denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use subset matching instead of is_contained_in() to select a child_cfg

Browse Source 
If one selector has a wider IP range than the other, but the other has a
wider port/protocol selector than the first one, none is completely contained
in the other. The check for a match using is_contained_in() therefore would
fail. Using get_subset() can handle such cases, fixing configuration selection.
This commit is contained in:
Martin Willi
2013-06-13 13:37:50 +02:00
parent 44fb978169
commit 246e2bed1d
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/config/peer_cfg.c
+8 -4
View File
@@ -249,7 +249,7 @@ static int get_ts_match(child_cfg_t *cfg, bool local,
{ {
linked_list_t *cfg_list; linked_list_t *cfg_list;
enumerator_t *sup_enum, *cfg_enum; enumerator_t *sup_enum, *cfg_enum;
traffic_selector_t *sup_ts, *cfg_ts; traffic_selector_t *sup_ts, *cfg_ts, *subset;
int match = 0, round; int match = 0, round;
/* fetch configured TS list, narrowing dynamic TS */ /* fetch configured TS list, narrowing dynamic TS */
@@ -268,10 +268,14 @@ static int get_ts_match(child_cfg_t *cfg, bool local,
{ /* equality is honored better than matches */ { /* equality is honored better than matches */
match += round * 5; match += round * 5;
} }
else if (cfg_ts->is_contained_in(cfg_ts, sup_ts) || else
sup_ts->is_contained_in(sup_ts, cfg_ts))
{ {
match += round * 1; subset = cfg_ts->get_subset(cfg_ts, sup_ts);
if (subset)
{
subset->destroy(subset);
match += round * 1;
}
} }
} }
cfg_enum->destroy(cfg_enum); cfg_enum->destroy(cfg_enum);