/home/build/quick-libreswan-2/programs/pluto/connections.c

Bug Summary

File:	programs/pluto/connections.c
Warning:	line 3891, column 17 Access to field 'host_pair' results in a dereference of a null pointer (loaded from variable 'c')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-redhat-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name connections.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fmath-errno -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/build/quick-libreswan-2/programs/pluto -resource-dir /usr/lib64/clang/13.0.0 -D TimeZoneOffset=timezone -D PIE -D NSS_IPSEC_PROFILE -D XFRM_LIFETIME_DEFAULT=30 -D USE_IKEv1 -D XFRM_SUPPORT -D USE_XFRM_INTERFACE -D USE_DNSSEC -D DEFAULT_DNSSEC_ROOTKEY_FILE="/var/lib/unbound/root.key" -D HAVE_LABELED_IPSEC -D HAVE_SECCOMP -D LIBCURL -D USE_LINUX_AUDIT -D HAVE_NM -D USE_PAM_AUTH -D USE_3DES -D USE_AES -D USE_CAMELLIA -D USE_CHACHA -D USE_DH31 -D USE_MD5 -D USE_SHA1 -D USE_SHA2 -D USE_PRF_AES_XCBC -D USE_NSS_KDF -D DEFAULT_RUNDIR="/run/pluto" -D IPSEC_CONF="/etc/ipsec.conf" -D IPSEC_CONFDDIR="/etc/ipsec.d" -D IPSEC_NSSDIR="/var/lib/ipsec/nss" -D IPSEC_CONFDIR="/etc" -D IPSEC_EXECDIR="/usr/local/libexec/ipsec" -D IPSEC_SBINDIR="/usr/local/sbin" -D IPSEC_VARDIR="/var" -D POLICYGROUPSDIR="/etc/ipsec.d/policies" -D IPSEC_SECRETS_FILE="/etc/ipsec.secrets" -D FORCE_PR_ASSERT -D USE_FORK=1 -D USE_VFORK=0 -D USE_DAEMON=0 -D USE_PTHREAD_SETSCHEDPRIO=1 -D GCC_LINT -D HAVE_LIBCAP_NG -I . -I ../../OBJ.linux.x86_64/programs/pluto -I ../../include -I /usr/include/nss3 -I /usr/include/nspr4 -I /home/build/quick-libreswan-2/programs/pluto/linux-copy -D HERE_FILENAME="programs/pluto/connections.c" -internal-isystem /usr/lib64/clang/13.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/bin/../lib/gcc/x86_64-redhat-linux/11/../../../../x86_64-redhat-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -std=gnu99 -fdebug-compilation-dir=/home/build/quick-libreswan-2/programs/pluto -ferror-limit 19 -stack-protector 3 -fgnuc-version=4.2.1 -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-01-01-205714-1273399-1 -x c /home/build/quick-libreswan-2/programs/pluto/connections.c
1/* information about connections between hosts and clients
*
* Copyright (C) 1998-2002,2010,2013,2018 D. Hugh Redelmeier <hugh@mimosa.com>
* Copyright (C) 2003-2008 Michael Richardson <mcr@xelerance.com>
* Copyright (C) 2003-2011 Paul Wouters <paul@xelerance.com>
* Copyright (C) 2008-2009 David McCullough <david_mccullough@securecomputing.com>
* Copyright (C) 2009-2011 Avesh Agarwal <avagarwa@redhat.com>
* Copyright (C) 2010 Bart Trojanowski <bart@jukie.net>
* Copyright (C) 2010 Shinichi Furuso <Shinichi.Furuso@jp.sony.com>
* Copyright (C) 2010,2013 Tuomo Soini <tis@foobar.fi>
* Copyright (C) 2012-2017 Paul Wouters <paul@libreswan.org>
* Copyright (C) 2012 Philippe Vouters <Philippe.Vouters@laposte.net>
* Copyright (C) 2012 Bram <bram-bcrafjna-erqzvar@spam.wizbit.be>
* Copyright (C) 2013 Kim B. Heino <b@bbbs.net>
* Copyright (C) 2013,2017 Antony Antony <antony@phenome.org>
* Copyright (C) 2013,2018 Matt Rogers <mrogers@redhat.com>
* Copyright (C) 2013 Florian Weimer <fweimer@redhat.com>
* Copyright (C) 2015-2020 Paul Wouters <pwouters@redhat.com>
* Copyright (C) 2016-2020 Andrew Cagney <cagney@gnu.org>
* Copyright (C) 2017 Mayank Totale <mtotale@gmail.com>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version.  See <https://www.gnu.org/licenses/gpl2.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
* for more details.
*/

33#include <string.h>
34#include <stdio.h>
35#include <stddef.h>
36#include <stdlib.h>
37#include <unistd.h>
38#include <netinet/in.h>
39#include <sys/socket.h>
40#include <sys/stat.h>
41#include <arpa/inet.h>
42#include <resolv.h>
43#include <errno(*__errno_location ()).h>
44#include <limits.h>

46#include "sysdep.h"
47#include "constants.h"
48#include "lswalloc.h"
49#include "lswconf.h"
50#include "id.h"
51#include "x509.h"
52#include "certs.h"
53#include "secrets.h"

55#include "defs.h"
56#include "connections.h" /* needs id.h */
57#include "connection_db.h"
58#include "pending.h"
59#include "foodgroups.h"
60#include "packet.h"
61#include "demux.h" /* needs packet.h */
62#include "state.h"
63#include "timer.h"
64#include "ipsec_doi.h" /* needs demux.h and state.h */
65#include "server.h"
66#include "kernel.h" /* needs connections.h */
67#include "log.h"
68#include "keys.h"
69#include "whack.h"
70#include "ike_alg.h"
71#include "kernel_alg.h"
72#include "plutoalg.h"
73#include "ikev1_xauth.h"
74#include "addresspool.h"
75#include "nat_traversal.h"
76#include "pluto_x509.h"
77#include "nss_cert_verify.h" /* for cert_VerifySubjectAltName() */
78#include "nss_cert_load.h"
79#include "ikev2.h"
80#include "virtual_ip.h"	/* needs connections.h */
81#include "host_pair.h"
82#include "lswfips.h"
83#include "crypto.h"
84#include "kernel_xfrm.h"
85#include "ip_address.h"
86#include "ip_info.h"
87#include "keyhi.h" /* for SECKEY_DestroyPublicKey */
88#include "state_db.h"
89# include "kernel_xfrm_interface.h"
90#include "iface.h"
91#include "ip_selector.h"
92#include "labeled_ipsec.h"		/* for vet_seclabel() */
93#include "orient.h"

95#define MINIMUM_IPSEC_SA_RANDOM_MARK65536 65536
96static uint32_t global_marks = MINIMUM_IPSEC_SA_RANDOM_MARK65536;

98static bool_Bool idr_wildmatch(const struct end *this, const struct id *b, struct logger *logger);

100/*
* Find a connection by name.
*
* no_inst: don't accept a CK_INSTANCE.
*/

106struct connection *conn_by_name(const char *nm, bool_Bool no_inst)
107{
dbg("FOR_EACH_CONNECTION_... in %s", __func__){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("FOR_EACH_CONNECTION_... in %s", __func__); } };
struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 109, }; &here;
 }), .c = NULL((void*)0), };
while (new2old_connection(&cq)) {
struct connection *c = cq.c;
if (no_inst && c->kind == CK_INSTANCE) {
	continue;
}
if (!streq(c->name, nm)(strcmp((c->name), (nm)) == 0)) {
	continue;
}
return c;
}
return NULL((void*)0);
121}

123void release_connection(struct connection *c, bool_Bool relations)
124{
pexpect(c->kind != CK_INSTANCE)({ _Bool assertion__ = c->kind != CK_INSTANCE; if (!assertion__
) { where_t here_ = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 125
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_pexpect(logger_, here_, "%s", "c->kind != CK_INSTANCE"
); } assertion__; });
flush_pending_by_connection(c);
delete_states_by_connection(c, relations);
unroute_connection(c);
129}

131/* Delete a connection */
132static void delete_end(struct end *e)
133{
free_id_content(&e->id);

if (e->cert.nss_cert != NULL((void*)0))
CERT_DestroyCertificate(e->cert.nss_cert);

free_chunk_content(&e->ca);
pfreeany(e->updown){ typeof(e->updown) *pp_ = &(e->updown); if (*pp_ !=
 ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
pfreeany(e->host_addr_name){ typeof(e->host_addr_name) *pp_ = &(e->host_addr_name
); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); }
 };
pfreeany(e->xauth_password){ typeof(e->xauth_password) *pp_ = &(e->xauth_password
); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); }
 };
pfreeany(e->xauth_username){ typeof(e->xauth_username) *pp_ = &(e->xauth_username
); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); }
 };
pfreeany(e->ckaid){ typeof(e->ckaid) *pp_ = &(e->ckaid); if (*pp_ != (
(void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
free_chunk_content(&e->sec_label);
146}

148static void delete_sr(struct spd_route *sr)
149{
delete_end(&sr->this);
delete_end(&sr->that);
152}

154/*
* delete_connection -- removes a connection by pointer
*
* @c - the connection pointer
* @relations - whether to delete any instances as well.
* @connection_valid - apply sanity checks
*
*/

163static void discard_connection(struct connection **cp, bool_Bool connection_valid);

165void delete_connection(struct connection **cp, bool_Bool relations)
166{
struct connection *c = *cp;
*cp = NULL((void*)0);

/*
* Must be careful to avoid circularity:
* we mark c as going away so it won't get deleted recursively.
*/
passert(c->kind != CK_GOING_AWAY)({ _Bool assertion__ = c->kind != CK_GOING_AWAY; if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 174
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "c->kind != CK_GOING_AWAY"
); } (void) 1; });
if (c->kind == CK_INSTANCE) {
if ((c->policy & POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX))) == LEMPTY((lset_t)0)) {
	address_buf b;
	llog(RC_LOG, c->logger,
	     "deleting connection instance with peer %s {isakmp=#%lu/ipsec=#%lu}",
	     str_address_sensitive(&c->spd.that.host_addr, &b),
	     c->newest_ike_sa, c->newest_ipsec_sa);
}
c->kind = CK_GOING_AWAY;
if (c->pool != NULL((void*)0)) {
	free_that_address_lease(c);
}
}
release_connection(c, relations);
discard_connection(&c, true1/*connection_valid*/);
190}

192static void discard_connection(struct connection **cp, bool_Bool connection_valid)
193{
struct connection *c = *cp;
*cp = NULL((void*)0);

if (c->kind == CK_GROUP)
delete_group(c);

if (c->pool != NULL((void*)0))
unreference_addresspool(c);

if (IS_XFRMI1 && c->xfrmi != NULL((void*)0))
unreference_xfrmi(c);

struct logger *connection_logger = clone_logger(c->logger, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 206, }; &here;
 }));

/* find and delete c from the host pair list */
host_pair_remove_connection(c, connection_valid);

flush_revival(c);

pfreeany(c->name){ typeof(c->name) *pp_ = &(c->name); if (*pp_ != ((
void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
pfreeany(c->foodgroup){ typeof(c->foodgroup) *pp_ = &(c->foodgroup); if (
*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
pfreeany(c->connalias){ typeof(c->connalias) *pp_ = &(c->connalias); if (
*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
pfreeany(c->vti_iface){ typeof(c->vti_iface) *pp_ = &(c->vti_iface); if (
*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
pfreeany(c->modecfg_dns){ typeof(c->modecfg_dns) *pp_ = &(c->modecfg_dns); if
 (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
pfreeany(c->modecfg_domains){ typeof(c->modecfg_domains) *pp_ = &(c->modecfg_domains
); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); }
 };
pfreeany(c->modecfg_banner){ typeof(c->modecfg_banner) *pp_ = &(c->modecfg_banner
); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); }
 };
pfreeany(c->dnshostname){ typeof(c->dnshostname) *pp_ = &(c->dnshostname); if
 (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
pfreeany(c->redirect_to){ typeof(c->redirect_to) *pp_ = &(c->redirect_to); if
 (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); } };
pfreeany(c->accept_redirect_to){ typeof(c->accept_redirect_to) *pp_ = &(c->accept_redirect_to
); if (*pp_ != ((void*)0)) { pfree(*pp_); *pp_ = ((void*)0); }
 };
free_logger(&c->logger, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 223, }; &here;
 }));

/* deal with top spd_route and then the rest */

passert(c->spd.this.virt == NULL)({ _Bool assertion__ = c->spd.this.virt == ((void*)0); if (
!assertion__) { where_t here = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 227, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "c->spd.this.virt == ((void*)0)"
); } (void) 1; });

virtual_ip_delref(&c->spd.this.virt, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 229, }; &here;
 }));
virtual_ip_delref(&c->spd.that.virt, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 230, }; &here;
 }));

struct spd_route *sr = c->spd.spd_next;

delete_sr(&c->spd);

while (sr != NULL((void*)0)) {
struct spd_route *next_sr = sr->spd_next;

passert(sr->this.virt == NULL)({ _Bool assertion__ = sr->this.virt == ((void*)0); if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 239
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "sr->this.virt == ((void*)0)"
); } (void) 1; });
passert(sr->that.virt == NULL)({ _Bool assertion__ = sr->that.virt == ((void*)0); if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 240
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "sr->that.virt == ((void*)0)"
); } (void) 1; });
delete_sr(sr);
/* ??? should we: pfree(sr); */
sr = next_sr;
}

proposals_delref(&c->ike_proposals.p);
proposals_delref(&c->child_proposals.p);

free_ikev2_proposals(&c->v2_ike_proposals);
free_ikev2_proposals(&c->v2_ike_auth_child_proposals);
free_ikev2_proposals(&c->v2_create_child_proposals);
c->v2_create_child_proposals_default_dh = NULL((void*)0); /* static pointer */

remove_connection_from_db(c);

if (c->root_config != NULL((void*)0)) {
passert(co_serial_is_unset(c->serial_from))({ _Bool assertion__ = ((c->serial_from) == UNSET_CO_SERIAL
); if (!assertion__) { where_t here = ({ static const struct where
 here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 257, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "((c->serial_from) == UNSET_CO_SERIAL)"
); } (void) 1; });
free_chunk_content(&c->root_config->sec_label);
pfree(c->root_config);
}

pfree(c);
free_logger(&connection_logger, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 263, }; &here;
 }));
264}

266int foreach_connection_by_alias(const char *alias,
		int (*f)(struct connection *c,
			 void *arg, struct logger *logger),
		void *arg, struct logger *logger)
270{
int count = 0;

struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 273, }; &here;
 }), .c = NULL((void*)0), };
while (new2old_connection(&cq)) {
struct connection *p = cq.c;

if (lsw_alias_cmp(alias, p->connalias))
	count += (*f)(p, arg, logger);
}
return count;
281}

283/*
* return -1 if nothing was found at all; else total from f()
*/

287int foreach_concrete_connection_by_name(const char *name,
			int (*f)(struct connection *c,
				 void *arg, struct logger *logger),
			void *arg, struct logger *logger)
291{
/*
* Find the first non-CK_INSTANCE connection matching NAME;
* that is CK_GROUP, CK_TEMPLATE, CK_PERMENANT, CK_GOING_AWAY.
*
* If this search succeeds, then the function also succeeds.
*
* But here's the kicker:
*
* The original conn_by_name() call also moved the connection
* to the front of the connections list.  For CK_GROUP and
* CK_TEMPLATE this put any CK_INSTANCES after it in the list
* so continuing the search would find them (without this the
* list is new-to-old so instances would have been skipped).
*
* This code achieves the same effect by searching old2new.
*/
struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 308, }; &here;
 }), .c = NULL((void*)0), };
bool_Bool found = false0;
while (old2new_connection(&cq)) {
struct connection *c = cq.c;
if (c->kind == CK_INSTANCE) {
	continue;
}
if (!streq(c->name, name)(strcmp((c->name), (name)) == 0)) {
	continue;
}
found = true1;
break;
}
if (!found) {
/* nothing matched at all */
return -1;
}
/*
* Now continue with the connection list looking for
* CK_PERMENANT and/or CK_INSTANCE connections with the name.
*/
int total = 0;
do {
struct connection *c = cq.c;
if (c->kind >= CK_PERMANENT &&
    !NEVER_NEGOTIATE(c->policy)(((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) &&
    streq(c->name, name)(strcmp((c->name), (name)) == 0)) {
	total += f(c, arg, logger);
}
} while (old2new_connection(&cq));
return total;
339}

341static int delete_connection_wrap(struct connection *c, void *arg UNUSED__attribute__ ((unused)), struct logger *logger)
342{
/* XXX: something better? */
close_any(&c->logger->global_whackfd)close_any_fd((&c->logger->global_whackfd), ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 344, }; &here; }));
c->logger->global_whackfd = fd_dup(logger->global_whackfd, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 345, }; &here;
 })); /* freed by discard_conection() */

delete_connection(&c, false0);
return 1;
349}

351/* Delete connections with the specified name */
352void delete_connections_by_name(const char *name, bool_Bool strict, struct logger *logger)
353{
passert(name != NULL)({ _Bool assertion__ = name != ((void*)0); if (!assertion__) {
 where_t here = ({ static const struct where here = { .func =
 __func__, .file = "programs/pluto/connections.c", .line = 354
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "name != ((void*)0)"); } (
void) 1; });
struct connection *c = conn_by_name(name, strict);
if (c != NULL((void*)0)) {
do {
	/* XXX: something better? */
	delete_connection_wrap(c, NULL((void*)0), logger);
	c = conn_by_name(name, false0/*!strict*/);
} while (c != NULL((void*)0));
} else {
foreach_connection_by_alias(name, delete_connection_wrap, NULL((void*)0), logger);
}
365}

367void delete_every_connection(void)
368{
struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 369, }; &here;
 }), .c = NULL((void*)0), };
/* Delete instances before templates. */
while (new2old_connection(&cq)) {
struct connection *c = cq.c;
delete_connection(&c, true1);
}
375}

377ip_port end_host_port(const struct end *end, const struct end *other)
378{
unsigned port;
if (end->config->host.ikeport != 0) {
/*
 * The END's IKEPORT was specified in the config file.
 * Use that.
 */
port = end->config->host.ikeport;
} else if (other->config->host.ikeport != 0) {
/*
 * The other end's IKEPORT was specified in the config
 * file.  Since specifying an IKEPORT implies ESP
 * encapsulation (i.e. IKE packets must include the
 * ESP=0 prefix), send packets from the encapsulating
 * NAT_IKE_UDP_PORT.
 */
port = NAT_IKE_UDP_PORT4500;
} else if (other->host_encap) {
/*
 * See above.  Presumably an instance which previously
 * had a natted port and is being revived.
 */
port = NAT_IKE_UDP_PORT4500;
} else {
port = IKE_UDP_PORT500;
}
return ip_hport(port);
405}

407void update_ends_from_this_host_addr(struct end *this, struct end *that)
408{
const struct ip_info *afi = address_type(&this->host_addr);
if (afi == NULL((void*)0)) {
dbg("%s.host_addr's address family is unknown; skipping default_end()",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s.host_addr's address family is unknown; skipping default_end()"
, this->config->leftright); } }
    this->config->leftright){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s.host_addr's address family is unknown; skipping default_end()"
, this->config->leftright); } };
return;
}

if (address_is_any(this->host_addr)) {
dbg("%s.host_addr's is %%any; skipping default_end()",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s.host_addr's is %%any; skipping default_end()"
, this->config->leftright); } }
    this->config->leftright){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s.host_addr's is %%any; skipping default_end()"
, this->config->leftright); } };
return;
}

dbg("updating connection from %s.host_addr", this->config->leftright){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("updating connection from %s.host_addr", this->
config->leftright); } };

/* Default ID to IP (but only if not NO_IP -- WildCard) */
if (this->id.kind == ID_NONE && address_is_specified(this->host_addr)) {
this->id.kind = afi->id_ip_addr;
this->id.ip_addr = this->host_addr;
this->has_id_wildcards = false0;
}

/* propagate this HOST_ADDR to that. */
if (address_is_unset(&that->host_nexthop) ||
   address_is_any(that->host_nexthop)) {
that->host_nexthop = this->host_addr;
address_buf ab;
dbg("%s host_nexthop %s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s host_nexthop %s", that->config->leftright
, str_address(&that->host_nexthop, &ab)); } }
    that->config->leftright, str_address(&that->host_nexthop, &ab)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s host_nexthop %s", that->config->leftright
, str_address(&that->host_nexthop, &ab)); } };
}

/*
* If THAT has an IKEPORT (which means messages are ESP=0
* prefixed), then THIS must send from either IKEPORT or the
* NAT port (and also ESP=0 prefix messages).
*/
unsigned host_port = hport(end_host_port(this, that));
dbg("%s() %s.host_port: %u->%u", __func__, this->config->leftright,{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s() %s.host_port: %u->%u", __func__, this
->config->leftright, this->host_port, host_port); } }
   this->host_port, host_port){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s() %s.host_port: %u->%u", __func__, this
->config->leftright, this->host_port, host_port); } };
this->host_port = host_port;

/* Default client to subnet containing only self */
if (!this->has_client) {
/*
 * Default client to a subnet containing only self.
 *
 * For instance, the config file omitted subnet, but
 * specified protoport; merge that.
 */
this->client = selector_from_address_protoport(this->host_addr,
					       this->config->client.protoport);
}

if (this->sendcert == 0) {
/* uninitialized (ugly hack) */
this->sendcert = CERT_SENDIFASKED;
}
466}

468/*
* Format the topology of a connection end, leaving out defaults.
* Used to construct strings of the form:
*
*      LOCAL_END ...END_REMOTE
*
* where END_REMOTE is roughly formatted as the mirror image of
* LOCAL_END.  IS_LEFT (confusing name given connection left/right)
* determines if the LHS or RHS string is being emitted..  LOCAL_END's
* longest string is:
*
*    client === host : port [ host_id ] --- HOP
*
* Note: if that == NULL, skip nexthop Returns strlen of formatted
* result (length excludes NUL at end).
*/

485static void jam_end_host(struct jambuf *buf, const struct end *this, lset_t policy)
486{
/* HOST */
bool_Bool dohost_name;
bool_Bool dohost_port;
if (address_is_unset(&this->host_addr) ||
   address_is_any(this->host_addr)) {
dohost_port = false0;
if (this->host_type == KH_IPHOSTNAME) {
	dohost_name = true1;
	jam_string(buf, "%dns");
} else {
	dohost_name = false0;
	switch (policy & (POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX)) | POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX)))) {
	case POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX)):
		jam_string(buf, "%group");
		break;
	case POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX)):
		jam_string(buf, "%opportunistic");
		break;
	case POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX)) | POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX)):
		jam_string(buf, "%opportunisticgroup");
		break;
	default:
		jam_string(buf, "%any");
		break;
	}
}
} else if (is_virtual_end(this)) {
dohost_name = false0;
dohost_port = false0;
jam_string(buf, "%virtual");
} else {
dohost_name = true1;
dohost_port = true1;
jam_address_sensitive(buf, &this->host_addr);
}

/* <NAME> */
if (dohost_name && this->host_addr_name != NULL((void*)0)) {
jam(buf, "<%s>", this->host_addr_name);
}

/*
* XXX: only print anomalies: when the host address is
* "non-zero", a non-IKE_UDP_PORT; and when zero, any non-zero
* port.
*/
if (dohost_port ? (this->config->host.ikeport != 0 || this->host_port != IKE_UDP_PORT500) :
   this->host_port != 0) {
/*
 * XXX: Part of the problem is that code is stomping
 * on the HOST_ADDR's port setting it to the CLIENT's
 * port.
 *
 * XXX: Format this as ADDRESS:PORT<name> not
 * ADDRESS<name>:PORT?  Or always emit the PORT?
 */
jam(buf, ":%u", this->host_port);
}
545}

547static void jam_end_client(struct jambuf *buf, const struct end *this,
	   lset_t policy, bool_Bool is_left)
549{
/* [CLIENT===] or [===CLIENT] */
if (!this->has_client) {
return;
}
if (selector_is_unset(&this->client)) {
return;
}
bool_Bool boring = (selector_is_all(this->client) &&
       (policy & (POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX)) | POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX)))));

if (!boring && !is_left) {
jam_string(buf, "===");
}

if (boring) {
/* boring case */
} else if (is_virtual_end(this)) {
if (is_virtual_vhost(this))
	jam_string(buf, "vhost:?");
else
	jam_string(buf,  "vnet:?");
} else if (selector_is_zero(this->client)) {
jam_string(buf, "?");
} else {
jam_selector_subnet(buf, &this->client);
}

if (!boring && is_left) {
jam_string(buf, "===");
}
580}

582static void jam_end_protoport(struct jambuf *buf, const struct end *this)
583{
/* payload portocol and port */
if (this->has_port_wildcard) {
jam(buf, ":%u/%%any", this->protocol);
} else if (this->port || this->protocol) {
jam(buf, ":%u/%u", this->protocol, this->port);
}
590}

592static void jam_end_id(struct jambuf *buf, const struct end *this)
593{
/* id, if different from host */
bool_Bool open_paren = false0;
if (!(this->id.kind == ID_NONE ||
     (id_is_ipaddr(&this->id)((&this->id)->kind == ID_IPV4_ADDR || (&this->
id)->kind == ID_IPV6_ADDR) &&
      sameaddr(&this->id.ip_addr, &this->host_addr)))) {
open_paren = true1;
jam_string(buf, "[");
jam_id_bytes(buf, &this->id, jam_sanitized_bytes);
}

if (this->modecfg_server || this->modecfg_client ||
   this->xauth_server || this->xauth_client ||
   this->sendcert != cert_defaultcertpolicyCERT_ALWAYSSEND) {

if (open_paren) {
	jam_string(buf, ",");
} else {
	open_paren = true1;
	jam_string(buf, "[");
}

if (this->modecfg_server)
	jam_string(buf, "MS");
if (this->modecfg_client)
	jam_string(buf, "+MC");
if (this->cat)
	jam_string(buf, "+CAT");
if (this->xauth_server)
	jam_string(buf, "+XS");
if (this->xauth_client)
	jam_string(buf, "+XC");

switch (this->sendcert) {
case CERT_NEVERSEND:
	jam(buf, "+S-C");
	break;
case CERT_SENDIFASKED:
	jam(buf, "+S?C");
	break;
case CERT_ALWAYSSEND:
	jam(buf, "+S=C");
	break;
default:
	jam(buf, "+UNKNOWN");
}
}

if (open_paren) {
jam_string(buf, "]");
}
644}

646static void jam_end_nexthop(struct jambuf *buf, const struct end *this,
	    const struct end *that, bool_Bool filter_rnh, bool_Bool is_left)
648{
/* [---hop] */
if (that != NULL((void*)0) &&
   !filter_rnh &&
   !sameaddr(&this->host_nexthop, &that->host_addr)) {
if (is_left) {
	jam_string(buf, "---");
}
jam_address(buf, &this->host_nexthop);
if (!is_left) {
	jam_string(buf, "---");
}
}
661}

663void jam_end(struct jambuf *buf, const struct end *this, const struct end *that,
    bool_Bool is_left, lset_t policy, bool_Bool filter_rnh)
665{
if (is_left) {
/* CLIENT=== */
jam_end_client(buf, this, policy, is_left);
/* HOST */
jam_end_host(buf, this, policy);
/* [ID+OPTS] */
jam_end_id(buf, this);
/* /PROTOCOL:PORT */
jam_end_protoport(buf, this);
/* ---NEXTHOP */
jam_end_nexthop(buf, this, that, filter_rnh, is_left);
} else {
/* HOPNEXT--- */
jam_end_nexthop(buf, this, that, filter_rnh, is_left);
/* HOST */
jam_end_host(buf, this, policy);
/* [ID+OPTS] */
jam_end_id(buf, this);
/* /PROTOCOL:PORT */
jam_end_protoport(buf, this);
/* ===CLIENT */
jam_end_client(buf, this, policy, is_left);
}
689}

691/*
* format topology of a connection.
* Two symmetric ends separated by ...
*/

696#define END_BUF(sizeof(subnet_buf) + sizeof(address_buf) + sizeof(id_buf) + sizeof
(subnet_buf) + 10) (sizeof(subnet_buf) + sizeof(address_buf) + sizeof(id_buf) + sizeof(subnet_buf) + 10)
697#define CONN_BUF_LEN(2 * ((sizeof(subnet_buf) + sizeof(address_buf) + sizeof(id_buf
) + sizeof(subnet_buf) + 10) - 1) + 4)    (2 * (END_BUF(sizeof(subnet_buf) + sizeof(address_buf) + sizeof(id_buf) + sizeof
(subnet_buf) + 10) - 1) + 4)

699static char *format_connection(char *buf, size_t buf_len,
	       const struct connection *c,
	       const struct spd_route *sr)
702{
struct jambuf b = array_as_jambuf(buf, buf_len);
jam_end(&b, &sr->this, &sr->that, /*left?*/true1, LEMPTY((lset_t)0), false0);
jam(&b, "...");
jam_end(&b, &sr->that, &sr->this, /*left?*/false0, c->policy, oriented(c));
return buf;
708}

710/* spd_route's with end's get copied in xauth.c */
711void unshare_connection_end(struct end *e)
712{
e->id = clone_id(&e->id, "unshare connection id");

if (e->cert.nss_cert != NULL((void*)0)) {
e->cert.nss_cert = CERT_DupCertificate(e->cert.nss_cert);
passert(e->cert.nss_cert != NULL)({ _Bool assertion__ = e->cert.nss_cert != ((void*)0); if (
!assertion__) { where_t here = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 717, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "e->cert.nss_cert != ((void*)0)"
); } (void) 1; });
}

e->ca = clone_hunk(e->ca, "ca string")({ typeof(e->ca) hunk_ = e->ca; clone_bytes_as_chunk(hunk_
.ptr, hunk_.len, "ca string"); });
e->updown = clone_str(e->updown, "updown")((e->updown) == ((void*)0) ? ((void*)0) : clone_bytes((e->
updown), strlen((e->updown)) + 1, ("updown")));
e->xauth_username = clone_str(e->xauth_username, "xauth username")((e->xauth_username) == ((void*)0) ? ((void*)0) : clone_bytes
((e->xauth_username), strlen((e->xauth_username)) + 1, (
"xauth username")));
e->xauth_password = clone_str(e->xauth_password, "xauth password")((e->xauth_password) == ((void*)0) ? ((void*)0) : clone_bytes
((e->xauth_password), strlen((e->xauth_password)) + 1, (
"xauth password")));
e->host_addr_name = clone_str(e->host_addr_name, "host ip")((e->host_addr_name) == ((void*)0) ? ((void*)0) : clone_bytes
((e->host_addr_name), strlen((e->host_addr_name)) + 1, (
"host ip")));
e->virt = virtual_ip_addref(e->virt, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 725, }; &here;
 }));
if (e->ckaid != NULL((void*)0)) {
e->ckaid = clone_thing(*e->ckaid, "ckaid")((__typeof__(&(*e->ckaid))) clone_bytes((const void *)
&(*e->ckaid), sizeof(*e->ckaid), ("ckaid")));
}
pexpect(e->sec_label.ptr == NULL)({ _Bool assertion__ = e->sec_label.ptr == ((void*)0); if (
!assertion__) { where_t here_ = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 729, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_pexpect(logger_, here_, "%s", "e->sec_label.ptr == ((void*)0)"
); } assertion__; });
730}

732/*
* unshare_connection: after a struct connection has been copied,
* duplicate anything it references so that unshareable resources
* are no longer shared.  Typically strings, but some other things too.
*
* Think of this as converting a shallow copy to a deep copy
*
* XXX: unshare_connection() and the shallow clone should be merged
* into a routine that allocates a new connection and then explicitly
* copy over the data.  Cloning pointers and then trying to fix them
* up after the event is a guaranteed way to create use-after-free
* problems.
*/
745static void unshare_connection(struct connection *c)
746{
c->root_config = NULL((void*)0);

c->foodgroup = clone_str(c->foodgroup, "connection foodgroup")((c->foodgroup) == ((void*)0) ? ((void*)0) : clone_bytes((
c->foodgroup), strlen((c->foodgroup)) + 1, ("connection foodgroup"
)));

c->modecfg_dns = clone_str(c->modecfg_dns,((c->modecfg_dns) == ((void*)0) ? ((void*)0) : clone_bytes
((c->modecfg_dns), strlen((c->modecfg_dns)) + 1, ("connection modecfg_dns"
)))
		"connection modecfg_dns")((c->modecfg_dns) == ((void*)0) ? ((void*)0) : clone_bytes
((c->modecfg_dns), strlen((c->modecfg_dns)) + 1, ("connection modecfg_dns"
)));
c->modecfg_domains = clone_str(c->modecfg_domains,((c->modecfg_domains) == ((void*)0) ? ((void*)0) : clone_bytes
((c->modecfg_domains), strlen((c->modecfg_domains)) + 1
, ("connection modecfg_domains")))
		"connection modecfg_domains")((c->modecfg_domains) == ((void*)0) ? ((void*)0) : clone_bytes
((c->modecfg_domains), strlen((c->modecfg_domains)) + 1
, ("connection modecfg_domains")));
c->modecfg_banner = clone_str(c->modecfg_banner,((c->modecfg_banner) == ((void*)0) ? ((void*)0) : clone_bytes
((c->modecfg_banner), strlen((c->modecfg_banner)) + 1, (
"connection modecfg_banner")))
		"connection modecfg_banner")((c->modecfg_banner) == ((void*)0) ? ((void*)0) : clone_bytes
((c->modecfg_banner), strlen((c->modecfg_banner)) + 1, (
"connection modecfg_banner")));
c->dnshostname = clone_str(c->dnshostname, "connection dnshostname")((c->dnshostname) == ((void*)0) ? ((void*)0) : clone_bytes
((c->dnshostname), strlen((c->dnshostname)) + 1, ("connection dnshostname"
)));

/* duplicate any alias, adding spaces to the beginning and end */
c->connalias = clone_str(c->connalias, "connection alias")((c->connalias) == ((void*)0) ? ((void*)0) : clone_bytes((
c->connalias), strlen((c->connalias)) + 1, ("connection alias"
)));

c->vti_iface = clone_str(c->vti_iface, "connection vti_iface")((c->vti_iface) == ((void*)0) ? ((void*)0) : clone_bytes((
c->vti_iface), strlen((c->vti_iface)) + 1, ("connection vti_iface"
)));

c->redirect_to = clone_str(c->redirect_to,\((c->redirect_to) == ((void*)0) ? ((void*)0) : clone_bytes
((c->redirect_to), strlen((c->redirect_to)) + 1, ("connection redirect_to"
)))
			"connection redirect_to")((c->redirect_to) == ((void*)0) ? ((void*)0) : clone_bytes
((c->redirect_to), strlen((c->redirect_to)) + 1, ("connection redirect_to"
)));
c->accept_redirect_to = clone_str(c->accept_redirect_to,\((c->accept_redirect_to) == ((void*)0) ? ((void*)0) : clone_bytes
((c->accept_redirect_to), strlen((c->accept_redirect_to
)) + 1, ("connection accept_redirect_to")))
			"connection accept_redirect_to")((c->accept_redirect_to) == ((void*)0) ? ((void*)0) : clone_bytes
((c->accept_redirect_to), strlen((c->accept_redirect_to
)) + 1, ("connection accept_redirect_to")));

for (struct spd_route *sr = &c->spd; sr != NULL((void*)0); sr = sr->spd_next) {
unshare_connection_end(&sr->this);
unshare_connection_end(&sr->that);
}

/* increment references to algo's, if any */
proposals_addref(&c->ike_proposals.p);
proposals_addref(&c->child_proposals.p);
c->v2_ike_proposals = NULL((void*)0); /* don't share IKE proposals */

if (c->pool !=  NULL((void*)0))
reference_addresspool(c);

if (IS_XFRMI1 && c->xfrmi != NULL((void*)0))
reference_xfrmi(c);
784}

786static int extract_end(struct connection *c,
       struct end *dst,
       struct config_end *config_end,
       const struct whack_end *src,
       struct end *other_end,
       struct logger *logger/*connection "..."*/)
792{
passert(dst->config == config_end)({ _Bool assertion__ = dst->config == config_end; if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 793
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "dst->config == config_end"
); } (void) 1; });
const char *leftright = dst->config->leftright;
bool_Bool same_ca = 0;

/*
* decode id, if any
*
* For %fromcert, the load_end_cert*() call will update it.
*/
if (src->id == NULL((void*)0)) {
dst->id.kind = ID_NONE;
} else {
/*
 * Cannot report errors due to low level nesting of functions,
 * since it will try literal IP string conversions first. But
 * atoid() will log real failures like illegal DNS chars already,
 * and for @string ID's all chars are valid without processing.
 */
atoid(src->id, &dst->id);
}

/* decode CA distinguished name, if any */
dst->ca = EMPTY_CHUNK((const chunk_t) { .ptr = ((void*)0), .len = 0 });
if (src->ca != NULL((void*)0)) {
if (streq(src->ca, "%same")(strcmp((src->ca), ("%same")) == 0)) {
	same_ca = 1;
} else if (!streq(src->ca, "%any")(strcmp((src->ca), ("%any")) == 0)) {
	err_t ugh;

	/* convert the CA into a DN blob */
	free_chunk_content(&dst->ca);
	ugh = atodn(src->ca, &dst->ca);
	if (ugh != NULL((void*)0)) {
		llog(RC_LOG, logger,
		     "bad %s CA string '%s': %s (ignored)",
		     leftright, src->ca, ugh);
	} else {
		/* now try converting it back; isn't failing this a bug? */
		ugh = parse_dn(dst->ca);
		if (ugh != NULL((void*)0)) {
			llog(RC_LOG, logger,
			     "error parsing %s CA converted to DN: %s",
			     leftright, ugh);
			DBG_dump_hunk(NULL, dst->ca){ typeof(dst->ca) hunk_ = dst->ca; DBG_dump(((void*)0),
 hunk_.ptr, hunk_.len); };
		}
	}

}
}

/*
* Try to find the cert / private key.
*
* XXX: Be lazy and simply warn about combinations such as
* cert+ckaid.
*
* Should this instead cross check?
*/
if (src->cert != NULL((void*)0)) {
if (src->ckaid != NULL((void*)0)) {
	llog(RC_LOG, logger,
		    "warning: ignoring %s ckaid '%s' and using %s certificate '%s'",
		    leftright, src->cert,
		    leftright, src->cert);
}
if (src->rsasigkey != NULL((void*)0)) {
	llog(RC_LOG, logger,
		    "warning: ignoring %s rsasigkey '%s' and using %s certificate '%s'",
		    leftright, src->cert,
		    leftright, src->cert);
}
CERTCertificate *cert = get_cert_by_nickname_from_nss(src->cert, logger);
if (cert == NULL((void*)0)) {
	llog(RC_FATAL, logger,
		    "failed to add connection: %s certificate '%s' not found in the NSS database",
		    leftright, src->cert);
	return -1; /* fatal */
}
diag_t diag = add_end_cert_and_preload_private_key(cert, dst,
						   same_ca/*preserve_ca*/,
						   logger);
if (diag != NULL((void*)0)) {
	llog_diag(RC_FATAL, logger, &diag, "failed to add connection: ");
	CERT_DestroyCertificate(cert);
	return -1;
}
} else if (src->rsasigkey != NULL((void*)0)) {
if (src->ckaid != NULL((void*)0)) {
	llog(RC_LOG, logger,
		    "warning: ignoring %s ckaid '%s' and using %s rsasigkey",
		    leftright, src->ckaid, leftright);
}
/*
 * XXX: hack: whack will load the rsasigkey in a
 * second message, this code just extracts the ckaid.
 */
const struct pubkey_type *type = &pubkey_type_rsa;
/* XXX: lifted from starter_whack_add_pubkey() */
char err_buf[TTODATAV_BUF40];
char keyspace[1024 + 4];
size_t keylen;

/* ??? this value of err isn't used */
err_t err = ttodatav(src->rsasigkey, 0, 0,
		     keyspace, sizeof(keyspace), &keylen,
		     err_buf, sizeof(err_buf), 0);
union pubkey_content pkc;
keyid_t pubkey;
ckaid_t ckaid;
size_t size;
err = type->unpack_pubkey_content(&pkc, &pubkey, &ckaid, &size,
				  chunk2(keyspace, keylen));
if (err != NULL((void*)0)) {
	llog(RC_FATAL, logger,
		    "failed to add connection: %s raw public key invalid: %s",
		    leftright, err);
	return -1;
}
ckaid_buf ckb;
dbg("saving %s CKAID %s extracted from raw %s public key",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("saving %s CKAID %s extracted from raw %s public key"
, leftright, str_ckaid(&ckaid, &ckb), type->name);
 } }
    leftright, str_ckaid(&ckaid, &ckb), type->name){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("saving %s CKAID %s extracted from raw %s public key"
, leftright, str_ckaid(&ckaid, &ckb), type->name);
 } };
dst->ckaid = clone_const_thing(ckaid, "raw pubkey's ckaid")clone_bytes((const void *)&(ckaid), sizeof(ckaid), ("raw pubkey's ckaid"
));
type->free_pubkey_content(&pkc);
/* try to pre-load the private key */
bool_Bool load_needed;
err = preload_private_key_by_ckaid(&ckaid, &load_needed, logger);
if (err != NULL((void*)0)) {
	ckaid_buf ckb;
	dbg("no private key matching %s CKAID %s: %s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no private key matching %s CKAID %s: %s", leftright
, str_ckaid(dst->ckaid, &ckb), err); } }
	    leftright, str_ckaid(dst->ckaid, &ckb), err){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no private key matching %s CKAID %s: %s", leftright
, str_ckaid(dst->ckaid, &ckb), err); } };
} else if (load_needed) {
	ckaid_buf ckb;
	llog(RC_LOG|LOG_STREAM/*not-whack-for-now*/, logger,
		    "loaded private key matching %s CKAID %s",
		    leftright, str_ckaid(dst->ckaid, &ckb));
}
} else if (src->ckaid != NULL((void*)0)) {
ckaid_t ckaid;
err_t err = string_to_ckaid(src->ckaid, &ckaid);
if (err != NULL((void*)0)) {
	/* should have been rejected by whack? */
	/* XXX: don't trust whack */
	llog(RC_FATAL, logger,
		    "failed to add connection: %s CKAID '%s' invalid: %s",
		    leftright, src->ckaid, err);
	return -1; /* fatal */
}
/*
 * Always save the CKAID so lazy load of the private
 * key will work.
 */
dst->ckaid = clone_thing(ckaid, "end ckaid")((__typeof__(&(ckaid))) clone_bytes((const void *)&(ckaid
), sizeof(ckaid), ("end ckaid")));
/*
 * See if there's a certificate matching the CKAID, if
 * not assume things will later find the private key.
 */
CERTCertificate *cert = get_cert_by_ckaid_from_nss(&ckaid, logger);
if (cert != NULL((void*)0)) {
	diag_t diag = add_end_cert_and_preload_private_key(cert, dst,
							   same_ca/*preserve_ca*/,
							   logger);
	if (diag != NULL((void*)0)) {
		llog_diag(RC_FATAL, logger, &diag, "failed to add connection: ");
		CERT_DestroyCertificate(cert);
		return -1;
	}
} else {
	dbg("%s CKAID '%s' did not match a certificate in the NSS database",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s CKAID '%s' did not match a certificate in the NSS database"
, leftright, src->ckaid); } }
	    leftright, src->ckaid){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s CKAID '%s' did not match a certificate in the NSS database"
, leftright, src->ckaid); } };
	/* try to pre-load the private key */
	bool_Bool load_needed;
	err_t err = preload_private_key_by_ckaid(&ckaid, &load_needed, logger);
	if (err != NULL((void*)0)) {
		ckaid_buf ckb;
		dbg("no private key matching %s CKAID %s: %s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no private key matching %s CKAID %s: %s", leftright
, str_ckaid(dst->ckaid, &ckb), err); } }
		    leftright, str_ckaid(dst->ckaid, &ckb), err){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no private key matching %s CKAID %s: %s", leftright
, str_ckaid(dst->ckaid, &ckb), err); } };
	} else {
		ckaid_buf ckb;
		llog(RC_LOG|LOG_STREAM/*not-whack-for-now*/, logger,
			    "loaded private key matching %s CKAID %s",
			    leftright, str_ckaid(dst->ckaid, &ckb));
	}
}
}

/* does id have wildcards? */
dst->has_id_wildcards = id_count_wildcards(&dst->id) > 0;

/* the rest is simple copying of corresponding fields */
dst->host_type = src->host_type;
dst->host_addr = src->host_addr;
dst->host_addr_name = clone_str(src->host_addr_name, "host ip")((src->host_addr_name) == ((void*)0) ? ((void*)0) : clone_bytes
((src->host_addr_name), strlen((src->host_addr_name)) +
 1, ("host ip")));
dst->host_nexthop = src->host_nexthop;
dst->host_srcip = src->host_srcip;
dst->host_vtiip = src->host_vtiip;
dst->ifaceip = src->ifaceip;
dst->cat = src->cat;
dst->pool_range = src->pool_range;

dst->xauth_server = src->xauth_server;
dst->xauth_client = src->xauth_client;
dst->xauth_username = clone_str(src->xauth_username, "xauth username")((src->xauth_username) == ((void*)0) ? ((void*)0) : clone_bytes
((src->xauth_username), strlen((src->xauth_username)) +
 1, ("xauth username")));

dst->authby = src->authby;

/* save some defaults */
config_end->client.subnet = src->client;
config_end->client.protoport = src->protoport;

/*
* .has_client means that .client contains a hardwired value,
* if it doesn't then it is filled in later (for instance by
* instantiate() calling default_end() after host_addr is
* known).
*/
dst->has_client = src->has_client;
if (src->has_client) {
if (subnet_is_unset(&src->client)) {
	llog(RC_BADID, logger, "subnet error - failing to load connection");
	return -1;
}
dst->client = selector_from_subnet_protoport(src->client,
					     src->protoport);
}

dst->protocol = src->protoport.ipproto;
dst->port = src->protoport.hport;
dst->has_port_wildcard = protoport_has_any_port(&src->protoport);
dst->key_from_DNS_on_demand = src->key_from_DNS_on_demand;
dst->updown = clone_str(src->updown, "updown")((src->updown) == ((void*)0) ? ((void*)0) : clone_bytes((src
->updown), strlen((src->updown)) + 1, ("updown")));
dst->sendcert =  src->sendcert;

config_end->host.ikeport = src->host_ikeport;
if (src->host_ikeport > 65535) {
llog(RC_BADID, logger,
	    "%sikeport=%u must be between 1..65535, ignored",
	    leftright, src->host_ikeport);
config_end->host.ikeport = 0;
}

/*
* see if we can resolve the DNS name right now
* XXX this is WRONG, we should do this asynchronously, as part of
* the normal loading process
*/
switch (dst->host_type) {
case KH_IPHOSTNAME:
{
err_t er = ttoaddress_dns(shunk1(dst->host_addr_name),
			     address_type(&dst->host_addr),
			     &dst->host_addr);
if (er != NULL((void*)0)) {
	llog(RC_COMMENT, logger,
		    "failed to convert '%s' at load time: %s",
		    dst->host_addr_name, er);
}
break;
}

default:
break;
}

/*
* How to add addresspool only for responder?  It is not
* necessary on the initiator
*
* Note that, possibly confusingly, it is the client's end
* that has the address pool.  I.e., set OTHER_END to server.
*
* Need to also merge in the client/server options provided by
* whack - sometimes they are set, sometimes they are not.
*/

dst->modecfg_server = dst->modecfg_server || src->modecfg_server;
dst->modecfg_client = dst->modecfg_client || src->modecfg_client;

if (range_size(src->pool_range) > 0) {
if (c->pool != NULL((void*)0)) {
	llog(RC_LOG_SERIOUS, logger, "both left and right define address pools");
	return -1;
}
diag_t d = install_addresspool(src->pool_range, &c->pool);
if (d != NULL((void*)0)) {
	llog_diag(RC_LOG_SERIOUS, c->logger, &d,
		 "invalid %saddresspool: ", leftright);
	return -1;
}
other_end->modecfg_server = true1;
dst->modecfg_client = true1;
}

return same_ca;
1086}

1088static diag_t check_connection_end(const struct whack_end *this,
		   const struct whack_end *that,
		   const struct whack_message *wm)
1091{
/*
* This should have been diagnosed by whack,
* so we need not be clear.
*
* XXX: don't trust whack.
* XXX: don't assume values were set (defaulted).
* XXX: don't assume unset's type is NULL.
* XXX: because both directions are tested some checks are redundant.
*/

/*
* Find a type for the host addresses.  Order search by what
* was most liklely specified.
*/
const struct ip_info *type = (!address_is_unset(&this->host_addr) ? address_type(&this->host_addr) :
		      !address_is_unset(&this->host_nexthop) ? address_type(&this->host_nexthop) :
		      NULL((void*)0));

if (type != NULL((void*)0)) {
if (!address_is_unset(&this->host_nexthop) &&
    address_type(&this->host_nexthop) != type) {
	return diag("host address family inconsistent: expecting %s but %snexthop is %s",
		    type->ip_name, this->leftright, address_type(&this->host_nexthop)->ip_name);
}
if (!address_is_unset(&that->host_addr) &&
    address_type(&that->host_addr) != type) {
	return diag("host address family inconsistent: expecting %s but %shost is %s",
		    type->ip_name, that->leftright, address_type(&that->host_addr)->ip_name);
}
if (!address_is_unset(&that->host_nexthop) &&
    address_type(&that->host_nexthop) != type) {
	return diag("host address family inconsistent: expecting %s but %snexthop is %s",
		    type->ip_name, that->leftright, address_type(&that->host_nexthop)->ip_name);
}
}

/* ??? seems like a nasty test (in-band, low-level) */
/* XXX: still nasty; just less low-level */
if (range_size(this->pool_range) > 0) {
struct ip_pool *pool; /* ignore */
diag_t d = find_addresspool(this->pool_range, &pool);
if (d != NULL((void*)0)) {
	return d;
}
}

const struct ip_info *this_afi = subnet_type(&this->client);
const struct ip_info *that_afi = subnet_type(&that->client);
if (this_afi != NULL((void*)0) && that_afi != NULL((void*)0) && this_afi != that_afi) {
/* IPv4 vs IPv6? */
return diag("subnets must have the same address family");
}

/* MAKE this more sane in the face of unresolved IP addresses */
if (that->host_type != KH_IPHOSTNAME &&
   (address_is_unset(&that->host_addr) || address_is_any(that->host_addr))) {
/*
 * Other side is wildcard: we must check if other conditions
 * met.
 */
if (this->host_type != KH_IPHOSTNAME &&
    (address_is_unset(&this->host_addr) || address_is_any(this->host_addr))) {
	return diag("connection %s must specify host IP address for our side",
		    wm->name);
}
}

if (this->protoport.ipproto == 0 && this->protoport.hport != 0) {
return diag("connection %s cannot specify non-zero port %d for prototcol 0",
	    wm->name, this->protoport.hport);
}

if (this->id != NULL((void*)0) && streq(this->id, "%fromcert")(strcmp((this->id), ("%fromcert")) == 0)) {
lset_t auth_pol = (wm->policy & POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
)));

if (this->authby == AUTHBY_PSK || this->authby == AUTHBY_NULL ||
	auth_pol == POLICY_PSK((lset_t)1 << (POLICY_PSK_IX)) || auth_pol == POLICY_AUTH_NULL((lset_t)1 << (POLICY_AUTH_NULL_IX))) {
	return diag("ID cannot be specified as %%fromcert if PSK or AUTH-NULL is used");
}
}

return NULL((void*)0); /* happy */
1174}

1176diag_t add_end_cert_and_preload_private_key(CERTCertificate *cert,
			    struct end *dst_end,
			    bool_Bool preserve_ca,
			    struct logger *logger)
1180{
passert(cert != NULL)({ _Bool assertion__ = cert != ((void*)0); if (!assertion__) {
 where_t here = ({ static const struct where here = { .func =
 __func__, .file = "programs/pluto/connections.c", .line = 1181
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "cert != ((void*)0)"); } (
void) 1; });
dst_end->cert.nss_cert = NULL((void*)0);
const char *nickname = cert->nickname;
const char *leftright = dst_end->config->leftright;

/*
* A copy of this code lives in nss_cert_verify.c :/
* Currently only a check for RSA is needed, as the only ECDSA
* key size not allowed in FIPS mode (p192 curve), is not implemented
* by NSS.
* See also RSA_secret_sane() and ECDSA_secret_sane()
*/
if (libreswan_fipsmode()) {
SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
passert(pk != NULL)({ _Bool assertion__ = pk != ((void*)0); if (!assertion__) { where_t
 here = ({ static const struct where here = { .func = __func__
, .file = "programs/pluto/connections.c", .line = 1195, }; &
here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "pk != ((void*)0)"); } (void
) 1; });
if (pk->keyType == rsaKey &&
    ((pk->u.rsa.modulus.len * BITS_PER_BYTE8) < FIPS_MIN_RSA_KEY_SIZE2048)) {
	SECKEY_DestroyPublicKey(pk);
	return diag("FIPS: rejecting %s certificate '%s' with key size %d which is under %d",
		    leftright, nickname,
		    pk->u.rsa.modulus.len * BITS_PER_BYTE8,
		    FIPS_MIN_RSA_KEY_SIZE2048);
}
/* TODO FORCE MINIMUM SIZE ECDSA KEY */
SECKEY_DestroyPublicKey(pk);
}

/* XXX: should this be after validity check? */
select_nss_cert_id(cert, &dst_end->id);

/* check validity of cert */
if (CERT_CheckCertValidTimes(cert, PR_Now(), false0) !=
	secCertTimeValid) {
return diag("%s certificate '%s' is expired or not yet valid",
	    leftright, nickname);
}

dbg("loading %s certificate \'%s\' pubkey", leftright, nickname){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("loading %s certificate \'%s\' pubkey", leftright
, nickname); } };
if (!add_pubkey_from_nss_cert(&pluto_pubkeys, &dst_end->id, cert, logger)) {
/* XXX: push diag_t into add_pubkey_from_nss_cert()? */
return diag("%s certificate \'%s\' pubkey could not be loaded",
	    leftright, nickname);
}

dst_end->cert.nss_cert = cert;

/*
* If no CA is defined, use issuer as default; but only when
* update is ok.
*
*/
if (preserve_ca || dst_end->ca.ptr != NULL((void*)0)) {
dbg("preserving existing %s ca", leftright){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("preserving existing %s ca", leftright); } };
} else {
dst_end->ca = clone_secitem_as_chunk(cert->derIssuer, "issuer ca");
}

/*
* Try to pre-load the certificate's secret (private key) into
* the local cache (see keys.c).
*
* This can fail.  For instance, this end may only have the
* peer's certificate
*
* This could also fail because a needed secret is missing.
* That case is handled by refine_host_connection /
* get_psk.
*/
dbg("preload cert/secret for connection: %s", cert->nickname){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("preload cert/secret for connection: %s", cert
->nickname); } };
bool_Bool load_needed;
err_t ugh = preload_private_key_by_cert(&dst_end->cert, &load_needed, logger);
if (ugh != NULL((void*)0)) {
dbg("no private key matching %s certificate %s: %s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no private key matching %s certificate %s: %s"
, leftright, nickname, ugh); } }
    leftright, nickname, ugh){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no private key matching %s certificate %s: %s"
, leftright, nickname, ugh); } };
} else if (load_needed) {
llog(RC_LOG|LOG_STREAM/*not-whack-for-now*/, logger,
     "loaded private key matching %s certificate '%s'",
     leftright, nickname);
}
return NULL((void*)0);
1261}

1263/* only used by add_connection() */
1264static void mark_parse(/*const*/ char *wmmark,
       struct sa_mark *sa_mark,
       struct logger *logger/*connection "...":*/)
1267{
/*const*/ char *val_end;

sa_mark->unique = false0;
sa_mark->val = 0xffffffff;
sa_mark->mask = 0xffffffff;
if (streq(wmmark, "-1")(strcmp((wmmark), ("-1")) == 0) || startswith(wmmark, "-1/")(strncmp(((wmmark)), (("-1/")), (strlen("-1/"))) == 0)) {
sa_mark->unique = true1;
val_end = wmmark + strlen("-1");
} else {
errno(*__errno_location ()) = 0;
unsigned long v = strtoul(wmmark, &val_end, 0);
if (errno(*__errno_location ()) != 0 || v > 0xffffffff ||
    (*val_end != '\0' && *val_end != '/'))
{
	/* ??? should be detected and reported by confread and whack */
	/* XXX: don't trust whack */
	llog(RC_LOG_SERIOUS, logger,
		    "bad mark value \"%s\"", wmmark);
} else {
	sa_mark->val = v;
}
}

if (*val_end == '/') {
/*const*/ char *mask_end;
errno(*__errno_location ()) = 0;
unsigned long v = strtoul(val_end+1, &mask_end, 0);
if (errno(*__errno_location ()) != 0 || v > 0xffffffff || *mask_end != '\0') {
	/* ??? should be detected and reported by confread and whack */
	/* XXX: don't trust whack */
	llog(RC_LOG_SERIOUS, logger,
		   "bad mark mask \"%s\"", mask_end);
} else {
	sa_mark->mask = v;
}
}
if ((sa_mark->val & ~sa_mark->mask) != 0) {
/* ??? should be detected and reported by confread and whack */
/* XXX: don't trust whack */
llog(RC_LOG_SERIOUS, logger,
	    "mark value %#08" PRIx32"x" " has bits outside mask %#08" PRIx32"x",
	    sa_mark->val, sa_mark->mask);
}
1311}

1313/*
* Extract the connection detail from the whack message WM and store
* them in the connection C.
*
* This code is responsible for cloning strings and other structures
* so that they out live the whack message.  When things go wrong,
* return false, the caller will then use delete_connection() to free
* the partially constructed connection.
*
* Checks from confread/whack should be moved here so it is similar
* for all methods of loading a connection.
*
* XXX: at one point this code was populating the connection with
* pointer's to the whack message's strings and then trying to use
* unshare_connection() to create local copies.  Bad idea.  For
* instance, it duplicated the proposal pointers yet here the pointer
* was freshy allocated so no duplication should be needed (or at
* least shouldn't be) (look for strange free() vs delref() sequence).
*/
1332static bool_Bool extract_connection(const struct whack_message *wm,
	       struct connection *c)
1334{
diag_t d;

struct config *config = alloc_thing(struct config, "root config")((struct config*) alloc_bytes(sizeof(struct config), ("root config"
)));
c->root_config = config; /* writeable; root only */
c->config = config; /* read only; shared */

passert(c->name != NULL)({ _Bool assertion__ = c->name != ((void*)0); if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 1341
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "c->name != ((void*)0)"
); } (void) 1; }); /* see alloc_connection() */

if ((wm->policy & POLICY_COMPRESS((lset_t)1 << (POLICY_COMPRESS_IX))) && !can_do_IPcomp) {
llog(RC_FATAL, c->logger,
     "failed to add connection with compress because kernel is not configured to do IPCOMP");
return false0;
}

if ((wm->policy & POLICY_TUNNEL((lset_t)1 << (POLICY_TUNNEL_IX))) == LEMPTY((lset_t)0)) {
if (wm->sa_tfcpad != 0) {
	llog(RC_FATAL, c->logger,
	     "failed to add connection: connection with type=transport cannot specify tfc=");
	return false0;
}
if (wm->vti_iface != NULL((void*)0)) {
	llog(RC_FATAL, c->logger,
	     "failed to add connection: VTI requires tunnel mode but connection specifies type=transport");
	return false0;
}
}
if (LIN(POLICY_AUTHENTICATE, wm->policy)(((((lset_t)1 << (POLICY_AUTHENTICATE_IX))) & (wm->
policy)) == (((lset_t)1 << (POLICY_AUTHENTICATE_IX))))) {
if (wm->sa_tfcpad != 0) {
	llog(RC_FATAL, c->logger,
	     "failed to add connection: connection with phase2=ah cannot specify tfc=");
	return false0;
}
}

if (LIN(POLICY_AUTH_NEVER, wm->policy)(((((lset_t)1 << (POLICY_AUTH_NEVER_IX))) & (wm->
policy)) == (((lset_t)1 << (POLICY_AUTH_NEVER_IX))))) {
if ((wm->policy & POLICY_SHUNT_MASK(((lset_t)1 << (POLICY_SHUNT1_IX)) - ((lset_t)1 <<
 (POLICY_SHUNT0_IX)) + ((lset_t)1 << (POLICY_SHUNT1_IX)
))) == POLICY_SHUNT_TRAP(SHUNT_DEFAULT * ((lset_t)1 << (POLICY_SHUNT0_IX)))) {
	llog(RC_FATAL, c->logger,
		    "failed to add connection: connection with authby=never must specify shunt type via type=");
	return false0;
}
}
if ((wm->policy & POLICY_SHUNT_MASK(((lset_t)1 << (POLICY_SHUNT1_IX)) - ((lset_t)1 <<
 (POLICY_SHUNT0_IX)) + ((lset_t)1 << (POLICY_SHUNT1_IX)
))) != POLICY_SHUNT_TRAP(SHUNT_DEFAULT * ((lset_t)1 << (POLICY_SHUNT0_IX)))) {
if ((wm->policy & (POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
)) & ~POLICY_AUTH_NEVER((lset_t)1 << (POLICY_AUTH_NEVER_IX)))) != LEMPTY((lset_t)0)) {
	llog(RC_FATAL, c->logger,
		    "failed to add connection: shunt connection cannot have authentication method other then authby=never");
	return false0;
}
} else {
switch (wm->policy & (POLICY_AUTHENTICATE((lset_t)1 << (POLICY_AUTHENTICATE_IX)) | POLICY_ENCRYPT((lset_t)1 << (POLICY_ENCRYPT_IX)))) {
case LEMPTY((lset_t)0):
	if (!LIN(POLICY_AUTH_NEVER, wm->policy)(((((lset_t)1 << (POLICY_AUTH_NEVER_IX))) & (wm->
policy)) == (((lset_t)1 << (POLICY_AUTH_NEVER_IX))))) {
		llog(RC_FATAL, c->logger,
			    "failed to add connection: non-shunt connection must have AH or ESP");
		return false0;
	}
	break;
case POLICY_AUTHENTICATE((lset_t)1 << (POLICY_AUTHENTICATE_IX)) | POLICY_ENCRYPT((lset_t)1 << (POLICY_ENCRYPT_IX)):
	llog(RC_FATAL, c->logger,
		    "failed to add connection: non-shunt connection must not specify both AH and ESP");
	return false0;
}
}

if (wm->ike_version == IKEv1) {
1399#ifdef USE_IKEv11
if (pluto_ikev1_pol != GLOBAL_IKEv1_ACCEPT) {
	llog(RC_FATAL, c->logger,
		    "failed to add IKEv1 connection: global ikev1-policy does not allow IKEv1 connections");
	return false0;
}
1405#else
llog(RC_FATAL, c->logger, "failed to add IKEv1 connection: IKEv1 support not compiled in");
return false0;
1408#endif
}
c->ike_version = wm->ike_version;

if (wm->policy & POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX)) &&
   c->ike_version == IKEv1) {
llog(RC_FATAL, c->logger,
	    "failed to add connection: opportunistic connection MUST have IKEv2");
return false0;
}

if (wm->policy & POLICY_MOBIKE((lset_t)1 << (POLICY_MOBIKE_IX)) &&
   c->ike_version == IKEv1) {
llog(RC_FATAL, c->logger,
	    "failed to add connection: MOBIKE requires IKEv2");
return false0;
}

if (wm->policy & POLICY_IKEV2_ALLOW_NARROWING((lset_t)1 << (POLICY_IKEV2_ALLOW_NARROWING_IX)) &&
   c->ike_version == IKEv1) {
llog(RC_FATAL, c->logger,
	    "failed to add connection: narrowing=yes requires IKEv2");
return false0;
}

if (wm->iketcp != IKE_TCP_NO &&
   c->ike_version != IKEv2) {
llog(RC_FATAL, c->logger,
	    "failed to add connection: enable-tcp= requires IKEv2");
return false0;
}

if (wm->policy & POLICY_MOBIKE((lset_t)1 << (POLICY_MOBIKE_IX))) {
if (kernel_ops->migrate_sa_check == NULL((void*)0)) {
	llog(RC_FATAL, c->logger,
		    "failed to add connection: MOBIKE not supported by %s interface",
		    kernel_ops->kern_name);
	return false0;
}
/* probe the interface */
err_t err = kernel_ops->migrate_sa_check(c->logger);
if (err != NULL((void*)0)) {
	llog(RC_FATAL, c->logger,
		    "failed to add connection: MOBIKE kernel support missing for %s interface: %s",
		    kernel_ops->kern_name, err);
	return false0;
}
}

if (wm->iketcp != IKE_TCP_NO && (wm->remote_tcpport == 0 || wm->remote_tcpport == 500)) {
llog(RC_FATAL, c->logger,
	    "failed to add connection: tcp-remoteport cannot be 0 or 500");
return false0;
}

/* we could complain about a lot more whack strings */
if (NEVER_NEGOTIATE(wm->policy)(((((wm->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0)))) {
if (wm->ike != NULL((void*)0)) {
	llog(RC_INFORMATIONAL, c->logger,
		    "ignored ike= option for type=passthrough connection");
}
if (wm->esp != NULL((void*)0)) {
	llog(RC_INFORMATIONAL, c->logger,
		    "ignored esp= option for type=passthrough connection");
}
if (wm->iketcp != IKE_TCP_NO) {
	llog(RC_INFORMATIONAL, c->logger,
		    "ignored enable-tcp= option for type=passthrough connection");
}
if (wm->left.authby != AUTHBY_UNSET || wm->right.authby != AUTHBY_UNSET) {
	llog(RC_FATAL, c->logger,
		    "failed to add connection: leftauth= / rightauth= options are invalid for type=passthrough connection");
	return false0;
}
} else {
/* reject all bad combinations of authby with leftauth=/rightauth= */
if (wm->left.authby != AUTHBY_UNSET || wm->right.authby != AUTHBY_UNSET) {
	if (c->ike_version == IKEv1) {
		llog(RC_FATAL, c->logger,
			    "failed to add connection: leftauth= and rightauth= require ikev2");
		return false0;
	}
	if (wm->left.authby == AUTHBY_UNSET || wm->right.authby == AUTHBY_UNSET) {
		llog(RC_FATAL, c->logger,
			    "failed to add connection: leftauth= and rightauth= must both be set or both be unset");
		return false0;
	}
	/* ensure no conflicts of set left/rightauth with (set or unset) authby= */
	if (wm->left.authby == wm->right.authby) {

		lset_t auth_pol = (wm->policy & POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
)));
		const char *conflict = NULL((void*)0);
		switch (wm->left.authby) {
		case AUTHBY_PSK:
			if (auth_pol != POLICY_PSK((lset_t)1 << (POLICY_PSK_IX)) && auth_pol != LEMPTY((lset_t)0)) {
				conflict = "leftauthby=secret but authby= is not secret";
			}
			break;
		case AUTHBY_NULL:
			if (auth_pol != POLICY_AUTH_NULL((lset_t)1 << (POLICY_AUTH_NULL_IX)) && auth_pol != LEMPTY((lset_t)0)) {
				conflict = "leftauthby=null but authby= is not null";
			}
			break;
		case AUTHBY_NEVER:
			if ((wm->policy & POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
))) != LEMPTY((lset_t)0)) {
				conflict = "leftauthby=never but authby= is not never - double huh?";
			}
			break;
		case AUTHBY_RSASIG:
		case AUTHBY_ECDSA:
			/* will be fixed later below */
			break;
		default:
			bad_case(wm->left.authby)libreswan_bad_case("wm->left.authby", (wm->left.authby)
, ({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 1521, }; &here
; }));
		}
		if (conflict != NULL((void*)0)) {
			policy_buf pb;
			llog(RC_FATAL, c->logger,
			     "failed to add connection: leftauth=%s and rightauth=%s conflict with authby=%s, %s",
			     enum_name(&keyword_authby_names, wm->left.authby),
			     enum_name(&keyword_authby_names, wm->right.authby),
			     str_policy(wm->policy & POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
)), &pb),
			     conflict);
			return false0;
		}
	} else {
		if ((wm->left.authby == AUTHBY_PSK && wm->right.authby == AUTHBY_NULL) ||
		    (wm->left.authby == AUTHBY_NULL && wm->right.authby == AUTHBY_PSK)) {
			llog(RC_FATAL, c->logger,
				    "failed to add connection: cannot mix PSK and NULL authentication (leftauth=%s and rightauth=%s)",
				    enum_name(&keyword_authby_names, wm->left.authby),
				    enum_name(&keyword_authby_names, wm->right.authby));
			return false0;
		}
	}
}
}

if (protoport_has_any_port(&wm->right.protoport) &&
   protoport_has_any_port(&wm->left.protoport)) {
llog(RC_FATAL, c->logger,
	    "failed to add connection: cannot have protoport with %%any on both sides");
return false0;
}

d = check_connection_end(&wm->right, &wm->left, wm);
if (d != NULL((void*)0)) {
llog_diag(RC_FATAL, c->logger, &d, "failed to add connection: ");
return false0;
}
d = check_connection_end(&wm->left, &wm->right, wm);
if (d != NULL((void*)0)) {
llog_diag(RC_FATAL, c->logger, &d, "failed to add connection: ");
return false0;
}

/* duplicate any alias, adding spaces to the beginning and end */
c->connalias = clone_str(wm->connalias, "connection alias")((wm->connalias) == ((void*)0) ? ((void*)0) : clone_bytes(
(wm->connalias), strlen((wm->connalias)) + 1, ("connection alias"
)));

c->dnshostname = clone_str(wm->dnshostname, "connection dnshostname")((wm->dnshostname) == ((void*)0) ? ((void*)0) : clone_bytes
((wm->dnshostname), strlen((wm->dnshostname)) + 1, ("connection dnshostname"
)));
c->policy = wm->policy;
/* ignore IKEv2 ECDSA and legacy RSA policies for IKEv1 connections */
if (c->ike_version == IKEv1)
c->policy = (c->policy & ~(POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX)) | POLICY_RSASIG_v1_5((lset_t)1 << (POLICY_RSASIG_v1_5_IX))));
/* ignore symmetrical defaults if we got left/rightauth */
if (wm->left.authby != wm->right.authby)
c->policy = c->policy & ~POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
));
/* remove default pubkey policy if left/rightauth is specified */
if (wm->left.authby == wm->right.authby) {
if (wm->left.authby == AUTHBY_RSASIG)
	c->policy = (c->policy & ~(POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX))));
if (wm->left.authby == AUTHBY_ECDSA)
	c->policy = (c->policy & ~(POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX)) | POLICY_RSASIG_v1_5((lset_t)1 << (POLICY_RSASIG_v1_5_IX))));
}
/* ignore supplied sighash and ECDSA (from defaults) for IKEv1 */
if (c->ike_version == IKEv2)
c->sighash_policy = wm->sighash_policy;

if (NEVER_NEGOTIATE(c->policy)(((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0)))) {
/* cleanup inherited default */
c->ike_version = 0;
c->iketcp = IKE_TCP_NO;
c->remote_tcpport = 0;
}

if (libreswan_fipsmode()) {
if (c->policy & POLICY_NEGO_PASS((lset_t)1 << (POLICY_NEGO_PASS_IX))) {
	c->policy &= ~POLICY_NEGO_PASS((lset_t)1 << (POLICY_NEGO_PASS_IX));
	llog(RC_LOG_SERIOUS, c->logger,
	     "FIPS: ignored negotiationshunt=passthrough - packets MUST be blocked in FIPS mode");
}
if ((c->policy & POLICY_FAIL_MASK(((lset_t)1 << (POLICY_FAIL1_IX)) - ((lset_t)1 <<
 (POLICY_FAIL0_IX)) + ((lset_t)1 << (POLICY_FAIL1_IX)))) == POLICY_FAIL_PASS(SHUNT_PASS * ((lset_t)1 << (POLICY_FAIL0_IX)))) {
	c->policy &= ~POLICY_FAIL_MASK(((lset_t)1 << (POLICY_FAIL1_IX)) - ((lset_t)1 <<
 (POLICY_FAIL0_IX)) + ((lset_t)1 << (POLICY_FAIL1_IX)));
	c->policy |= POLICY_FAIL_NONE(SHUNT_DEFAULT * ((lset_t)1 << (POLICY_FAIL0_IX)));
	llog(RC_LOG_SERIOUS, c->logger,
	     "FIPS: ignored failureshunt=passthrough - packets MUST be blocked in FIPS mode");
}
}

policy_buf pb;
dbg("added new %s connection %s with policy %s%s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("added new %s connection %s with policy %s%s",
 enum_name(&ike_version_names, c->ike_version), c->
name, str_policy(c->policy, &pb), (((((c->policy)) &
 (((lset_t)1 << (POLICY_ENCRYPT_IX)) | ((lset_t)1 <<
 (POLICY_AUTHENTICATE_IX)))) == ((lset_t)0))) ? "+NEVER_NEGOTIATE"
 : ""); } }
   enum_name(&ike_version_names, c->ike_version),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("added new %s connection %s with policy %s%s",
 enum_name(&ike_version_names, c->ike_version), c->
name, str_policy(c->policy, &pb), (((((c->policy)) &
 (((lset_t)1 << (POLICY_ENCRYPT_IX)) | ((lset_t)1 <<
 (POLICY_AUTHENTICATE_IX)))) == ((lset_t)0))) ? "+NEVER_NEGOTIATE"
 : ""); } }
   c->name, str_policy(c->policy, &pb),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("added new %s connection %s with policy %s%s",
 enum_name(&ike_version_names, c->ike_version), c->
name, str_policy(c->policy, &pb), (((((c->policy)) &
 (((lset_t)1 << (POLICY_ENCRYPT_IX)) | ((lset_t)1 <<
 (POLICY_AUTHENTICATE_IX)))) == ((lset_t)0))) ? "+NEVER_NEGOTIATE"
 : ""); } }
   NEVER_NEGOTIATE(c->policy) ? "+NEVER_NEGOTIATE" : ""){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("added new %s connection %s with policy %s%s",
 enum_name(&ike_version_names, c->ike_version), c->
name, str_policy(c->policy, &pb), (((((c->policy)) &
 (((lset_t)1 << (POLICY_ENCRYPT_IX)) | ((lset_t)1 <<
 (POLICY_AUTHENTICATE_IX)))) == ((lset_t)0))) ? "+NEVER_NEGOTIATE"
 : ""); } };

if (NEVER_NEGOTIATE(wm->policy)(((((wm->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0)))) {
/* set default to AUTHBY_NEVER if unset and we do not expect to do IKE */
if (wm->left.authby == AUTHBY_UNSET && wm->right.authby == AUTHBY_UNSET) {
	if ((c->policy & POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
))) == LEMPTY((lset_t)0)) {
		/* authby= was also not specified - fill in default */
		c->policy |= POLICY_AUTH_NEVER((lset_t)1 << (POLICY_AUTH_NEVER_IX));
		policy_buf pb;
		dbg("no AUTH policy was set for type=passthrough - defaulting to %s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no AUTH policy was set for type=passthrough - defaulting to %s"
, str_policy(c->policy & (((lset_t)1 << (POLICY_AUTH_NULL_IX
)) - ((lset_t)1 << (POLICY_PSK_IX)) + ((lset_t)1 <<
 (POLICY_AUTH_NULL_IX))), &pb)); } }
		    str_policy(c->policy & POLICY_ID_AUTH_MASK, &pb)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no AUTH policy was set for type=passthrough - defaulting to %s"
, str_policy(c->policy & (((lset_t)1 << (POLICY_AUTH_NULL_IX
)) - ((lset_t)1 << (POLICY_PSK_IX)) + ((lset_t)1 <<
 (POLICY_AUTH_NULL_IX))), &pb)); } };
	}
}
} else {
/* set default to RSASIG if unset and we expect to do IKE */
if (wm->left.authby == AUTHBY_UNSET && wm->right.authby == AUTHBY_UNSET) {
	 if ((c->policy & POLICY_ID_AUTH_MASK(((lset_t)1 << (POLICY_AUTH_NULL_IX)) - ((lset_t)1 <<
 (POLICY_PSK_IX)) + ((lset_t)1 << (POLICY_AUTH_NULL_IX)
))) == LEMPTY((lset_t)0)) {
		/* authby= was also not specified - fill in default */
		c->policy |= POLICY_DEFAULT((lset_t)1 << (POLICY_RSASIG_IX));
		policy_buf pb;
		dbg("no AUTH policy was set - defaulting to %s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no AUTH policy was set - defaulting to %s", str_policy
(c->policy & (((lset_t)1 << (POLICY_AUTH_NULL_IX
)) - ((lset_t)1 << (POLICY_PSK_IX)) + ((lset_t)1 <<
 (POLICY_AUTH_NULL_IX))), &pb)); } }
		    str_policy(c->policy & POLICY_ID_AUTH_MASK, &pb)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("no AUTH policy was set - defaulting to %s", str_policy
(c->policy & (((lset_t)1 << (POLICY_AUTH_NULL_IX
)) - ((lset_t)1 << (POLICY_PSK_IX)) + ((lset_t)1 <<
 (POLICY_AUTH_NULL_IX))), &pb)); } };
	}
}

/* fixup symmetric policy flags based on asymmetric ones */
if ((wm->left.authby == AUTHBY_NULL && wm->right.authby == AUTHBY_RSASIG) ||
    (wm->left.authby == AUTHBY_RSASIG && wm->right.authby == AUTHBY_NULL)) {
	c->policy |= POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX));
}
if ((wm->left.authby == AUTHBY_NULL && wm->right.authby == AUTHBY_ECDSA) ||
    (wm->left.authby == AUTHBY_ECDSA && wm->right.authby == AUTHBY_NULL)) {
	c->policy |= POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX));
}

/* IKE cipher suites */

if (!LIN(POLICY_AUTH_NEVER, wm->policy)(((((lset_t)1 << (POLICY_AUTH_NEVER_IX))) & (wm->
policy)) == (((lset_t)1 << (POLICY_AUTH_NEVER_IX)))) &&
    (wm->ike != NULL((void*)0) || c->ike_version == IKEv2)) {
	const struct proposal_policy proposal_policy = {
		/* logic needs to match pick_initiator() */
		.version = c->ike_version,
		.alg_is_ok = ike_alg_is_ike,
		.pfs = LIN(POLICY_PFS, wm->policy)(((((lset_t)1 << (POLICY_PFS_IX))) & (wm->policy
)) == (((lset_t)1 << (POLICY_PFS_IX)))),
		.check_pfs_vs_dh = false0,
		.logger_rc_flags = ALL_STREAMS|RC_LOG,
		.logger = c->logger, /* on-stack */
		/* let defaults stumble on regardless */
		.ignore_parser_errors = (wm->ike == NULL((void*)0)),
	};

	struct proposal_parser *parser = ike_proposal_parser(&proposal_policy);
	c->ike_proposals.p = proposals_from_str(parser, wm->ike);

	if (c->ike_proposals.p == NULL((void*)0)) {
		pexpect(parser->diag != NULL)({ _Bool assertion__ = parser->diag != ((void*)0); if (!assertion__
) { where_t here_ = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 1666
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_pexpect(logger_, here_, "%s", "parser->diag != ((void*)0)"
); } assertion__; }); /* something */
		llog_diag(RC_FATAL, c->logger, &parser->diag,
			 "failed to add connection: ");
		free_proposal_parser(&parser);
		/* caller will free C */
		return false0;
	}
	free_proposal_parser(&parser);

	/* from here on, error returns should alg_info_free(&c->ike_proposals->ai); */

	LSWDBGP(DBG_BASE, buf)for (_Bool lswlog_p = (cur_debugging & (((lset_t)1 <<
 (DBG_BASE_IX)))); lswlog_p; lswlog_p = 0) for (char lswbuf[(
(size_t)1024)], *lswbuf_ = lswbuf; lswbuf_ != ((void*)0); lswbuf_
 = ((void*)0)) for (struct jambuf jambuf = array_as_jambuf((lswbuf
), sizeof(lswbuf)), *buf = &jambuf; buf != ((void*)0); buf
 = ((void*)0)) for (; buf != ((void*)0); jambuf_to_logger(buf
, &failsafe_logger, DEBUG_STREAM), buf = ((void*)0)) {
		jam_string(buf, "ike (phase1) algorithm values: ");
		jam_proposals(buf, c->ike_proposals.p);
	}
}

/* ESP or AH cipher suites (but not both) */

if (wm->esp != NULL((void*)0) ||
    (c->ike_version == IKEv2 &&
     (c->policy & (POLICY_ENCRYPT((lset_t)1 << (POLICY_ENCRYPT_IX))|POLICY_AUTHENTICATE((lset_t)1 << (POLICY_AUTHENTICATE_IX)))))) {
	const char *esp = wm->esp != NULL((void*)0) ? wm->esp : "";
	dbg("from whack: got --esp=%s", esp){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("from whack: got --esp=%s", esp); } };

	const struct proposal_policy proposal_policy = {
		/*
		 * logic needs to match pick_initiator()
		 *
		 * XXX: Once pluto is changed to IKEv1 XOR
		 * IKEv2 it should be possible to move this
		 * magic into pluto proper and instead pass a
		 * simple boolean.
		 */
		.version = c->ike_version,
		.alg_is_ok = kernel_alg_is_ok,
		.pfs = LIN(POLICY_PFS, wm->policy)(((((lset_t)1 << (POLICY_PFS_IX))) & (wm->policy
)) == (((lset_t)1 << (POLICY_PFS_IX)))),
		.check_pfs_vs_dh = true1,
		.logger_rc_flags = ALL_STREAMS|RC_LOG,
		.logger = c->logger, /* on-stack */
		/* let defaults stumble on regardless */
		.ignore_parser_errors = (wm->esp == NULL((void*)0)),
	};

	/*
	 * We checked above that exactly one of
	 * POLICY_ENCRYPT and POLICY_AUTHENTICATE is on.
	 * The only difference in processing is which
	 * function is called (and those functions are
	 * almost identical).
	 */
	struct proposal_parser *(*fn)(const struct proposal_policy *policy) =
		(c->policy & POLICY_ENCRYPT((lset_t)1 << (POLICY_ENCRYPT_IX))) ? esp_proposal_parser :
		(c->policy & POLICY_AUTHENTICATE((lset_t)1 << (POLICY_AUTHENTICATE_IX))) ? ah_proposal_parser :
		NULL((void*)0);
	passert(fn != NULL)({ _Bool assertion__ = fn != ((void*)0); if (!assertion__) { where_t
 here = ({ static const struct where here = { .func = __func__
, .file = "programs/pluto/connections.c", .line = 1721, }; &
here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "fn != ((void*)0)"); } (void
) 1; });
	struct proposal_parser *parser = fn(&proposal_policy);
	c->child_proposals.p = proposals_from_str(parser, wm->esp);
	if (c->child_proposals.p == NULL((void*)0)) {
		pexpect(parser->diag != NULL)({ _Bool assertion__ = parser->diag != ((void*)0); if (!assertion__
) { where_t here_ = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 1725
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_pexpect(logger_, here_, "%s", "parser->diag != ((void*)0)"
); } assertion__; });
		llog_diag(RC_FATAL, c->logger, &parser->diag,
			 "failed to add connection: ");
		free_proposal_parser(&parser);
		/* caller will free C */
		return false0;
	}
	free_proposal_parser(&parser);

	/* from here on, error returns should alg_info_free(&c->child_proposals->ai); */

	LSWDBGP(DBG_BASE, buf)for (_Bool lswlog_p = (cur_debugging & (((lset_t)1 <<
 (DBG_BASE_IX)))); lswlog_p; lswlog_p = 0) for (char lswbuf[(
(size_t)1024)], *lswbuf_ = lswbuf; lswbuf_ != ((void*)0); lswbuf_
 = ((void*)0)) for (struct jambuf jambuf = array_as_jambuf((lswbuf
), sizeof(lswbuf)), *buf = &jambuf; buf != ((void*)0); buf
 = ((void*)0)) for (; buf != ((void*)0); jambuf_to_logger(buf
, &failsafe_logger, DEBUG_STREAM), buf = ((void*)0)) {
		jam_string(buf, "ESP/AH string values: ");
		jam_proposals(buf, c->child_proposals.p);
	};
}

c->nic_offload = wm->nic_offload;
c->sa_ike_life_seconds = wm->sa_ike_life_seconds;
c->sa_ipsec_life_seconds = wm->sa_ipsec_life_seconds;
c->sa_rekey_margin = wm->sa_rekey_margin;
c->sa_rekey_fuzz = wm->sa_rekey_fuzz;
c->sa_keying_tries = wm->sa_keying_tries;
c->sa_replay_window = wm->sa_replay_window;
config->retransmit_timeout = wm->retransmit_timeout;
config->retransmit_interval = wm->retransmit_interval;

if (deltatime_cmp(c->sa_rekey_margin, >=, c->sa_ipsec_life_seconds)(deltatime_sub_sign(c->sa_rekey_margin, c->sa_ipsec_life_seconds
) >= 0)) {
	deltatime_t new_rkm = deltatimescale(1, 2, c->sa_ipsec_life_seconds);

	llog(RC_LOG, c->logger,
	     "rekeymargin (%jds) >= salifetime (%jds); reducing rekeymargin to %jds seconds",
	     deltasecs(c->sa_rekey_margin),
	     deltasecs(c->sa_ipsec_life_seconds),
	     deltasecs(new_rkm));

	c->sa_rekey_margin = new_rkm;
}

{
	/* http://csrc.nist.gov/publications/nistpubs/800-77/sp800-77.pdf */
	time_t max_ike = libreswan_fipsmode() ? FIPS_IKE_SA_LIFETIME_MAXIMUMsecs_per_hour * 24 : IKE_SA_LIFETIME_MAXIMUMsecs_per_day;
	time_t max_ipsec = libreswan_fipsmode() ? FIPS_IPSEC_SA_LIFETIME_MAXIMUMsecs_per_hour * 8 : IPSEC_SA_LIFETIME_MAXIMUMsecs_per_day;

	if (deltasecs(c->sa_ike_life_seconds) > max_ike) {
		llog(RC_LOG_SERIOUS, c->logger,
		     "IKE lifetime limited to the maximum allowed %jds",
		     (intmax_t) max_ike);
		c->sa_ike_life_seconds = deltatime(max_ike);
	}
	if (deltasecs(c->sa_ipsec_life_seconds) > max_ipsec) {
		llog(RC_LOG_SERIOUS, c->logger,
		     "IPsec lifetime limited to the maximum allowed %jds",
		     (intmax_t) max_ipsec);
		c->sa_ipsec_life_seconds = deltatime(max_ipsec);
	}
}

/* RFC 3706 DPD */
c->dpd_delay = wm->dpd_delay;
c->dpd_timeout = wm->dpd_timeout;
c->dpd_action = wm->dpd_action;

/* Cisco interop: remote peer type */
c->remotepeertype = wm->remotepeertype;

c->metric = wm->metric;
c->connmtu = wm->connmtu;
c->encaps = wm->encaps;
c->nat_keepalive = wm->nat_keepalive;
c->ikev1_natt = wm->ikev1_natt;
c->initial_contact = wm->initial_contact;
c->cisco_unity = wm->cisco_unity;
c->fake_strongswan = wm->fake_strongswan;
c->send_vendorid = wm->send_vendorid;
c->send_ca = wm->send_ca;
c->xauthby = wm->xauthby;
c->xauthfail = wm->xauthfail;

c->modecfg_dns = clone_str(wm->modecfg_dns, "connection modecfg_dns")((wm->modecfg_dns) == ((void*)0) ? ((void*)0) : clone_bytes
((wm->modecfg_dns), strlen((wm->modecfg_dns)) + 1, ("connection modecfg_dns"
)));
c->modecfg_domains = clone_str(wm->modecfg_domains, "connection modecfg_domains")((wm->modecfg_domains) == ((void*)0) ? ((void*)0) : clone_bytes
((wm->modecfg_domains), strlen((wm->modecfg_domains)) +
 1, ("connection modecfg_domains")));
c->modecfg_banner = clone_str(wm->modecfg_banner, "connection modecfg_banner")((wm->modecfg_banner) == ((void*)0) ? ((void*)0) : clone_bytes
((wm->modecfg_banner), strlen((wm->modecfg_banner)) + 1
, ("connection modecfg_banner")));

/* RFC 5685 - IKEv2 Redirect mechanism */
c->redirect_to = clone_str(wm->redirect_to, "connection redirect_to")((wm->redirect_to) == ((void*)0) ? ((void*)0) : clone_bytes
((wm->redirect_to), strlen((wm->redirect_to)) + 1, ("connection redirect_to"
)));
c->accept_redirect_to = clone_str(wm->accept_redirect_to, "connection accept_redirect_to")((wm->accept_redirect_to) == ((void*)0) ? ((void*)0) : clone_bytes
((wm->accept_redirect_to), strlen((wm->accept_redirect_to
)) + 1, ("connection accept_redirect_to")));

/* RFC 8229 TCP encap*/
c->remote_tcpport = wm->remote_tcpport;
c->iketcp = wm->iketcp;

/*
 * parse mark and mask values form the mark/mask string
 * acceptable string formats are
 * ( -1 | <nat> | <hex> ) [ / ( <nat> | <hex> ) ]
 * examples:
 *   10
 *   10/0xffffffff
 *   0xA/0xFFFFFFFF
 *
 * defaults:
 *  if mark is provided and mask is not mask will default to 0xFFFFFFFF
 *  if nothing is provided mark and mask are set to 0;
 */

/* mark-in= and mark-out= overwrite mark= */
if (wm->conn_mark_both != NULL((void*)0)) {
	mark_parse(wm->conn_mark_both, &c->sa_marks.in, c->logger);
	mark_parse(wm->conn_mark_both, &c->sa_marks.out, c->logger);
	if (wm->conn_mark_in != NULL((void*)0) || wm->conn_mark_out != NULL((void*)0)) {
		llog(RC_LOG_SERIOUS, c->logger,
		     "conflicting mark specifications");
	}
}
if (wm->conn_mark_in != NULL((void*)0))
	mark_parse(wm->conn_mark_in, &c->sa_marks.in, c->logger);
if (wm->conn_mark_out != NULL((void*)0))
	mark_parse(wm->conn_mark_out, &c->sa_marks.out, c->logger);

c->vti_iface = clone_str(wm->vti_iface, "connection vti_iface")((wm->vti_iface) == ((void*)0) ? ((void*)0) : clone_bytes(
(wm->vti_iface), strlen((wm->vti_iface)) + 1, ("connection vti_iface"
)));
c->vti_routing = wm->vti_routing;
c->vti_shared = wm->vti_shared;
1847#ifdef USE_XFRM_INTERFACE1
if (wm->xfrm_if_id != UINT32_MAX(4294967295U)) {
	err_t err = xfrm_iface_supported(c->logger);
	if (err == NULL((void*)0)) {
		if (!setup_xfrm_interface(c, wm->xfrm_if_id == 0 ?
			PLUTO_XFRMI_REMAP_IF_ID_ZERO16384 : wm->xfrm_if_id ))
			return false0;
	} else {
		llog(RC_FATAL, c->logger,
		     "failed to add connection: ipsec-interface=%u not supported. %s",
		     wm->xfrm_if_id, err);
		return false0;
	}
}
1861#endif
}

1864#ifdef HAVE_NM1
c->nmconfigured = wm->nmconfigured;
1866#endif

c->nflog_group = wm->nflog_group;
c->sa_priority = wm->sa_priority;
c->sa_tfcpad = wm->sa_tfcpad;
c->send_no_esp_tfc = wm->send_no_esp_tfc;

/*
* Since security labels use the same REQID for everything,
* pre-assign it.
*/
c->sa_reqid = (wm->sa_reqid != 0 ? wm->sa_reqid :
       wm->ike_version != IKEv2 ? /*generated later*/0 :
       wm->sec_label != NULL((void*)0) ? gen_reqid() :
       /*generated later*/0);
dbg("%s c->sa_reqid=%d because wm->sa_reqid=%d and sec-label=%s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s c->sa_reqid=%d because wm->sa_reqid=%d and sec-label=%s"
, c->name, c->sa_reqid, wm->sa_reqid, (wm->ike_version
 != IKEv2 ? "not-IKEv2" : wm->sec_label != ((void*)0) ? wm
->sec_label : "n/a")); } }
   c->name, c->sa_reqid, wm->sa_reqid,{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s c->sa_reqid=%d because wm->sa_reqid=%d and sec-label=%s"
, c->name, c->sa_reqid, wm->sa_reqid, (wm->ike_version
 != IKEv2 ? "not-IKEv2" : wm->sec_label != ((void*)0) ? wm
->sec_label : "n/a")); } }
   (wm->ike_version != IKEv2 ? "not-IKEv2" :{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s c->sa_reqid=%d because wm->sa_reqid=%d and sec-label=%s"
, c->name, c->sa_reqid, wm->sa_reqid, (wm->ike_version
 != IKEv2 ? "not-IKEv2" : wm->sec_label != ((void*)0) ? wm
->sec_label : "n/a")); } }
    wm->sec_label != NULL ? wm->sec_label :{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s c->sa_reqid=%d because wm->sa_reqid=%d and sec-label=%s"
, c->name, c->sa_reqid, wm->sa_reqid, (wm->ike_version
 != IKEv2 ? "not-IKEv2" : wm->sec_label != ((void*)0) ? wm
->sec_label : "n/a")); } }
    "n/a")){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s c->sa_reqid=%d because wm->sa_reqid=%d and sec-label=%s"
, c->name, c->sa_reqid, wm->sa_reqid, (wm->ike_version
 != IKEv2 ? "not-IKEv2" : wm->sec_label != ((void*)0) ? wm
->sec_label : "n/a")); } };

/*
* Set both end's sec_label to the same value.
*/

if (wm->sec_label != NULL((void*)0)) {
dbg("received sec_label '%s' from whack", wm->sec_label){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("received sec_label '%s' from whack", wm->sec_label
); } };
/* include NUL! */
shunk_t sec_label = shunk2(wm->sec_label, strlen(wm->sec_label)+1);
err_t ugh = vet_seclabel(sec_label);
if (ugh != NULL((void*)0)) {
	llog(RC_LOG_SERIOUS, c->logger, "failed to add connection: %s: policy-label=%s",
	     ugh, wm->sec_label);
	return false0;
}
config->sec_label = clone_hunk(sec_label, "struct config sec_label")({ typeof(sec_label) hunk_ = sec_label; clone_bytes_as_chunk(
hunk_.ptr, hunk_.len, "struct config sec_label"); });
}


/*
* At this point THIS and THAT are disoriented so
* distinguishing one as local and the other as remote is
* pretty much meaningless.
*
* Somewhat arbitrarially (as in this is the way it's always
* been) start with:
*
*    LEFT == LOCAL / THIS
*    RIGHT == REMOTE / THAT
*
* XXX: This is all too confusing - wouldn't it be simpler if
* there was a '.left' and '.right' (or even .end[2] - this
* code seems to be crying out for a for loop) and then having
* orient() set up .local and .remote pointers or indexes
* accordingly?
*/

for (enum left_right end_index = 0; end_index < elemsof(config->end)(sizeof(config->end) / sizeof(*(config->end))); end_index++) {
struct config_end *config_end = &config->end[end_index];
config_end->end_index = end_index;
config_end->leftright = (end_index == LEFT_END ? "left" :
			 end_index == RIGHT_END ? "right" :
			 NULL((void*)0));
passert(config_end->leftright != NULL)({ _Bool assertion__ = config_end->leftright != ((void*)0)
; if (!assertion__) { where_t here = ({ static const struct where
 here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 1929, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "config_end->leftright != ((void*)0)"
); } (void) 1; });
}

struct end *left = &c->spd.this;
struct end *right = &c->spd.that;
left->config = c->local = &config->end[LEFT_END];
right->config = c->remote = &config->end[RIGHT_END];

int same_leftca = extract_end(c, left, &config->end[LEFT_END], &wm->left,
		      /*other_end*/right, c->logger);
if (same_leftca < 0) {
return false0;
}

int same_rightca = extract_end(c, right, &config->end[RIGHT_END], &wm->right,
		       /*other_end*/left, c->logger);
if (same_rightca < 0) {
return false0;
}

if (same_rightca == 1) {
c->spd.that.ca = clone_hunk(c->spd.this.ca, "same rightca")({ typeof(c->spd.this.ca) hunk_ = c->spd.this.ca; clone_bytes_as_chunk
(hunk_.ptr, hunk_.len, "same rightca"); });
} else if (same_leftca == 1) {
c->spd.this.ca = clone_hunk(c->spd.that.ca, "same leftca")({ typeof(c->spd.that.ca) hunk_ = c->spd.that.ca; clone_bytes_as_chunk
(hunk_.ptr, hunk_.len, "same leftca"); });
}

if (c->spd.this.xauth_server || c->spd.that.xauth_server)
c->policy |= POLICY_XAUTH((lset_t)1 << (POLICY_XAUTH_IX));

update_ends_from_this_host_addr(&c->spd.this, &c->spd.that);
update_ends_from_this_host_addr(&c->spd.that, &c->spd.this);

/*
* If both left/rightauth is unset, fill it in with (preferred) symmetric policy
*/
if (wm->left.authby == AUTHBY_UNSET && wm->right.authby == AUTHBY_UNSET) {
if (c->policy & POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX)))
	c->spd.this.authby = c->spd.that.authby = AUTHBY_RSASIG;
else if (c->policy & POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX)))
	c->spd.this.authby = c->spd.that.authby = AUTHBY_ECDSA;
else if (c->policy & POLICY_PSK((lset_t)1 << (POLICY_PSK_IX)))
	c->spd.this.authby = c->spd.that.authby = AUTHBY_PSK;
else if (c->policy & POLICY_AUTH_NULL((lset_t)1 << (POLICY_AUTH_NULL_IX)))
	c->spd.this.authby = c->spd.that.authby = AUTHBY_NULL;
}

/* if left/rightauth are set, but symmetric policy is not, fill it in */
if (wm->left.authby == wm->right.authby) {
switch (wm->left.authby) {
case AUTHBY_RSASIG:
	c->policy |= POLICY_RSASIG((lset_t)1 << (POLICY_RSASIG_IX));
	break;
case AUTHBY_ECDSA:
	c->policy |= POLICY_ECDSA((lset_t)1 << (POLICY_ECDSA_IX));
	break;
case AUTHBY_PSK:
	c->policy |= POLICY_PSK((lset_t)1 << (POLICY_PSK_IX));
	break;
case AUTHBY_NULL:
	c->policy |= POLICY_AUTH_NULL((lset_t)1 << (POLICY_AUTH_NULL_IX));
	break;
default:
	break;
}
}

/*
* force any wildcard host IP address, any wildcard subnet
* or any wildcard ID to _that_ end
*/
if (address_is_unset(&c->spd.this.host_addr) ||
   address_is_any(c->spd.this.host_addr) ||
   c->spd.this.has_port_wildcard ||
   c->spd.this.has_id_wildcards) {
struct end t = c->spd.this;

c->spd.this = c->spd.that;
c->spd.that = t;
}

c->spd.spd_next = NULL((void*)0);

/* set internal fields */
c->instance_serial = 0;
c->interface = NULL((void*)0);
c->spd.routing = RT_UNROUTED;
c->newest_ike_sa = SOS_NOBODY0;
c->newest_ipsec_sa = SOS_NOBODY0;
c->spd.eroute_owner = SOS_NOBODY0;
c->temp_vars.num_redirects = 0;
/*
* is spd.reqid necessary for all c? CK_INSTANCE or CK_PERMANENT
* need one. Does CK_TEMPLATE need one?
*/
c->spd.reqid = c->sa_reqid == 0 ? gen_reqid() : c->sa_reqid;
dbg("%s c->spd.reqid=%d because c->sa_reqid=%d",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s c->spd.reqid=%d because c->sa_reqid=%d"
, c->name, c->spd.reqid, c->sa_reqid); } }
   c->name, c->spd.reqid, c->sa_reqid){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s c->spd.reqid=%d because c->sa_reqid=%d"
, c->name, c->spd.reqid, c->sa_reqid); } };

/* force all oppo connections to have a client */
if (c->policy & POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX))) {
c->spd.that.has_client = true1;
c->spd.that.client.maskbits = 0; /* ??? shouldn't this be 32 for v4? */
/*
 * We cannot have unlimited keyingtries for Opportunistic, or else
 * we gain infinite partial IKE SA's. But also, more than one makes
 * no sense, since it will be installing a failureshunt (not
 * negotiationshunt) on the 2nd keyingtry, and try to re-install another
 * negotiation or failure shunt
 */
if (c->sa_keying_tries == 0) {
	c->sa_keying_tries = 1;
	llog(RC_LOG, c->logger,
	     "the connection is Opportunistic, but used keyingtries=0. The specified value was changed to 1");
}
}

if (c->policy & POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX))) {
dbg("connection is group: by policy"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection is group: by policy"); } };
c->kind = CK_GROUP;
add_group(c);
} else if (!NEVER_NEGOTIATE(c->policy)(((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) && (address_is_unset(&c->spd.that.host_addr) ||
				   address_is_any(c->spd.that.host_addr))) {
dbg("connection is template: no remote address yet policy negotiate"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection is template: no remote address yet policy negotiate"
); } };
c->kind = CK_TEMPLATE;
} else if (c->spd.that.has_port_wildcard) {
dbg("connection is template: remote has wildcard port"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection is template: remote has wildcard port"
); } };
c->kind = CK_TEMPLATE;
} else if (c->ike_version == IKEv2 && c->config->sec_label.len > 0) {
dbg("connection is template: has security label: "PRI_SHUNK,{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection is template: has security label: "
"%.*s", ((int) (c->config->sec_label).len), (const char
 *) ((c->config->sec_label).ptr)); } }
    pri_shunk(c->config->sec_label)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection is template: has security label: "
"%.*s", ((int) (c->config->sec_label).len), (const char
 *) ((c->config->sec_label).ptr)); } };
c->kind = CK_TEMPLATE;
} else if (wm->left.virt != NULL((void*)0) || wm->right.virt != NULL((void*)0)) {
/*
 * If we have a subnet=vnet: needing instantiation
 * so we can accept multiple subnets from
 * the remote peer.
 */
dbg("connection is template: there are vnets at play"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection is template: there are vnets at play"
); } };
c->kind = CK_TEMPLATE;
} else if (c->policy & POLICY_IKEV2_ALLOW_NARROWING((lset_t)1 << (POLICY_IKEV2_ALLOW_NARROWING_IX))) {
dbg("connection is template: POLICY_IKEV2_ALLOW_NARROWING"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection is template: POLICY_IKEV2_ALLOW_NARROWING"
); } };
c->kind = CK_TEMPLATE;
} else {
dbg("connection is permanent: by default"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection is permanent: by default"); } };
c->kind = CK_PERMANENT;
}

set_policy_prio(c); /* must be after kind is set */

c->extra_debugging = wm->debugging;

/* at most one virt can be present */
passert(wm->left.virt == NULL || wm->right.virt == NULL)({ _Bool assertion__ = wm->left.virt == ((void*)0) || wm->
right.virt == ((void*)0); if (!assertion__) { where_t here = (
{ static const struct where here = { .func = __func__, .file =
 "programs/pluto/connections.c", .line = 2081, }; &here; }
); const struct logger *logger_ = &failsafe_logger; llog_passert
(logger_, here, "%s", "wm->left.virt == ((void*)0) || wm->right.virt == ((void*)0)"
); } (void) 1; });

if (wm->left.virt != NULL((void*)0) || wm->right.virt != NULL((void*)0)) {
/*
 * This now happens with wildcards on
 * non-instantiations, such as rightsubnet=vnet:%priv
 * or rightprotoport=17/%any
 * passert(address_is_unset(&c->spd.that.host_addr) || address_is_any(c->spd.that.host_addr));
 */
passert(c->spd.that.virt == NULL)({ _Bool assertion__ = c->spd.that.virt == ((void*)0); if (
!assertion__) { where_t here = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2090, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "c->spd.that.virt == ((void*)0)"
); } (void) 1; });
c->spd.that.virt = create_virtual(wm->left.virt != NULL((void*)0) ?
				  wm->left.virt :
				  wm->right.virt,
				  c->logger);
if (c->spd.that.virt != NULL((void*)0))
	c->spd.that.has_client = true1;
}

if (c->pool !=  NULL((void*)0))
reference_addresspool(c);

orient(c, c->logger);

connect_to_host_pair(c);
/* non configurable */
c->ike_window = IKE_V2_OVERLAPPING_WINDOW_SIZE1;
return true1;
2108}

2110/* slightly different names compared to pluto_constants.c */
2111static const char *const policy_shunt_names[4] = {
"trap[should not happen]",
"passthrough",
"drop",
"reject",
2116};

2118void add_connection(const struct whack_message *wm, struct logger *logger)
2119{
/*
* Check for duplicate before allocating; otherwize the lookup
* will return the just allocated connection missing the
* original.
*/
if (conn_by_name(wm->name, false0/*!strict*/) != NULL((void*)0)) {
llog(RC_DUPNAME, logger,
     "attempt to redefine connection \"%s\"", wm->name);
return;
}

struct connection *c = alloc_connection(wm->name, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2131, }; &here
; }));
/* XXX: something better? */
close_any(&c->logger->global_whackfd)close_any_fd((&c->logger->global_whackfd), ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2133, }; &here; }));
c->logger->global_whackfd = fd_dup(logger->global_whackfd, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2134, }; &here
; }));

if (!extract_connection(wm, c)) {
/* already logged */
discard_connection(&c, false0/*not-valid*/);
return;
}

/* log all about this connection */
const char *what = (NEVER_NEGOTIATE(c->policy)(((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? policy_shunt_names[(c->policy & POLICY_SHUNT_MASK(((lset_t)1 << (POLICY_SHUNT1_IX)) - ((lset_t)1 <<
 (POLICY_SHUNT0_IX)) + ((lset_t)1 << (POLICY_SHUNT1_IX)
))) >> POLICY_SHUNT_SHIFTPOLICY_SHUNT0_IX] :
	    c->ike_version == IKEv1 ? "IKEv1" :
	    c->ike_version == IKEv2 ? "IKEv2" :
	    "IKEv?");
/* connection is good-to-go: log against it */
llog(RC_LOG, c->logger, "added %s connection", what);
policy_buf pb;
dbg("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s"
, deltasecs(c->sa_ike_life_seconds), deltasecs(c->sa_ipsec_life_seconds
), deltasecs(c->sa_rekey_margin), c->sa_rekey_fuzz, c->
sa_keying_tries, c->sa_replay_window, str_policy(c->policy
, &pb), (((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : ""); } }
   deltasecs(c->sa_ike_life_seconds),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s"
, deltasecs(c->sa_ike_life_seconds), deltasecs(c->sa_ipsec_life_seconds
), deltasecs(c->sa_rekey_margin), c->sa_rekey_fuzz, c->
sa_keying_tries, c->sa_replay_window, str_policy(c->policy
, &pb), (((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : ""); } }
   deltasecs(c->sa_ipsec_life_seconds),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s"
, deltasecs(c->sa_ike_life_seconds), deltasecs(c->sa_ipsec_life_seconds
), deltasecs(c->sa_rekey_margin), c->sa_rekey_fuzz, c->
sa_keying_tries, c->sa_replay_window, str_policy(c->policy
, &pb), (((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : ""); } }
   deltasecs(c->sa_rekey_margin),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s"
, deltasecs(c->sa_ike_life_seconds), deltasecs(c->sa_ipsec_life_seconds
), deltasecs(c->sa_rekey_margin), c->sa_rekey_fuzz, c->
sa_keying_tries, c->sa_replay_window, str_policy(c->policy
, &pb), (((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : ""); } }
   c->sa_rekey_fuzz,{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s"
, deltasecs(c->sa_ike_life_seconds), deltasecs(c->sa_ipsec_life_seconds
), deltasecs(c->sa_rekey_margin), c->sa_rekey_fuzz, c->
sa_keying_tries, c->sa_replay_window, str_policy(c->policy
, &pb), (((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : ""); } }
   c->sa_keying_tries,{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s"
, deltasecs(c->sa_ike_life_seconds), deltasecs(c->sa_ipsec_life_seconds
), deltasecs(c->sa_rekey_margin), c->sa_rekey_fuzz, c->
sa_keying_tries, c->sa_replay_window, str_policy(c->policy
, &pb), (((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : ""); } }
   c->sa_replay_window,{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s"
, deltasecs(c->sa_ike_life_seconds), deltasecs(c->sa_ipsec_life_seconds
), deltasecs(c->sa_rekey_margin), c->sa_rekey_fuzz, c->
sa_keying_tries, c->sa_replay_window, str_policy(c->policy
, &pb), (((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : ""); } }
   str_policy(c->policy, &pb),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s"
, deltasecs(c->sa_ike_life_seconds), deltasecs(c->sa_ipsec_life_seconds
), deltasecs(c->sa_rekey_margin), c->sa_rekey_fuzz, c->
sa_keying_tries, c->sa_replay_window, str_policy(c->policy
, &pb), (((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : ""); } }
   NEVER_NEGOTIATE(c->policy) ? "+NEVER_NEGOTIATE" : ""){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("ike_life: %jd; ipsec_life: %jds; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu; replay_window: %u; policy: %s%s"
, deltasecs(c->sa_ike_life_seconds), deltasecs(c->sa_ipsec_life_seconds
), deltasecs(c->sa_rekey_margin), c->sa_rekey_fuzz, c->
sa_keying_tries, c->sa_replay_window, str_policy(c->policy
, &pb), (((((c->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : ""); } };
char topo[CONN_BUF_LEN(2 * ((sizeof(subnet_buf) + sizeof(address_buf) + sizeof(id_buf
) + sizeof(subnet_buf) + 10) - 1) + 4)];
dbg("%s", format_connection(topo, sizeof(topo), c, &c->spd)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s", format_connection(topo, sizeof(topo), c,
 &c->spd)); } };
/* XXX: something better? */
close_any(&c->logger->global_whackfd)close_any_fd((&c->logger->global_whackfd), ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2162, }; &here; }));
2163}

2165/*
* Derive a template connection from a group connection and target.
* Similar to instantiate().  Happens at whack --listen.  Returns name
* of new connection.  NULL on failure (duplicated name).  Caller is
* responsible for pfreeing name.
*/
2171struct connection *add_group_instance(struct connection *group,
		      const ip_selector *target,
		      uint8_t proto , uint16_t sport , uint16_t dport)
2174{
passert(group->kind == CK_GROUP)({ _Bool assertion__ = group->kind == CK_GROUP; if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 2175
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "group->kind == CK_GROUP"
); } (void) 1; });
passert(oriented(group))({ _Bool assertion__ = oriented(group); if (!assertion__) { where_t
 here = ({ static const struct where here = { .func = __func__
, .file = "programs/pluto/connections.c", .line = 2176, }; &
here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "oriented(group)"); } (void
) 1; });

/*
* Manufacture a unique name for this template.
*/
char *namebuf; /* must free */

subnet_buf targetbuf;
str_selector_subnet(target, &targetbuf);

if (proto == 0) {
namebuf = alloc_printf("%s#%s", group->name, targetbuf.buf);
} else {
namebuf = alloc_printf("%s#%s-(%d--%d--%d)", group->name,
		       targetbuf.buf, sport, proto, dport);
}

if (conn_by_name(namebuf, false0/*!strict*/) != NULL((void*)0)) {
llog(RC_DUPNAME, group->logger,
     "group name + target yields duplicate name \"%s\"", namebuf);
pfreeany(namebuf){ typeof(namebuf) *pp_ = &(namebuf); if (*pp_ != ((void*)
0)) { pfree(*pp_); *pp_ = ((void*)0); } };
return NULL((void*)0);
}

struct connection *t = clone_connection(namebuf, group, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2200, }; &here
; }));
passert(namebuf != t->name)({ _Bool assertion__ = namebuf != t->name; if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 2201
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "namebuf != t->name");
 } (void) 1; }); /* see clone_connection() */
pfreeany(namebuf){ typeof(namebuf) *pp_ = &(namebuf); if (*pp_ != ((void*)
0)) { pfree(*pp_); *pp_ = ((void*)0); } };
t->foodgroup = t->name; /* XXX: DANGER: unshare_connection() will clone this */

/* suppress virt before unsharing */
passert(t->spd.this.virt == NULL)({ _Bool assertion__ = t->spd.this.virt == ((void*)0); if (
!assertion__) { where_t here = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2206, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "t->spd.this.virt == ((void*)0)"
); } (void) 1; });

pexpect(t->spd.spd_next == NULL)({ _Bool assertion__ = t->spd.spd_next == ((void*)0); if (
!assertion__) { where_t here_ = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2208, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_pexpect(logger_, here_, "%s", "t->spd.spd_next == ((void*)0)"
); } assertion__; });	/* we only handle top spd */

if (t->spd.that.virt != NULL((void*)0)) {
DBG_log("virtual_ip not supported in group instance; ignored");
virtual_ip_delref(&t->spd.that.virt, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2212, }; &here
; }));
}

unshare_connection(t);
passert(t->foodgroup != t->name)({ _Bool assertion__ = t->foodgroup != t->name; if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 2216
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "t->foodgroup != t->name"
); } (void) 1; }); /* XXX: see DANGER above */

t->spd.that.client = *target;
if (proto != 0) {
/* if foodgroup entry specifies protoport, override protoport= settings */
t->spd.this.protocol = proto;
t->spd.that.protocol = proto;
t->spd.this.port = sport;
t->spd.that.port = dport;
}
t->policy &= ~(POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX)) | POLICY_GROUTED((lset_t)1 << (POLICY_GROUTED_IX)));
t->policy |= POLICY_GROUPINSTANCE((lset_t)1 << (POLICY_GROUPINSTANCE_IX)); /* mark as group instance for later */
t->kind = (address_is_unset(&t->spd.that.host_addr) || address_is_any(t->spd.that.host_addr)) &&
!NEVER_NEGOTIATE(t->policy)(((((t->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ?
CK_TEMPLATE : CK_INSTANCE;

/* reset log file info */
t->log_file_name = NULL((void*)0);
t->log_file = NULL((void*)0);
t->log_file_err = false0;

t->spd.reqid = group->sa_reqid == 0 ? gen_reqid() : group->sa_reqid;
dbg("%s t->spd.reqid=%d because group->sa_reqid=%d",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s t->spd.reqid=%d because group->sa_reqid=%d"
, t->name, t->spd.reqid, group->sa_reqid); } }
   t->name, t->spd.reqid, group->sa_reqid){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s t->spd.reqid=%d because group->sa_reqid=%d"
, t->name, t->spd.reqid, group->sa_reqid); } };

/* same host_pair as parent: stick after parent on list */
/* t->hp_next = group->hp_next; */	/* done by clone_thing */
group->hp_next = t;

/* route if group is routed */
if (group->policy & POLICY_GROUTED((lset_t)1 << (POLICY_GROUTED_IX))) {
/* XXX: something better? */
close_any(&t->logger->global_whackfd)close_any_fd((&t->logger->global_whackfd), ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2248, }; &here; }));
t->logger->global_whackfd = fd_dup(group->logger->global_whackfd, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2249, }; &here
; }));
if (!trap_connection(t)) {
	llog(WHACK_STREAM|RC_ROUTE, group->logger,
	     "could not route");
}
/* XXX: something better? */
close_any(&t->logger->global_whackfd)close_any_fd((&t->logger->global_whackfd), ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2255, }; &here; }));
}
return t;
2258}

2260/*
* Common part of instantiating a Road Warrior or Opportunistic connection.
* peers_id can be used to carry over an ID discovered in Phase 1.
* It must not disagree with the one in c, but if that is unspecified,
* the new connection will use peers_id.
* If peers_id is NULL, and c.that.id is uninstantiated (ID_NONE), the
* new connection will continue to have an uninstantiated that.id.
* Note: instantiation does not affect port numbers.
*
* Note that instantiate can only deal with a single SPD/eroute.
*/
2271struct connection *instantiate(struct connection *c,
	       const ip_address *peer_addr,
	       const struct id *peer_id,
	       shunk_t sec_label)
2275{
passert(c->kind == CK_TEMPLATE)({ _Bool assertion__ = c->kind == CK_TEMPLATE; if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 2276
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "c->kind == CK_TEMPLATE"
); } (void) 1; });
passert(c->spd.spd_next == NULL)({ _Bool assertion__ = c->spd.spd_next == ((void*)0); if (
!assertion__) { where_t here = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2277, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "c->spd.spd_next == ((void*)0)"
); } (void) 1; });

/*
* Is the new connection still a template?
*
* For instance, a responder with a template connection T with
* both remote=%any and configuration sec_label will:
*
* - during IKE_SA_INIT, instantiate T with the remote
       *   address; creating a new template T.IKE (since the
       *   negotiated sec_label isn't known it is still a template)
*
* - during IKE_AUTH (or CREATE_CHILD_SA), instantate T.IKE
*   with the Child SA's negotiated SEC_LABEL creating the
*   connection instance C.CHILD
*/
enum connection_kind kind;
if (c->config->sec_label.len > 0) {
/*
 * Either:
 *
 * - C is T, and D is T.IKE (the remote address is
 *   updated below) -> CK_TEMPLATE
 *
 * Or:
 *
 * - or C is T.IKE and D is C.CHILD (the sec_label is
 *   updated below) -> CK_INSTANCE
 */
pexpect(address_is_specified(c->spd.that.host_addr) || peer_addr != NULL)({ _Bool assertion__ = address_is_specified(c->spd.that.host_addr
) || peer_addr != ((void*)0); if (!assertion__) { where_t here_
 = ({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2306, }; &here
; }); const struct logger *logger_ = &failsafe_logger; llog_pexpect
(logger_, here_, "%s", "address_is_specified(c->spd.that.host_addr) || peer_addr != ((void*)0)"
); } assertion__; });
if (sec_label.len == 0) {
	kind = CK_TEMPLATE;
} else {
	kind = CK_INSTANCE;
}
} else {
/* pexpect(address_is_specified(c->spd.that.host_addr) || peer_addr != NULL); true??? */
kind = CK_INSTANCE;
}

c->instance_serial++;
struct connection *d = clone_connection(c->name, c, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2318, }; &here
; }));
passert(c->name != d->name)({ _Bool assertion__ = c->name != d->name; if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 2319
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "c->name != d->name"
); } (void) 1; }); /* see clone_connection() */
if (peer_id != NULL((void*)0)) {
int wildcards;	/* value ignored */

passert(d->spd.that.id.kind == ID_FROMCERT || match_id(peer_id, &d->spd.that.id, &wildcards))({ _Bool assertion__ = d->spd.that.id.kind == ID_FROMCERT ||
 match_id(peer_id, &d->spd.that.id, &wildcards); if
 (!assertion__) { where_t here = ({ static const struct where
 here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2323, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "d->spd.that.id.kind == ID_FROMCERT || match_id(peer_id, &d->spd.that.id, &wildcards)"
); } (void) 1; });
d->spd.that.id = *peer_id;
d->spd.that.has_id_wildcards = false0;
}
unshare_connection(d);
d->kind = kind;
passert(oriented(d))({ _Bool assertion__ = oriented(d); if (!assertion__) { where_t
 here = ({ static const struct where here = { .func = __func__
, .file = "programs/pluto/connections.c", .line = 2329, }; &
here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "oriented(d)"); } (void) 1
; });
if (peer_addr != NULL((void*)0)) {
d->spd.that.host_addr = *peer_addr;
}
update_ends_from_this_host_addr(&d->spd.that, &d->spd.this);

/*
* We cannot guess what our next_hop should be, but if it was
* explicitly specified as 0.0.0.0, we set it to be peer.
* (whack will not allow nexthop to be elided in RW case.)
*/
update_ends_from_this_host_addr(&d->spd.this, &d->spd.that);
d->spd.spd_next = NULL((void*)0);

d->spd.reqid = c->sa_reqid == 0 ? gen_reqid() : c->sa_reqid;
dbg("%s d->spd.reqid=%d because c->sa_reqid=%d",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s d->spd.reqid=%d because c->sa_reqid=%d"
, d->name, d->spd.reqid, c->sa_reqid); } }
   d->name, d->spd.reqid, c->sa_reqid){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s d->spd.reqid=%d because c->sa_reqid=%d"
, d->name, d->spd.reqid, c->sa_reqid); } };

/* since both ends updated; presumably already oriented? */
set_policy_prio(d);

/* set internal fields */
d->spd.routing = RT_UNROUTED;
d->newest_ike_sa = SOS_NOBODY0;
d->newest_ipsec_sa = SOS_NOBODY0;
d->spd.eroute_owner = SOS_NOBODY0;

/* reset log file info */
d->log_file_name = NULL((void*)0);
d->log_file = NULL((void*)0);
d->log_file_err = false0;

if (c->sa_marks.in.unique) {
d->sa_marks.in.val = global_marks;
d->sa_marks.out.val = global_marks;
global_marks++;
if (global_marks == UINT_MAX(2147483647 *2U +1U) - 1) {
	/* we hope 2^32 connections ago are no longer around */
	global_marks = MINIMUM_IPSEC_SA_RANDOM_MARK65536;
}
}

/* assumption: orientation is the same as c's */
connect_to_host_pair(d);

if (sec_label.len > 0) {
/*
 * Install the sec_label from either an acquire or
 * child payload into both ends.
 */
FOR_EACH_THING(end, &d->spd.this, &d->spd.that)for (typeof(&d->spd.this) things_[] = { &d->spd
.this, &d->spd.that }, *thingp_ = things_, end; thingp_
 < things_ + (sizeof(things_) / sizeof(*(things_))) ? (end
 = *thingp_, 1) : 0; thingp_++) {
	pexpect(end->sec_label.ptr == NULL)({ _Bool assertion__ = end->sec_label.ptr == ((void*)0); if
 (!assertion__) { where_t here_ = ({ static const struct where
 here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2380, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_pexpect(logger_, here_, "%s", "end->sec_label.ptr == ((void*)0)"
); } assertion__; });
	end->sec_label = clone_hunk(sec_label, "instantiate() sec_label")({ typeof(sec_label) hunk_ = sec_label; clone_bytes_as_chunk(
hunk_.ptr, hunk_.len, "instantiate() sec_label"); });
}
}

connection_buf cb, db;
address_buf pab;
id_buf pib;
dbg("instantiated "PRI_CO" "PRI_CONNECTION" as "PRI_CO" "PRI_CONNECTION" using kind=%s remote_address=%s remote_id=%s sec_label="PRI_SHUNK,{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("instantiated ""$%u"" ""\"%s\"%s"" as ""$%u"" "
"\"%s\"%s"" using kind=%s remote_address=%s remote_id=%s sec_label="
"%.*s", ((c->serialno)), (c)->name, str_connection_instance
(c, &cb), ((d->serialno)), (d)->name, str_connection_instance
(d, &db), enum_name(&connection_kind_names, d->kind
), peer_addr != ((void*)0) ? str_address(peer_addr, &pab)
 : "N/A", peer_id != ((void*)0) ? str_id_bytes(peer_id, jam_raw_bytes
, &pib) : "N/A", ((int) (d->spd.this.sec_label).len), (
const char *) ((d->spd.this.sec_label).ptr)); } }
   pri_co(c->serialno), pri_connection(c, &cb),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("instantiated ""$%u"" ""\"%s\"%s"" as ""$%u"" "
"\"%s\"%s"" using kind=%s remote_address=%s remote_id=%s sec_label="
"%.*s", ((c->serialno)), (c)->name, str_connection_instance
(c, &cb), ((d->serialno)), (d)->name, str_connection_instance
(d, &db), enum_name(&connection_kind_names, d->kind
), peer_addr != ((void*)0) ? str_address(peer_addr, &pab)
 : "N/A", peer_id != ((void*)0) ? str_id_bytes(peer_id, jam_raw_bytes
, &pib) : "N/A", ((int) (d->spd.this.sec_label).len), (
const char *) ((d->spd.this.sec_label).ptr)); } }
   pri_co(d->serialno), pri_connection(d, &db),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("instantiated ""$%u"" ""\"%s\"%s"" as ""$%u"" "
"\"%s\"%s"" using kind=%s remote_address=%s remote_id=%s sec_label="
"%.*s", ((c->serialno)), (c)->name, str_connection_instance
(c, &cb), ((d->serialno)), (d)->name, str_connection_instance
(d, &db), enum_name(&connection_kind_names, d->kind
), peer_addr != ((void*)0) ? str_address(peer_addr, &pab)
 : "N/A", peer_id != ((void*)0) ? str_id_bytes(peer_id, jam_raw_bytes
, &pib) : "N/A", ((int) (d->spd.this.sec_label).len), (
const char *) ((d->spd.this.sec_label).ptr)); } }
   enum_name(&connection_kind_names, d->kind),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("instantiated ""$%u"" ""\"%s\"%s"" as ""$%u"" "
"\"%s\"%s"" using kind=%s remote_address=%s remote_id=%s sec_label="
"%.*s", ((c->serialno)), (c)->name, str_connection_instance
(c, &cb), ((d->serialno)), (d)->name, str_connection_instance
(d, &db), enum_name(&connection_kind_names, d->kind
), peer_addr != ((void*)0) ? str_address(peer_addr, &pab)
 : "N/A", peer_id != ((void*)0) ? str_id_bytes(peer_id, jam_raw_bytes
, &pib) : "N/A", ((int) (d->spd.this.sec_label).len), (
const char *) ((d->spd.this.sec_label).ptr)); } }
   peer_addr != NULL ? str_address(peer_addr, &pab) : "N/A",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("instantiated ""$%u"" ""\"%s\"%s"" as ""$%u"" "
"\"%s\"%s"" using kind=%s remote_address=%s remote_id=%s sec_label="
"%.*s", ((c->serialno)), (c)->name, str_connection_instance
(c, &cb), ((d->serialno)), (d)->name, str_connection_instance
(d, &db), enum_name(&connection_kind_names, d->kind
), peer_addr != ((void*)0) ? str_address(peer_addr, &pab)
 : "N/A", peer_id != ((void*)0) ? str_id_bytes(peer_id, jam_raw_bytes
, &pib) : "N/A", ((int) (d->spd.this.sec_label).len), (
const char *) ((d->spd.this.sec_label).ptr)); } }
   peer_id != NULL ? str_id(peer_id, &pib) : "N/A",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("instantiated ""$%u"" ""\"%s\"%s"" as ""$%u"" "
"\"%s\"%s"" using kind=%s remote_address=%s remote_id=%s sec_label="
"%.*s", ((c->serialno)), (c)->name, str_connection_instance
(c, &cb), ((d->serialno)), (d)->name, str_connection_instance
(d, &db), enum_name(&connection_kind_names, d->kind
), peer_addr != ((void*)0) ? str_address(peer_addr, &pab)
 : "N/A", peer_id != ((void*)0) ? str_id_bytes(peer_id, jam_raw_bytes
, &pib) : "N/A", ((int) (d->spd.this.sec_label).len), (
const char *) ((d->spd.this.sec_label).ptr)); } }
   pri_shunk(d->spd.this.sec_label)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("instantiated ""$%u"" ""\"%s\"%s"" as ""$%u"" "
"\"%s\"%s"" using kind=%s remote_address=%s remote_id=%s sec_label="
"%.*s", ((c->serialno)), (c)->name, str_connection_instance
(c, &cb), ((d->serialno)), (d)->name, str_connection_instance
(d, &db), enum_name(&connection_kind_names, d->kind
), peer_addr != ((void*)0) ? str_address(peer_addr, &pab)
 : "N/A", peer_id != ((void*)0) ? str_id_bytes(peer_id, jam_raw_bytes
, &pib) : "N/A", ((int) (d->spd.this.sec_label).len), (
const char *) ((d->spd.this.sec_label).ptr)); } };

return d;
2397}

2399struct connection *rw_instantiate(struct connection *c,
		  const ip_address *peer_addr,
		  const ip_selector *peer_subnet,
		  const struct id *peer_id)
2403{
struct connection *d = instantiate(c, peer_addr, peer_id, null_shunk);

if (peer_subnet != NULL((void*)0) && is_virtual_connection(c)) {
d->spd.that.client = *peer_subnet;
if (selector_eq_address(*peer_subnet, *peer_addr))
	d->spd.that.has_client = false0;
}

if (d->policy & POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX))) {
/*
 * This must be before we know the client addresses.
 * Fill in one that is impossible. This prevents anyone else
 * from trying to use this connection to get to a particular
 * client
 */
d->spd.that.client = selector_type(&d->spd.that.client)->selector.zero;
}
connection_buf inst;
address_buf b;
dbg("rw_instantiate() instantiated "PRI_CONNECTION" for %s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("rw_instantiate() instantiated ""\"%s\"%s"" for %s"
, (d)->name, str_connection_instance(d, &inst), str_address
(peer_addr, &b)); } }
   pri_connection(d, &inst),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("rw_instantiate() instantiated ""\"%s\"%s"" for %s"
, (d)->name, str_connection_instance(d, &inst), str_address
(peer_addr, &b)); } }
   str_address(peer_addr, &b)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("rw_instantiate() instantiated ""\"%s\"%s"" for %s"
, (d)->name, str_connection_instance(d, &inst), str_address
(peer_addr, &b)); } };
return d;
2427}

2429/* priority formatting */
2430size_t jam_policy_prio(struct jambuf *buf, policy_prio_t pp)
2431{
if (pp == BOTTOM_PRIO((policy_prio_t)0)) {
return jam_string(buf, "0");
}

return jam(buf, "%" PRIu32"u" ",%" PRIu32"u",
   pp >> 17, (pp & ~(~(policy_prio_t)0 << 17)) >> 8);
2438}

2440const char *str_policy_prio(policy_prio_t pp, policy_prio_buf *buf)
2441{
struct jambuf jb = ARRAY_AS_JAMBUF(buf->buf)array_as_jambuf((buf->buf), sizeof(buf->buf));
jam_policy_prio(&jb, pp);
return buf->buf;
2445}

2447void set_policy_prio(struct connection *c)
2448{
c->policy_prio = (((policy_prio_t)c->spd.this.client.maskbits << 17) |
	  ((policy_prio_t)c->spd.that.client.maskbits << 8) |
	  ((policy_prio_t)1));
2452}

2454/*
* Format any information needed to identify an instance of a connection.
* Fills any needed information into buf which MUST be big enough.
* Road Warrior: peer's IP address
* Opportunistic: [" " myclient "==="] " ..." peer ["===" peer_client] '\0'
*/

2461static size_t jam_connection_client(struct jambuf *b,
		    const char *prefix, const char *suffix,
		    const ip_selector client,
		    const ip_address host_addr)
2465{
size_t s = 0;
if (selector_range_eq_address(client, host_addr)) {
/* compact denotation for "self" */
} else {
s += jam_string(b, prefix);
if (selector_is_unset(&client)) {
	s += jam_string(b, "?");
} else if (selector_is_zero(client)) {
	s += jam_string(b, "?"); /* unknown */
} else {
	s += jam_selector_subnet(b, &client);
}
s += jam_string(b, suffix);
}
return s;
2481}

2483size_t jam_connection_instance(struct jambuf *buf, const struct connection *c)
2484{
if (!pexpect(c->kind == CK_INSTANCE ||({ _Bool assertion__ = c->kind == CK_INSTANCE || c->kind
 == CK_GOING_AWAY; if (!assertion__) { where_t here_ = ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2486, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_pexpect(logger_, here_, "%s", "c->kind == CK_INSTANCE || c->kind == CK_GOING_AWAY"
); } assertion__; })
     c->kind == CK_GOING_AWAY)({ _Bool assertion__ = c->kind == CK_INSTANCE || c->kind
 == CK_GOING_AWAY; if (!assertion__) { where_t here_ = ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2486, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_pexpect(logger_, here_, "%s", "c->kind == CK_INSTANCE || c->kind == CK_GOING_AWAY"
); } assertion__; })) {
return 0;
}
size_t s = 0;
if (c->instance_serial != 0) {
s += jam(buf, "[%lu]", c->instance_serial);
}
if (c->policy & POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX))) {
s += jam_connection_client(buf, " ", "===",
			   c->spd.this.client,
			   c->spd.this.host_addr);
s += jam_string(buf, " ...");
s += jam_address(buf, &c->spd.that.host_addr);
s += jam_connection_client(buf, "===", "",
			   c->spd.that.client,
			   c->spd.that.host_addr);
} else {
s += jam_string(buf, " ");
s += jam_address_sensitive(buf, &c->spd.that.host_addr);
}
return s;
2507}

2509size_t jam_connection(struct jambuf *buf, const struct connection *c)
2510{
size_t s = 0;
s += jam(buf, "\"%s\"", c->name);
if (c->kind == CK_INSTANCE || c->kind == CK_GOING_AWAY) {
s += jam_connection_instance(buf, c);
}
return s;
2517}

2519const char *str_connection_instance(const struct connection *c, connection_buf *buf)
2520{
struct jambuf p = ARRAY_AS_JAMBUF(buf->buf)array_as_jambuf((buf->buf), sizeof(buf->buf));
if (c->kind == CK_INSTANCE) {
jam_connection_instance(&p, c);
}
return buf->buf;
2526}

2528/*
* Find an existing connection for a trapped outbound packet.
*
* This is attempted before we bother with gateway discovery.
*   + this connection is routed or instance_of_routed_template
*     (i.e. approved for on-demand)
*   + this subnet contains our_client (or we are our_client)
*   + that subnet contains peer_client (or peer is peer_client)
*   + don't care about Phase 1 IDs (we don't know)
* Note: result may still need to be instantiated.
* The winner has the highest policy priority.
*
* If there are several with that priority, we give preference to the
* first one that is an instance.
*
* See also build_outgoing_opportunistic_connection.
*/
2545struct connection *find_connection_for_clients(struct spd_route **srp,
			       const ip_endpoint *local_client,
			       const ip_endpoint *remote_client,
			       shunk_t sec_label, struct logger *logger)
2549{
passert(!endpoint_is_unset(local_client))({ _Bool assertion__ = !endpoint_is_unset(local_client); if (
!assertion__) { where_t here = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2550, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "!endpoint_is_unset(local_client)"
); } (void) 1; });
passert(!endpoint_is_unset(remote_client))({ _Bool assertion__ = !endpoint_is_unset(remote_client); if (
!assertion__) { where_t here = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2551, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "!endpoint_is_unset(remote_client)"
); } (void) 1; });
passert(endpoint_protocol(*local_client) == endpoint_protocol(*remote_client))({ _Bool assertion__ = endpoint_protocol(*local_client) == endpoint_protocol
(*remote_client); if (!assertion__) { where_t here = ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2552, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "endpoint_protocol(*local_client) == endpoint_protocol(*remote_client)"
); } (void) 1; });

int local_port = endpoint_hport(*local_client);
int remote_port = endpoint_hport(*remote_client);

struct connection *best = NULL((void*)0);
policy_prio_t best_prio = BOTTOM_PRIO((policy_prio_t)0);
struct spd_route *best_sr = NULL((void*)0);

endpoints_buf eb;
dbg("find_connection: looking for policy for connection: %s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("find_connection: looking for policy for connection: %s"
, str_endpoints(local_client, remote_client, &eb)); } }
   str_endpoints(local_client, remote_client, &eb)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("find_connection: looking for policy for connection: %s"
, str_endpoints(local_client, remote_client, &eb)); } };

struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2565, }; &here
; }), .c = NULL((void*)0), };
while (new2old_connection(&cq)) {
struct connection *c = cq.c;

if (c->kind == CK_GROUP) {
	continue;
}

/*
 * For both IKEv1 and IKEv2 labeled IPsec, don't try
 * to mix 'n' match acquire sec_label with
 * non-sec_label connection.
 */
if ((sec_label.len > 0) != (c->config->sec_label.len > 0)) {
	continue;
}

/*
 * For IKEv2 labeled IPsec, always start with the
 * template.  Who are we to argue if the kernel asks
 * for a new SA with, seemingly, a security label that
 * matches an existing connection instance.
 */
if (c->ike_version == IKEv2 &&
    c->config->sec_label.len > 0 &&
    c->kind != CK_TEMPLATE) {
	pexpect(c->kind == CK_INSTANCE)({ _Bool assertion__ = c->kind == CK_INSTANCE; if (!assertion__
) { where_t here_ = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 2591
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_pexpect(logger_, here_, "%s", "c->kind == CK_INSTANCE"
); } assertion__; });
	connection_buf cb;
	dbg("skipping non-template IKEv2 "PRI_CONNECTION" with a security label",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("skipping non-template IKEv2 ""\"%s\"%s"" with a security label"
, (c)->name, str_connection_instance(c, &cb)); } }
	    pri_connection(c, &cb)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("skipping non-template IKEv2 ""\"%s\"%s"" with a security label"
, (c)->name, str_connection_instance(c, &cb)); } };
	continue;
}

/*
 * When there is a sec_label, it needs to be within
 * the configuration's range.
 */
if (sec_label.len > 0 /*implies c->config->sec_label*/ &&
    !sec_label_within_range(sec_label, c->config->sec_label, logger)) {
	continue;
}

struct spd_route *sr;

for (sr = &c->spd; best != c && sr; sr = sr->spd_next) {

	/*
	 * XXX: is the !sec_label an IKEv1 thing?  An
	 * IKEv2 sec-labeled connection should have
	 * been routed by now?
	 */
	if (!routed(sr->routing)((sr->routing) > RT_UNROUTED_HOLD) &&
	    !c->instance_initiation_ok &&
	    c->config->sec_label.len == 0) {
		continue;
	}

	/*
	 * The triggering traffic needs to be within
	 * the client.
	 */
	if (!endpoint_in_selector(*local_client, sr->this.client) ||
	    !endpoint_in_selector(*remote_client, sr->that.client)) {
		continue;
	}

	unsigned ipproto = endpoint_protocol(*local_client)->ipproto;
	policy_prio_t prio =
		(8 * (c->policy_prio + (c->kind == CK_INSTANCE)) +
		 2 * (sr->this.port == local_port) +
		 2 * (sr->that.port == remote_port) +
		 1 * (sr->this.protocol == ipproto));

	if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
		connection_buf cib_c;
		selectors_buf sb;
		DBG_log("find_connection: conn "PRI_CONNECTION"\"%s\"%s"" has compatible peers: %s [pri: %" PRIu32"u" "]",
			pri_connection(c, &cib_c)(c)->name, str_connection_instance(c, &cib_c),
			str_selectors(&c->spd.this.client, &c->spd.that.client, &sb),
			prio);
		if (best == NULL((void*)0)) {
			DBG_log("find_connection: first OK "PRI_CONNECTION"\"%s\"%s"" [pri:%" PRIu32"u" "]{%p} (child %s)",
				pri_connection(c, &cib_c)(c)->name, str_connection_instance(c, &cib_c),
				prio, c,
				c->policy_next ?
				c->policy_next->name :
				"none");
		} else {
			connection_buf cib_best;
			DBG_log("find_connection: comparing best "PRI_CONNECTION"\"%s\"%s"" [pri:%" PRIu32"u" "]{%p} (child %s) to "PRI_CONNECTION"\"%s\"%s"" [pri:%" PRIu32"u" "]{%p} (child %s)",
				pri_connection(best, &cib_best)(best)->name, str_connection_instance(best, &cib_best),
				best_prio,
				best,
				best->policy_next ?
				best->policy_next->name :
				"none",
				pri_connection(c, &cib_c)(c)->name, str_connection_instance(c, &cib_c),
				prio, c,
				c->policy_next ?
				c->policy_next->name :
				"none");
		}
	}

	if (best == NULL((void*)0) || prio > best_prio) {
		best = c;
		best_sr = sr;
		best_prio = prio;
	}
}
}

if (best != NULL((void*)0) && NEVER_NEGOTIATE(best->policy)(((((best->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))))
best = NULL((void*)0);

if (srp != NULL((void*)0) && best != NULL((void*)0))
*srp = best_sr;

if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
if (best != NULL((void*)0)) {
	connection_buf cib;
	DBG_log("find_connection: concluding with "PRI_CONNECTION"\"%s\"%s"" [pri:%" PRIu32"u" "]{%p} kind=%s",
		pri_connection(best, &cib)(best)->name, str_connection_instance(best, &cib),
		best_prio, best,
		enum_name(&connection_kind_names, best->kind));
} else {
	DBG_log("find_connection: concluding with empty");
}
}

return best;
2696}

2698struct connection *oppo_instantiate(struct connection *c,
		    const struct id *remote_id,
		    /* both host and client */
		    const ip_address *local_address,
		    const ip_address *remote_address)
2703{
passert(local_address != NULL)({ _Bool assertion__ = local_address != ((void*)0); if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 2704
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "local_address != ((void*)0)"
); } (void) 1; });
passert(remote_address != NULL)({ _Bool assertion__ = remote_address != ((void*)0); if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 2705
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "remote_address != ((void*)0)"
); } (void) 1; });
address_buf lb, rb;
dbg("oppo instantiating c=\"%s\" with c->routing %s between %s -> %s",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("oppo instantiating c=\"%s\" with c->routing %s between %s -> %s"
, c->name, enum_name(&routing_story, c->spd.routing
), str_address(local_address, &lb), str_address(remote_address
, &rb)); } }
   c->name, enum_name(&routing_story, c->spd.routing),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("oppo instantiating c=\"%s\" with c->routing %s between %s -> %s"
, c->name, enum_name(&routing_story, c->spd.routing
), str_address(local_address, &lb), str_address(remote_address
, &rb)); } }
   str_address(local_address, &lb), str_address(remote_address, &rb)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("oppo instantiating c=\"%s\" with c->routing %s between %s -> %s"
, c->name, enum_name(&routing_story, c->spd.routing
), str_address(local_address, &lb), str_address(remote_address
, &rb)); } };

struct connection *d = instantiate(c, remote_address, remote_id, null_shunk);

passert(d->spd.spd_next == NULL)({ _Bool assertion__ = d->spd.spd_next == ((void*)0); if (
!assertion__) { where_t here = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2713, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "d->spd.spd_next == ((void*)0)"
); } (void) 1; });

/* fill in our client side */
if (d->spd.this.has_client) {
/*
 * There was a client in the abstract connection so we
 * demand that either ...
 */

/* opportunistic connections do not use port selectors */
if (address_in_selector_range(*local_address, d->spd.this.client)) {
	/*
	 * the required client is within that subnet
	 * narrow it(?), ...
	*/
	d->spd.this.client = selector_from_address(*local_address);
} else if (address_eq_address(*local_address, d->spd.this.host_addr)) {
	/*
	 * or that it is our private ip in case we are
	 * behind a port forward.
	 */
	update_selector_hport(&d->spd.this.client, 0){ (&d->spd.this.client)->hport = (0); };
} else {
	passert_failllog_passert(c->logger, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2736, }; &here
; }),
		     "local address does not match the host or client");
}
} else {
/*
 * There was no client in the abstract connection so
 * we demand that the required client be the host.
 */
passert(address_eq_address(*local_address, d->spd.this.host_addr))({ _Bool assertion__ = address_eq_address(*local_address, d->
spd.this.host_addr); if (!assertion__) { where_t here = ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2744, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "address_eq_address(*local_address, d->spd.this.host_addr)"
); } (void) 1; });
}

/*
* Fill in peer's client side.
* If the client is the peer, excise the client from the connection.
*/
passert(d->policy & POLICY_OPPORTUNISTIC)({ _Bool assertion__ = d->policy & ((lset_t)1 <<
 (POLICY_OPPORTUNISTIC_IX)); if (!assertion__) { where_t here
 = ({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2751, }; &here
; }); const struct logger *logger_ = &failsafe_logger; llog_passert
(logger_, here, "%s", "d->policy & ((lset_t)1 << (POLICY_OPPORTUNISTIC_IX))"
); } (void) 1; });
passert(address_in_selector_range(*remote_address, d->spd.that.client))({ _Bool assertion__ = address_in_selector_range(*remote_address
, d->spd.that.client); if (!assertion__) { where_t here = (
{ static const struct where here = { .func = __func__, .file =
 "programs/pluto/connections.c", .line = 2752, }; &here; }
); const struct logger *logger_ = &failsafe_logger; llog_passert
(logger_, here, "%s", "address_in_selector_range(*remote_address, d->spd.that.client)"
); } (void) 1; });
d->spd.that.client = selector_from_address(*remote_address);

if (address_eq_address(*remote_address, d->spd.that.host_addr))
d->spd.that.has_client = false0;

/*
* Adjust routing if something is eclipsing c.
* It must be a %hold for us (hard to passert this).
* If there was another instance eclipsing, we'd be using it.
*/
if (c->spd.routing == RT_ROUTED_ECLIPSED)
d->spd.routing = RT_ROUTED_PROSPECTIVE;

/*
* Remember if the template is routed:
* if so, this instance applies for initiation
* even if it is created for responding.
*/
if (routed(c->spd.routing)((c->spd.routing) > RT_UNROUTED_HOLD))
d->instance_initiation_ok = true1;

if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
char topo[CONN_BUF_LEN(2 * ((sizeof(subnet_buf) + sizeof(address_buf) + sizeof(id_buf
) + sizeof(subnet_buf) + 10) - 1) + 4)];
connection_buf inst;
DBG_log("oppo_instantiate() instantiated "PRI_CONNECTION"\"%s\"%s"" with routing %s: %s",
	pri_connection(d, &inst)(d)->name, str_connection_instance(d, &inst),
	enum_name(&routing_story, d->spd.routing),
	format_connection(topo, sizeof(topo), d, &d->spd));
}
return d;
2783}

2785/*
* Outgoing opportunistic connection.
*
* Find and instantiate a connection for an outgoing Opportunistic connection.
* We've already discovered its gateway.
* We look for a connection such that:
*   + this is one of our interfaces
*   + this subnet contains our_client (or we are our_client)
*     (we will specialize the client). We prefer the smallest such subnet.
*   + that subnet contains peer_clent (we will specialize the client).
*     We prefer the smallest such subnet.
*   + is opportunistic
*   + that peer is NO_IP
*   + don't care about Phase 1 IDs (probably should be default)
* We could look for a connection that already had the desired peer
* (rather than NO_IP) specified, but it doesn't seem worth the
* bother.
*
* We look for the routed policy applying to the narrowest subnets.
* We only succeed if we find such a policy AND it is satisfactory.
*
* The body of the inner loop is a lot like that in
* find_connection_for_clients. In this case, we know the gateways
* that we need to instantiate an opportunistic connection.
*/
2810struct connection *build_outgoing_opportunistic_connection(const ip_endpoint *local_client,
					   const ip_endpoint *remote_client)
2812{
/*
* Did the caller do their job?
*
* Where the protocol includes a port, the endpoint ports
* don't need to match but they do need to be defined.
*
* Unfortunately rcv_whack.c calls this function with a very
* flimsy looking local/remote endpoints - both the protocol
* and the port are missing.  Hence some of the fuzzy checks
* below.
*/
pendpoint(local_client)pexpect_endpoint(local_client, ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2824, }; &here; }));
pendpoint(remote_client)pexpect_endpoint(remote_client, ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2825, }; &here; }));
pexpect(endpoint_protocol(*local_client) == endpoint_protocol(*remote_client))({ _Bool assertion__ = endpoint_protocol(*local_client) == endpoint_protocol
(*remote_client); if (!assertion__) { where_t here_ = ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2826, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_pexpect(logger_, here_, "%s", "endpoint_protocol(*local_client) == endpoint_protocol(*remote_client)"
); } assertion__; });

/*
* Go through all the "half" oriented connections (remote
* address is unset) looking for client that matches the
* local/remote endpoint.
*
* Unfortunately there's no good data structure for doing
* this, so ...
*
* Big hack: get the list of local addresses by iterating over
* the interface endpoints, and then feed the endpoint's
* address into FOR_EACH_HOST_PAIR_CONNECTION(LOCAL,UNSET).
*/
struct connection *best = NULL((void*)0);
struct spd_route *best_spd_route = NULL((void*)0);
struct iface_dev *last_iface_device = NULL((void*)0);
for (struct iface_endpoint *p = interfaces; p != NULL((void*)0); p = p->next) {
/*
 * Bigger hack: assume the interface endpoints
 * (ADDRESS:500 ADDRESS:4500) for a device are grouped
 * (mostly true, TCP, custom port?) and only search
 * when a new interface device is found.
 */
if (p->ip_dev == last_iface_device) {
	continue;
}
last_iface_device = p->ip_dev;
/*
 * Go through those connections with our address and
 * NO_IP as hosts.
 *
 * We cannot know what port the peer would use, so we
 * assume that it is pluto_port (makes debugging
 * easier).
 *
 * XXX: the port doesn't matter!
 */
FOR_EACH_HOST_PAIR_CONNECTION(p->ip_dev->id_address, unset_address, c)for (struct connection *next_ = ((void*)0), *c = next_host_pair_connection
(p->ip_dev->id_address, unset_address, &next_, 1, (
{ static const struct where here = { .func = __func__, .file =
 "programs/pluto/connections.c", .line = 2864, }; &here; }
)); c != ((void*)0); c = next_host_pair_connection(p->ip_dev
->id_address, unset_address, &next_, 0, ({ static const
 struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 2864, }; &here; }))) {

	dbg("checking %s", c->name){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("checking %s", c->name); } };
	if (c->kind == CK_GROUP)
		continue;

	/*
	 * for each sr of c, see if we have a new best
	 *
	 * Paul: while this code can reject unmatched
	 * conns, it does not find the most narrow
	 * match!
	 */
	for (struct spd_route *sr = &c->spd; sr != NULL((void*)0); sr = sr->spd_next) {
		if (!routed(sr->routing)((sr->routing) > RT_UNROUTED_HOLD)) {
			continue;
		}
		if (!endpoint_in_selector(*local_client, sr->this.client)) {
			continue;
		}
		if (!endpoint_in_selector(*remote_client, sr->that.client)) {
			continue;
		}

		/*
		 * First or better solution.
		 *
		 * The test for better is:
		 *   sr's .this is narrower, or
		 *   sr's .this is same and sr's .that is narrower.
		 * ??? not elegant, not symmetric.
		 * Possible replacement test:
		 *   best_spd_route->this.client.maskbits + best_spd_route->that.client.maskbits >
		 *   sr->this.client.maskbits + sr->that.client.maskbits
		 * but this knows too much about the representation of ip_subnet.
		 * What is the correct semantics?
		 *
		 * XXX: selector_in_selector() is
		 * exclusive - it excludes
		 * selector_eq().
		 */

		if (best_spd_route != NULL((void*)0) &&
		    selector_in_selector(best_spd_route->this.client, sr->this.client)) {
			/*
			 * BEST_SPD_ROUTE is better.
			 *
			 * BEST_SPD_ROUTE's .this is
			 * narrower than .SR's.
			 */
			continue;
		}
		if (best_spd_route != NULL((void*)0) &&
		    selector_eq_selector(best_spd_route->this.client, sr->this.client) &&
		    selector_in_selector(best_spd_route->that.client, sr->that.client)) {
			/*
			 * BEST_SPD_ROUTE is better.
			 *
			 * Since BEST_SPD_ROUTE's
			 * .this matches SR's,
			 * tie-break with
			 * BEST_SPD_ROUTE's .that
			 * being narrower than .SR's.
			 */
			continue;
		}
		best = c;
		best_spd_route = sr;
	}
}
}

if (best == NULL((void*)0) ||
   NEVER_NEGOTIATE(best->policy)(((((best->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ||
   (best->policy & POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX))) == LEMPTY((lset_t)0) ||
   best->kind != CK_TEMPLATE) {
return NULL((void*)0);
}

/* XXX we might not yet know the ID! */
ip_address local_address = endpoint_address(*local_client);
ip_address remote_address = endpoint_address(*remote_client);
return oppo_instantiate(best, NULL((void*)0), &local_address, &remote_address);
2947}

2949/*
* Find the connection to connection c's peer's client with the
* largest value of .routing.  All other things being equal,
* preference is given to c.  If none is routed, return NULL.
*
* If erop is non-null, set *erop to a connection sharing both
* our client subnet and peer's client subnet with the largest value
* of .routing.  If none is erouted, set *erop to NULL.
*
* The return value is used to find other connections sharing a route.
* *erop is used to find other connections sharing an eroute.
*/
2961struct connection *route_owner(struct connection *c,
	const struct spd_route *cur_spd,
	struct spd_route **srp,
	struct connection **erop,
	struct spd_route **esrp)
2966{
if (!oriented(c)) {
llog(RC_LOG, c->logger,
     "route_owner: connection no longer oriented - system interface change?");
return NULL((void*)0);
}

struct connection
*best_ro = c,
*best_ero = c;
struct spd_route *best_sr = NULL((void*)0),
*best_esr = NULL((void*)0);
enum routing_t best_routing = cur_spd->routing,
best_erouting = best_routing;


struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 2982, }; &here
; }), .c = NULL((void*)0), };
while (new2old_connection(&cq)) {
struct connection *d = cq.c;

if (!oriented(d))
	continue;

/*
 * consider policies different if the either in or out marks
 * differ (after masking)
 */
if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
	DBG_log(" conn %s mark %" PRIu32"u" "/%#08" PRIx32"x" ", %" PRIu32"u" "/%#08" PRIx32"x" " vs",
		c->name, c->sa_marks.in.val, c->sa_marks.in.mask,
		c->sa_marks.out.val, c->sa_marks.out.mask);
	DBG_log(" conn %s mark %" PRIu32"u" "/%#08" PRIx32"x" ", %" PRIu32"u" "/%#08" PRIx32"x",
		d->name, d->sa_marks.in.val, d->sa_marks.in.mask,
		d->sa_marks.out.val, d->sa_marks.out.mask);
}

if ( (c->sa_marks.in.val & c->sa_marks.in.mask) != (d->sa_marks.in.val & d->sa_marks.in.mask) ||
     (c->sa_marks.out.val & c->sa_marks.out.mask) != (d->sa_marks.out.val & d->sa_marks.out.mask) )
	continue;

struct spd_route *srd;

for (srd = &d->spd; srd != NULL((void*)0); srd = srd->spd_next) {
	if (srd->routing == RT_UNROUTED)
		continue;

	const struct spd_route *src;

	for (src = &c->spd; src != NULL((void*)0); src = src->spd_next) {
		if (src == srd)
			continue;

		if (!selector_range_eq_selector_range(src->that.client, srd->that.client) ||
		    src->that.protocol != srd->that.protocol ||
		    src->that.port != srd->that.port ||
		    !sameaddr(&src->this.host_addr,
				&srd->this.host_addr))
			continue;

		if (srd->routing > best_routing) {
			best_ro = d;
			best_sr = srd;
			best_routing = srd->routing;
		}

		if (selector_range_eq_selector_range(src->this.client, srd->this.client) &&
		    src->this.protocol == srd->this.protocol &&
		    src->this.port == srd->this.port &&
		    srd->routing > best_erouting)
		{
			best_ero = d;
			best_esr = srd;
			best_erouting = srd->routing;
		}
	}
}
}

LSWDBGP(DBG_BASE, buf)for (_Bool lswlog_p = (cur_debugging & (((lset_t)1 <<
 (DBG_BASE_IX)))); lswlog_p; lswlog_p = 0) for (char lswbuf[(
(size_t)1024)], *lswbuf_ = lswbuf; lswbuf_ != ((void*)0); lswbuf_
 = ((void*)0)) for (struct jambuf jambuf = array_as_jambuf((lswbuf
), sizeof(lswbuf)), *buf = &jambuf; buf != ((void*)0); buf
 = ((void*)0)) for (; buf != ((void*)0); jambuf_to_logger(buf
, &failsafe_logger, DEBUG_STREAM), buf = ((void*)0)) {
connection_buf cib;
jam(buf, "route owner of \"%s\"%s %s: ",
    pri_connection(c, &cib)(c)->name, str_connection_instance(c, &cib),
    enum_name(&routing_story, cur_spd->routing));

if (!routed(best_routing)((best_routing) > RT_UNROUTED_HOLD)) {
	jam(buf, "NULL");
} else if (best_ro == c) {
	jam(buf, "self");
} else {
	connection_buf cib;
	jam(buf, ""PRI_CONNECTION"\"%s\"%s"" %s",
	    pri_connection(best_ro, &cib)(best_ro)->name, str_connection_instance(best_ro, &cib
),
	    enum_name(&routing_story, best_routing));
}

if (erop != NULL((void*)0)) {
	jam(buf, "; eroute owner: ");
	if (!erouted(best_ero->spd.routing)((best_ero->spd.routing) != RT_UNROUTED)) {
		jam(buf, "NULL");
	} else if (best_ero == c) {
		jam(buf, "self");
	} else {
		connection_buf cib;
		jam(buf, ""PRI_CONNECTION"\"%s\"%s"" %s",
		    pri_connection(best_ero, &cib)(best_ero)->name, str_connection_instance(best_ero, &cib
),
		    enum_name(&routing_story, best_ero->spd.routing));
	}
}
}

if (erop != NULL((void*)0))
*erop = erouted(best_erouting)((best_erouting) != RT_UNROUTED) ? best_ero : NULL((void*)0);

if (srp != NULL((void*)0) ) {
*srp = best_sr;
if (esrp != NULL((void*)0) )
	*esrp = best_esr;
}

return routed(best_routing)((best_routing) > RT_UNROUTED_HOLD) ? best_ro : NULL((void*)0);
3086}

3088/*
* Extracts the peer's ca from the chained list of public keys.
*/
3091static chunk_t get_peer_ca(struct pubkey_list *const *pubkey_db,
	   const struct id *peer_id)
3093{
struct pubkey_list *p;

for (p = *pubkey_db; p != NULL((void*)0); p = p->next) {
struct pubkey *key = p->key;
if (key->type == &pubkey_type_rsa && same_id(peer_id, &key->id))
	return key->issuer;
}
return EMPTY_CHUNK((const chunk_t) { .ptr = ((void*)0), .len = 0 });
3102}

3104/*
* ??? NOTE: THESE IMPORTANT COMMENTS DO NOT REFLECT ANY CHANGES MADE AFTER FreeS/WAN.
*
* Given an up-until-now satisfactory connection, find the best connection
* now that we just got the Phase 1 Id Payload from the peer.
*
* Comments in the code describe the (tricky!) matching criteria.
*
* In RFC 2409 "The Internet Key Exchange (IKE)",
* in 5.1 "IKE Phase 1 Authenticated With Signatures", describing Main
* Mode:
*
*         Initiator                          Responder
*        -----------                        -----------
*         HDR, SA                     -->
*                                     <--    HDR, SA
*         HDR, KE, Ni                 -->
*                                     <--    HDR, KE, Nr
*         HDR*, IDii, [ CERT, ] SIG_I -->
*                                     <--    HDR*, IDir, [ CERT, ] SIG_R
*
* In 5.4 "Phase 1 Authenticated With a Pre-Shared Key":
*
*               HDR, SA             -->
*                                   <--    HDR, SA
*               HDR, KE, Ni         -->
*                                   <--    HDR, KE, Nr
*               HDR*, IDii, HASH_I  -->
*                                   <--    HDR*, IDir, HASH_R
*
* - the Responder receives the IDii payload:
*   + [PSK] after using PSK to decode this message
*   + before sending its IDir payload
*   + before using its ID in HASH_R computation
*   + [DSig] before using its private key to sign SIG_R
*   + before using the Initiator's ID in HASH_I calculation
*   + [DSig] before using the Initiator's public key to check SIG_I
*
* refine_host_connection can choose a different connection, as long as
* nothing already used is changed.
*/
3145struct connection *refine_host_connection_on_responder(const struct state *st,
				       const struct id *peer_id,
				       const struct id *tarzan_id,
				       lset_t auth_policy /* used by ikev1 */,
				       enum keyword_authby this_authby /* used by ikev2 */,
				       bool_Bool *fromcert)
3151{
struct connection *c = st->st_connection;
const generalName_t *requested_ca = st->st_requested_ca;
/* Ensure the caller and we know the IKE version we are looking for */
bool_Bool ikev1 = auth_policy != LEMPTY((lset_t)0);
bool_Bool ikev2 = this_authby != AUTHBY_UNSET;

*fromcert = false0;

passert(ikev1 != ikev2 && ikev2 == (st->st_ike_version == IKEv2))({ _Bool assertion__ = ikev1 != ikev2 && ikev2 == (st
->st_connection->ike_version == IKEv2); if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 3160
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "ikev1 != ikev2 && ikev2 == (st->st_connection->ike_version == IKEv2)"
); } (void) 1; });
passert(this_authby != AUTHBY_NEVER)({ _Bool assertion__ = this_authby != AUTHBY_NEVER; if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 3161
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "this_authby != AUTHBY_NEVER"
); } (void) 1; });

/*
* Translate the IKEv1 policy onto an IKEv2 policy.
* Saves duplicating the checks for v1 and v2, and the
* v1 policy is a subset of the v2 policy. Use the ikev2
* bool for IKEv2-only feature checks.
*/
if (ikev1) {
/* ??? are these cases mutually exclusive? */
if (LIN(POLICY_RSASIG, auth_policy)(((((lset_t)1 << (POLICY_RSASIG_IX))) & (auth_policy
)) == (((lset_t)1 << (POLICY_RSASIG_IX)))))
	this_authby = AUTHBY_RSASIG;
if (LIN(POLICY_PSK, auth_policy)(((((lset_t)1 << (POLICY_PSK_IX))) & (auth_policy))
 == (((lset_t)1 << (POLICY_PSK_IX)))))
	this_authby = AUTHBY_PSK;
passert(this_authby != AUTHBY_UNSET)({ _Bool assertion__ = this_authby != AUTHBY_UNSET; if (!assertion__
) { where_t here = ({ static const struct where here = { .func
 = __func__, .file = "programs/pluto/connections.c", .line = 3175
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "this_authby != AUTHBY_UNSET"
); } (void) 1; });
}
/* from here on, auth_policy must only be used to check POLICY_AGGRESSIVE */

connection_buf cib;
dbg("refine_host_connection for %s: starting with "PRI_CONNECTION"",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("refine_host_connection for %s: starting with "
"\"%s\"%s""", enum_name(&ike_version_names, st->st_connection
->ike_version), (c)->name, str_connection_instance(c, &
cib)); } }
   enum_name(&ike_version_names, st->st_ike_version),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("refine_host_connection for %s: starting with "
"\"%s\"%s""", enum_name(&ike_version_names, st->st_connection
->ike_version), (c)->name, str_connection_instance(c, &
cib)); } }
   pri_connection(c, &cib)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("refine_host_connection for %s: starting with "
"\"%s\"%s""", enum_name(&ike_version_names, st->st_connection
->ike_version), (c)->name, str_connection_instance(c, &
cib)); } };

/*
* Find the PEER's CA, check the per-state DB first.
*/
pexpect(st->st_remote_certs.processed)({ _Bool assertion__ = st->st_remote_certs.processed; if (
!assertion__) { where_t here_ = ({ static const struct where here
 = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 3187, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_pexpect(logger_, here_, "%s", "st->st_remote_certs.processed"
); } assertion__; });
chunk_t peer_ca = get_peer_ca(&st->st_remote_certs.pubkey_db, peer_id);

if (hunk_isempty(peer_ca)({ (peer_ca).len == 0; })) {
peer_ca = get_peer_ca(&pluto_pubkeys, peer_id);
}

{
int opl;
int ppl;

if (same_id(&c->spd.that.id, peer_id) &&
    peer_ca.ptr != NULL((void*)0) &&
    trusted_ca_nss(peer_ca, c->spd.that.ca, &ppl) &&
    ppl == 0 &&
    match_requested_ca(requested_ca, c->spd.this.ca, &opl) &&
    opl == 0) {

	connection_buf cib;
	dbg("refine_host_connection: happy with starting point: "PRI_CONNECTION"",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("refine_host_connection: happy with starting point: "
"\"%s\"%s""", (c)->name, str_connection_instance(c, &cib
)); } }
	    pri_connection(c, &cib)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("refine_host_connection: happy with starting point: "
"\"%s\"%s""", (c)->name, str_connection_instance(c, &cib
)); } };

	/*
	 * Peer ID matches current connection -- check
	 * for "you Tarzan, me Jane" (remember this is
	 * the responder).
	 */
	if (tarzan_id != NULL((void*)0)) {
		/* ??? pexpect(c->spd.spd_next == NULL); */
		if (idr_wildmatch(&c->spd.this, tarzan_id, st->st_logger)) {
			dbg("the remote specified our ID in its IDr payload"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("the remote specified our ID in its IDr payload"
); } };
			return c;
		} else {
			dbg("the remote specified an IDr that is not our ID for this connection"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("the remote specified an IDr that is not our ID for this connection"
); } };
		}
	} else {
		dbg("the remote did not specify an IDr and our current connection is good enough"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("the remote did not specify an IDr and our current connection is good enough"
); } };
		return c;
	}
}
}

/*
* The current connection won't do: search for one that will.
* First search for one with the same pair of hosts.
* If that fails, search for a suitable Road Warrior or Opportunistic
* connection (i.e. wildcard peer IP).
* We need to match:
* - peer_id (slightly complicated by instantiation)
* - if PSK auth, the key must not change (we used it to decode message)
* - policy-as-used must be acceptable to new connection
* - if initiator, also:
*   + our ID must not change (we sent it in previous message)
*   + our RSA key must not change (we used in in previous message)
*/
passert(c != NULL)({ _Bool assertion__ = c != ((void*)0); if (!assertion__) { where_t
 here = ({ static const struct where here = { .func = __func__
, .file = "programs/pluto/connections.c", .line = 3242, }; &
here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "c != ((void*)0)"); } (void
) 1; });

int best_our_pathlen = 0;
int best_peer_pathlen = 0;
struct connection *best_found = NULL((void*)0);
int best_wildcards = 0;

/* wcpip stands for: wildcard Peer IP? */
for (unsigned wcpip = 1; wcpip <= 2; wcpip++) {
/*
 * When starting second time around we're willing to
 * settle for a connection that needs Peer IP
 * instantiated: Road Warrior or Opportunistic.  Look
 * on list of connections for host pair with wildcard
 * Peer IP.
 */
ip_address remote = wcpip == 2 ? unset_address : endpoint_address(st->st_remote_endpoint);
FOR_EACH_HOST_PAIR_CONNECTION(c->interface->ip_dev->id_address, remote, d)for (struct connection *next_ = ((void*)0), *d = next_host_pair_connection
(c->interface->ip_dev->id_address, remote, &next_
, 1, ({ static const struct where here = { .func = __func__, .
file = "programs/pluto/connections.c", .line = 3259, }; &
here; })); d != ((void*)0); d = next_host_pair_connection(c->
interface->ip_dev->id_address, remote, &next_, 0, (
{ static const struct where here = { .func = __func__, .file =
 "programs/pluto/connections.c", .line = 3259, }; &here; }
))) {

	int wildcards;
	bool_Bool matching_peer_id = (c->connalias != NULL((void*)0) && d->connalias != NULL((void*)0) && 
				streq(c->connalias, d->connalias)(strcmp((c->connalias), (d->connalias)) == 0)) ||
				match_id(peer_id,
					&d->spd.that.id,
					&wildcards);

	int peer_pathlen;
	bool_Bool matching_peer_ca = trusted_ca_nss(peer_ca,
					d->spd.that.ca,
					&peer_pathlen);

	int our_pathlen;
	bool_Bool matching_requested_ca = match_requested_ca(requested_ca,
					d->spd.this.ca,
					&our_pathlen);

	if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
		connection_buf b1, b2;
		DBG_log("  refine_host_connection: checking "PRI_CONNECTION"\"%s\"%s"" against "PRI_CONNECTION"\"%s\"%s"", best=%s with match=%d(id=%d(%d)/ca=%d(%d)/reqca=%d(%d))",
			pri_connection(c, &b1)(c)->name, str_connection_instance(c, &b1), pri_connection(d, &b2)(d)->name, str_connection_instance(d, &b2),
			best_found != NULL((void*)0) ? best_found->name : "(none)",
			matching_peer_id && matching_peer_ca && matching_requested_ca,
			matching_peer_id, wildcards,
			matching_peer_ca, peer_pathlen,
			matching_requested_ca, our_pathlen);
		DBG_log("  warning: not switching back to template of current instance");
	}

	/*
	 * 'You Tarzan, me Jane' check based on
	 * received IDr (remember, this is the
	 * responder).
	 */
	if (tarzan_id != NULL((void*)0)) {
		id_buf tzb;
		esb_buf tzesb;
		dbg("    peer expects us to be %s (%s) according to its IDr payload",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    peer expects us to be %s (%s) according to its IDr payload"
, str_id_bytes(tarzan_id, jam_raw_bytes, &tzb), enum_show
(&ike_id_type_names, tarzan_id->kind, &tzesb)); } }
		    str_id(tarzan_id, &tzb),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    peer expects us to be %s (%s) according to its IDr payload"
, str_id_bytes(tarzan_id, jam_raw_bytes, &tzb), enum_show
(&ike_id_type_names, tarzan_id->kind, &tzesb)); } }
		    enum_show(&ike_id_type_names, tarzan_id->kind, &tzesb)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    peer expects us to be %s (%s) according to its IDr payload"
, str_id_bytes(tarzan_id, jam_raw_bytes, &tzb), enum_show
(&ike_id_type_names, tarzan_id->kind, &tzesb)); } };
		id_buf usb;
		esb_buf usesb;
		dbg("    this connection's local id is %s (%s)",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    this connection's local id is %s (%s)", str_id_bytes
(&d->spd.this.id, jam_raw_bytes, &usb), enum_show(
&ike_id_type_names, d->spd.this.id.kind, &usesb));
 } }
		    str_id(&d->spd.this.id, &usb),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    this connection's local id is %s (%s)", str_id_bytes
(&d->spd.this.id, jam_raw_bytes, &usb), enum_show(
&ike_id_type_names, d->spd.this.id.kind, &usesb));
 } }
		    enum_show(&ike_id_type_names, d->spd.this.id.kind, &usesb)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    this connection's local id is %s (%s)", str_id_bytes
(&d->spd.this.id, jam_raw_bytes, &usb), enum_show(
&ike_id_type_names, d->spd.this.id.kind, &usesb));
 } };
		/* ??? pexpect(d->spd.spd_next == NULL); */
		if (!idr_wildmatch(&d->spd.this, tarzan_id, st->st_logger)) {
			dbg("    skipping because peer IDr payload does not match our expected ID"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because peer IDr payload does not match our expected ID"
); } };
			continue;
		}
	} else {
		dbg("    no IDr payload received from peer"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    no IDr payload received from peer"); } };
	}

	/* only consider sec_label+template */
	if (d->config->sec_label.len > 0 && d->kind != CK_TEMPLATE) {
		dbg("    skipping because sec_label requires template"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because sec_label requires template"
); } };
		continue;
	}

	/* ignore group connections */
	if (d->policy & POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX))) {
		dbg("    skipping because group connection"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because group connection"); } };
		continue;
	}

	/* matching_peer_ca and matching_requested_ca are required */
	if (!matching_peer_ca || !matching_requested_ca) {
		dbg("    skipping because !matching_peer_ca || !matching_requested_ca"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because !matching_peer_ca || !matching_requested_ca"
); } };
		continue;
	}
	/*
	 * Check if peer_id matches, exactly or after
	 * instantiation.
	 * Check for the match but also check to see if it's
	 * the %fromcert + peer id match result. - matt
	 */
	bool_Bool d_fromcert = false0;
	if (!matching_peer_id) {
		d_fromcert = d->spd.that.id.kind == ID_FROMCERT;
		if (!d_fromcert) {
			dbg("    skipping because peer_id does not match"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because peer_id does not match")
; } };
			continue;
		}
	}

	if (d->ike_version != st->st_ike_versionst_connection->ike_version) {
		/* IKE version has to match */
		dbg("    skipping because mismatching IKE version"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because mismatching IKE version"
); } };
		continue;
	}

	/*
	 * Authentication used must fit policy of this
	 * connection.
	 */
	if (ikev1) {
		if ((auth_policy ^ d->policy) & POLICY_AGGRESSIVE((lset_t)1 << (POLICY_AGGRESSIVE_IX))) {
			dbg("    skipping because AGGRESSIVE isn't right"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because AGGRESSIVE isn't right")
; } };
			continue;	/* differ about aggressive mode */
		}

		if ((d->policy & auth_policy & ~POLICY_AGGRESSIVE((lset_t)1 << (POLICY_AGGRESSIVE_IX))) == LEMPTY((lset_t)0)) {
			/* Our auth isn't OK for this connection. */
			dbg("    skipping because AUTH isn't right"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because AUTH isn't right"); } };
			continue;
		}
	} else {
		/*
		 * We need to check if leftauth and rightauth match, but we only know
		 * what the remote end will send IKE_AUTH message..
		 * Note with IKEv2 we are guaranteed to be a RESPONDER
		 * this_authby is the received AUTH payload type in IKE_AUTH reply.
		 * This also means, we have already sent out AUTH payload, so we cannot
		 * switch away from previously used this.authby.
		 */
		if (this_authby != d->spd.that.authby) {
			dbg("    skipping because mismatched authby"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because mismatched authby"); } };
			continue;
		}
	}

	if (d->spd.this.xauth_server != c->spd.this.xauth_server) {
		/* Disallow IKEv2 CP or IKEv1 XAUTH mismatch */
		dbg("    skipping because mismatched xauthserver"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because mismatched xauthserver")
; } };
		continue;
	}

	if (d->spd.this.xauth_client != c->spd.this.xauth_client) {
		/* Disallow IKEv2 CP or IKEv1 XAUTH mismatch */
		dbg("    skipping because mismatched xauthclient"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    skipping because mismatched xauthclient")
; } };
		continue;
	}

	connection_buf b1, b2;
	dbg("    refine_host_connection: checked "PRI_CONNECTION" against "PRI_CONNECTION", now for see if best",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    refine_host_connection: checked ""\"%s\"%s"
" against ""\"%s\"%s"", now for see if best", (c)->name, str_connection_instance
(c, &b1), (d)->name, str_connection_instance(d, &b2
)); } }
	    pri_connection(c, &b1), pri_connection(d, &b2)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    refine_host_connection: checked ""\"%s\"%s"
" against ""\"%s\"%s"", now for see if best", (c)->name, str_connection_instance
(c, &b1), (d)->name, str_connection_instance(d, &b2
)); } };

	if (this_authby == AUTHBY_PSK) {
		/* secret must match the one we already used */
		const chunk_t *dpsk = get_connection_psk(d);

		/*
		 * We can change PSK mid-way in IKEv2 or aggressive mode.
		 * If we initiated, the key we used and the key
		 * we would have used with d must match.
		 */
		if (!((st->st_ike_versionst_connection->ike_version == IKEv2) || (auth_policy & POLICY_AGGRESSIVE((lset_t)1 << (POLICY_AGGRESSIVE_IX))))) {
			if (dpsk == NULL((void*)0))
				continue; /* no secret */
		}
	}

	if (this_authby == AUTHBY_RSASIG) {
		/*
		 * We must at least be able to find our private key.
		 * If we initiated, it must match the one we used in
		 * the IKEv1 SIG_I payload or IKEv2 AUTH payload that
		 * we sent previously.
		 */
		const struct pubkey_type *type = &pubkey_type_rsa;
		const struct private_key_stuff *pks = get_connection_private_key(d, type, st->st_logger);
		if (pks == NULL((void*)0))
			continue;	/* no key */
	}

	/*
	 * Paul: We need to check all the other relevant
	 * policy bits, like compression, pfs, etc
	 */

	/*
	 * d has passed all the tests.
	 * We'll go with it if the Peer ID was an exact match.
	 */
	if (matching_peer_id && wildcards == 0 &&
	    peer_pathlen == 0 && our_pathlen == 0) {
		*fromcert = d_fromcert;
		connection_buf dcb;
		dbg("    returning "PRI_CONNECTION" because exact peer id match",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    returning ""\"%s\"%s"" because exact peer id match"
, (d)->name, str_connection_instance(d, &dcb)); } }
		    pri_connection(d, &dcb)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    returning ""\"%s\"%s"" because exact peer id match"
, (d)->name, str_connection_instance(d, &dcb)); } };
		return d;
	}

	/*
	 * If it was a non-exact (wildcard) match, we'll
	 * remember it as best_found in case an exact match
	 * doesn't come along.
	 * ??? the logic involving *_pathlen looks wrong.
	 * ??? which matters more peer_pathlen or our_pathlen minimization?
	 */
	if (best_found == NULL((void*)0) || wildcards < best_wildcards ||
		((wildcards == best_wildcards &&
		  peer_pathlen < best_peer_pathlen) ||
		 (peer_pathlen == best_peer_pathlen &&
		  our_pathlen < best_our_pathlen))) {
		connection_buf cib;
		dbg("    refine_host_connection: picking new best "PRI_CONNECTION" (wild=%d, peer_pathlen=%d/our=%d)",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    refine_host_connection: picking new best "
"\"%s\"%s"" (wild=%d, peer_pathlen=%d/our=%d)", (d)->name,
 str_connection_instance(d, &cib), wildcards, peer_pathlen
, our_pathlen); } }
		    pri_connection(d, &cib),{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    refine_host_connection: picking new best "
"\"%s\"%s"" (wild=%d, peer_pathlen=%d/our=%d)", (d)->name,
 str_connection_instance(d, &cib), wildcards, peer_pathlen
, our_pathlen); } }
		    wildcards, peer_pathlen,{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    refine_host_connection: picking new best "
"\"%s\"%s"" (wild=%d, peer_pathlen=%d/our=%d)", (d)->name,
 str_connection_instance(d, &cib), wildcards, peer_pathlen
, our_pathlen); } }
		    our_pathlen){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("    refine_host_connection: picking new best "
"\"%s\"%s"" (wild=%d, peer_pathlen=%d/our=%d)", (d)->name,
 str_connection_instance(d, &cib), wildcards, peer_pathlen
, our_pathlen); } };
		*fromcert = d_fromcert;
		best_found = d;
		best_wildcards = wildcards;
		best_peer_pathlen = peer_pathlen;
		best_our_pathlen = our_pathlen;
	}
}
}
return best_found;
3471}

3473/*
* With virtual addressing, we must not allow someone to use an already
* used (by another id) addr/net.
*/
3477static bool_Bool is_virtual_net_used(struct connection *c,
		const ip_selector *peer_net,
		const struct id *peer_id)
3480{
struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 3481, }; &here
; }), .c = NULL((void*)0), };
while (new2old_connection(&cq)) {
struct connection *d = cq.c;
switch (d->kind) {
case CK_PERMANENT:
case CK_TEMPLATE:
case CK_INSTANCE:
	if ((selector_range_in_selector_range(*peer_net, d->spd.that.client) ||
	     selector_range_in_selector_range(d->spd.that.client, *peer_net)) &&
	    !same_id(&d->spd.that.id, peer_id))
	{
		id_buf idb;
		connection_buf cbuf;
		subnet_buf client;
		llog(RC_LOG, c->logger,
		     "Virtual IP %s overlaps with connection "PRI_CONNECTION"\"%s\"%s"" (kind=%s) '%s'",
		     str_selector_subnet(peer_net, &client),
		     pri_connection(d, &cbuf)(d)->name, str_connection_instance(d, &cbuf),
		     enum_name(&connection_kind_names, d->kind),
		     str_id(&d->spd.that.id, &idb)str_id_bytes(&d->spd.that.id, jam_raw_bytes, &idb));

		if (!kernel_ops->overlap_supported) {
			llog(RC_LOG, c->logger,
			     "Kernel method '%s' does not support overlapping IP ranges",
			     kernel_ops->kern_name);
			return true1;
		}

		if (LIN(POLICY_OVERLAPIP, c->policy & d->policy)(((((lset_t)1 << (POLICY_OVERLAPIP_IX))) & (c->policy
 & d->policy)) == (((lset_t)1 << (POLICY_OVERLAPIP_IX
))))) {
			llog(RC_LOG, c->logger,
			     "overlap is okay by mutual consent");

			/*
			 * Look for another overlap to report
			 * on.
			 */
			break;
		}

		/* We're not allowed to overlap.  Carefully report. */

		const struct connection *x =
			LIN(POLICY_OVERLAPIP, c->policy)(((((lset_t)1 << (POLICY_OVERLAPIP_IX))) & (c->policy
)) == (((lset_t)1 << (POLICY_OVERLAPIP_IX)))) ? d :
			LIN(POLICY_OVERLAPIP, d->policy)(((((lset_t)1 << (POLICY_OVERLAPIP_IX))) & (d->policy
)) == (((lset_t)1 << (POLICY_OVERLAPIP_IX)))) ? c :
			NULL((void*)0);

		if (x == NULL((void*)0)) {
			llog(RC_LOG, c->logger,
			     "overlap is forbidden (neither agrees to overlap)");
		} else {
			llog(RC_LOG, c->logger,
			     "overlap is forbidden ("PRI_CONNECTION"\"%s\"%s"" does not agree to overlap)",
			     pri_connection(x, &cbuf)(x)->name, str_connection_instance(x, &cbuf));
		}

		/* ??? why is this a separate log line? */
		llog(RC_LOG, c->logger,
		     "Your ID is '%s'", str_id(peer_id, &idb)str_id_bytes(peer_id, jam_raw_bytes, &idb));

		return true1; /* already used by another one */
	}
	break;

case CK_GOING_AWAY:
default:
	break;
}
}
return false0; /* you can safely use it */
3550}

3552/*
* find_client_connection: given a connection suitable for ISAKMP
* (i.e. the hosts match), find a one suitable for IPSEC
* (i.e. with matching clients).
*
* If we don't find an exact match (not even our current connection),
* we try for one that still needs instantiation.  Try Road Warrior
* abstract connections and the Opportunistic abstract connections.
* This requires inverse instantiation: abstraction.
*
* After failing to find an exact match, we abstract the peer
* to be NO_IP (the wildcard value).  This enables matches with
* Road Warrior and Opportunistic abstract connections.
*
* After failing that search, we also abstract the Phase 1 peer ID
* if possible.  If the peer's ID was the peer's IP address, we make
* it NO_ID; instantiation will make it the peer's IP address again.
*
* If searching for a Road Warrior abstract connection fails,
* and conditions are suitable, we search for the best Opportunistic
* abstract connection.
*
* Note: in the end, both Phase 1 IDs must be preserved, after any
* instantiation.  They are the IDs that have been authenticated.
*/

3578#define PATH_WEIGHT1 1
3579#define WILD_WEIGHT(7 + 1) (MAX_CA_PATH_LEN7 + 1)
3580#define PRIO_WEIGHT((15 + 1) * (7 + 1)) ((MAX_WILDCARDS15 + 1) * WILD_WEIGHT(7 + 1))

3582/* fc_try: a helper function for find_client_connection */
3583static struct connection *fc_try(const struct connection *c,
		 const struct host_pair *hp,
		 const ip_selector *local_client,
		 const ip_selector *remote_client)
3587{
struct connection *best = NULL((void*)0);
policy_prio_t best_prio = BOTTOM_PRIO((policy_prio_t)0);
const bool_Bool remote_is_host = selector_eq_address(*remote_client,
					c->spd.that.host_addr);

err_t virtualwhy = NULL((void*)0);
for (struct connection *d = hp->connections; d != NULL((void*)0); d = d->hp_next) {
if (d->policy & POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX)))
	continue;

int wildcards, pathlen;

if (!(c->connalias != NULL((void*)0) && d->connalias != NULL((void*)0) && streq(c->connalias, d->connalias)(strcmp((c->connalias), (d->connalias)) == 0))) {
	if (!(same_id(&c->spd.this.id, &d->spd.this.id) &&
		match_id(&c->spd.that.id, &d->spd.that.id, &wildcards) &&
		trusted_ca_nss(c->spd.that.ca, d->spd.that.ca, &pathlen)))
	{
		continue;
	}
}

/* compare protocol and ports */
unsigned local_protocol = selector_protocol(*local_client)->ipproto;
unsigned remote_protocol = selector_protocol(*remote_client)->ipproto;
unsigned local_port = hport(selector_port(*local_client));
unsigned remote_port = hport(selector_port(*remote_client));
if (!(d->spd.this.protocol == local_protocol &&
      d->spd.that.protocol == remote_protocol &&
      (d->spd.this.port == 0 || d->spd.this.port == local_port) &&
      (d->spd.that.has_port_wildcard || d->spd.that.port == remote_port)))
{
	continue;
}

/*
 * non-Opportunistic case:
 * local_client must match.
 *
 * So must remote_client, but the testing is complicated
 * by the fact that the peer might be a wildcard
 * and if so, the default value of that.client
 * won't match the default remote_net. The appropriate test:
 *
 * If d has a peer client, it must match remote_net.
 * If d has no peer client, remote_net must just have peer itself.
 */

for (const struct spd_route *sr = &d->spd;
     best != d && sr != NULL((void*)0); sr = sr->spd_next) {

	if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
		selector_buf s1, d1;
		selector_buf s3, d3;
		DBG_log("  fc_try trying %s:%s:%d/%d -> %s:%d/%d%s vs %s:%s:%d/%d -> %s:%d/%d%s",
			c->name, str_selector(local_client, &s1),
			c->spd.this.protocol, c->spd.this.port,
			str_selector(remote_client, &d1),
			c->spd.that.protocol, c->spd.that.port,
			is_virtual_connection(c) ?
			"(virt)" : "", d->name,
			str_selector(&sr->this.client, &s3),
			sr->this.protocol, sr->this.port,
			str_selector(&sr->that.client, &d3),
			sr->that.protocol, sr->that.port,
			is_virtual_sr(sr) ? "(virt)" : "");
	}

	if (!selector_range_eq_selector_range(sr->this.client, *local_client)) {
		if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
			selector_buf s1, s3;
			DBG_log("   our client (%s) not in local_net (%s)",
				str_selector(&sr->this.client, &s3),
				str_selector(local_client, &s1));
		}
		continue;
	}

	if (sr->that.has_client) {

		if (!selector_range_eq_selector_range(sr->that.client, *remote_client) &&
		    !is_virtual_sr(sr)) {
			if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
				selector_buf d1, d3;
				DBG_log("   their client (%s) not in same remote_net (%s)",
					str_selector(&sr->that.client, &d3),
					str_selector(remote_client, &d1));
			}
			continue;
		}

		virtualwhy = check_virtual_net_allowed(d,
						       selector_subnet(*remote_client),
						       sr->that.host_addr);

		if (is_virtual_sr(sr) &&
		    (virtualwhy != NULL((void*)0) ||
		     is_virtual_net_used(d, remote_client,
					 &sr->that.id))) {
			dbg("   virtual net not allowed"){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("   virtual net not allowed"); } };
			continue;
		}
	} else if (!remote_is_host) {
		continue;
	}

	/*
	 * We've run the gauntlet -- success:
	 * We've got an exact match of subnets.
	 * The connection is feasible, but we continue looking
	 * for the best.
	 * The highest priority wins, implementing eroute-like
	 * rule.
	 * - a routed connection is preferrred
	 * - given that, the smallest number of ID wildcards
	 *   are preferred
	 * - given that, the shortest CA pathlength is preferred
	 * - given that, not switching is preferred
	 */
	policy_prio_t prio =
		PRIO_WEIGHT((15 + 1) * (7 + 1)) * routed(sr->routing)((sr->routing) > RT_UNROUTED_HOLD) +
		WILD_WEIGHT(7 + 1) * (MAX_WILDCARDS15 - wildcards) +
		PATH_WEIGHT1 * (MAX_CA_PATH_LEN7 - pathlen) +
		(c == d ? 1 : 0) +
		1;
	if (prio > best_prio) {
		best = d;
		best_prio = prio;
	}
}
}

if (best != NULL((void*)0) && NEVER_NEGOTIATE(best->policy)(((((best->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))))
best = NULL((void*)0);

dbg("  fc_try concluding with %s [%" PRIu32 "]",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("  fc_try concluding with %s [%" "u" "]", (best
 ? best->name : "none"), best_prio); } }
   (best ? best->name : "none"), best_prio){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("  fc_try concluding with %s [%" "u" "]", (best
 ? best->name : "none"), best_prio); } };

if (best == NULL((void*)0) && virtualwhy != NULL((void*)0)) {
llog(RC_LOG, c->logger,
     "peer proposal was rejected in a virtual connection policy: %s",
     virtualwhy);
}

return best;
3732}

3734static struct connection *fc_try_oppo(const struct connection *c,
		      const struct host_pair *hp,
		      const ip_selector *local_client,
		      const ip_selector *remote_client)
3738{
struct connection *best = NULL((void*)0);
policy_prio_t best_prio = BOTTOM_PRIO((policy_prio_t)0);

for (struct connection *d = hp->connections; d != NULL((void*)0); d = d->hp_next) {
if (d->policy & POLICY_GROUP((lset_t)1 << (POLICY_GROUP_IX)))
	continue;

int wildcards, pathlen;
if (!(same_id(&c->spd.this.id, &d->spd.this.id) &&
      match_id(&c->spd.that.id, &d->spd.that.id, &wildcards) &&
      trusted_ca_nss(c->spd.that.ca, d->spd.that.ca, &pathlen)))
{
	continue;
}

/* compare protocol and ports */
unsigned local_protocol = selector_protocol(*local_client)->ipproto;
unsigned remote_protocol = selector_protocol(*remote_client)->ipproto;
unsigned local_port = hport(selector_port(*local_client));
unsigned remote_port = hport(selector_port(*remote_client));
if (d->spd.this.protocol != local_protocol ||
	(d->spd.this.port && d->spd.this.port != local_port) ||
	d->spd.that.protocol != remote_protocol ||
	(d->spd.that.port != remote_port &&
		!d->spd.that.has_port_wildcard))
	continue;

/*
 * Opportunistic case:
 * local_net must be inside d->spd.this.client
 * and remote_net must be inside d->spd.that.client
 * Note: this host_pair chain also has shunt
 * eroute conns (clear, drop), but they won't
 * be marked as opportunistic.
 */

for (const struct spd_route *sr = &d->spd;
     sr != NULL((void*)0); sr = sr->spd_next) {

	if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
		selector_buf s1;
		selector_buf d1;
		selector_buf s3;
		selector_buf d3;
		DBG_log("  fc_try_oppo trying %s:%s -> %s vs %s:%s -> %s",
			c->name, str_selector(local_client, &s1),
			str_selector(remote_client, &d1),
			d->name, str_selector(&sr->this.client, &s3),
			str_selector(&sr->that.client, &d3));
	}

	if (!selector_range_in_selector_range(*local_client, sr->this.client) ||
	    !selector_range_in_selector_range(*remote_client, sr->that.client))
		continue;

	/*
	 * The connection is feasible, but we continue looking
	 * for the best.
	 * The highest priority wins, implementing eroute-like
	 * rule.
	 * - our smallest client subnet is preferred (longest
	 *   mask)
	 * - given that, peers smallest client subnet is preferred
	 * - given that, a routed connection is preferrred
	 * - given that, the smallest number of ID wildcards
	 *   are preferred
	 * - given that, the shortest CA pathlength is preferred
	 */
	policy_prio_t prio =
		PRIO_WEIGHT((15 + 1) * (7 + 1)) * (d->policy_prio + routed(sr->routing)((sr->routing) > RT_UNROUTED_HOLD)) +
		WILD_WEIGHT(7 + 1) * (MAX_WILDCARDS15 - wildcards) +
		PATH_WEIGHT1 * (MAX_CA_PATH_LEN7 - pathlen);

	if (prio > best_prio) {
		best = d;
		best_prio = prio;
	}
}
}

/* if the best wasn't opportunistic, we fail: it must be a shunt */
if (best != NULL((void*)0) &&
   (NEVER_NEGOTIATE(best->policy)(((((best->policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX
)) | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ||
    (best->policy & POLICY_OPPORTUNISTIC((lset_t)1 << (POLICY_OPPORTUNISTIC_IX))) == LEMPTY((lset_t)0)))
best = NULL((void*)0);

dbg("  fc_try_oppo concluding with %s [%" PRIu32 "]",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("  fc_try_oppo concluding with %s [%" "u" "]",
 (best ? best->name : "none"), best_prio); } }
   (best ? best->name : "none"), best_prio){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("  fc_try_oppo concluding with %s [%" "u" "]",
 (best ? best->name : "none"), best_prio); } };
return best;
3828}

3830struct connection *find_v1_client_connection(struct connection *const c,
			     const ip_selector *local_client,
			     const ip_selector *remote_client)
3833{
struct connection *d;

/* weird things can happen to our interfaces */
if (!oriented(c)) {
1
Assuming the condition is false→
2
←
Taking false branch→
return NULL((void*)0);
}

if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
3
←
Assuming the condition is false→
4
←
Taking false branch→
selectors_buf sb;
DBG_log("find_v1_client_connection starting with %s", c->name);
DBG_log("  looking for %s",
	str_selectors(local_client, remote_client, &sb));
}

/*
* Give priority to current connection
* but even greater priority to a routed concrete connection.
*/
{
struct connection *unrouted = NULL((void*)0);
int srnum = -1;

for (const struct spd_route *sr = &c->spd; unrouted4.1
'unrouted' is equal to NULL
 == NULL((void*)0) && sr != NULL((void*)0);
5
←
Assuming 'sr' is equal to NULL→
6
←
Loop condition is false. Execution continues on line 3891→
	sr = sr->spd_next) {
	srnum++;

	if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
		selector_buf s2;
		selector_buf d2;
		DBG_log("  concrete checking against sr#%d %s -> %s", srnum,
			str_selector(&sr->this.client, &s2),
			str_selector(&sr->that.client, &d2));
	}

	unsigned local_protocol = selector_protocol(*local_client)->ipproto;
	unsigned local_port = selector_port(*local_client).hport;
	unsigned remote_protocol = selector_protocol(*remote_client)->ipproto;
	unsigned remote_port = selector_port(*remote_client).hport;
	if (selector_range_eq_selector_range(sr->this.client, *local_client) &&
	    selector_range_eq_selector_range(sr->that.client, *remote_client) &&
	    sr->this.protocol == local_protocol &&
	    (!sr->this.port || sr->this.port == local_port) &&
	    (sr->that.protocol == remote_protocol) &&
	    (!sr->that.port || sr->that.port == remote_port)) {
		if (routed(sr->routing)((sr->routing) > RT_UNROUTED_HOLD))
			return c;

		unrouted = c;
	}
}

/* exact match? */
/*
 * clang 3.4 says: warning: Access to field 'host_pair' results in a dereference of a null pointer (loaded from variable 'c')
 * If so, the caller must have passed NULL for it
 * and earlier references would be wrong (segfault).
 */
d = fc_try(c, c->host_pair, local_client, remote_client);
7
←
Access to field 'host_pair' results in a dereference of a null pointer (loaded from variable 'c')

dbg("  fc_try %s gives %s", c->name, (d ? d->name : "none")){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("  fc_try %s gives %s", c->name, (d ? d->
name : "none")); } };

if (d == NULL((void*)0))
	d = unrouted;
}

if (d == NULL((void*)0)) {
/*
 * look for an abstract connection to match
 */
const struct host_pair *hp = NULL((void*)0);
for (const struct spd_route *sra = &c->spd;
     sra != NULL((void*)0) && hp == NULL((void*)0); sra = sra->spd_next) {
	hp = find_host_pair(sra->this.host_addr, unset_address);
	if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
		selector_buf s2;
		selector_buf d2;
		DBG_log("  checking hostpair %s -> %s is %s",
			str_selector(&sra->this.client, &s2),
			str_selector(&sra->that.client, &d2),
			(hp ? "found" : "not found"));
	}
}

if (hp != NULL((void*)0)) {
	/* RW match with actual remote_id or abstract remote_id? */
	d = fc_try(c, hp, local_client, remote_client);

	if (d == NULL((void*)0) &&
	    selector_contains_one_address(*local_client) &&
	    selector_contains_one_address(*remote_client)) {
		/*
		 * Opportunistic match?
		 * Always use abstract remote_id.
		 * Note that later instantiation will result
		 * in the same remote_id.
		 */
		d = fc_try_oppo(c, hp, local_client, remote_client);
	}
}
}

dbg("  concluding with d = %s", (d ? d->name : "none")){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("  concluding with d = %s", (d ? d->name : "none"
)); } };
return d;
3937}

3939/* signed result suitable for quicksort */
3940int connection_compare(const struct connection *ca,
const struct connection *cb)
3942{
int ret;

ret = strcmp(ca->name, cb->name);
if (ret != 0)
return ret;

/* note: enum connection_kind behaves like int */
ret = ca->kind - cb->kind;
if (ret != 0)
return ret;

/* same name, and same type */
switch (ca->kind) {
case CK_INSTANCE:
return ca->instance_serial < cb->instance_serial ? -1 :
ca->instance_serial > cb-> instance_serial ? 1 : 0;

default:
return (ca->policy_prio < cb->policy_prio ? -1 :
	ca->policy_prio > cb->policy_prio ? 1 : 0);
}
3964}

3966static int connection_compare_qsort(const void *a, const void *b)
3967{
return connection_compare(*(const struct connection *const *)a,
		*(const struct connection *const *)b);
3970}

3972static void show_one_sr(struct show *s,
	const struct connection *c,
	const struct spd_route *sr,
	const char *instance)
3976{
char topo[CONN_BUF_LEN(2 * ((sizeof(subnet_buf) + sizeof(address_buf) + sizeof(id_buf
) + sizeof(subnet_buf) + 10) - 1) + 4)];
ipstr_buf thisipb, thatipb;

show_comment(s, "\"%s\"%s: %s; %s; eroute owner: #%lu",
c->name, instance,
format_connection(topo, sizeof(topo), c, sr),
enum_name(&routing_story, sr->routing),
sr->eroute_owner);

3986#define OPT_HOST(h, ipb)  (address_is_specified(h) ? str_address(&h, &ipb) : "unset")

/* note: this macro generates a pair of arguments */
3989#define OPT_PREFIX_STR(pre, s) (s) == NULL((void*)0) ? "" : (pre), (s) == NULL((void*)0)? "" : (s)

show_comment(s,
"\"%s\"%s:     %s; my_ip=%s; their_ip=%s%s%s%s%s; my_updown=%s;",
c->name, instance,
oriented(c) ? "oriented" : "unoriented",
OPT_HOST(c->spd.this.host_srcip, thisipb),
OPT_HOST(c->spd.that.host_srcip, thatipb),
OPT_PREFIX_STR("; mycert=", cert_nickname(&sr->this.cert)),
OPT_PREFIX_STR("; peercert=", cert_nickname(&sr->that.cert)),
(sr->this.updown == NULL((void*)0) || streq(sr->this.updown, "%disabled")(strcmp((sr->this.updown), ("%disabled")) == 0)) ?
	"<disabled>" : sr->this.updown
);

4003#undef OPT_HOST
4004#undef OPT_PREFIX_STR

/*
* Both should not be set, but if they are, we want
* to know
*/
4010#define COMBO(END, SERVER, CLIENT) \
((END).SERVER ? \
((END).CLIENT ? "BOTH??" : "server") : \
((END).CLIENT ? "client" : "none"))

show_comment(s,
"\"%s\"%s:   xauth us:%s, xauth them:%s, %s my_username=%s; their_username=%s",
c->name, instance,
/*
 * Both should not be set, but if they are, we want to
 * know
 */
COMBO(sr->this, xauth_server, xauth_client),
COMBO(sr->that, xauth_server, xauth_client),
/* should really be an enum name */
sr->this.xauth_server ?
	c->xauthby == XAUTHBY_FILE ?
		"xauthby:file;" :
	c->xauthby == XAUTHBY_PAM ?
		"xauthby:pam;" :
		"xauthby:alwaysok;" :
	"",
sr->this.xauth_username != NULL((void*)0) ? sr->this.xauth_username : "[any]",
sr->that.xauth_username != NULL((void*)0) ? sr->that.xauth_username : "[any]");

esb_buf auth1, auth2;

show_comment(s,
"\"%s\"%s:   our auth:%s, their auth:%s",
c->name, instance,
enum_show_short(&keyword_authby_names, sr->this.authby, &auth1),
enum_show_short(&keyword_authby_names, sr->that.authby, &auth2));

show_comment(s,
"\"%s\"%s:   modecfg info: us:%s, them:%s, modecfg policy:%s, dns:%s, domains:%s, cat:%s;",
c->name, instance,
COMBO(sr->this, modecfg_server, modecfg_client),
COMBO(sr->that, modecfg_server, modecfg_client),

(c->policy & POLICY_MODECFG_PULL((lset_t)1 << (POLICY_MODECFG_PULL_IX))) ? "pull" : "push",
(c->modecfg_dns == NULL((void*)0)) ? "unset" : c->modecfg_dns,
(c->modecfg_domains == NULL((void*)0)) ? "unset" : c->modecfg_domains,
sr->this.cat ? "set" : "unset");

4054#undef COMBO

if (c->modecfg_banner != NULL((void*)0)) {
show_comment(s, "\"%s\"%s: banner:%s;",
c->name, instance, c->modecfg_banner);
}

/*
* Show the first valid sec_label.
*
* We only support symmetric labels, but store it in struct
* end - pick one.
*
* XXX: IKEv1 stores the negotiated sec_label in the state.
*/
if (sr->this.sec_label.len > 0) {
/* negotiated (IKEv2) */
show_comment(s, "\"%s\"%s:   sec_label:"PRI_SHUNK"%.*s",
	     c->name, instance, pri_shunk(sr->this.sec_label)((int) (sr->this.sec_label).len), (const char *) ((sr->
this.sec_label).ptr));
} else if (c->config->sec_label.len > 0) {
/* configured */
show_comment(s, "\"%s\"%s:   sec_label:"PRI_SHUNK"%.*s",
	     c->name, instance, pri_shunk(c->config->sec_label)((int) (c->config->sec_label).len), (const char *) ((c->
config->sec_label).ptr));
} else {
show_comment(s, "\"%s\"%s:   sec_label:unset;", c->name, instance);
}
4080}

4082void show_one_connection(struct show *s,
	 const struct connection *c)
4084{
const char *ifn;
char ifnstr[2 *  IFNAMSIZ16 + 2];  /* id_rname@id_vname\0 */
char instance[32];
char mtustr[8];
char sapriostr[13];
char satfcstr[13];
char nflogstr[8];
char markstr[2 * (2 * strlen("0xffffffff") + strlen("/")) + strlen(", ") ];

if (oriented(c)) {
if (c->xfrmi != NULL((void*)0) && c->xfrmi->name != NULL((void*)0)) {
	char *n = jam_str(ifnstr, sizeof(ifnstr),
			c->xfrmi->name);
	add_str(ifnstr, sizeof(ifnstr), n, "@");
	add_str(ifnstr, sizeof(ifnstr), n,
			c->interface->ip_dev->id_rname);
	ifn = ifnstr;
} else {
	ifn = c->interface->ip_dev->id_rname;
}
} else {
ifn = "";
};

instance[0] = '\0';
if (c->kind == CK_INSTANCE && c->instance_serial != 0)
snprintf(instance, sizeof(instance), "[%lu]",
	c->instance_serial);

/* Show topology. */
{
const struct spd_route *sr = &c->spd;

while (sr != NULL((void*)0)) {
	show_one_sr(s, c, sr, instance);
	sr = sr->spd_next;
}
}

/* Show CAs */
if (c->spd.this.ca.ptr != NULL((void*)0) || c->spd.that.ca.ptr != NULL((void*)0)) {
dn_buf this_ca, that_ca;
show_comment(s,
	  "\"%s\"%s:   CAs: '%s'...'%s'",
	  c->name,
	  instance,
	  str_dn_or_null(c->spd.this.ca, "%any", &this_ca),
	  str_dn_or_null(c->spd.that.ca, "%any", &that_ca));
}

show_comment(s,
"\"%s\"%s:   ike_life: %jds; ipsec_life: %jds; replay_window: %u; rekey_margin: %jds; rekey_fuzz: %lu%%; keyingtries: %lu;",
c->name,
instance,
deltasecs(c->sa_ike_life_seconds),
deltasecs(c->sa_ipsec_life_seconds),
c->sa_replay_window,
deltasecs(c->sa_rekey_margin),
c->sa_rekey_fuzz,
c->sa_keying_tries);

show_comment(s,
  "\"%s\"%s:   retransmit-interval: %jdms; retransmit-timeout: %jds; iketcp:%s; iketcp-port:%d;",
  c->name,
  instance,
  deltamillisecs(c->config->retransmit_interval),
  deltasecs(c->config->retransmit_timeout),
  c->iketcp == IKE_TCP_NO ? "no" : c->iketcp == IKE_TCP_ONLY ? "yes" :
	c->iketcp == IKE_TCP_FALLBACK ? "fallback" : "<BAD VALUE>",
  c->remote_tcpport);

show_comment(s,
  "\"%s\"%s:   initial-contact:%s; cisco-unity:%s; fake-strongswan:%s; send-vendorid:%s; send-no-esp-tfc:%s;",
  c->name, instance,
  bool_str(c->initial_contact),
  bool_str(c->cisco_unity),
  bool_str(c->fake_strongswan),
  bool_str(c->send_vendorid),
  bool_str(c->send_no_esp_tfc));

if (c->policy_next != NULL((void*)0)) {
show_comment(s,
	"\"%s\"%s:   policy_next: %s",
	c->name, instance, c->policy_next->name);
}

lset_t policy = c->policy;
policy_buf pb;
show_comment(s, "\"%s\"%s:   policy: %s%s%s%s%s%s%s;",
     c->name, instance,
     c->ike_version > 0 ? enum_name(&ike_version_names, c->ike_version) : "",
     c->ike_version > 0 && policy != LEMPTY((lset_t)0) ? "+" : "",
     str_policy(policy, &pb),
     NEVER_NEGOTIATE(policy)(((((policy)) & (((lset_t)1 << (POLICY_ENCRYPT_IX))
 | ((lset_t)1 << (POLICY_AUTHENTICATE_IX)))) == ((lset_t
)0))) ? "+NEVER_NEGOTIATE" : "",
     (c->spd.this.key_from_DNS_on_demand ||
      c->spd.that.key_from_DNS_on_demand) ? "; " : "",
     c->spd.this.key_from_DNS_on_demand ? "+lKOD" : "",
     c->spd.that.key_from_DNS_on_demand ? "+rKOD" : "");

if (c->ike_version == IKEv2) {
lset_buf hashpolbuf;
const char *hashstr = str_lset(&sighash_policy_bit_names,
			       c->sighash_policy,
			       &hashpolbuf);
show_comment(s, "\"%s\"%s:   v2-auth-hash-policy: %s;",
	c->name, instance, hashstr);
}

if (c->connmtu != 0)
snprintf(mtustr, sizeof(mtustr), "%d", c->connmtu);
else
strcpy(mtustr, "unset");

if (c->sa_priority != 0)
snprintf(sapriostr, sizeof(sapriostr), "%" PRIu32"u", c->sa_priority);
else
strcpy(sapriostr, "auto");

if (c->sa_tfcpad != 0)
snprintf(satfcstr, sizeof(satfcstr), "%u", c->sa_tfcpad);
else
strcpy(satfcstr, "none");

policy_prio_buf prio;
show_comment(s,
  "\"%s\"%s:   conn_prio: %s; interface: %s; metric: %u; mtu: %s; sa_prio:%s; sa_tfc:%s;",
     c->name, instance,
     str_policy_prio(c->policy_prio, &prio),
     ifn,
     c->metric,
     mtustr, sapriostr, satfcstr);

if (c->nflog_group != 0)
snprintf(nflogstr, sizeof(nflogstr), "%d", c->nflog_group);
else
strcpy(nflogstr, "unset");

if (c->sa_marks.in.val != 0 || c->sa_marks.out.val != 0 ) {
snprintf(markstr, sizeof(markstr), "%" PRIu32"u" "/%#08" PRIx32"x" ", %" PRIu32"u" "/%#08" PRIx32"x",
	c->sa_marks.in.val, c->sa_marks.in.mask,
	c->sa_marks.out.val, c->sa_marks.out.mask);
} else {
strcpy(markstr, "unset");
}

show_comment(s,
  "\"%s\"%s:   nflog-group: %s; mark: %s; vti-iface:%s; "
  "vti-routing:%s; vti-shared:%s;"
 " nic-offload:%s;"
  ,
  c->name, instance, nflogstr, markstr,
  c->vti_iface == NULL((void*)0) ? "unset" : c->vti_iface,
  bool_str(c->vti_routing),
  bool_str(c->vti_shared),
  (c->nic_offload == yna_auto) ? "auto" :
	bool_str(c->nic_offload == yna_yes)
);

{
id_buf thisidb;
id_buf thatidb;

show_comment(s,
"\"%s\"%s:   our idtype: %s; our id=%s; their idtype: %s; their id=%s",
c->name, instance,
enum_name(&ike_id_type_names, c->spd.this.id.kind),
str_id(&c->spd.this.id, &thisidb)str_id_bytes(&c->spd.this.id, jam_raw_bytes, &thisidb
),
enum_name(&ike_id_type_names, c->spd.that.id.kind),
str_id(&c->spd.that.id, &thatidb)str_id_bytes(&c->spd.that.id, jam_raw_bytes, &thatidb
));
}

/* slightly complicated stuff to avoid extra crap */
show_comment(s,
"\"%s\"%s:   dpd: %s; delay:%ld; timeout:%ld; nat-t: encaps:%s; nat_keepalive:%s; ikev1_natt:%s",
c->name, instance,
enum_name(&dpd_action_names, c->dpd_action),
(long) deltasecs(c->dpd_delay),
(long) deltasecs(c->dpd_timeout),
(c->encaps == yna_auto) ? "auto" :
    bool_str(c->encaps == yna_yes),
bool_str(c->nat_keepalive),
(c->ikev1_natt == NATT_BOTH) ? "both" :
 (c->ikev1_natt == NATT_RFC) ? "rfc" :
 (c->ikev1_natt == NATT_DRAFTS) ? "drafts" : "none"
);

if (!lmod_empty(c->extra_debugging)) {
SHOW_JAMBUF(RC_COMMENT, s, buf)for (struct jambuf *buf = show_jambuf(s); buf != ((void*)0); jambuf_to_show
(buf, s, RC_COMMENT), buf = ((void*)0)) {
	jam(buf, "\"%s\"%s:   debug: ",
	    c->name, instance);
	jam_lmod(buf, &debug_names, "+", c->extra_debugging);
}
}

SHOW_JAMBUF(RC_COMMENT, s, buf)for (struct jambuf *buf = show_jambuf(s); buf != ((void*)0); jambuf_to_show
(buf, s, RC_COMMENT), buf = ((void*)0)) {
jam(buf, "\"%s\"%s:   newest ISAKMP SA: #%lu; newest IPsec SA: #%lu; conn serial: "PRI_CO"$%u""",
    c->name,
    instance,
    c->newest_ike_sa,
    c->newest_ipsec_sa,
    pri_co(c->serialno)((c->serialno)));
if (c->serial_from != UNSET_CO_SERIAL) {
	jam(buf, ", instantiated from: "PRI_CO"$%u"";",
	    pri_co(c->serial_from)((c->serial_from)));
} else {
	jam(buf, ";");
}
}

if (c->connalias != NULL((void*)0)) {
show_comment(s, "\"%s\"%s:   aliases: %s",
	     c->name,
	     instance,
	     c->connalias);
}

show_ike_alg_connection(s, c, instance);
show_kernel_alg_connection(s, c, instance);
4303}

4305void show_connections_status(struct show *s)
4306{
int count = 0;
int active = 0;

show_separator(s);
show_comment(s, "Connection list:");
show_separator(s);

struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 4314, }; &here
; }), .c = NULL((void*)0), };
while (new2old_connection(&cq)) {
struct connection *c = cq.c;
count++;
if (c->spd.routing == RT_ROUTED_TUNNEL)
	active++;
}

if (count != 0) {
/* make an array of connections, sort it, and report it */

struct connection **array =
	alloc_bytes(sizeof(struct connection *) * count,
		"connection array");
int i = 0;


struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 4331, }; &here
; }), .c = NULL((void*)0), };
while (new2old_connection(&cq)) {
	array[i++] = cq.c;
}

/* sort it! */
qsort(array, count, sizeof(struct connection *),
	connection_compare_qsort);

for (i = 0; i < count; i++)
	show_one_connection(s, array[i]);

pfree(array);
show_separator(s);
}

show_comment(s, "Total IPsec connections: loaded %d, active %d",
     count, active);
4349}

4351/*
* Delete a connection if
* - it is an instance and it is no longer in use.
* - the ike state is not shared with another connection
* We must be careful to avoid circularity:
* we don't touch it if it is CK_GOING_AWAY.
*/
4358void connection_delete_unused_instance(struct connection **cp,
		       struct state *old_state,
		       struct fd *whackfd)
4361{
struct connection *c = (*cp);
*cp = NULL((void*)0);

if (c->kind != CK_INSTANCE) {
dbg("connection %s is not an instance, skipping delete-unused", c->name){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection %s is not an instance, skipping delete-unused"
, c->name); } };
return;
}

if (connection_is_pending(c)) {
dbg("connection instance %s is pending, skipping delete-unused",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection instance %s is pending, skipping delete-unused"
, c->name); } }
    c->name){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection instance %s is pending, skipping delete-unused"
, c->name); } };
return;
}

if (LIN(POLICY_UP, c->policy)(((((lset_t)1 << (POLICY_UP_IX))) & (c->policy))
 == (((lset_t)1 << (POLICY_UP_IX)))) &&
   old_state != NULL((void*)0) && (IS_IKE_SA_ESTABLISHED(old_state)((old_state)->st_state->kind == STATE_V2_ESTABLISHED_IKE_SA
) ||
		  IS_V1_ISAKMP_SA_ESTABLISHED(old_state)((((lset_t)1 << ((old_state)->st_state->kind)) &
 (((lset_t)1 << (STATE_MAIN_R3)) | ((lset_t)1 << (
STATE_MAIN_I4)) | ((lset_t)1 << (STATE_AGGR_I2)) | ((lset_t
)1 << (STATE_AGGR_R2)) | ((lset_t)1 << (STATE_XAUTH_R0
)) | ((lset_t)1 << (STATE_XAUTH_R1)) | ((lset_t)1 <<
 (STATE_MODE_CFG_R0)) | ((lset_t)1 << (STATE_MODE_CFG_R1
)) | ((lset_t)1 << (STATE_MODE_CFG_R2)) | ((lset_t)1 <<
 (STATE_MODE_CFG_I1)) | ((lset_t)1 << (STATE_XAUTH_I0))
 | ((lset_t)1 << (STATE_XAUTH_I1)))) != ((lset_t)0)))) {
/*
 * If this connection instance was previously for an
 * established sa planning to revive, don't delete.
 */
dbg("connection instance %s with serial "PRI_CO" is being revived, skipping delete-unused",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection instance %s with serial ""$%u"" is being revived, skipping delete-unused"
, c->name, ((c->serialno))); } }
    c->name, pri_co(c->serialno)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection instance %s with serial ""$%u"" is being revived, skipping delete-unused"
, c->name, ((c->serialno))); } };
return;
}

/* find the first */
struct state *st = state_by_connection(c, NULL((void*)0), NULL((void*)0), __func__);
if (DBGP(DBG_BASE)(cur_debugging & (((lset_t)1 << (DBG_BASE_IX))))) {
/*
 * Cross check that the state DB has been kept
 * up-to-date.
 */
struct state *dst = NULL((void*)0);
FOR_EACH_STATE_NEW2OLD(dst)for (struct list_entry *entry_ = (&state_serialno_list_head
)->head.older; entry_ != ((void*)0); entry_ = ((void*)0)) for
 (dst = (typeof(dst))entry_->data, entry_ = entry_->older
; dst != ((void*)0); dst = (typeof(dst))entry_->data, entry_
 = entry_->older) {
	if (dst->st_connection == c) {
		break;
	}
}
/* found a state, may not be the same */
pexpect((dst == NULL) == (st == NULL))({ _Bool assertion__ = (dst == ((void*)0)) == (st == ((void*)
0)); if (!assertion__) { where_t here_ = ({ static const struct
 where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 4402, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_pexpect(logger_, here_, "%s", "(dst == ((void*)0)) == (st == ((void*)0))"
); } assertion__; });
st = dst; /* let the truth be free */
}

if (st != NULL((void*)0)) {
dbg("connection instance %s in use by #%lu, skipping delete-unused",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection instance %s in use by #%lu, skipping delete-unused"
, c->name, st->st_serialno); } }
    c->name, st->st_serialno){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection instance %s in use by #%lu, skipping delete-unused"
, c->name, st->st_serialno); } };
return;
}

dbg("connection instance %s is not being used, deleting", c->name){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("connection instance %s is not being used, deleting"
, c->name); } };
/* XXX: something better? */
close_any(&c->logger->global_whackfd)close_any_fd((&c->logger->global_whackfd), ({ static
 const struct where here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 4414, }; &here; }));
c->logger->global_whackfd = fd_dup(whackfd, HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 4415, }; &here
; }));
delete_connection(&c, false0);
4417}

4419/*
* Every time a state's connection is changed, the following need to happen:
*
* - update the connection->state hash table
*
* - discard the old connection when not in use
*/
4426void update_state_connection(struct state *st, struct connection *new)
4427{
struct connection *old = st->st_connection;
passert(old != NULL)({ _Bool assertion__ = old != ((void*)0); if (!assertion__) {
 where_t here = ({ static const struct where here = { .func =
 __func__, .file = "programs/pluto/connections.c", .line = 4429
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "old != ((void*)0)"); } (
void) 1; });
passert(new != NULL)({ _Bool assertion__ = new != ((void*)0); if (!assertion__) {
 where_t here = ({ static const struct where here = { .func =
 __func__, .file = "programs/pluto/connections.c", .line = 4430
, }; &here; }); const struct logger *logger_ = &failsafe_logger
; llog_passert(logger_, here, "%s", "new != ((void*)0)"); } (
void) 1; });

if (old != new) {
st->st_connection = new;
st->st_v1_peer_alt_id = false0; /* must be rechecked against new 'that' */
rehash_state_connection(st);
if (old != NULL((void*)0)) {
	connection_delete_unused_instance(&old, st,
					  st->st_logger->global_whackfd);
}
}
4441}

4443/*
* A template connection's eroute can be eclipsed by
* either a %hold or an eroute for an instance iff
* the template is a /32 -> /32. This requires some special casing.
*/
4448long eclipse_count = 0;

4450struct connection *eclipsed(const struct connection *c, struct spd_route **esrp /*OUT*/)
4451{
/*
* This function was changed in freeswan 2.02 and since
* then has never worked because it always returned NULL.
* It should be caught by the testing/pluto/co-terminal test cases.
* ??? DHR doesn't know how much of this is true.
*/

/* ??? this logic seems broken: it doesn't try all spd_routes of c */

/* XXX This logic also predates support for protoports, which isn't handled below */

struct connection_query cq = { .where = HERE({ static const struct where here = { .func = __func__, .file
 = "programs/pluto/connections.c", .line = 4463, }; &here
; }), .c = NULL((void*)0), };
while (new2old_connection(&cq)) {
struct connection *ue = cq.c;

for (struct spd_route *srue = &ue->spd; srue != NULL((void*)0); srue =srue->spd_next) {
	for (const struct spd_route *src = &c->spd; src != NULL((void*)0); src = src->spd_next) {
		if (srue->routing == RT_ROUTED_ECLIPSED &&
		    selector_range_eq_selector_range(src->this.client, srue->this.client) &&
		    selector_range_eq_selector_range(src->that.client, srue->that.client)) {
			dbg("%s eclipsed %s", c->name, ue->name){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("%s eclipsed %s", c->name, ue->name); } };
			*esrp = srue;
			return ue;
		}
	}
}
}
*esrp = NULL((void*)0);
return NULL((void*)0);
4481}

4483/*
* This is to support certificates with SAN using wildcard, eg SAN
* contains DNS:*.vpnservice.com where our leftid=*.vpnservice.com
*/
4487static bool_Bool idr_wildmatch(const struct end *this, const struct id *idr, struct logger *logger)
4488{
/* check if received IDr is a valid SAN of our cert */
/* cert_VerifySubjectAltName, if called, will [debug]log any errors */
/* XXX:  calling cert_VerifySubjectAltName with ID_DER_ASN1_DN futile? */
/* ??? if cert matches we don't actually do any further ID matching, wildcard or not */
if (this->cert.nss_cert != NULL((void*)0) &&
   (idr->kind == ID_FQDN || idr->kind == ID_DER_ASN1_DN)) {
diag_t d = cert_verify_subject_alt_name(this->cert.nss_cert, idr);
if (d == NULL((void*)0)) {
	return true1;
}
llog_diag(RC_LOG_SERIOUS, logger, &d, "%s", "");
}

const struct id *wild = &this->id;

/* if not both ID_FQDN, fall back to same_id (no wildcarding possible) */
if (idr->kind != ID_FQDN || wild->kind != ID_FQDN)
return same_id(wild, idr);

size_t wl = wild->name.len;
const char *wp = (const char *) wild->name.ptr;

/* if wild has no *, fall back to same_id (no wildcard present) */
if (wl == 0 || wp[0] != '*')
return same_id(wild, idr);

while (wp[wl - 1] == '.')
wl--;	/* strip trailing dot */

size_t il = idr->name.len;
const char *ip = (const char *) idr->name.ptr;
while (il > 0 && ip[il - 1] == '.')
il--;	/* strip trailing dot */

/*
* ??? should we require that the * match only whole components?
* wl-1 == il ||   // total match
* wl > 1 && wp[1] == '.' ||   // wild included leading "."
* ip[il-(wl-1) - 1] == '.'   // match preceded by "."
*/

return wl-1 <= il && strncaseeq(&wp[1], &ip[il-(wl-1)], wl-1)(strncasecmp((&wp[1]), (&ip[il-(wl-1)]), (wl-1)) == 0
);
4531}

4533/*
* sa priority and type should really go into kernel_sa
*
* Danger! While the priority used by the kernel is lowest-wins this
* code computes the reverse, only to then subtract that from some
* magic constant.
*/
4540uint32_t calculate_sa_prio(const struct connection *c, bool_Bool oe_shunt)
4541{
connection_buf cib;

if (c->sa_priority != 0) {
dbg("priority calculation of connection "PRI_CONNECTION" overruled by connection specification of %"PRIu32" (%#"PRIx32")",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("priority calculation of connection ""\"%s\"%s"
" overruled by connection specification of %""u"" (%#""x"")",
 (c)->name, str_connection_instance(c, &cib), c->sa_priority
, c->sa_priority); } }
    pri_connection(c, &cib), c->sa_priority, c->sa_priority){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("priority calculation of connection ""\"%s\"%s"
" overruled by connection specification of %""u"" (%#""x"")",
 (c)->name, str_connection_instance(c, &cib), c->sa_priority
, c->sa_priority); } };
return c->sa_priority;
}

if (LIN(POLICY_GROUP, c->policy)(((((lset_t)1 << (POLICY_GROUP_IX))) & (c->policy
)) == (((lset_t)1 << (POLICY_GROUP_IX))))) {
dbg("priority calculation of connection "PRI_CONNECTION" skipped - group template does not install SPDs",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("priority calculation of connection ""\"%s\"%s"
" skipped - group template does not install SPDs", (c)->name
, str_connection_instance(c, &cib)); } }
    pri_connection(c, &cib)){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("priority calculation of connection ""\"%s\"%s"
" skipped - group template does not install SPDs", (c)->name
, str_connection_instance(c, &cib)); } };
return 0;
}

/* XXX: assume unsigned >= 32-bits */
passert(sizeof(unsigned) >= sizeof(uint32_t))({ _Bool assertion__ = sizeof(unsigned) >= sizeof(uint32_t
); if (!assertion__) { where_t here = ({ static const struct where
 here = { .func = __func__, .file = "programs/pluto/connections.c"
, .line = 4557, }; &here; }); const struct logger *logger_
 = &failsafe_logger; llog_passert(logger_, here, "%s", "sizeof(unsigned) >= sizeof(uint32_t)"
); } (void) 1; });

unsigned portsw = /* max 2 (2 bits) */
(c->spd.this.port == 0 ? 0 : 1) +
(c->spd.that.port == 0 ? 0 : 1);

unsigned protow = c->spd.this.protocol == 0 ? 0 : 1;	/* (1 bit) */


/*
* For transport mode or /32 to /32, the client mask bits are
* set based on the host_addr parameters.
*/
unsigned srcw, dstw;	/* each max 128 (8 bits) */
srcw = c->spd.this.client.maskbits;
dstw = c->spd.that.client.maskbits;
/* if opportunistic, override the template destination mask with /32 or /128 */
if (oe_shunt) {
dstw = (addrtypeof(&c->spd.that.host_addr) == AF_INET2) ? 32 : 128;
}

/*
* "Ensure an instance of a template/OE-group always has
* preference."
*
* Except, at this point, the polarity is reversed so the
* below gives CK_INSTANCE lower priority.  Get around this
* for sec-labels by making the decrement bigger (except that
* is overflowing into the DSTW bits).
*
* Should fix the math, but that affects all tests.
*/
unsigned instw = (c->kind == CK_INSTANCE && c->spd.this.sec_label.len > 0 ? 2u :
	  c->kind == CK_INSTANCE ? 0u :
	  1u);

unsigned pmax;
if (LIN(POLICY_GROUPINSTANCE, c->policy)(((((lset_t)1 << (POLICY_GROUPINSTANCE_IX))) & (c->
policy)) == (((lset_t)1 << (POLICY_GROUPINSTANCE_IX))))) {
if (LIN(POLICY_AUTH_NULL, c->policy)(((((lset_t)1 << (POLICY_AUTH_NULL_IX))) & (c->policy
)) == (((lset_t)1 << (POLICY_AUTH_NULL_IX))))) {
	pmax = PLUTO_SPD_OPPO_ANON_MAX(4u * (1u << 20) - 1u);
} else {
	pmax = PLUTO_SPD_OPPO_MAX(3u * (1u << 20) - 1u);
}
} else {
pmax = PLUTO_SPD_STATIC_MAX(2u * (1u << 20) - 1u);
}

unsigned prio_hi = (portsw << 18 | protow << 17 | srcw << 9 | dstw << 1 | instw);
unsigned prio_lo = pmax - prio_hi;

dbg("priority calculation of connection "PRI_CONNECTION" is %u-%u=%u (%#x) portsw=%u protow=%u, srcw=%u dstw=%u instw=%u",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("priority calculation of connection ""\"%s\"%s"
" is %u-%u=%u (%#x) portsw=%u protow=%u, srcw=%u dstw=%u instw=%u"
, (c)->name, str_connection_instance(c, &cib), pmax, prio_hi
, prio_lo, prio_lo, portsw, protow, srcw, dstw, instw); } }
   pri_connection(c, &cib), pmax, prio_hi, prio_lo, prio_lo,{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("priority calculation of connection ""\"%s\"%s"
" is %u-%u=%u (%#x) portsw=%u protow=%u, srcw=%u dstw=%u instw=%u"
, (c)->name, str_connection_instance(c, &cib), pmax, prio_hi
, prio_lo, prio_lo, portsw, protow, srcw, dstw, instw); } }
   portsw, protow, srcw, dstw, instw){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("priority calculation of connection ""\"%s\"%s"
" is %u-%u=%u (%#x) portsw=%u protow=%u, srcw=%u dstw=%u instw=%u"
, (c)->name, str_connection_instance(c, &cib), pmax, prio_hi
, prio_lo, prio_lo, portsw, protow, srcw, dstw, instw); } };
return prio_lo;
4611}

4613/*
* If the connection contains a newer SA, return it.
*/
4616so_serial_t get_newer_sa_from_connection(struct state *st)
4617{
struct connection *c = st->st_connection;
so_serial_t newest;

if (IS_IKE_SA(st)((st)->st_clonedfrom == 0)) {
newest = c->newest_ike_sa;
dbg("picked newest_ike_sa #%lu for #%lu",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("picked newest_ike_sa #%lu for #%lu", newest, st
->st_serialno); } }
    newest, st->st_serialno){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("picked newest_ike_sa #%lu for #%lu", newest, st
->st_serialno); } };
} else {
newest = c->newest_ipsec_sa;
dbg("picked newest_ipsec_sa #%lu for #%lu",{ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("picked newest_ipsec_sa #%lu for #%lu", newest
, st->st_serialno); } }
    newest, st->st_serialno){ if ((cur_debugging & (((lset_t)1 << (DBG_BASE_IX)
)))) { DBG_log("picked newest_ipsec_sa #%lu for #%lu", newest
, st->st_serialno); } };
}

if (newest != SOS_NOBODY0 && newest != st->st_serialno) {
return newest;
} else {
return SOS_NOBODY0;
}
4636}

4638/* check to see that Ids of peers match */
4639bool_Bool same_peer_ids(const struct connection *c, const struct connection *d,
   const struct id *peer_id)
4641{
return same_id(&c->spd.this.id, &d->spd.this.id) &&
      same_id(peer_id == NULL((void*)0) ? &c->spd.that.id : peer_id,
       &d->spd.that.id);
4645}