denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Make absolutely sure we always delete the right policy cache entry

Browse Source
This commit is contained in:
Tobias Brunner
2015-11-10 16:42:53 +01:00
parent a6e0f14fd2
commit 33400876d4
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+9 -2
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright (C) 2006-2013 Tobias Brunner * Copyright (C) 2006-2015 Tobias Brunner
* Copyright (C) 2005-2009 Martin Willi * Copyright (C) 2005-2009 Martin Willi
* Copyright (C) 2008 Andreas Steffen * Copyright (C) 2008 Andreas Steffen
* Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser * Copyright (C) 2006-2007 Fabian Hartmann, Noah Heusser
@@ -2483,6 +2483,12 @@ METHOD(kernel_ipsec_t, del_policy, status_t,
struct xfrm_userpolicy_id *policy_id; struct xfrm_userpolicy_id *policy_id;
bool is_installed = TRUE; bool is_installed = TRUE;
u_int32_t priority; u_int32_t priority;
ipsec_sa_t assigned_sa = {
.src = src,
.dst = dst,
.mark = mark,
.cfg = *sa,
};
DBG2(DBG_KNL, "deleting policy %R === %R %N (mark %u/0x%08x)", DBG2(DBG_KNL, "deleting policy %R === %R %N (mark %u/0x%08x)",
src_ts, dst_ts, policy_dir_names, direction, src_ts, dst_ts, policy_dir_names, direction,
@@ -2519,7 +2525,8 @@ METHOD(kernel_ipsec_t, del_policy, status_t,
enumerator = current->used_by->create_enumerator(current->used_by); enumerator = current->used_by->create_enumerator(current->used_by);
while (enumerator->enumerate(enumerator, (void**)&mapping)) while (enumerator->enumerate(enumerator, (void**)&mapping))
{ {
if (priority == mapping->priority) if (priority == mapping->priority && type == mapping->type &&
ipsec_sa_equals(mapping->sa, &assigned_sa))
{ {
current->used_by->remove_at(current->used_by, enumerator); current->used_by->remove_at(current->used_by, enumerator);
policy_sa_destroy(mapping, &direction, this); policy_sa_destroy(mapping, &direction, this);