[Swan-commit] Changes to ref refs/heads/main
cagney at vault.libreswan.fi
Fri Nov 25 18:04:30 EET 2022
Author: Andrew Cagney <cagney at gnu.org>
Date: Fri Nov 25 08:56:29 2022 -0500
kernel: drop eclipsed() code
With KLIPS, which didn't support kernel policy priorities, a
connection template with /32 subnet (a bare kernel policy) could find
its kernel policy being eclipsed (scribbled on and then deleted) by a
connection instance with an identical /32 subnet.
In an attempt to get around this the eclipsed() code would try to
juggle the two policies, restoring the templates bare kernel policy
when the connection instance was deleted.
With traffic selectors and narrowing, this code completely fails. For
instance this can't handle a template with a /31 subnet being eclipsed
by an instance with two narrowed /32 subnets. Hence it is being
The XFRM backend implements priorities so this isn't needed.
The FreeBSD kernel seems to support priorities (ref #740).
More information about the Swan-commit