From 77cfa835cdc721b1a2e1d62550088b9359a2aaaf Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Sun, 12 Jul 2026 16:57:27 +0200 Subject: [PATCH] connmark: Only install one rule per Child SA in PREROUTING These rules don't depend on traffic selectors, so for SAs with multiple traffic selectors we'd install several duplicate rules. Since this plugin is used for transport mode SAs, it probably never was an issue in practice. Fixes: b8973b266131 ("connmark: Add CONNMARK rules to select correct output SA based on conntrack") --- src/libcharon/plugins/connmark/connmark_listener.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/libcharon/plugins/connmark/connmark_listener.c b/src/libcharon/plugins/connmark/connmark_listener.c index 22d714233..faf649a29 100644 --- a/src/libcharon/plugins/connmark/connmark_listener.c +++ b/src/libcharon/plugins/connmark/connmark_listener.c @@ -408,11 +408,15 @@ static bool manage_policies(private_connmark_listener_t *this, mark = child_sa->get_mark(child_sa, TRUE).value; mask = child_sa->get_mark(child_sa, TRUE).mask; + if (!manage_pre(this, ipth, add, mark, mask, spi, encap, dst, src)) + { + return FALSE; + } + enumerator = child_sa->create_policy_enumerator(child_sa); while (enumerator->enumerate(enumerator, &local, &remote)) { - if (!manage_pre(this, ipth, add, mark, mask, spi, encap, dst, src) || - !manage_in(this, ipth, add, mark, mask, spi, local, remote) || + if (!manage_in(this, ipth, add, mark, mask, spi, local, remote) || !manage_out(this, ipth, add, mask, remote, local)) { done = FALSE;