denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

connmark: Only install one rule per Child SA in PREROUTING

Browse Source 
These rules don't depend on traffic selectors, so for SAs with multiple
traffic selectors we'd install several duplicate rules.  Since this
plugin is used for transport mode SAs, it probably never was an issue
in practice.

Fixes: b8973b2661 ("connmark: Add CONNMARK rules to select correct output SA based on conntrack")
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:38 +02:00
parent 71fff07aba
commit 77cfa835cd
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/connmark/connmark_listener.c
+6 -2
View File
@@ -408,11 +408,15 @@ static bool manage_policies(private_connmark_listener_t *this,
mark = child_sa->get_mark(child_sa, TRUE).value;
mask = child_sa->get_mark(child_sa, TRUE).mask;
if (!manage_pre(this, ipth, add, mark, mask, spi, encap, dst, src))
{
return FALSE;
}
enumerator = child_sa->create_policy_enumerator(child_sa);
while (enumerator->enumerate(enumerator, &local, &remote))
{
if (!manage_pre(this, ipth, add, mark, mask, spi, encap, dst, src) ||
!manage_in(this, ipth, add, mark, mask, spi, local, remote) ||
if (!manage_in(this, ipth, add, mark, mask, spi, local, remote) ||
!manage_out(this, ipth, add, mask, remote, local))
{
done = FALSE;