connmark: Compare the complete rules when deleting them
authorTobias Brunner <tobias@strongswan.org>
Mon, 7 Mar 2016 14:32:02 +0000 (15:32 +0100)
committerTobias Brunner <tobias@strongswan.org>
Thu, 10 Mar 2016 16:26:09 +0000 (17:26 +0100)
By settings a matchmask that covers the complete rule we ensure that the
correct rule is deleted (i.e. matches and targets with potentially different
marks are also compared).

Since data after the passed pointer is actually dereferenced when
comparing we definitely have to pass an array that is at least as long as
the ipt_entry.

Fixes #1229.

src/libcharon/plugins/connmark/connmark_listener.c

index cd53701..9dde7c1 100644 (file)
@@ -101,7 +101,10 @@ static bool manage_rule(struct iptc_handle *ipth, const char *chain,
        }
        else
        {
-               if (!iptc_delete_entry(chain, e, "", ipth))
+               u_char matchmask[e->next_offset];
+
+               memset(matchmask, 255, sizeof(matchmask));
+               if (!iptc_delete_entry(chain, e, matchmask, ipth))
                {
                        DBG1(DBG_CFG, "deleting %s rule failed: %s",
                                 chain, iptc_strerror(errno));