diff options
| author | Yves-Alexis Perez <corsac@corsac.net> | 2017-04-01 16:26:44 +0200 |
|---|---|---|
| committer | Yves-Alexis Perez <corsac@corsac.net> | 2017-04-01 16:26:44 +0200 |
| commit | 05ddd767992d68bb38c7f16ece142e8c2e9ae016 (patch) | |
| tree | 302c618be306d4ed3c7f9fc58a1f6aaad4dd252f /src/libipsec/ipsec_policy.c | |
| parent | 25663e04c3ab01ef8dc9f906608282319cfea2db (diff) | |
| download | vyos-strongswan-05ddd767992d68bb38c7f16ece142e8c2e9ae016.tar.gz vyos-strongswan-05ddd767992d68bb38c7f16ece142e8c2e9ae016.zip | |
New upstream version 5.5.2
Diffstat (limited to 'src/libipsec/ipsec_policy.c')
| -rw-r--r-- | src/libipsec/ipsec_policy.c | 22 |
1 files changed, 21 insertions, 1 deletions
diff --git a/src/libipsec/ipsec_policy.c b/src/libipsec/ipsec_policy.c index 8077d3c8d..98201b843 100644 --- a/src/libipsec/ipsec_policy.c +++ b/src/libipsec/ipsec_policy.c @@ -101,6 +101,24 @@ METHOD(ipsec_policy_t, match, bool, this->dst_ts->equals(this->dst_ts, dst_ts)); } +/** + * Match the port of the given host against the given traffic selector. + */ +static inline bool match_port(traffic_selector_t *ts, host_t *host) +{ + uint16_t from, to, port; + + from = ts->get_from_port(ts); + to = ts->get_to_port(ts); + if ((from == 0 && to == 0xffff) || + (from == 0xffff && to == 0)) + { + return TRUE; + } + port = host->get_port(host); + return from <= port && port <= to; +} + METHOD(ipsec_policy_t, match_packet, bool, private_ipsec_policy_t *this, ip_packet_t *packet) { @@ -110,7 +128,9 @@ METHOD(ipsec_policy_t, match_packet, bool, return (!this->protocol || this->protocol == proto) && this->src_ts->includes(this->src_ts, src) && - this->dst_ts->includes(this->dst_ts, dst); + match_port(this->src_ts, src) && + this->dst_ts->includes(this->dst_ts, dst) && + match_port(this->dst_ts, dst); } METHOD(ipsec_policy_t, get_source_ts, traffic_selector_t*, |