From 6b58665697db98169fe52a1c2c588eb7cc6c02e8 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Wed, 24 Jun 2026 15:34:01 +0200
Subject: [PATCH] kernel-wfp: Uninstall policies before deleting provider

The policies reference the provider, so it might not actually get removed
and be left dangling in the WFP system (maybe Windows refcounts it and
still removes it).
---
 src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c b/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c
index 558ff1bf2..34f882626 100644
--- a/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c
+++ b/src/libcharon/plugins/kernel_wfp/kernel_wfp_ipsec.c
@@ -319,11 +319,13 @@ static void entry_destroy(private_kernel_wfp_ipsec_t *this, entry_t *entry)
 	{
 		IPsecSaContextDeleteById0(this->handle, entry->sa_id);
 	}
+	/* tunnel-mode policy filters reference the provider context, so remove
+	 * them before the context to avoid leaving it dangling in WFP */
+	cleanup_policies(this, entry);
 	if (entry->provider)
 	{
 		FwpmProviderContextDeleteById0(this->handle, entry->provider);
 	}
-	cleanup_policies(this, entry);
 	array_destroy_function(entry->sps, (void*)sp_entry_destroy, NULL);
 	entry->local->destroy(entry->local);
 	entry->remote->destroy(entry->remote);