Commit d70e66fd08 for strongswan.org

commit d70e66fd0896792860a7a5fd9a2be56bd56f8c53
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Thu Sep 17 10:41:12 2026 +0200

    kernel-pfroute: Ignore addresses with unusable scope (loopback/linklocal)

    So far we only ignored IPv6 link-local addresses, for IPv4 they could be
    announced for e.g. MOBIKE.  Loopback addresses were only filtered by not
    enumerating loopback interfaces.

diff --git a/src/libcharon/plugins/kernel_pfroute/kernel_pfroute_net.c b/src/libcharon/plugins/kernel_pfroute/kernel_pfroute_net.c
index ee7ce6e2f6..6fe4371599 100644
--- a/src/libcharon/plugins/kernel_pfroute/kernel_pfroute_net.c
+++ b/src/libcharon/plugins/kernel_pfroute/kernel_pfroute_net.c
@@ -1122,8 +1122,7 @@ CALLBACK(filter_addresses, bool,
 	address_enumerator_t *data, enumerator_t *orig, va_list args)
 {
 	addr_entry_t *addr;
-	host_t *ip, **out;
-	struct sockaddr_in6 *sin6;
+	host_t **out;

 	VA_ARGS_VGET(args, out);

@@ -1137,16 +1136,11 @@ CALLBACK(filter_addresses, bool,
 		{	/* address is regular, but not requested */
 			continue;
 		}
-		ip = addr->ip;
-		if (ip->get_family(ip) == AF_INET6)
-		{
-			sin6 = (struct sockaddr_in6 *)ip->get_sockaddr(ip);
-			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
-			{   /* skip addresses with a unusable scope */
-				continue;
-			}
+		if (host_is_loopback(addr->ip) || host_is_linklocal(addr->ip))
+		{	/* skip loopback and link-local addresses */
+			continue;
 		}
-		*out = ip;
+		*out = addr->ip;
 		return TRUE;
 	}
 	return FALSE;