From c81a8a8f3607f2ccc3e503fd7edeea1e543d140f Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 5 Dec 2019 16:15:33 +0100 Subject: [PATCH] kernel-netlink: Properly compare routes for policies without gateway/netxhop This happened when installing a duplicate bypass policy for a locally connected subnet. The destructor and the kernel-net part already handle this correctly. --- .../plugins/kernel_netlink/kernel_netlink_ipsec.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c index 4465d41f3..c1b44180b 100644 --- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c +++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c @@ -409,10 +409,14 @@ static void route_entry_destroy(route_entry_t *this) */ static bool route_entry_equals(route_entry_t *a, route_entry_t *b) { - return a->if_name && b->if_name && streq(a->if_name, b->if_name) && - a->src_ip->ip_equals(a->src_ip, b->src_ip) && - a->gateway->ip_equals(a->gateway, b->gateway) && - chunk_equals(a->dst_net, b->dst_net) && a->prefixlen == b->prefixlen; + if (a->if_name && b->if_name && streq(a->if_name, b->if_name) && + a->src_ip->ip_equals(a->src_ip, b->src_ip) && + chunk_equals(a->dst_net, b->dst_net) && a->prefixlen == b->prefixlen) + { + return (!a->gateway && !b->gateway) || (a->gateway && b->gateway && + a->gateway->ip_equals(a->gateway, b->gateway)); + } + return FALSE; } typedef struct ipsec_sa_t ipsec_sa_t;