %s\n", loc, rem);
-                enumph1(&sel, admin_ph1_delete_sa, NULL);
-+               remcontacted(sel.remote);
- 
-                racoon_free(loc);
-                racoon_free(rem);
-Index: src/racoon/handler.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/handler.c,v
-retrieving revision 1.31
-diff -u -r1.31 handler.c
---- src/racoon/handler.c        22 Nov 2009 19:34:55 -0000      1.31
-+++ src/racoon/handler.c        10 Dec 2009 14:38:48 -0000
-@@ -966,6 +966,22 @@
- }
- 
- void
-+remcontacted(remote)
-+       struct sockaddr *remote;
-+{
-+       struct contacted *p;
-+
-+       LIST_FOREACH(p, &ctdtree, chain) {
-+               if (cmpsaddr(remote, p->remote) == 0) {
-+                       LIST_REMOVE(p, chain);
-+                       racoon_free(p->remote);
-+                       racoon_free(p);
-+                       break;
-+               }
-+       }       
-+}
-+
-+void
- initctdtree()
- {
-        LIST_INIT(&ctdtree);
-Index: src/racoon/handler.h
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/handler.h,v
-retrieving revision 1.22
-diff -u -r1.22 handler.h
---- src/racoon/handler.h        3 Sep 2009 09:29:07 -0000       1.22
-+++ src/racoon/handler.h        10 Dec 2009 14:38:48 -0000
-@@ -518,6 +518,7 @@
- 
- extern struct contacted *getcontacted __P((struct sockaddr *));
- extern int inscontacted __P((struct sockaddr *));
-+extern void remcontacted __P((struct sockaddr *));
- extern void initctdtree __P((void));
- 
- extern int check_recvdpkt __P((struct sockaddr *,