denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Properly set port mask for ICMP type/code if only set on one side

Browse Source 
If only one traffic selector had a port (type/code) the other side had
the port mask set to 0, which canceled out the applied type/code.

It also fixes the installation of ICMP type/code on big-endian hosts.

Fixes #1091.
References #595.
This commit is contained in:
Tobias Brunner
2015-08-31 15:30:57 +02:00
parent d34a82dd57
commit 7b20ab0a94
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+8 -7
View File
@@ -735,6 +735,7 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
traffic_selector_t *dst)
{
struct xfrm_selector sel;
u_int16_t port;
memset(&sel, 0, sizeof(sel));
sel.family = (src->get_type(src) == TS_IPV4_ADDR_RANGE) ? AF_INET : AF_INET6;
@@ -747,13 +748,13 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) &&
(sel.dport || sel.sport))
{
/* the ICMP type is encoded in the most significant 8 bits and the ICMP
* code in the least significant 8 bits of the port. via XFRM we have
* to pass the ICMP type and code in the source and destination port
* fields, respectively. the port is in network byte order. */
u_int16_t port = max(sel.dport, sel.sport);
sel.sport = htons(port & 0xff);
sel.dport = htons(port >> 8);
/* the kernel expects the ICMP type and code in the source and
* destination port fields, respectively. */
port = ntohs(max(sel.dport, sel.sport));
sel.sport = htons(traffic_selector_icmp_type(port));
sel.sport_mask = sel.sport ? ~0 : 0;
sel.dport = htons(traffic_selector_icmp_code(port));
sel.dport_mask = sel.dport ? ~0 : 0;
}
sel.ifindex = 0;
sel.user = 0;