kernel-pfkey: Fail route installation if remote TS matches peer

diff --git a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
index fb90f5b21497952c384d2e4cdb78c13415d962e7..dd998042cad410cdadccdc1541caf1fb768e679f 100644 (file)
--- a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+++ b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
@@ -2148,6 +2148,14 @@ static bool install_route(private_kernel_pfkey_ipsec_t *this,
        if (hydra->kernel_interface->get_features(
                                        hydra->kernel_interface) & KERNEL_REQUIRE_EXCLUDE_ROUTE)
        {
+               if (in->src_ts->is_host(in->src_ts, dst))
+               {
+                       DBG1(DBG_KNL, "can't install route for %R === %R %N, conflicts "
+                                "with IKE traffic", in->src_ts, in->dst_ts, policy_dir_names,
+                                policy->direction);
+                       route_entry_destroy(route);
+                       return FALSE;
+               }
                if (in->src_ts->includes(in->src_ts, dst))
                {
                        add_exclude_route(this, route, in->generic.sa->dst, dst);