vici: Don't fall back to uninstalling traps if a matching shunt was found
authorTobias Brunner <tobias@strongswan.org>
Wed, 22 Mar 2017 16:19:31 +0000 (17:19 +0100)
committerTobias Brunner <tobias@strongswan.org>
Thu, 23 Mar 2017 17:29:18 +0000 (18:29 +0100)
This is different if `ike` and `child` are provided and uninstall()
fails as we call that without knowing whether a matching shunt exists.
But if `ike` is not provided we explicitly search for a matching shunt
and if found don't need to look for a trap policy.

src/libcharon/plugins/vici/vici_control.c

index 83e09d5..afee649 100644 (file)
@@ -707,12 +707,16 @@ CALLBACK(uninstall, vici_message_t*,
                        }
                }
                enumerator->destroy(enumerator);
-               if (ike && charon->shunts->uninstall(charon->shunts, ike, child))
+               if (ike)
                {
+                       if (charon->shunts->uninstall(charon->shunts, ike, child))
+                       {
+                               free(ike);
+                               return send_reply(this, NULL);
+                       }
                        free(ike);
-                       return send_reply(this, NULL);
+                       return send_reply(this, "uninstalling policy '%s' failed", child);
                }
-               free(ike);
        }
        else if (charon->shunts->uninstall(charon->shunts, ike, child))
        {