denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

connmark: Fix addresses when removing policies in ike_update() handler

Browse Source 
These were never correct.  And the first referenced commit, unfortunately,
just simplified the incorrect code.

Fixes: 08a3ee0cce ("bus: Change ike_update() signature and only call it once")
Fixes: b8973b2661 ("connmark: Add CONNMARK rules to select correct output SA based on conntrack")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:35 +02:00
parent fe6dc7d256
commit b031cd27a8
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/connmark/connmark_listener.c
+5 -1
View File
@@ -499,8 +499,12 @@ METHOD(listener_t, ike_update, bool,
struct iptc_handle *ipth; struct iptc_handle *ipth;
enumerator_t *enumerator; enumerator_t *enumerator;
child_sa_t *child_sa; child_sa_t *child_sa;
host_t *oldlocal, *oldremote;
bool oldencap, newencap; bool oldencap, newencap;
oldlocal = ike_sa->get_my_host(ike_sa);
oldremote = ike_sa->get_other_host(ike_sa);
/* during ike_update(), has_encap() on the CHILD_SA has not yet been /* during ike_update(), has_encap() on the CHILD_SA has not yet been
* updated, but shows the old state. */ * updated, but shows the old state. */
newencap = ike_sa->has_condition(ike_sa, COND_NAT_ANY); newencap = ike_sa->has_condition(ike_sa, COND_NAT_ANY);
@@ -514,7 +518,7 @@ METHOD(listener_t, ike_update, bool,
ipth = init_handle(); ipth = init_handle();
if (ipth) if (ipth)
{ {
if (manage_policies(this, ipth, local, remote, oldencap, if (manage_policies(this, ipth, oldlocal, oldremote, oldencap,
child_sa, FALSE) && child_sa, FALSE) &&
manage_policies(this, ipth, local, remote, newencap, manage_policies(this, ipth, local, remote, newencap,
child_sa, TRUE)) child_sa, TRUE))