[patch] fwknop-2.6.4-ensure-a-overrides-IP-resolution.patch

fwknop-2.6.4-ensure-a-overrides-IP-resolution.patch (text/plain), 2.01 KB, created by Coacher on 2014-11-19 15:40:44 UTC

From ece855b66a87d98276dd8b82d15cecd6643b617b Mon Sep 17 00:00:00 2001
From: Michael Rash <[e-mail]>
Date: Tue, 18 Nov 2014 23:10:19 -0500
Subject: [PATCH] [client] bug fix to ensure -a overrides IP resolution

---
 client/config_init.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/client/config_init.c b/client/config_init.c
index 5b62a02..1400fdd 100644
--- a/client/config_init.c
+++ b/client/config_init.c
@@ -1791,7 +1791,7 @@ validate_options(fko_cli_options_t *options)
         strlcpy(options->use_rc_stanza, options->spa_server_str, sizeof(options->use_rc_stanza));
     }
 
-    /* Gotta have a Destination unless we are just testing or getting the
+    /* Must have a destination unless we are just testing or getting the
      * the version, and must use one of [-s|-R|-a].
     */
     if(!options->test
@@ -1825,20 +1825,20 @@ validate_options(fko_cli_options_t *options)
                     "[-] WARNING: Should use -a or -R to harden SPA against potential MITM attacks");
             }
         }
+    }
 
-        /* Make sure -a overrides IP resolution
-        */
-        if(options->allow_ip_str[0] != 0x0
-                && strncasecmp(options->allow_ip_str, "resolve", strlen("resolve")) != 0)
-        {
-            options->resolve_ip_http_https = 1;
+    /* Make sure -a overrides IP resolution
+    */
+    if(options->allow_ip_str[0] != 0x0
+            && strncasecmp(options->allow_ip_str, "resolve", strlen("resolve")) != 0)
+    {
+        options->resolve_ip_http_https = 0;
 
-            if(! is_valid_ipv4_addr(options->allow_ip_str))
-            {
-                log_msg(LOG_VERBOSITY_ERROR,
-                    "Invalid allow IP specified for SPA access");
-                exit(EXIT_FAILURE);
-            }
+        if(! is_valid_ipv4_addr(options->allow_ip_str))
+        {
+            log_msg(LOG_VERBOSITY_ERROR,
+                "Invalid allow IP specified for SPA access");
+            exit(EXIT_FAILURE);
         }
     }
 
-- 
2.0.4