From bd6af475ec2d67989e4eb0f45dcb46e2f664faeb Mon Sep 17 00:00:00 2001
From: Seth Mos <seth.mos@xs4all.nl>
Date: Thu, 12 Mar 2009 05:31:20 +0100
Subject: [PATCH] If either the old or new local or remote endpoint is not a IP
 address we make sure to abort.

---
 etc/inc/vpn.inc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index e2f713a8a3..8771ab95cc 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -1572,8 +1572,11 @@ function reload_tunnel_spd_policy($phase1, $phase2, $old_phase1, $old_phase2) {
 		return false;
 	}
 
-	$spdconf = "";
+	if((!ip_addr($oldep)) || (! is_ipaddr($ep)) || (! is_ipaddr($rgip)) || (! is_ipaddr($old_gw))) {
+		log_error("IPSEC: ERROR: One of the local or remote endpoints did not resolve to a IP address, aborting");
+	}
 
+	$spdconf = "";
 	/* Delete old SPD policies if there are changes between the old and new */
 	if(($phase1 != $old_phase1) || ($phase2 != $old_phase2)) {
 		$spdconf .= "spddelete {$old_local_subnet} " .