From: Tobias Brunner <tobias@strongswan.org>
Date: Mon, 15 Sep 2025 13:56:26 +0000 (+0200)
Subject: host: Don't try to resolve %any* keywords with mismatched address family
X-Git-Tag: 6.0.3dr1~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ac0272cad12f0b3dbe5432111d034fa7b6192f82;p=thirdparty%2Fstrongswan.git

host: Don't try to resolve %any* keywords with mismatched address family

While host_create_from_string_and_family() usually replaces %any*
keywords, this fails if the address family doesn't match (e.g. %any4 with
AF_INET6).  There is no point in trying to resolve these keywords via
DNS as % is no valid character for host names.

Closes strongswan/strongswan#2880
---

diff --git a/src/libstrongswan/networking/host.c b/src/libstrongswan/networking/host.c
index f2768dc10d..fae90b05b4 100644
--- a/src/libstrongswan/networking/host.c
+++ b/src/libstrongswan/networking/host.c
@@ -461,7 +461,7 @@ host_t *host_create_from_dns(char *string, int af, uint16_t port)
 	host_t *this;
 
 	this = host_create_from_string_and_family(string, af, port);
-	if (!this)
+	if (!this && string && string[0] != '%')
 	{
 		this = lib->hosts->resolve(lib->hosts, string, af);
 	}