Commit ac0404a865 for strongswan.org

commit ac0404a865ab728bc58e0f0082f4a1aecebf8bb2
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Mon Mar 16 11:10:28 2026 +0100

    kernel-netlink: Fail update_sa() if lockdown is set to confidentiality

    To update the SAs, we need to query them with the keys as we don't store
    them.  However, this won't work if the kernel's lockdown feature is set
    to confidentiality.  It just returns zeroed keys, which would render the
    updated SAs useless.  So we fail more gracefully and return NOT_SUPPORTED
    to trigger a rekeying.

diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
index 2f1ae0a38f..e3aa86b082 100644
--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -2585,6 +2585,30 @@ METHOD(kernel_ipsec_t, del_sa, status_t,
 	}
 }

+/**
+ * Check if the kernel's lockdown feature is set to "confidentiality", which
+ * means it won't allow userland to access confidential information like IPsec
+ * keys.
+ */
+static bool lockdown_confidentiality()
+{
+	char buf[BUF_LEN];
+	FILE *f;
+	bool locked = FALSE;
+
+	f = fopen("/sys/kernel/security/lockdown", "r");
+	if (f)
+	{
+		if (fgets(buf, sizeof(buf), f) &&
+			strstr(buf, "[confidentiality]"))
+		{
+			locked = TRUE;
+		}
+		fclose(f);
+	}
+	return locked;
+}
+
 METHOD(kernel_ipsec_t, update_sa, status_t,
 	private_kernel_netlink_ipsec_t *this, kernel_ipsec_sa_id_t *id,
 	kernel_ipsec_update_sa_t *data)
@@ -2606,6 +2630,13 @@ METHOD(kernel_ipsec_t, update_sa, status_t,
 	traffic_selector_t *ts;
 	char markstr[32] = "";

+	if (lockdown_confidentiality())
+	{
+		DBG1(DBG_KNL, "unable to update SAD entry with SPI %.8x due to "
+			 "kernel lockdown, triggering a rekeying", ntohl(id->spi));
+		return NOT_SUPPORTED;
+	}
+
 	/* if IPComp is used, we first update the IPComp SA */
 	if (data->cpi)
 	{