denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec-types: Don't mask the mark value if it is one of the 'unique' values

Browse Source 
Support for mark=%unique/%unique-dir is implemented by using designated
magic mark values.

Use of masks is orthogonal to the 'unique' feature, as it is useful to be
able to designate portions of the packet mark for other purposes, while
still using different marks for different connections.

When these magic values are masked, their magic meaning is lost.

Perform masking only on explicit mark values.

Closes strongswan/strongswan#87.
This commit is contained in:
Eyal Birger
2017-12-07 09:36:53 +01:00
committed by Tobias Brunner
parent ee22e8080f
commit 2389168388
2 changed files with 22 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/ipsec/ipsec_types.c
+5 -2
View File
@@ -104,7 +104,10 @@ bool mark_from_string(const char *value, mark_t *mark)
{
mark->mask = 0xffffffff;
}
/* apply the mask to ensure the value is in range */
mark->value &= mark->mask;
if (!MARK_IS_UNIQUE(mark->value))
{
/* apply the mask to ensure the value is in range */
mark->value &= mark->mask;
}
return TRUE;
}
src/libstrongswan/tests/suites/test_utils.c
+17 -2
View File
@@ -877,8 +877,23 @@ static struct {
{"/0xff", TRUE, { 0, 0xff }},
{"/x", FALSE, { 0 }},
{"x/x", FALSE, { 0 }},
{"0xffffffff/0x0000ffff", TRUE, { 0x0000ffff, 0x0000ffff }},
{"0xffffffff/0xffffffff", TRUE, { 0xffffffff, 0xffffffff }},
{"0xfffffff0/0x0000ffff", TRUE, { 0x0000fff0, 0x0000ffff }},
{"%unique", TRUE, { MARK_UNIQUE, 0xffffffff }},
{"%unique/", TRUE, { MARK_UNIQUE, 0 }},
{"%unique/0x0000ffff", TRUE, { MARK_UNIQUE, 0x0000ffff }},
{"%unique/0xffffffff", TRUE, { MARK_UNIQUE, 0xffffffff }},
{"%unique0xffffffffff", FALSE, { 0, 0 }},
{"0xffffffff/0x0000ffff", TRUE, { MARK_UNIQUE, 0x0000ffff }},
{"0xffffffff/0xffffffff", TRUE, { MARK_UNIQUE, 0xffffffff }},
{"%unique-dir", TRUE, { MARK_UNIQUE_DIR, 0xffffffff }},
{"%unique-dir/", TRUE, { MARK_UNIQUE_DIR, 0 }},
{"%unique-dir/0x0000ffff", TRUE, { MARK_UNIQUE_DIR, 0x0000ffff }},
{"%unique-dir/0xffffffff", TRUE, { MARK_UNIQUE_DIR, 0xffffffff }},
{"%unique-dir0xffffffff", FALSE, { 0, 0 }},
{"0xfffffffe/0x0000ffff", TRUE, { MARK_UNIQUE_DIR, 0x0000ffff }},
{"0xfffffffe/0xffffffff", TRUE, { MARK_UNIQUE_DIR, 0xffffffff }},
{"%unique-/0xffffffff", FALSE, { 0, 0 }},
{"%unique-foo/0xffffffff", FALSE, { 0, 0 }},
};
START_TEST(test_mark_from_string)