main/strongswan: ikev1 grekey

interoperability fix to work with Alpine patched ipsec-tools
(will probably be removed after a migration period)

(cherry picked from commit 2a4023dfee4f68916ac96d02fc41874d7286d625)

2 files changed, 512 insertions, 1 deletions

diff --git a/main/strongswan/1000-support-gre-key-in-ikev1.patch b/main/strongswan/1000-support-gre-key-in-ikev1.patch
new file mode 100644
index 0000000000..72cdd8b825
--- /dev/null
+++ b/main/strongswan/1000-support-gre-key-in-ikev1.patch
@@ -0,0 +1,507 @@
+From f69e2daf4c4ccc57c14fd73d6b7320c5359758c8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Mon, 13 Jul 2015 14:03:49 +0300
+Subject: [PATCH] support gre key in ikev1
+
+this implements gre key negotiation in ikev1 similarly to the
+ipsec-tools patch in alpine.
+
+the from/to port pair is internally used as gre key for gre
+protocol traffic selectors. since from/to pairs 0/0xffff and
+0xffff/0 have special meaning, the gre keys 0xffff and 0xffff0000
+will not work.
+
+this is not standard compliant, and should probably not be upstreamed
+or used widely, but it is applied for interoperability with alpine
+racoon for the time being.
+---
+ src/libcharon/encoding/payloads/id_payload.c       | 68 +++++++++++++++++-----
+ src/libcharon/encoding/payloads/id_payload.h       |  6 +-
+ src/libcharon/plugins/stroke/stroke_config.c       |  5 ++
+ src/libcharon/plugins/unity/unity_narrow.c         |  2 +-
+ src/libcharon/plugins/vici/vici_config.c           |  9 ++-
+ src/libcharon/sa/ikev1/tasks/quick_mode.c          | 16 ++---
+ .../plugins/kernel_netlink/kernel_netlink_ipsec.c  | 40 ++++++++++---
+ src/libstrongswan/selectors/traffic_selector.c     | 33 ++++++++++-
+ src/libstrongswan/selectors/traffic_selector.h     | 31 ++++++++++
+ 9 files changed, 171 insertions(+), 39 deletions(-)
+
+diff --git a/src/libcharon/encoding/payloads/id_payload.c b/src/libcharon/encoding/payloads/id_payload.c
+index bb8aab7..2cf08e9 100644
+--- a/src/libcharon/encoding/payloads/id_payload.c
++++ b/src/libcharon/encoding/payloads/id_payload.c
+@@ -245,18 +245,20 @@ METHOD(id_payload_t, get_identification, identification_t*,
+  * Create a traffic selector from an range ID
+  */
+ static traffic_selector_t *get_ts_from_range(private_id_payload_t *this,
+-                                                                                        ts_type_t type)
++                                                                                        ts_type_t type,
++                                                                                        u_int16_t from_port, u_int16_t to_port)
+ {
+        return traffic_selector_create_from_bytes(this->protocol_id, type,
+-               chunk_create(this->id_data.ptr, this->id_data.len / 2), this->port,
+-               chunk_skip(this->id_data, this->id_data.len / 2), this->port ?: 65535);
++               chunk_create(this->id_data.ptr, this->id_data.len / 2), from_port,
++               chunk_skip(this->id_data, this->id_data.len / 2), to_port);
+ }
+ 
+ /**
+  * Create a traffic selector from an subnet ID
+  */
+ static traffic_selector_t *get_ts_from_subnet(private_id_payload_t *this,
+-                                                                                         ts_type_t type)
++                                                                                         ts_type_t type,
++                                                                                         u_int16_t from_port, u_int16_t to_port)
+ {
+        traffic_selector_t *ts;
+        chunk_t net, netmask;
+@@ -269,7 +271,7 @@ static traffic_selector_t *get_ts_from_subnet(private_id_payload_t *this,
+                netmask.ptr[i] = (netmask.ptr[i] ^ 0xFF) | net.ptr[i];
+        }
+        ts = traffic_selector_create_from_bytes(this->protocol_id, type,
+-                                                               net, this->port, netmask, this->port ?: 65535);
++                                                               net, from_port, netmask, to_port);
+        chunk_free(&netmask);
+        return ts;
+ }
+@@ -278,51 +280,76 @@ static traffic_selector_t *get_ts_from_subnet(private_id_payload_t *this,
+  * Create a traffic selector from an IP ID
+  */
+ static traffic_selector_t *get_ts_from_ip(private_id_payload_t *this,
+-                                                                                 ts_type_t type)
++                                                                                 ts_type_t type,
++                                                                                 u_int16_t from_port, u_int16_t to_port)
+ {
+        return traffic_selector_create_from_bytes(this->protocol_id, type,
+-                               this->id_data, this->port, this->id_data, this->port ?: 65535);
++                               this->id_data, from_port, this->id_data, to_port);
+ }
+ 
+ METHOD(id_payload_t, get_ts, traffic_selector_t*,
+-       private_id_payload_t *this)
++       private_id_payload_t *this, id_payload_t *other_, bool initiator)
+ {
++       private_id_payload_t *other = (private_id_payload_t *) other_;
++       u_int16_t from_port, to_port;
++
++       if (other && this->protocol_id == IPPROTO_GRE && other->protocol_id == IPPROTO_GRE)
++       {
++               if (initiator)
++               {
++                       from_port = this->port;
++                       to_port = other->port;
++               }
++               else
++               {
++                       from_port = other->port;
++                       to_port = this->port;
++               }
++               if (from_port == 0 && to_port == 0)
++                       to_port = 0xffff;
++       }
++       else
++       {
++               from_port = this->port;
++               to_port = this->port ?: 0xffff;
++       }
++
+        switch (this->id_type)
+        {
+                case ID_IPV4_ADDR_SUBNET:
+                        if (this->id_data.len == 8)
+                        {
+-                               return get_ts_from_subnet(this, TS_IPV4_ADDR_RANGE);
++                               return get_ts_from_subnet(this, TS_IPV4_ADDR_RANGE, from_port, to_port);
+                        }
+                        break;
+                case ID_IPV6_ADDR_SUBNET:
+                        if (this->id_data.len == 32)
+                        {
+-                               return get_ts_from_subnet(this, TS_IPV6_ADDR_RANGE);
++                               return get_ts_from_subnet(this, TS_IPV6_ADDR_RANGE, from_port, to_port);
+                        }
+                        break;
+                case ID_IPV4_ADDR_RANGE:
+                        if (this->id_data.len == 8)
+                        {
+-                               return get_ts_from_range(this, TS_IPV4_ADDR_RANGE);
++                               return get_ts_from_range(this, TS_IPV4_ADDR_RANGE, from_port, to_port);
+                        }
+                        break;
+                case ID_IPV6_ADDR_RANGE:
+                        if (this->id_data.len == 32)
+                        {
+-                               return get_ts_from_range(this, TS_IPV6_ADDR_RANGE);
++                               return get_ts_from_range(this, TS_IPV6_ADDR_RANGE, from_port, to_port);
+                        }
+                        break;
+                case ID_IPV4_ADDR:
+                        if (this->id_data.len == 4)
+                        {
+-                               return get_ts_from_ip(this, TS_IPV4_ADDR_RANGE);
++                               return get_ts_from_ip(this, TS_IPV4_ADDR_RANGE, from_port, to_port);
+                        }
+                        break;
+                case ID_IPV6_ADDR:
+                        if (this->id_data.len == 16)
+                        {
+-                               return get_ts_from_ip(this, TS_IPV6_ADDR_RANGE);
++                               return get_ts_from_ip(this, TS_IPV6_ADDR_RANGE, from_port, to_port);
+                        }
+                        break;
+                default:
+@@ -397,7 +424,7 @@ id_payload_t *id_payload_create_from_identification(payload_type_t type,
+ /*
+  * Described in header.
+  */
+-id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts)
++id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts, bool initiator)
+ {
+        private_id_payload_t *this;
+        u_int8_t mask;
+@@ -460,8 +487,17 @@ id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts)
+                                                        ts->get_from_address(ts), ts->get_to_address(ts));
+                net->destroy(net);
+        }
+-       this->port = ts->get_from_port(ts);
+        this->protocol_id = ts->get_protocol(ts);
++       if (initiator || this->protocol_id != IPPROTO_GRE)
++       {
++               this->port = ts->get_from_port(ts);
++       }
++       else
++       {
++               this->port = ts->get_to_port(ts);
++               if (this->port == 0xffff && ts->get_from_port(ts) == 0)
++                       this->port = 0;
++       }
+        this->payload_length += this->id_data.len;
+ 
+        return &this->public;
+diff --git a/src/libcharon/encoding/payloads/id_payload.h b/src/libcharon/encoding/payloads/id_payload.h
+index df1d075..7558e91 100644
+--- a/src/libcharon/encoding/payloads/id_payload.h
++++ b/src/libcharon/encoding/payloads/id_payload.h
+@@ -48,11 +48,11 @@ struct id_payload_t {
+        identification_t *(*get_identification) (id_payload_t *this);
+ 
+        /**
+-        * Creates a traffic selector form a ID_ADDR_SUBNET/RANGE identity.
++        * Creates a traffic selector form a ID_ADDR_SUBNET/RANGE identity pair.
+         *
+         * @return                              traffic selector, NULL on failure
+         */
+-       traffic_selector_t* (*get_ts)(id_payload_t *this);
++       traffic_selector_t* (*get_ts)(id_payload_t *this, id_payload_t *other, bool initiator);
+ 
+        /**
+         * Get encoded payload without fixed payload header (used for IKEv1).
+@@ -91,6 +91,6 @@ id_payload_t *id_payload_create_from_identification(payload_type_t type,
+  * @param ts           traffic selector
+  * @return                     PLV1_ID id_paylad_t object.
+  */
+-id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts);
++id_payload_t *id_payload_create_from_ts(traffic_selector_t *ts, bool initiator);
+ 
+ #endif /** ID_PAYLOAD_H_ @}*/
+diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
+index 55ec7cd..87a1d08 100644
+--- a/src/libcharon/plugins/stroke/stroke_config.c
++++ b/src/libcharon/plugins/stroke/stroke_config.c
+@@ -1032,6 +1032,11 @@ static bool parse_protoport(char *token, u_int16_t *from_port,
+                *from_port = 0xffff;
+                *to_port = 0;
+        }
++       else if (*port && *protocol == IPPROTO_GRE)
++       {
++               p = strtol(port, &endptr, 0);
++               traffic_selector_split_grekey(p, from_port, to_port);
++       }
+        else if (*port)
+        {
+                svc = getservbyname(port, NULL);
+diff --git a/src/libcharon/plugins/unity/unity_narrow.c b/src/libcharon/plugins/unity/unity_narrow.c
+index 227d24b..7749d8c 100644
+--- a/src/libcharon/plugins/unity/unity_narrow.c
++++ b/src/libcharon/plugins/unity/unity_narrow.c
+@@ -247,7 +247,7 @@ METHOD(listener_t, message, bool,
+                        if (!first)
+                        {
+                                id_payload = (id_payload_t*)payload;
+-                               tsr = id_payload->get_ts(id_payload);
++                               tsr = id_payload->get_ts(id_payload, NULL, FALSE);
+                                break;
+                        }
+                        first = FALSE;
+diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
+index 3c4e3ec..9495d4d 100644
+--- a/src/libcharon/plugins/vici/vici_config.c
++++ b/src/libcharon/plugins/vici/vici_config.c
+@@ -586,8 +586,13 @@ CALLBACK(parse_ts, bool,
+                }
+                else if (*port && !streq(port, "any"))
+                {
+-                       svc = getservbyname(port, NULL);
+-                       if (svc)
++                       if (proto == IPPROTO_GRE)
++                       {
++                               p = strtol(port, &end, 0);
++                               if (*end) return FALSE;
++                               traffic_selector_split_grekey(p, &from, &to);
++                       }
++                       else if ((svc = getservbyname(port, NULL)) != NULL)
+                        {
+                                from = to = ntohs(svc->s_port);
+                        }
+diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c
+index 96edfd8..c0830dd 100644
+--- a/src/libcharon/sa/ikev1/tasks/quick_mode.c
++++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c
+@@ -536,9 +536,9 @@ static void add_ts(private_quick_mode_t *this, message_t *message)
+ {
+        id_payload_t *id_payload;
+ 
+-       id_payload = id_payload_create_from_ts(this->tsi);
++       id_payload = id_payload_create_from_ts(this->tsi, TRUE);
+        message->add_payload(message, &id_payload->payload_interface);
+-       id_payload = id_payload_create_from_ts(this->tsr);
++       id_payload = id_payload_create_from_ts(this->tsr, FALSE);
+        message->add_payload(message, &id_payload->payload_interface);
+ }
+ 
+@@ -549,7 +549,7 @@ static bool get_ts(private_quick_mode_t *this, message_t *message)
+ {
+        traffic_selector_t *tsi = NULL, *tsr = NULL;
+        enumerator_t *enumerator;
+-       id_payload_t *id_payload;
++       id_payload_t *idi = NULL, *idr = NULL;
+        payload_t *payload;
+        host_t *hsi, *hsr;
+        bool first = TRUE;
+@@ -559,20 +559,22 @@ static bool get_ts(private_quick_mode_t *this, message_t *message)
+        {
+                if (payload->get_type(payload) == PLV1_ID)
+                {
+-                       id_payload = (id_payload_t*)payload;
+-
+                        if (first)
+                        {
+-                               tsi = id_payload->get_ts(id_payload);
++                               idi = (id_payload_t*)payload;
+                                first = FALSE;
+                        }
+                        else
+                        {
+-                               tsr = id_payload->get_ts(id_payload);
++                               idr = (id_payload_t*)payload;
+                                break;
+                        }
+                }
+        }
++       if (idi && idr) {
++               tsi = idi->get_ts(idi, idr, TRUE);
++               tsr = idr->get_ts(idr, idi, FALSE);
++       }
+        enumerator->destroy(enumerator);
+ 
+        /* create host2host selectors if ID payloads missing */
+diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+index f22e07d..e43df3f 100644
+--- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
++++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+@@ -743,7 +743,18 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
+        ts2subnet(src, &sel.saddr, &sel.prefixlen_s);
+        ts2ports(dst, &sel.dport, &sel.dport_mask);
+        ts2ports(src, &sel.sport, &sel.sport_mask);
+-       if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) &&
++       if (sel.proto == IPPROTO_GRE)
++       {
++               sel.sport = htons(src->get_from_port(src));
++               sel.dport = htons(src->get_to_port(src));
++               sel.sport_mask = ~0;
++               sel.dport_mask = ~0;
++               if (sel.sport == htons(0) && sel.dport == htons(0xffff))
++               {
++                       sel.sport = sel.dport = sel.sport_mask = sel.dport_mask = 0;
++               }
++       }
++       else if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) &&
+                (sel.dport || sel.sport))
+        {
+                /* the ICMP type is encoded in the most significant 8 bits and the ICMP
+@@ -767,7 +778,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
+ {
+        u_char *addr;
+        u_int8_t prefixlen;
+-       u_int16_t port = 0;
++       u_int16_t from_port = 0, to_port = 65535;
+        host_t *host = NULL;
+ 
+        if (src)
+@@ -776,7 +787,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
+                prefixlen = sel->prefixlen_s;
+                if (sel->sport_mask)
+                {
+-                       port = ntohs(sel->sport);
++                       from_port = to_port = ntohs(sel->sport);
+                }
+        }
+        else
+@@ -785,14 +796,27 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
+                prefixlen = sel->prefixlen_d;
+                if (sel->dport_mask)
+                {
+-                       port = ntohs(sel->dport);
++                       from_port = to_port = ntohs(sel->dport);
++               }
++       }
++       if (sel->proto == IPPROTO_GRE)
++       {
++               if (sel->sport_mask)
++               {
++                       from_port = ntohs(sel->sport);
++                       to_port = ntohs(sel->dport);
++               }
++               else
++               {
++                       from_port = 0;
++                       to_port = 0xffff;
+                }
+        }
+-       if (sel->proto == IPPROTO_ICMP || sel->proto == IPPROTO_ICMPV6)
++       else if (sel->proto == IPPROTO_ICMP || sel->proto == IPPROTO_ICMPV6)
+        {       /* convert ICMP[v6] message type and code as supplied by the kernel in
+                 * source and destination ports (both in network order) */
+-               port = (sel->sport >> 8) | (sel->dport & 0xff00);
+-               port = ntohs(port);
++               from_port = (sel->sport >> 8) | (sel->dport & 0xff00);
++               from_port = to_port = ntohs(from_port);
+        }
+        /* The Linux 2.6 kernel does not set the selector's family field,
+         * so as a kludge we additionally test the prefix length.
+@@ -809,7 +833,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
+        if (host)
+        {
+                return traffic_selector_create_from_subnet(host, prefixlen,
+-                                                                                       sel->proto, port, port ?: 65535);
++                                                                                       sel->proto, from_port, to_port);
+        }
+        return NULL;
+ }
+diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c
+index 3b7f8c5..c593a3f 100644
+--- a/src/libstrongswan/selectors/traffic_selector.c
++++ b/src/libstrongswan/selectors/traffic_selector.c
+@@ -209,6 +209,14 @@ static int print_icmp(printf_hook_data_t *data, u_int16_t port)
+ }
+ 
+ /**
++ * Print GRE key
++ */
++static int print_grekey(printf_hook_data_t *data, u_int16_t from_port, u_int16_t to_port)
++{
++       return print_in_hook(data, "%d", traffic_selector_grekey(from_port, to_port));
++}
++
++/**
+  * Described in header.
+  */
+ int traffic_selector_printf_hook(printf_hook_data_t *data,
+@@ -313,7 +321,11 @@ int traffic_selector_printf_hook(printf_hook_data_t *data,
+        /* build port string */
+        if (has_ports)
+        {
+-               if (this->from_port == this->to_port)
++               if (this->protocol == IPPROTO_GRE)
++               {
++                       written += print_grekey(data, this->from_port, this->to_port);
++               }
++               else if (this->from_port == this->to_port)
+                {
+                        struct servent *serv;
+ 
+@@ -398,7 +410,24 @@ METHOD(traffic_selector_t, get_subset, traffic_selector_t*,
+        /* select protocol, which is not zero */
+        protocol = max(this->protocol, other->protocol);
+ 
+-       if ((is_opaque(this) && is_opaque(other)) ||
++       if (this->protocol == IPPROTO_GRE)
++       {
++               if (is_any(this))
++               {
++                       from_port = other->from_port;
++                       to_port = other->to_port;
++               }
++               else if (is_any(other) ||
++                        (this->from_port == other->from_port &&
++                         this->to_port == other->to_port))
++               {
++                       from_port = this->from_port;
++                       to_port = this->to_port;
++               }
++               else
++                       return NULL;
++       }
++       else if ((is_opaque(this) && is_opaque(other)) ||
+                (is_opaque(this) && is_any(other)) ||
+                (is_opaque(other) && is_any(this)))
+        {
+diff --git a/src/libstrongswan/selectors/traffic_selector.h b/src/libstrongswan/selectors/traffic_selector.h
+index cf9a286..d458c68 100644
+--- a/src/libstrongswan/selectors/traffic_selector.h
++++ b/src/libstrongswan/selectors/traffic_selector.h
+@@ -120,6 +120,9 @@ struct traffic_selector_t {
+         * 8 bits and the code in the least significant 8 bits.  Use the utility
+         * functions to extract them.
+         *
++        * If the protocol is GRE, the high 16-bits of the 32-bit GRE key is stored
++        * in the from port. Use the utility function to merge and split them.
++        *
+         * @return                      port
+         */
+        u_int16_t (*get_from_port) (traffic_selector_t *this);
+@@ -134,6 +137,9 @@ struct traffic_selector_t {
+         * 8 bits and the code in the least significant 8 bits.  Use the utility
+         * functions to extract them.
+         *
++        * If the protocol is GRE, the low 16-bits of the 32-bit GRE key is stored
++        * in the to port. Use the utility function to merge and split them.
++        *
+         * @return                      port
+         */
+        u_int16_t (*get_to_port) (traffic_selector_t *this);
+@@ -268,6 +274,31 @@ int traffic_selector_cmp(traffic_selector_t *a, traffic_selector_t *b,
+                                                 void *opts);
+ 
+ /**
++ * Reconstruct the 32-bit GRE KEY in host order from a from/to ports.
++ *
++ * @param from_port                    port number in host order
++ * @param to_port                      port number in host order
++ * @return                             GRE KEY in host order
++ */
++static inline u_int32_t traffic_selector_grekey(u_int16_t from_port, u_int16_t to_port)
++{
++       return (from_port << 16) | to_port;
++}
++
++/**
++ * Split 32-bit GRE KEY in host order to from/to ports.
++ *
++ * @param grekey                       grekey in host order
++ * @param from_port                    from port in host order
++ * @param to_port                      to port in host order
++ */
++static inline void traffic_selector_split_grekey(u_int32_t grekey, u_int16_t *from_port, u_int16_t *to_port)
++{
++       *from_port = grekey >> 16;
++       *to_port = grekey & 0xffff;
++}
++
++/**
+  * Create a new traffic selector using human readable params.
+  *
+  * If protocol is ICMP or ICMPv6 the ports are interpreted as follows:  If they
+-- 
+2.4.5
+
diff --git a/main/strongswan/APKBUILD b/main/strongswan/APKBUILD
index b8701ddec5..f3a5493b30 100644
--- a/main/strongswan/APKBUILD
+++ b/main/strongswan/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=strongswan
 pkgver=5.3.2
 _pkgver=${pkgver//_rc/rc}
-pkgrel=1
+pkgrel=2
 pkgdesc="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
 url="http://www.strongswan.org/"
 arch="all"
@@ -20,6 +20,7 @@ source="http://download.strongswan.org/$pkgname-$_pkgver.tar.bz2
         0002-vici-send-certificates-for-ike-sa-events.patch
         0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
         0004-vici-support-asynchronous-initiation.patch
+        1000-support-gre-key-in-ikev1.patch
 
         strongswan.initd
         charon.initd"
@@ -107,6 +108,7 @@ e553c5e9a895a2d95b1cbc33407d64a0  0001-charon-add-optional-source-and-remote-ove
 8bea05feac6f4e90c4973b2459864437  0002-vici-send-certificates-for-ike-sa-events.patch
 125c4e648f73b0dbdaa741ac13ed6d87  0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
 f65811bd1ae6e7f98cf9d76928a0aa03  0004-vici-support-asynchronous-initiation.patch
+b9f874287c35cce075b761087c28ab50  1000-support-gre-key-in-ikev1.patch
 85ebc1b6c6b9c0c6640d8136e97da8e1  strongswan.initd
 7962a720ebef6892d80a3cbdab72c204  charon.initd"
 sha256sums="a4a9bc8c4e42bdc4366a87a05a02bf9f425169a7ab0c6f4482d347e44acbf225  strongswan-5.3.2.tar.bz2
@@ -114,6 +116,7 @@ a472df28677d4f43a063926a65b52b317dfca0b74f8c6a2e3bf852b94fbf5f0f  0001-charon-ad
 c1cfe3d1e3345238e125a46a492f8dc0800aa3dc75aea060d54cdbab35fd60cb  0002-vici-send-certificates-for-ike-sa-events.patch
 4e08d4fe01717de0601411b4756141394ced2d3107adc47f2c2beac2f92a967e  0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
 42171ee35e7679fe3d4efb80fdb121b0a7ea8df5cf3395bbcccb97d56327027c  0004-vici-support-asynchronous-initiation.patch
+ec58de15c3856a2fd9ea003b7e78a7434dad54f9a4c54d499b09a6eef3761d18  1000-support-gre-key-in-ikev1.patch
 ad43d1ed2585d84e12ad1e67fbdfe93983c424c5c64b230d5027c0aae496c65f  strongswan.initd
 97b018796f0f15106b70694449cff36e8fc586292aab09ef83a05c0c13142e73  charon.initd"
 sha512sums="60b17645c00769d497f4cea2229b41a217c29fe1109b58be256a0d4a6ccf4765348b9eb89466539c2528756344c2fa969f25ea1cd8856d56c5d55aa78e632e68  strongswan-5.3.2.tar.bz2
@@ -121,5 +124,6 @@ sha512sums="60b17645c00769d497f4cea2229b41a217c29fe1109b58be256a0d4a6ccf4765348b
 ca6eec72f75f243234baa1b361ab6dba82a810d1efb01dbcfd16cd7ce104c3f18fb932c1f6f280a566bfcbe16bc67d7d55e024f72c9eef82a62fe78505293c5c  0002-vici-send-certificates-for-ike-sa-events.patch
 2e28af9043cab41f16c57f41ccb65b6591ec32d50a811bd393c4dcf7f0ffe81fac67679c41b716dfc74fca9ebedd178fe0b572b1c2cda3ccc685a0ad0d02f65a  0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
 39e4a9839b2f6f42f662620b20697c684b90949622f8cc21c393ca55ab40e669befd1d2055e0f0c799cf37733a37bbf4df2b9cebc984a45bb66ecba6fa0ef116  0004-vici-support-asynchronous-initiation.patch
+723aad9269ae7da54b1d551b290c80951c3b779737353fa845c00d190c9ef6c6bc406d8ed22254a27844985b7ffaa12b99acce91ec0b192caf639c81b06bf771  1000-support-gre-key-in-ikev1.patch
 b56008c07b804dacb3441d3802880058986ab7b314297fe485649a771861885b9232f9fd53b94faa3388a5e9330e2b38a86af5c04f3ff119199720043967ec64  strongswan.initd
 6f3abaaa8da0925f06cdd184fdf534518e40c49533dba427dbf31dbe88172e5626bdc9aadf798d791f82fbded08801c1f565d514e2c289e1f28448d0c2e72b79  charon.initd"