diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2015-08-26 18:07:06 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2015-09-16 15:00:46 +0200 |
| commit | 65978f08f4738b2bc4c998c974201b688c779435 (patch) | |
| tree | 88ff7d0e0fdea0278f73452ba30183e7be43a1a0 /src | |
| parent | 5f18e2c3711c091acb571b898bf820b6192272d6 (diff) | |
| download | strongswan-65978f08f4738b2bc4c998c974201b688c779435.tar.bz2 strongswan-65978f08f4738b2bc4c998c974201b688c779435.tar.xz | |
shunt-manager: Don't install policies in case of an address family or IP protocol mismatch
References #595.
Diffstat (limited to 'src')
| -rw-r--r-- | src/libcharon/sa/shunt_manager.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/src/libcharon/sa/shunt_manager.c b/src/libcharon/sa/shunt_manager.c index 1a984435c..14609b2bf 100644 --- a/src/libcharon/sa/shunt_manager.c +++ b/src/libcharon/sa/shunt_manager.c @@ -96,6 +96,16 @@ static bool install_shunt_policy(child_cfg_t *child) e_other_ts = other_ts_list->create_enumerator(other_ts_list); while (e_other_ts->enumerate(e_other_ts, &other_ts)) { + if (my_ts->get_type(my_ts) != other_ts->get_type(other_ts)) + { + continue; + } + if (my_ts->get_protocol(my_ts) && + other_ts->get_protocol(other_ts) && + my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts)) + { + continue; + } /* install out policy */ status |= hydra->kernel_interface->add_policy( hydra->kernel_interface, host_any, host_any, @@ -212,6 +222,16 @@ static void uninstall_shunt_policy(child_cfg_t *child) e_other_ts = other_ts_list->create_enumerator(other_ts_list); while (e_other_ts->enumerate(e_other_ts, &other_ts)) { + if (my_ts->get_type(my_ts) != other_ts->get_type(other_ts)) + { + continue; + } + if (my_ts->get_protocol(my_ts) && + other_ts->get_protocol(other_ts) && + my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts)) + { + continue; + } /* uninstall out policy */ status |= hydra->kernel_interface->del_policy( hydra->kernel_interface, my_ts, other_ts, |