Add an ipsec.conf leftgroups2 parameter for the second authentication round

diff --git a/man/ipsec.conf.5.in b/man/ipsec.conf.5.in
index a51ae40cfc10cb3326d573b580bcc4a1503aae4b..1f88761bec70385b708f77d88b0fda0b02d65412 100644 (file)
--- a/man/ipsec.conf.5.in
+++ b/man/ipsec.conf.5.in
@@ -622,6 +622,12 @@ a comma separated list of group names. If the
 parameter is present then the peer must be a member of at least one
 of the groups defined by the parameter.
 .TP
+.BR leftgroups2 " = <group list>"
+Same as
+.B leftgroups,
+but for the second authentication round defined with
+.B leftauth2.
+.TP
 .BR lefthostaccess " = yes | " no
 inserts a pair of INPUT and OUTPUT iptables rules using the default
 \fBipsec _updown\fR script, thus allowing access to the host itself

diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index da0d2a74dc7d042678e2a768276ec002b6693245..8657c3b26351740d7c065f3cf9b157267dcc3e5b 100644 (file)
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -365,7 +365,7 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
 {
        identification_t *identity;
        certificate_t *certificate;
-       char *auth, *id, *pubkey, *cert, *ca;
+       char *auth, *id, *pubkey, *cert, *ca, *groups;
        stroke_end_t *end, *other_end;
        auth_cfg_t *cfg;
 
@@ -491,12 +491,13 @@ static auth_cfg_t *build_auth_cfg(private_stroke_config_t *this,
        }
 
        /* groups */
-       if (end->groups)
+       groups = primary ? end->groups : end->groups2;
+       if (groups)
        {
                enumerator_t *enumerator;
                char *group;
 
-               enumerator = enumerator_create_token(end->groups, ",", " ");
+               enumerator = enumerator_create_token(groups, ",", " ");
                while (enumerator->enumerate(enumerator, &group))
                {
                        cfg->add(cfg, AUTH_RULE_GROUP,

diff --git a/src/libcharon/plugins/stroke/stroke_socket.c b/src/libcharon/plugins/stroke/stroke_socket.c
index 698c45ed879f36fdfcb93b8e677d9dd8c6510409..6bf65cc7e69e02c7f26e205400adae88342dc186 100644 (file)
--- a/src/libcharon/plugins/stroke/stroke_socket.c
+++ b/src/libcharon/plugins/stroke/stroke_socket.c
@@ -181,6 +181,7 @@ static void pop_end(stroke_msg_t *msg, const char* label, stroke_end_t *end)
        pop_string(msg, &end->ca);
        pop_string(msg, &end->ca2);
        pop_string(msg, &end->groups);
+       pop_string(msg, &end->groups2);
        pop_string(msg, &end->cert_policy);
        pop_string(msg, &end->updown);
 
@@ -197,6 +198,7 @@ static void pop_end(stroke_msg_t *msg, const char* label, stroke_end_t *end)
        DBG2(DBG_CFG, "  %sca=%s", label, end->ca);
        DBG2(DBG_CFG, "  %sca2=%s", label, end->ca2);
        DBG2(DBG_CFG, "  %sgroups=%s", label, end->groups);
+       DBG2(DBG_CFG, "  %sgroups2=%s", label, end->groups2);
        DBG2(DBG_CFG, "  %supdown=%s", label, end->updown);
 }
 

diff --git a/src/starter/args.c b/src/starter/args.c
index 96b5e803dda6e931ba29b247b7e328b44ebc422d..640cc43d6cb242de1c5efd58114534fc8db61b70 100644 (file)
--- a/src/starter/args.c
+++ b/src/starter/args.c
@@ -203,6 +203,7 @@ static const token_info_t token_info[] =
        { ARG_STR,  offsetof(starter_end_t, ca), NULL                                  },
        { ARG_STR,  offsetof(starter_end_t, ca2), NULL                                 },
        { ARG_STR,  offsetof(starter_end_t, groups), NULL                              },
+       { ARG_STR,  offsetof(starter_end_t, groups2), NULL                             },
        { ARG_MISC, 0, NULL  /* KW_END_DEPRECATED */                                   },
 };
 

diff --git a/src/starter/confread.h b/src/starter/confread.h
index ea59d44b525cfbc47132b8bef3685c660164a18a..0c284229bad8c0a61619a1ae46ff2e560e0c3871 100644 (file)
--- a/src/starter/confread.h
+++ b/src/starter/confread.h
@@ -97,6 +97,7 @@ struct starter_end {
                char            *ca;
                char            *ca2;
                char            *groups;
+               char            *groups2;
                char            *cert_policy;
                char            *host;
                u_int           ikeport;

diff --git a/src/starter/keywords.h b/src/starter/keywords.h
index 9dac6a82083fcc814b5731214f3ca174aebe430b..bd9affe6c3cdf689b8b91681b058636ed9974952 100644 (file)
--- a/src/starter/keywords.h
+++ b/src/starter/keywords.h
@@ -114,6 +114,7 @@ typedef enum {
        KW_CA,
        KW_CA2,
        KW_GROUPS,
+       KW_GROUPS2,
        KW_END_DEPRECATED,
 
 #define KW_END_FIRST    KW_HOST
@@ -142,6 +143,7 @@ typedef enum {
        KW_LEFTCA,
        KW_LEFTCA2,
        KW_LEFTGROUPS,
+       KW_LEFTGROUPS2,
        KW_LEFT_DEPRECATED,
 
 #define KW_LEFT_FIRST   KW_LEFT
@@ -170,6 +172,7 @@ typedef enum {
        KW_RIGHTCA,
        KW_RIGHTCA2,
        KW_RIGHTGROUPS,
+       KW_RIGHTGROUPS2,
        KW_RIGHT_DEPRECATED,
 
 #define KW_RIGHT_FIRST  KW_RIGHT

diff --git a/src/starter/keywords.txt b/src/starter/keywords.txt
index 2716f21f148c7af0d0515e50ccb91a499b4fa735..30d89f9247b2f4284137f5e7f46008ea58e3b631 100644 (file)
--- a/src/starter/keywords.txt
+++ b/src/starter/keywords.txt
@@ -102,6 +102,7 @@ leftsendcert,      KW_LEFTSENDCERT
 leftca,            KW_LEFTCA
 leftca2,           KW_LEFTCA2
 leftgroups,        KW_LEFTGROUPS
+leftgroups2,       KW_LEFTGROUPS2
 right,             KW_RIGHT
 rightikeport,      KW_RIGHTIKEPORT
 rightsubnet,       KW_RIGHTSUBNET
@@ -125,6 +126,7 @@ rightsendcert,     KW_RIGHTSENDCERT
 rightca,           KW_RIGHTCA
 rightca2,          KW_RIGHTCA2
 rightgroups,       KW_RIGHTGROUPS
+rightgroups2,      KW_RIGHTGROUPS2
 also,              KW_ALSO
 auto,              KW_AUTO
 # deprecated/removed keywords

diff --git a/src/starter/starterstroke.c b/src/starter/starterstroke.c
index 26ac5dafc951cb2f6dc4bb84000e5d1f130454fc..0fbc5d24560c1efb72bc430e8615b0e455ffcbd4 100644 (file)
--- a/src/starter/starterstroke.c
+++ b/src/starter/starterstroke.c
@@ -127,6 +127,7 @@ static void starter_stroke_add_end(stroke_msg_t *msg, stroke_end_t *msg_end, sta
        msg_end->ca = push_string(msg, conn_end->ca);
        msg_end->ca2 = push_string(msg, conn_end->ca2);
        msg_end->groups = push_string(msg, conn_end->groups);
+       msg_end->groups2 = push_string(msg, conn_end->groups2);
        msg_end->updown = push_string(msg, conn_end->updown);
        if (conn_end->host)
        {

diff --git a/src/stroke/stroke_msg.h b/src/stroke/stroke_msg.h
index cc0819fdabcd210c6bc265160fd4d3473f8b464d..95de7d69b90921395ca520e60f4c45f8fc0ee8fa 100644 (file)
--- a/src/stroke/stroke_msg.h
+++ b/src/stroke/stroke_msg.h
@@ -152,6 +152,7 @@ struct stroke_end_t {
        char *ca;
        char *ca2;
        char *groups;
+       char *groups2;
        char *cert_policy;
        char *updown;
        char *address;