From 5faf88428561e935b517505cb1065e140655a923 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 31 May 2021 15:06:41 +0200 Subject: [PATCH] connmark: Ignore per-CPU CHILD_SAs The combination probably doesn't make much sense. The OUTPUT rules would definitely only be required once, while the INPUT and PREROUTING rules list individual SPIs and/or UDP ports, which would be necessary for all SAs. By the way, the rules in PREROUTING might actually not be necessary anymore if the set_mark_in option was used for such SAs. --- src/libcharon/plugins/connmark/connmark_listener.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libcharon/plugins/connmark/connmark_listener.c b/src/libcharon/plugins/connmark/connmark_listener.c index 48731af61..7a6d3d466 100644 --- a/src/libcharon/plugins/connmark/connmark_listener.c +++ b/src/libcharon/plugins/connmark/connmark_listener.c @@ -432,7 +432,8 @@ static bool handle_sa(child_sa_t *child_sa) return child_sa->get_mark(child_sa, TRUE).value && child_sa->get_mark(child_sa, FALSE).value && child_sa->get_mode(child_sa) == MODE_TRANSPORT && - child_sa->get_protocol(child_sa) == PROTO_ESP; + child_sa->get_protocol(child_sa) == PROTO_ESP && + !child_sa->use_per_cpu(child_sa); } METHOD(listener_t, child_updown, bool,