denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec-types: Restrict the use of %unique and other keywords when parsing marks

Browse Source 
%unique (and the upcoming %same key) are usable in specific contexts only.
To restrict the user from using it in other places where it does not get the
expected results, reject such keywords unless explicitly allowed.
This commit is contained in:
Martin Willi
2018-08-31 12:26:40 +02:00
committed by Tobias Brunner
parent b9aacf9adc
commit ebd2d3877e
7 changed files with 80 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starter/confread.c
+3 -3
View File
@@ -444,7 +444,7 @@ static void handle_keyword(kw_token_t token, starter_conn_t *conn, char *key,
KW_SA_OPTION_FLAG("yes", "no", SA_OPTION_COMPRESS)
break;
case KW_MARK:
if (!mark_from_string(value, &conn->mark_in))
if (!mark_from_string(value, MARK_OP_UNIQUE, &conn->mark_in))
{
cfg->err++;
break;
@@ -452,13 +452,13 @@ static void handle_keyword(kw_token_t token, starter_conn_t *conn, char *key,
conn->mark_out = conn->mark_in;
break;
case KW_MARK_IN:
if (!mark_from_string(value, &conn->mark_in))
if (!mark_from_string(value, MARK_OP_UNIQUE, &conn->mark_in))
{
cfg->err++;
}
break;
case KW_MARK_OUT:
if (!mark_from_string(value, &conn->mark_out))
if (!mark_from_string(value, MARK_OP_UNIQUE, &conn->mark_out))
{
cfg->err++;
}