[strongSwan-dev] [PATCH mark-inbound-sa 1/2] fixup! child-cfg: Optionally set mark on inbound SA

[Christophe Gouault]

---
 src/libcharon/sa/child_sa.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c
index 7ed96910d7e7..fdd25e474f85 100644
--- a/src/libcharon/sa/child_sa.c
+++ b/src/libcharon/sa/child_sa.c
@@ -163,6 +163,12 @@ struct private_child_sa_t {
        mark_t mark_out;
 
        /**
+        * mark used for the inbound kernel SA
+        * (= mark_in if OPT_MARK_IN_SA, 0/0 else)
+        */
+       mark_t mark_sa_in;
+
+       /**
         * absolute time when rekeying is scheduled
         */
        time_t rekey_time;
@@ -754,7 +760,7 @@ static status_t install_internal(private_child_sa_t *this, 
chunk_t encr,
        uint32_t tfc = 0;
        host_t *src, *dst;
        status_t status;
-       mark_t mark = (mark_t){};
+       mark_t mark;
        bool update = FALSE;
 
        /* BEET requires the bound address from the traffic selectors */
@@ -778,10 +784,7 @@ static status_t install_internal(private_child_sa_t *this, 
chunk_t encr,
                this->my_cpi = cpi;
                dst_ts = my_ts;
                src_ts = other_ts;
-               if (this->config->has_option(this->config, OPT_MARK_IN_SA))
-               {
-                       mark = this->mark_in;
-               }
+               mark = this->mark_sa_in;
        }
        else
        {
@@ -1481,6 +1484,7 @@ METHOD(child_sa_t, update, status_t,
                                .dst = this->my_addr,
                                .spi = this->my_spi,
                                .proto = proto_ike2ip(this->protocol),
+                               .mark = this->mark_sa_in,
                        };
                        kernel_ipsec_update_sa_t sa = {
                                .cpi = this->ipcomp != IPCOMP_NONE ? 
this->my_cpi : 0,
@@ -1666,6 +1670,7 @@ METHOD(child_sa_t, destroy, void,
                        .dst = this->my_addr,
                        .spi = this->my_spi,
                        .proto = proto_ike2ip(this->protocol),
+                       .mark = this->mark_sa_in,
                };
                kernel_ipsec_del_sa_t sa = {
                        .cpi = this->my_cpi,
@@ -1855,6 +1860,11 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
                }
        }
 
+       if (config->has_option(this->config, OPT_MARK_IN_SA))
+       {
+               this->mark_sa_in = this->mark_in;
+       }
+
        if (!this->reqid)
        {
                /* reuse old reqid if we are rekeying an existing CHILD_SA. 
While the
-- 
2.1.4