Merge branch 'ipsec-sa-cfg-equals'

Fixes the comparison of ipsec_sa_cfg_t instances in case there is
padding that's not initialized to zero.

Fixes #1503.

src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c

@@ -414,8 +414,9 @@ static bool ipsec_sa_equals(ipsec_sa_t *sa, ipsec_sa_t *other_sa)
 {
 	return sa->src->ip_equals(sa->src, other_sa->src) &&
 		   sa->dst->ip_equals(sa->dst, other_sa->dst) &&
-		   memeq(&sa->mark, &other_sa->mark, sizeof(mark_t)) &&
-		   memeq(&sa->cfg, &other_sa->cfg, sizeof(ipsec_sa_cfg_t));
+		   sa->mark.value == other_sa->mark.value &&
+		   sa->mark.mask == other_sa->mark.mask &&
+		   ipsec_sa_cfg_equals(&sa->cfg, &other_sa->cfg);
 }
 
 /**

src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c

@@ -352,7 +352,7 @@ static bool ipsec_sa_equals(ipsec_sa_t *sa, ipsec_sa_t *other_sa)
 {
 	return sa->src->ip_equals(sa->src, other_sa->src) &&
 		   sa->dst->ip_equals(sa->dst, other_sa->dst) &&
-		   memeq(&sa->cfg, &other_sa->cfg, sizeof(ipsec_sa_cfg_t));
+		   ipsec_sa_cfg_equals(&sa->cfg, &other_sa->cfg);
 }
 
 /**

src/libstrongswan/ipsec/ipsec_types.c

@@ -37,6 +37,22 @@ ENUM(ipcomp_transform_names, IPCOMP_NONE, IPCOMP_LZJH,
 	"IPCOMP_LZJH"
 );
 
+/*
+ * See header
+ */
+bool ipsec_sa_cfg_equals(ipsec_sa_cfg_t *a, ipsec_sa_cfg_t *b)
+{
+	return a->mode == b->mode &&
+		a->reqid == b->reqid &&
+		a->policy_count == b->policy_count &&
+		a->esp.use == b->esp.use &&
+		a->esp.spi == b->esp.spi &&
+		a->ah.use == b->ah.use &&
+		a->ah.spi == b->ah.spi &&
+		a->ipcomp.transform == b->ipcomp.transform &&
+		a->ipcomp.cpi == b->ipcomp.cpi;
+}
+
 /*
  * See header
  */

src/libstrongswan/ipsec/ipsec_types.h

@@ -142,6 +142,15 @@ struct ipsec_sa_cfg_t {
 	} ipcomp;
 };
 
+/**
+ * Compare two ipsec_sa_cfg_t objects for equality.
+ *
+ * @param a			first object
+ * @param b			second object
+ * @return			TRUE if both objects are equal
+ */
+bool ipsec_sa_cfg_equals(ipsec_sa_cfg_t *a, ipsec_sa_cfg_t *b);
+
 /**
  * A lifetime_cfg_t defines the lifetime limits of an SA.
  *