Use a complete port range in traffic_selector_create_from_{subnet,cidr}

diff --git a/src/conftest/config.c b/src/conftest/config.c
index ae0d93460556751569d6ab99f3d20aecdcb022ed..5c078d21a179c81e8165f7889c966796f4add79a 100644 (file)
--- a/src/conftest/config.c
+++ b/src/conftest/config.c
@@ -188,7 +188,7 @@ static child_cfg_t *load_child_config(private_config_t *this,
                enumerator = enumerator_create_token(token, ",", " ");
                while (enumerator->enumerate(enumerator, &token))
                {
-                       ts = traffic_selector_create_from_cidr(token, 0, 0);
+                       ts = traffic_selector_create_from_cidr(token, 0, 0, 65535);
                        if (ts)
                        {
                                child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
@@ -212,7 +212,7 @@ static child_cfg_t *load_child_config(private_config_t *this,
                enumerator = enumerator_create_token(token, ",", " ");
                while (enumerator->enumerate(enumerator, &token))
                {
-                       ts = traffic_selector_create_from_cidr(token, 0, 0);
+                       ts = traffic_selector_create_from_cidr(token, 0, 0, 65535);
                        if (ts)
                        {
                                child_cfg->add_traffic_selector(child_cfg, FALSE, ts);

diff --git a/src/libcharon/plugins/load_tester/load_tester_config.c b/src/libcharon/plugins/load_tester/load_tester_config.c
index c6288c5d9167102a7b9548d6c91b7fc9f27ab65a..1033eb5173d3023b9dfcbb0f3f4e6b319b2e3067 100644 (file)
--- a/src/libcharon/plugins/load_tester/load_tester_config.c
+++ b/src/libcharon/plugins/load_tester/load_tester_config.c
@@ -369,7 +369,7 @@ static void add_ts(char *string, child_cfg_t *cfg, bool local)
 
        if (string)
        {
-               ts = traffic_selector_create_from_cidr(string, 0, 0);
+               ts = traffic_selector_create_from_cidr(string, 0, 0, 65535);
                if (!ts)
                {
                        DBG1(DBG_CFG, "parsing TS string '%s' failed", string);

diff --git a/src/libcharon/plugins/medcli/medcli_config.c b/src/libcharon/plugins/medcli/medcli_config.c
index 4be3dea026b60df9ef52d4574096c77d6232c2c1..73e128abeb0fbf78462d2582b4d956c21cbe09d9 100644 (file)
--- a/src/libcharon/plugins/medcli/medcli_config.c
+++ b/src/libcharon/plugins/medcli/medcli_config.c
@@ -63,7 +63,7 @@ static traffic_selector_t *ts_from_string(char *str)
        {
                traffic_selector_t *ts;
 
-               ts = traffic_selector_create_from_cidr(str, 0, 0);
+               ts = traffic_selector_create_from_cidr(str, 0, 0, 65535);
                if (ts)
                {
                        return ts;
@@ -389,4 +389,3 @@ medcli_config_t *medcli_config_create(database_t *db)
 
        return &this->public;
 }
-

diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
index 9f6124dc9969bab5e13c1ca0fdfee57ad87b4f21..70d6ce56216f75b02c8aa2165c011a518e6b18e0 100644 (file)
--- a/src/libcharon/plugins/stroke/stroke_config.c
+++ b/src/libcharon/plugins/stroke/stroke_config.c
@@ -873,11 +873,21 @@ static void add_ts(private_stroke_config_t *this,
                                   stroke_end_t *end, child_cfg_t *child_cfg, bool local)
 {
        traffic_selector_t *ts;
+       u_int16_t from_port, to_port;
+
+       if (end->port)
+       {
+               from_port = to_port = end->port;
+       }
+       else
+       {
+               from_port = 0;
+               to_port = 65535;
+       }
 
        if (end->tohost)
        {
-               ts = traffic_selector_create_dynamic(end->protocol,
-                                       end->port ? end->port : 0, end->port ? end->port : 65535);
+               ts = traffic_selector_create_dynamic(end->protocol, from_port, to_port);
                child_cfg->add_traffic_selector(child_cfg, local, ts);
        }
        else
@@ -890,7 +900,7 @@ static void add_ts(private_stroke_config_t *this,
                        if (net)
                        {
                                ts = traffic_selector_create_from_subnet(net, 0, end->protocol,
-                                                                                                                end->port);
+                                                                                                                from_port, to_port);
                                child_cfg->add_traffic_selector(child_cfg, local, ts);
                        }
                }
@@ -902,8 +912,8 @@ static void add_ts(private_stroke_config_t *this,
                        enumerator = enumerator_create_token(end->subnets, ",", " ");
                        while (enumerator->enumerate(enumerator, &subnet))
                        {
-                               ts = traffic_selector_create_from_cidr(subnet,
-                                                                                                       end->protocol, end->port);
+                               ts = traffic_selector_create_from_cidr(subnet, end->protocol,
+                                                                                                          from_port, to_port);
                                if (ts)
                                {
                                        child_cfg->add_traffic_selector(child_cfg, local, ts);

diff --git a/src/libcharon/plugins/uci/uci_config.c b/src/libcharon/plugins/uci/uci_config.c
index de0bf91af6a7654f59da026c119f7ff59535e670..b7df65d1c8dc26bffbdc68a2a63b2db319f43eb3 100644 (file)
--- a/src/libcharon/plugins/uci/uci_config.c
+++ b/src/libcharon/plugins/uci/uci_config.c
@@ -89,7 +89,7 @@ static traffic_selector_t *create_ts(char *string)
        {
                traffic_selector_t *ts;
 
-               ts = traffic_selector_create_from_cidr(string, 0, 0);
+               ts = traffic_selector_create_from_cidr(string, 0, 0, 65535);
                if (ts)
                {
                        return ts;
@@ -343,4 +343,3 @@ uci_config_t *uci_config_create(uci_parser_t *parser)
 
        return &this->public;
 }
-

diff --git a/src/libcharon/plugins/unity/unity_handler.c b/src/libcharon/plugins/unity/unity_handler.c
index 31d13add275954fed927e583fb61d110aafc2c6c..39dd5f0963870ebbe516b6d10c9192d8ec124777 100644 (file)
--- a/src/libcharon/plugins/unity/unity_handler.c
+++ b/src/libcharon/plugins/unity/unity_handler.c
@@ -192,7 +192,8 @@ static job_requeue_t add_exclude_async(entry_t *entry)
                {
                        has_vip = TRUE;
                        child_cfg->add_traffic_selector(child_cfg, TRUE,
-                               traffic_selector_create_from_subnet(host->clone(host), 32, 0, 0));
+                               traffic_selector_create_from_subnet(host->clone(host),
+                                                                                                       32, 0, 0, 65535));
                }
                enumerator->destroy(enumerator);
 
@@ -200,7 +201,8 @@ static job_requeue_t add_exclude_async(entry_t *entry)
                {
                        host = ike_sa->get_my_host(ike_sa);
                        child_cfg->add_traffic_selector(child_cfg, TRUE,
-                               traffic_selector_create_from_subnet(host->clone(host), 32, 0, 0));
+                               traffic_selector_create_from_subnet(host->clone(host), 32, 0,
+                                                                                                       0, 65535));
                }
                charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
 

diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c
index 1eae6aa932b92697c031e858f25ae046f2fc843d..16c47630d84930b0d512fee561ba266fbf746530 100644 (file)
--- a/src/libcharon/sa/ikev1/tasks/quick_mode.c
+++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c
@@ -576,12 +576,12 @@ static bool get_ts(private_quick_mode_t *this, message_t *message)
        if (!tsi)
        {
                tsi = traffic_selector_create_from_subnet(hsi->clone(hsi),
-                                                       hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0);
+                                       hsi->get_family(hsi) == AF_INET ? 32 : 128, 0, 0, 65535);
        }
        if (!tsr)
        {
                tsr = traffic_selector_create_from_subnet(hsr->clone(hsr),
-                                                       hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0);
+                                       hsr->get_family(hsr) == AF_INET ? 32 : 128, 0, 0, 65535);
        }
        if (this->mode == MODE_TRANSPORT && this->udp &&
           (!tsi->is_host(tsi, hsi) || !tsr->is_host(tsr, hsr)))

diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
index f9b2634a0bcca8d497c3919e2a3ac2f1d8e0fe9b..6c4e711a403563bf52d698e65ed49544c672bab5 100644 (file)
--- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -787,7 +787,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
        if (host)
        {
                return traffic_selector_create_from_subnet(host, prefixlen,
-                                                                                                  sel->proto, port);
+                                                                                       sel->proto, port, port ?: 65535);
        }
        return NULL;
 }
@@ -2822,4 +2822,3 @@ kernel_netlink_ipsec_t *kernel_netlink_ipsec_create()
 
        return &this->public;
 }
-

diff --git a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
index 71bdbbe2b9bb4b03883ed53c69be8b0aeee5316a..88b0284477d72da78ae4fd24ae8adf8003955168 100644 (file)
--- a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+++ b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
@@ -953,7 +953,8 @@ static traffic_selector_t* sadb_address2ts(struct sadb_address *address)
        ts = traffic_selector_create_from_subnet(host,
                                                                                         address->sadb_address_prefixlen,
                                                                                         address->sadb_address_proto,
-                                                                                        host->get_port(host));
+                                                                                        host->get_port(host),
+                                                                                        host->get_port(host) ?: 65535);
        return ts;
 }
 
@@ -2654,4 +2655,3 @@ kernel_pfkey_ipsec_t *kernel_pfkey_ipsec_create()
 
        return &this->public;
 }
-

diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c
index fd8bfe1a2fb39baf861e26f00a2d3e97bd9d7aba..ff8285f8c9b2d4403beb5a1626abb51145f42778 100644 (file)
--- a/src/libstrongswan/selectors/traffic_selector.c
+++ b/src/libstrongswan/selectors/traffic_selector.c
@@ -776,12 +776,13 @@ traffic_selector_t *traffic_selector_create_from_rfc3779_format(ts_type_t type,
  * see header
  */
 traffic_selector_t *traffic_selector_create_from_subnet(host_t *net,
-                                                       u_int8_t netbits, u_int8_t protocol, u_int16_t port)
+                                                       u_int8_t netbits, u_int8_t protocol,
+                                                       u_int16_t from_port, u_int16_t to_port)
 {
        private_traffic_selector_t *this;
        chunk_t from;
 
-       this = traffic_selector_create(protocol, 0, 0, 65535);
+       this = traffic_selector_create(protocol, 0, from_port, to_port);
 
        switch (net->get_family(net))
        {
@@ -800,11 +801,6 @@ traffic_selector_t *traffic_selector_create_from_subnet(host_t *net,
        memcpy(this->from, from.ptr, from.len);
        netbits = min(netbits, this->type == TS_IPV4_ADDR_RANGE ? 32 : 128);
        calc_range(this, netbits);
-       if (port)
-       {
-               this->from_port = port;
-               this->to_port = port;
-       }
        net->destroy(net);
 
        return &this->public;
@@ -855,8 +851,9 @@ traffic_selector_t *traffic_selector_create_from_string(
 /*
  * see header
  */
-traffic_selector_t *traffic_selector_create_from_cidr(char *string,
-                                                                       u_int8_t protocol, u_int16_t port)
+traffic_selector_t *traffic_selector_create_from_cidr(
+                                                                               char *string, u_int8_t protocol,
+                                                                               u_int16_t from_port, u_int16_t to_port)
 {
        host_t *net;
        int bits;
@@ -864,7 +861,8 @@ traffic_selector_t *traffic_selector_create_from_cidr(char *string,
        net = host_create_from_subnet(string, &bits);
        if (net)
        {
-               return traffic_selector_create_from_subnet(net, bits, protocol, port);
+               return traffic_selector_create_from_subnet(net, bits, protocol,
+                                                                                                  from_port, to_port);
        }
        return NULL;
 }

diff --git a/src/libstrongswan/selectors/traffic_selector.h b/src/libstrongswan/selectors/traffic_selector.h
index b6da391aa14b22293bc39cbfd647004c74e18ea3..0de358b99883d5ab088f1269aa93689f54ce0c3f 100644 (file)
--- a/src/libstrongswan/selectors/traffic_selector.h
+++ b/src/libstrongswan/selectors/traffic_selector.h
@@ -238,11 +238,13 @@ traffic_selector_t *traffic_selector_create_from_string(
  *
  * @param string               CIDR string, such as 10.1.0.0/16
  * @param protocol             protocol for this ts, such as TCP or UDP
- * @param port                 single port for this TS, 0 for any port
+ * @param from_port            start of allowed port range
+ * @param to_port              end of port range
  * @return                             traffic selector, NULL if string invalid
  */
-traffic_selector_t *traffic_selector_create_from_cidr(char *string,
-                                                                       u_int8_t protocol, u_int16_t port);
+traffic_selector_t *traffic_selector_create_from_cidr(
+                                                                               char *string, u_int8_t protocol,
+                                                                               u_int16_t from_port, u_int16_t to_port);
 
 /**
  * Create a new traffic selector using data read from the net.
@@ -288,14 +290,15 @@ traffic_selector_t *traffic_selector_create_from_rfc3779_format(ts_type_t type,
  * @param net                  subnet to use
  * @param netbits              size of the subnet, as used in e.g. 192.168.0.0/24 notation
  * @param protocol             protocol for this ts, such as TCP or UDP
- * @param port                 port number, host order
+ * @param from_port            start of allowed port range
+ * @param to_port              end of port range
  * @return
  *                                             - traffic_selector_t object
  *                                             - NULL if address family of net not supported
  */
 traffic_selector_t *traffic_selector_create_from_subnet(
-                                                                       host_t *net, u_int8_t netbits,
-                                                                       u_int8_t protocol, u_int16_t port);
+                                                       host_t *net, u_int8_t netbits, u_int8_t protocol,
+                                                       u_int16_t from_port, u_int16_t to_port);
 
 /**
  * Create a traffic selector for host-to-host cases.