ipsec-types: Don't mask the mark value if it is one of the 'unique' values

Support for mark=%unique/%unique-dir is implemented by using designated
magic mark values.

Use of masks is orthogonal to the 'unique' feature, as it is useful to be
able to designate portions of the packet mark for other purposes, while
still using different marks for different connections.

When these magic values are masked, their magic meaning is lost.

Perform masking only on explicit mark values.

Closes strongswan/strongswan#87.

diff --git a/src/libstrongswan/ipsec/ipsec_types.c b/src/libstrongswan/ipsec/ipsec_types.c
index 68c3935b9dd6a7c938bbbf1e02bd5a79865974c7..c992eb5add5620e8e561b945c1eb16190bf3a446 100644 (file)
--- a/src/libstrongswan/ipsec/ipsec_types.c
+++ b/src/libstrongswan/ipsec/ipsec_types.c
@@ -104,7 +104,10 @@ bool mark_from_string(const char *value, mark_t *mark)
        {
                mark->mask = 0xffffffff;
        }
-       /* apply the mask to ensure the value is in range */
-       mark->value &= mark->mask;
+       if (!MARK_IS_UNIQUE(mark->value))
+       {
+               /* apply the mask to ensure the value is in range */
+               mark->value &= mark->mask;
+       }
        return TRUE;
 }

diff --git a/src/libstrongswan/tests/suites/test_utils.c b/src/libstrongswan/tests/suites/test_utils.c
index 353010aaf1b819f5692100c77c875d67eb5b5201..b423d7d2d3227d2b8ac133604161470d91c8ffbf 100644 (file)
--- a/src/libstrongswan/tests/suites/test_utils.c
+++ b/src/libstrongswan/tests/suites/test_utils.c
@@ -877,8 +877,23 @@ static struct {
        {"/0xff",               TRUE,  { 0, 0xff }},
        {"/x",                  FALSE, { 0 }},
        {"x/x",                 FALSE, { 0 }},
-       {"0xffffffff/0x0000ffff",       TRUE, { 0x0000ffff, 0x0000ffff }},
-       {"0xffffffff/0xffffffff",       TRUE, { 0xffffffff, 0xffffffff }},
+       {"0xfffffff0/0x0000ffff",       TRUE,  { 0x0000fff0, 0x0000ffff }},
+       {"%unique",                                     TRUE,  { MARK_UNIQUE, 0xffffffff }},
+       {"%unique/",                            TRUE,  { MARK_UNIQUE, 0 }},
+       {"%unique/0x0000ffff",          TRUE,  { MARK_UNIQUE, 0x0000ffff }},
+       {"%unique/0xffffffff",          TRUE,  { MARK_UNIQUE, 0xffffffff }},
+       {"%unique0xffffffffff",         FALSE, { 0, 0 }},
+       {"0xffffffff/0x0000ffff",       TRUE,  { MARK_UNIQUE, 0x0000ffff }},
+       {"0xffffffff/0xffffffff",       TRUE,  { MARK_UNIQUE, 0xffffffff }},
+       {"%unique-dir",                         TRUE,  { MARK_UNIQUE_DIR, 0xffffffff }},
+       {"%unique-dir/",                        TRUE,  { MARK_UNIQUE_DIR, 0 }},
+       {"%unique-dir/0x0000ffff",      TRUE,  { MARK_UNIQUE_DIR, 0x0000ffff }},
+       {"%unique-dir/0xffffffff",      TRUE,  { MARK_UNIQUE_DIR, 0xffffffff }},
+       {"%unique-dir0xffffffff",       FALSE, { 0, 0 }},
+       {"0xfffffffe/0x0000ffff",       TRUE,  { MARK_UNIQUE_DIR, 0x0000ffff }},
+       {"0xfffffffe/0xffffffff",       TRUE,  { MARK_UNIQUE_DIR, 0xffffffff }},
+       {"%unique-/0xffffffff",         FALSE, { 0, 0 }},
+       {"%unique-foo/0xffffffff",      FALSE, { 0, 0 }},
 };
 
 START_TEST(test_mark_from_string)