denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel-netlink: Properly set port mask for ICMP type/code if only set on one side

Browse Source 
If only one traffic selector had a port (type/code) the other side had
the port mask set to 0, which canceled out the applied type/code.

It also fixes the installation of ICMP type/code on big-endian hosts.

Fixes #1091.
References #595.
This commit is contained in:
Tobias Brunner
2015-08-31 15:30:57 +02:00
parent d34a82dd57
commit 7b20ab0a94
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+8 -7
View File
@@ -735,6 +735,7 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
traffic_selector_t *dst) traffic_selector_t *dst)
{ {
struct xfrm_selector sel; struct xfrm_selector sel;
u_int16_t port;
memset(&sel, 0, sizeof(sel)); memset(&sel, 0, sizeof(sel));
sel.family = (src->get_type(src) == TS_IPV4_ADDR_RANGE) ? AF_INET : AF_INET6; sel.family = (src->get_type(src) == TS_IPV4_ADDR_RANGE) ? AF_INET : AF_INET6;
@@ -747,13 +748,13 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) && if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) &&
(sel.dport || sel.sport)) (sel.dport || sel.sport))
{ {
/* the ICMP type is encoded in the most significant 8 bits and the ICMP /* the kernel expects the ICMP type and code in the source and
* code in the least significant 8 bits of the port. via XFRM we have * destination port fields, respectively. */
* to pass the ICMP type and code in the source and destination port port = ntohs(max(sel.dport, sel.sport));
* fields, respectively. the port is in network byte order. */ sel.sport = htons(traffic_selector_icmp_type(port));
u_int16_t port = max(sel.dport, sel.sport); sel.sport_mask = sel.sport ? ~0 : 0;
sel.sport = htons(port & 0xff); sel.dport = htons(traffic_selector_icmp_code(port));
sel.dport = htons(port >> 8); sel.dport_mask = sel.dport ? ~0 : 0;
} }
sel.ifindex = 0; sel.ifindex = 0;
sel.user = 0; sel.user = 0;