From b031cd27a878b3871592e226ffc61065e68d9879 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 19 Jun 2026 18:48:49 +0200 Subject: [PATCH] connmark: Fix addresses when removing policies in ike_update() handler These were never correct. And the first referenced commit, unfortunately, just simplified the incorrect code. Fixes: 08a3ee0cce1b ("bus: Change ike_update() signature and only call it once") Fixes: b8973b266131 ("connmark: Add CONNMARK rules to select correct output SA based on conntrack") --- src/libcharon/plugins/connmark/connmark_listener.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/libcharon/plugins/connmark/connmark_listener.c b/src/libcharon/plugins/connmark/connmark_listener.c index 7a6d3d466..fda440966 100644 --- a/src/libcharon/plugins/connmark/connmark_listener.c +++ b/src/libcharon/plugins/connmark/connmark_listener.c @@ -499,8 +499,12 @@ METHOD(listener_t, ike_update, bool, struct iptc_handle *ipth; enumerator_t *enumerator; child_sa_t *child_sa; + host_t *oldlocal, *oldremote; bool oldencap, newencap; + oldlocal = ike_sa->get_my_host(ike_sa); + oldremote = ike_sa->get_other_host(ike_sa); + /* during ike_update(), has_encap() on the CHILD_SA has not yet been * updated, but shows the old state. */ newencap = ike_sa->has_condition(ike_sa, COND_NAT_ANY); @@ -514,7 +518,7 @@ METHOD(listener_t, ike_update, bool, ipth = init_handle(); if (ipth) { - if (manage_policies(this, ipth, local, remote, oldencap, + if (manage_policies(this, ipth, oldlocal, oldremote, oldencap, child_sa, FALSE) && manage_policies(this, ipth, local, remote, newencap, child_sa, TRUE))