From d6dee352af535d8a8486fbf6e8facf4651d5cb13 Mon Sep 17 00:00:00 2001
From: Michael Rash <mbr@cipherdyne.org>
Date: Wed, 3 Dec 2014 20:57:06 -0500
Subject: [PATCH] minor update to get DESTINATION filtering tests passing

---
 ChangeLog                   | 2 +-
 server/access.c             | 8 ++++----
 server/incoming_spa.c       | 5 ++++-
 test/tests/rijndael_hmac.pl | 4 ++++
 4 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 37b13cb2..3a263de7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,7 +6,7 @@ fwknop-2.6.5 (11//2014):
       networks should be specified in CIDR notation (e.g. "192.168.10.0/24"),
       and individual IP addresses can be specified as well. Also, multiple IP's
       and/or networks can be defined as a comma separated list (e.g.
-      "192.168.10.0/24,10.1.1.123).
+      "192.168.10.0/24,10.1.1.123").
     - [server] Bug fix to ensure that proper bounds are enforced when
       importing digest cache files from previous fwknopd executions. This bug
       was discovered through fuzzing with American Fuzzy Lop (AFL) as driven
diff --git a/server/access.c b/server/access.c
index a7ae679a..c5901da9 100644
--- a/server/access.c
+++ b/server/access.c
@@ -1752,19 +1752,19 @@ parse_access_file(fko_srv_options_t *opts)
 }
 
 int
-compare_addr_list(acc_int_list_t *source_list, const uint32_t ip)
+compare_addr_list(acc_int_list_t *ip_list, const uint32_t ip)
 {
     int match = 0;
 
-    while(source_list)
+    while(ip_list)
     {
-        if((ip & source_list->mask) == (source_list->maddr & source_list->mask))
+        if((ip & ip_list->mask) == (ip_list->maddr & ip_list->mask))
         {
             match = 1;
             break;
         }
 
-        source_list = source_list->next;
+        ip_list = ip_list->next;
     }
 
     return(match);
diff --git a/server/incoming_spa.c b/server/incoming_spa.c
index a49291c0..9163b0a2 100644
--- a/server/incoming_spa.c
+++ b/server/incoming_spa.c
@@ -320,7 +320,7 @@ incoming_spa(fko_srv_options_t *opts)
 
     inet_ntop(AF_INET, &(spa_pkt->packet_src_ip),
         spadat.pkt_source_ip, sizeof(spadat.pkt_source_ip));
-        
+
     inet_ntop(AF_INET, &(spa_pkt->packet_dst_ip),
         spadat.pkt_destination_ip, sizeof(spadat.pkt_destination_ip));
 
@@ -413,6 +413,9 @@ incoming_spa(fko_srv_options_t *opts)
         if(! compare_addr_list(acc->source_list, ntohl(spa_pkt->packet_src_ip)) ||
            (acc->destination_list != NULL && ! compare_addr_list(acc->destination_list, ntohl(spa_pkt->packet_dst_ip))))
         {
+            log_msg(LOG_DEBUG,
+                    "(stanza #%d) SPA packet (%s -> %s) filtered by SOURCE and/or DESTINATION criteria",
+                    stanza_num, spadat.pkt_source_ip, spadat.pkt_destination_ip);
             acc = acc->next;
             continue;
         }
diff --git a/test/tests/rijndael_hmac.pl b/test/tests/rijndael_hmac.pl
index 3396072f..5ec9d0b9 100644
--- a/test/tests/rijndael_hmac.pl
+++ b/test/tests/rijndael_hmac.pl
@@ -133,6 +133,8 @@
             "-a $cf{'hmac_spa_destination4_access'} " .
             "-d $default_digest_file -p $default_pid_file $intf_str",
         'fw_rule_created' => $REQUIRE_NO_NEW_RULE,
+        'client_pkt_tries' => 2,
+        'server_receive_re' => qr/SPA\spacket\s.*filtered\sby\sSOURCE.*DEST/,
         'key_file' => $cf{'rc_hmac_b64_key'},
     },
     {
@@ -145,6 +147,8 @@
             "-a $cf{'hmac_spa_destination5_access'} " .
             "-d $default_digest_file -p $default_pid_file $intf_str",
         'fw_rule_created' => $REQUIRE_NO_NEW_RULE,
+        'client_pkt_tries' => 2,
+        'server_receive_re' => qr/SPA\spacket\s.*filtered\sby\sSOURCE.*DEST/,
         'key_file' => $cf{'rc_hmac_b64_key'},
     },
     {