kernel-netlink: Allow blank source address in routes for passthrough policies

src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c

@@ -2622,8 +2622,17 @@ static void install_route(private_kernel_netlink_ipsec_t *this,
 	);
 
 	if (charon->kernel->get_address_by_ts(charon->kernel, out->src_ts,
-										  &route->src_ip, NULL) == SUCCESS)
+										  &route->src_ip, NULL) != SUCCESS)
 	{
+		if (!route->pass)
+		{
+			free(route);
+			return;
+		}
+		/* allow blank source IP for passthrough policies */
+		route->src_ip = host_create_any(policy->sel.family);
+	}
+
 	if (!ipsec->dst->is_anyaddr(ipsec->dst))
 	{
 		route->gateway = charon->kernel->get_nexthop(charon->kernel,
@@ -2701,11 +2710,6 @@ static void install_route(private_kernel_netlink_ipsec_t *this,
 			break;
 	}
 }
-	else
-	{
-		free(route);
-	}
-}
 
 /**
  * Add or update a policy in the kernel.