factor out check_address_sanity() from gpst.c and cstp.c, and use it in oncp.c and...

Suggested by David Woodhouse: https://gitlab.com/openconnect/openconnect/merge_requests/35#note_169620281

Signed-off-by: Daniel Lenski <dlenski@gmail.com>

diff --git a/cstp.c b/cstp.c
index e67144f4c63f30cba43a04d71aea98dc2777c009..b9d8251c51a26c899195c5cecefd9a5ee253b1a3 100644 (file)
--- a/cstp.c
+++ b/cstp.c
@@ -211,6 +211,44 @@ static int parse_hex_val(const char *str, unsigned char *storage, unsigned int m
        return len/2;
 }
 
+int check_address_sanity(struct openconnect_info *vpninfo, const char *old_addr, const char *old_netmask, const char *old_addr6, const char *old_netmask6)
+{
+       if (old_addr) {
+               if (!vpninfo->ip_info.addr || strcmp(old_addr, vpninfo->ip_info.addr)) {
+                       vpn_progress(vpninfo, PRG_ERR,
+                                                _("Reconnect gave different Legacy IP address (%s != %s)\n"),
+                                                vpninfo->ip_info.addr, old_addr);
+                       /* EPERM means that the retry loop will abort and won't keep trying. */
+                       return -EPERM;
+               }
+       }
+       if (old_netmask) {
+               if (!vpninfo->ip_info.netmask || strcmp(old_netmask, vpninfo->ip_info.netmask)) {
+                       vpn_progress(vpninfo, PRG_ERR,
+                                    _("Reconnect gave different Legacy IP netmask (%s != %s)\n"),
+                                    vpninfo->ip_info.netmask, old_netmask);
+                       return -EPERM;
+               }
+       }
+       if (old_addr6) {
+               if (!vpninfo->ip_info.addr6 || strcmp(old_addr6, vpninfo->ip_info.addr6)) {
+                       vpn_progress(vpninfo, PRG_ERR,
+                                                _("Reconnect gave different IPv6 address (%s != %s)\n"),
+                                                vpninfo->ip_info.addr6, old_addr6);
+                       return -EPERM;
+               }
+       }
+       if (old_netmask6) {
+               if (!vpninfo->ip_info.netmask6 || strcmp(old_netmask6, vpninfo->ip_info.netmask6)) {
+                       vpn_progress(vpninfo, PRG_ERR,
+                                    _("Reconnect gave different IPv6 netmask (%s != %s)\n"),
+                                    vpninfo->ip_info.netmask6, old_netmask6);
+                       return -EPERM;
+               }
+       }
+       return 0;
+}
+
 static int start_cstp_connection(struct openconnect_info *vpninfo)
 {
        struct oc_text_buf *reqbuf;
@@ -609,39 +647,10 @@ static int start_cstp_connection(struct openconnect_info *vpninfo)
                             _("IPv6 configuration received but MTU %d is too small.\n"),
                             mtu);
        }
-       if (old_addr) {
-               if (!vpninfo->ip_info.addr || strcmp(old_addr, vpninfo->ip_info.addr)) {
-                       vpn_progress(vpninfo, PRG_ERR,
-                                    _("Reconnect gave different Legacy IP address (%s != %s)\n"),
-                                    vpninfo->ip_info.addr, old_addr);
-                       /* EPERM means that the retry loop will abort and won't keep trying. */
-                       return -EPERM;
-               }
-       }
-       if (old_netmask) {
-               if (!vpninfo->ip_info.netmask || strcmp(old_netmask, vpninfo->ip_info.netmask)) {
-                       vpn_progress(vpninfo, PRG_ERR,
-                                    _("Reconnect gave different Legacy IP netmask (%s != %s)\n"),
-                                    vpninfo->ip_info.netmask, old_netmask);
-                       return -EPERM;
-               }
-       }
-       if (old_addr6) {
-               if (!vpninfo->ip_info.addr6 || strcmp(old_addr6, vpninfo->ip_info.addr6)) {
-                       vpn_progress(vpninfo, PRG_ERR,
-                                    _("Reconnect gave different IPv6 address (%s != %s)\n"),
-                                    vpninfo->ip_info.addr6, old_addr6);
-                       return -EPERM;
-               }
-       }
-       if (old_netmask6) {
-               if (!vpninfo->ip_info.netmask6 || strcmp(old_netmask6, vpninfo->ip_info.netmask6)) {
-                       vpn_progress(vpninfo, PRG_ERR,
-                                    _("Reconnect gave different IPv6 netmask (%s != %s)\n"),
-                                    vpninfo->ip_info.netmask6, old_netmask6);
-                       return -EPERM;
-               }
-       }
+
+       i = check_address_sanity(vpninfo, old_addr, old_netmask, old_addr6, old_netmask6);
+       if (i)
+               return i;
 
        free_optlist(old_dtls_opts);
        free_optlist(old_cstp_opts);

diff --git a/gpst.c b/gpst.c
index b437a60cd596b830740d6a3940f52a4152e44236..feee18adb02cc6421aa566b9b4007b5fb23649cc 100644 (file)
--- a/gpst.c
+++ b/gpst.c
@@ -674,40 +674,8 @@ static int gpst_get_config(struct openconnect_info *vpninfo)
                result = -EINVAL;
                goto out;
        }
-       if (old_addr) {
-               if (!vpninfo->ip_info.addr || strcmp(old_addr, vpninfo->ip_info.addr)) {
-                       vpn_progress(vpninfo, PRG_ERR,
-                                    _("Reconnect gave different Legacy IP address (%s != %s)\n"),
-                                    vpninfo->ip_info.addr, old_addr);
-                       result = -EPERM;
-                       goto out;
-               }
-       }
-       if (old_netmask) {
-               if (!vpninfo->ip_info.netmask || strcmp(old_netmask, vpninfo->ip_info.netmask)) {
-                       vpn_progress(vpninfo, PRG_ERR,
-                                    _("Reconnect gave different Legacy IP netmask (%s != %s)\n"),
-                                    vpninfo->ip_info.netmask, old_netmask);
-                       result = -EPERM;
-                       goto out;
-               }
-       }
-       if (old_addr6) {
-               if (!vpninfo->ip_info.addr6 || strcmp(old_addr6, vpninfo->ip_info.addr6)) {
-                       vpn_progress(vpninfo, PRG_ERR,
-                                    _("Reconnect gave different IPv6 address (%s != %s)\n"),
-                                    vpninfo->ip_info.addr6, old_addr6);
-                       return -EINVAL;
-               }
-       }
-       if (old_netmask6) {
-               if (!vpninfo->ip_info.netmask6 || strcmp(old_netmask6, vpninfo->ip_info.netmask6)) {
-                       vpn_progress(vpninfo, PRG_ERR,
-                                    _("Reconnect gave different IPv6 netmask (%s != %s)\n"),
-                                    vpninfo->ip_info.netmask6, old_netmask6);
-                       return -EINVAL;
-               }
-       }
+
+       result = check_address_sanity(vpninfo, old_addr, old_netmask, old_addr6, old_netmask6);
 
 out:
        free_optlist(old_cstp_opts);

diff --git a/oncp.c b/oncp.c
index 243143daaa0d002b68824f487d7c6fecd68dff61..171fb8c7aa252dc48e58e5922b273ecbdd745e6b 100644 (file)
--- a/oncp.c
+++ b/oncp.c
@@ -544,9 +544,7 @@ int oncp_connect(struct openconnect_info *vpninfo)
        int ret, len, kmp, kmplen, group, check_len;
        struct oc_text_buf *reqbuf;
        unsigned char bytes[65536];
-
-       /* XXX: We should do what cstp_connect() does to check that configuration
-          hasn't changed on a reconnect. */
+       const char *old_addr = vpninfo->ip_info.addr, *old_netmask = vpninfo->ip_info.netmask;
 
        if (!vpninfo->cookies) {
                ret = parse_cookie(vpninfo);
@@ -789,6 +787,9 @@ int oncp_connect(struct openconnect_info *vpninfo)
                             _("Short write in oNCP negotiation\n"));
                ret = -EIO;
        }
+
+       ret = check_address_sanity(vpninfo, old_addr, old_netmask, NULL, NULL);
+
  out:
        if (ret)
                openconnect_close_https(vpninfo, 0);

diff --git a/openconnect-internal.h b/openconnect-internal.h
index 92edf763da382092f6724f9eb4ea516103c3a255..9ff851506ea857a6c200cfe44239b3fd1a081b39 100644 (file)
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -892,6 +892,7 @@ char *openconnect_bin2hex(const char *prefix, const uint8_t *data, unsigned len)
 char *openconnect_bin2base64(const char *prefix, const uint8_t *data, unsigned len);
 
 /* cstp.c */
+int check_address_sanity(struct openconnect_info *vpninfo, const char *old_addr, const char *old_netmask, const char *old_addr6, const char *old_netmask6);
 void cstp_common_headers(struct openconnect_info *vpninfo, struct oc_text_buf *buf);
 int cstp_connect(struct openconnect_info *vpninfo);
 int cstp_mainloop(struct openconnect_info *vpninfo, int *timeout, int readable);

diff --git a/pulse.c b/pulse.c
index c1ca5d16fba871eaddd50a0f9f77abcf4a1df27d..067edbd35bafe61176840f77151fe7acc44b8d57 100644 (file)
--- a/pulse.c
+++ b/pulse.c
@@ -1382,9 +1382,6 @@ static int pulse_authenticate(struct openconnect_info *vpninfo, int connecting)
        char *user2_prompt = NULL, *pass2_prompt = NULL;
        int prompt_flags = PROMPT_PRIMARY | PROMPT_USERNAME | PROMPT_PASSWORD;
 
-       /* XXX: We should do what cstp_connect() does to check that configuration
-          hasn't changed on a reconnect. */
-
        ret = openconnect_open_https(vpninfo);
        if (ret)
                return ret;
@@ -2290,6 +2287,10 @@ static int handle_main_config_packet(struct openconnect_info *vpninfo,
        int routes_len = 0;
        int l;
        unsigned char *p;
+       const char *old_addr = vpninfo->ip_info.addr;
+       const char *old_netmask = vpninfo->ip_info.netmask;
+       const char *old_addr6 = vpninfo->ip_info.addr6;
+       const char *old_netmask6 = vpninfo->ip_info.netmask6;
 
        /* First part of header, similar to ESP, has already been checked */
        if (len < 0x31 ||
@@ -2393,7 +2394,8 @@ static int handle_main_config_packet(struct openconnect_info *vpninfo,
                if (l && l < 4)
                        goto bad_config;
        }
-       return 0;
+
+       return check_address_sanity(vpninfo, old_addr, old_netmask, old_addr6, old_netmask6);
 }
 
 /* Example ESP config packet: