denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipsec-types: Restrict the use of %unique and other keywords when parsing marks

Browse Source 
%unique (and the upcoming %same key) are usable in specific contexts only.
To restrict the user from using it in other places where it does not get the
expected results, reject such keywords unless explicitly allowed.
This commit is contained in:
Martin Willi authored and Tobias Brunner committed 2018-08-31 12:26:40 +02:00
1 parent b9aacf9adc
commit ebd2d3877e
7 files changed
+80 -41
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/starter/confread.c
+3 -3
View File
@@ -444,7 +444,7 @@ static void handle_keyword(kw_token_t token, starter_conn_t *conn, char *key,
KW_SA_OPTION_FLAG("yes", "no", SA_OPTION_COMPRESS)
break;
case KW_MARK:
if (!mark_from_string(value, &conn->mark_in))
if (!mark_from_string(value, MARK_OP_UNIQUE, &conn->mark_in))
{
cfg->err++;
break;
@@ -452,13 +452,13 @@ static void handle_keyword(kw_token_t token, starter_conn_t *conn, char *key,
conn->mark_out = conn->mark_in;
break;
case KW_MARK_IN:
if (!mark_from_string(value, &conn->mark_in))
if (!mark_from_string(value, MARK_OP_UNIQUE, &conn->mark_in))
{
cfg->err++;
}
break;
case KW_MARK_OUT:
if (!mark_from_string(value, &conn->mark_out))
if (!mark_from_string(value, MARK_OP_UNIQUE, &conn->mark_out))
{
cfg->err++;
}