Commit a92c806a1f for strongswan.org

commit a92c806a1fd624c3a6e6f58728f79707488cefef
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Thu Sep 17 10:28:13 2026 +0200

    kernel-netlink: Explicitly filter loopback and link-local addresses

    The existing scope filter already covers this in default setups, but
    since that scope is reported by the kernel and can be set freely,
    this makes sure we don't announce such addresses.

diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_net.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_net.c
index 6f9973dc53..17910a3057 100644
--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_net.c
+++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_net.c
@@ -1517,6 +1517,10 @@ CALLBACK(filter_addresses, bool,
 		{	/* skip deprecated addresses or those with an unusable scope */
 			continue;
 		}
+		if (host_is_loopback(addr->ip) || host_is_linklocal(addr->ip))
+		{	/* skip loopback and link-local addresses explicitly */
+			continue;
+		}
 		if (!addr->refcount && addr->ip->get_family(addr->ip) == AF_INET6)
 		{	/* handle non-VIP temporary IPv6 addresses according to config */
 			bool temporary = (addr->flags & IFA_F_TEMPORARY) == IFA_F_TEMPORARY;