vpn-manager: Fix l2tp/ipsec connections to Windows RRAS server

ipsec_manager.cc

 // Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "vpn-manager/ipsec_manager.h"
 
 #include <arpa/inet.h>  // for inet_ntop and inet_pton
 #include <grp.h>
 #include <netdb.h>  // for getaddrinfo
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
 #include <string>
 #include <vector>
 
 #include "base/eintr_wrapper.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/string_util.h"
 #include "chromeos/process.h"
 #include "gflags/gflags.h"
 
 #pragma GCC diagnostic ignored "-Wstrict-aliasing"
+// Windows RRAS requires modp1024 dh-group.  Strongswan's
+// default is modp1536 which it does not support.
+DEFINE_string(ike, "3des-sha1-modp1024", "ike proposals");
 DEFINE_int32(ipsec_timeout, 10, "timeout for ipsec to be established");
 DEFINE_string(leftprotoport, "17/1701", "client protocol/port");
+DEFINE_bool(nat_traversal, true, "Enable NAT-T nat traversal");
 DEFINE_bool(pfs, false, "pfs");
 DEFINE_bool(rekey, false, "rekey");
 DEFINE_string(rightprotoport, "17/1701", "server protocol/port");
+DEFINE_string(type, "transport", "IPsec type (transport or tunnel)");
 #pragma GCC diagnostic error "-Wstrict-aliasing"
 
 const char kIpsecConnectionName[] = "ipsec_managed";
 const char kIpsecGroupName[] = "ipsec";
 const char kIpsecRunPath[] = "/var/run/ipsec";
 const char kIpsecUpFile[] = "/var/run/ipsec/up";
 const char kIpsecServiceName[] = "ipsec";
 const char kStarterPidFile[] = "/var/run/starter.pid";
 const mode_t kIpsecRunPathMode = (S_IRUSR | S_IWUSR | S_IXUSR |
                                   S_IRGRP | S_IWGRP | S_IXGRP);
@@ skipping 213 matching lines @@
 }
 
 std::string IpsecManager::FormatStarterConfigFile() {
   std::string config;
   config.append("config setup\n");
   if (ike_version_ == 1) {
     AppendBoolSetting(&config, "charonstart", false);
   } else {
     AppendBoolSetting(&config, "plutostart", false);
   }
+  AppendBoolSetting(&config, "nat_traversal", FLAGS_nat_traversal);
   config.append("conn managed\n");
+  AppendStringSetting(&config, "ike", FLAGS_ike);
   AppendStringSetting(&config, "keyexchange",
                       ike_version_ == 1 ? "ikev1" : "ikev2");
   if (!psk_file_.empty()) AppendStringSetting(&config, "authby", "psk");
   AppendBoolSetting(&config, "pfs", FLAGS_pfs);
   AppendBoolSetting(&config, "rekey", FLAGS_rekey);
   AppendStringSetting(&config, "left", "%defaultroute");
   AppendStringSetting(&config, "leftprotoport", FLAGS_leftprotoport);
   AppendStringSetting(&config, "leftupdown", IPSEC_UPDOWN);
   AppendStringSetting(&config, "right", remote_address_);
   AppendStringSetting(&config, "rightprotoport", FLAGS_rightprotoport);
+  AppendStringSetting(&config, "type", FLAGS_type);
   AppendStringSetting(&config, "auto", "start");
   return config;
 }
 
 bool IpsecManager::SetIpsecGroup(const FilePath& file_path) {
   return chown(file_path.value().c_str(), getuid(), ipsec_group_) == 0;
 }
 
 bool IpsecManager::WriteConfigFiles() {
   // We need to keep secrets in /mnt/stateful_partition/etc for now
@@ skipping 115 matching lines @@
     return;
   }
 
   if (!starter_->Kill(SIGTERM, kTermTimeout)) {
     starter_->Kill(SIGKILL, 0);
     OnStopped(true);
     return;
   }
   OnStopped(false);
 }