libreswan/SOURCES/libreswan-4.3-labeled-ipsec.patch

diff -Naur libreswan-4.3-orig/programs/pluto/connections.c libreswan-4.3/programs/pluto/connections.c
--- libreswan-4.3-orig/programs/pluto/connections.c	2021-02-21 12:03:03.000000000 -0500
+++ libreswan-4.3/programs/pluto/connections.c	2021-02-24 16:28:05.608119041 -0500
@@ -2475,9 +2475,8 @@
 			    endpoint_in_selector(local_client, &sr->this.client) &&
 			    endpoint_in_selector(remote_client, &sr->that.client)
 #ifdef HAVE_LABELED_IPSEC
-			    && ((sec_label.ptr == NULL &&
-			      sr->this.sec_label.ptr == NULL) ||
-			     /* don't call with NULL, it confuses it */
+			    && ((sec_label.ptr == NULL && sr->this.sec_label.ptr == NULL) ||
+			     hunk_eq(sec_label, sr->this.sec_label) || 
 			     within_range((const char *)sec_label.ptr,
 					  (const char *)sr->this.sec_label.ptr, logger))
 #endif
diff -Naur libreswan-4.3-orig/programs/pluto/ikev1_spdb_struct.c libreswan-4.3/programs/pluto/ikev1_spdb_struct.c
--- libreswan-4.3-orig/programs/pluto/ikev1_spdb_struct.c	2021-02-21 12:03:03.000000000 -0500
+++ libreswan-4.3/programs/pluto/ikev1_spdb_struct.c	2021-02-24 16:28:59.819791102 -0500
@@ -113,7 +113,9 @@
 		return false;
 	}
 
-	if (!within_range(sec_label.ptr, /* we ensured NUL termination above */
+
+	 if (!hunk_eq(sec_label, c->spd.this.sec_label) &&
+               !within_range(sec_label.ptr, /* we ensured NUL termination above */
 			  (const char *)c->spd.this.sec_label.ptr,  /* we ensured NUL termination earlier? */
 			  st->st_logger)) {
 		LLOG_JAMBUF(RC_LOG_SERIOUS, st->st_logger, buf) {
diff -Naur libreswan-4.3-orig/programs/pluto/ikev2_ts.c libreswan-4.3/programs/pluto/ikev2_ts.c
--- libreswan-4.3-orig/programs/pluto/ikev2_ts.c	2021-02-21 12:03:03.000000000 -0500
+++ libreswan-4.3/programs/pluto/ikev2_ts.c	2021-02-24 16:30:19.639780631 -0500
@@ -862,7 +862,8 @@
 }
 
 #ifdef HAVE_LABELED_IPSEC
-static bool score_ends_seclabel(const struct ends *ends,
+static bool score_ends_seclabel(const chunk_t **selected_sec_label,
+				const struct ends *ends,
 				const struct connection *d,
 				const struct traffic_selectors *tsi,
 				const struct traffic_selectors *tsr,
@@ -875,6 +876,10 @@
 	bool match_i = false;
 	bool match_r = false;
 
+	if (selected_sec_label != NULL) {
+		*selected_sec_label = NULL;
+	}
+
 	for (unsigned tsi_n = 0; tsi_n < tsi->nr; tsi_n++) {
 		const struct traffic_selector *cur = &tsi->ts[tsi_n];
 		if (cur->ts_type == IKEv2_TS_SECLABEL) {
@@ -883,7 +888,8 @@
 				// complain loudly
 				continue;
 			} else {
-				if (within_range((const char *)cur->sec_label.ptr, (const char *)d->spd.this.sec_label.ptr, logger)) {
+				if (hunk_eq(cur->sec_label, d->spd.this.sec_label) ||
+				    within_range((const char *)cur->sec_label.ptr, (const char *)d->spd.this.sec_label.ptr, logger)) {
 					match_i = true;
 					dbg("ikev2ts #1: received label within range of our security label");
 				} else {
@@ -902,9 +908,13 @@
 						dbg("IKEv2_TS_SECLABEL but zero length cur->sec_label");
 						continue;
 					} else {
-						if (within_range((const char *)ends->r->sec_label.ptr, (const char *)d->spd.this.sec_label.ptr, logger)) {
+						if (hunk_eq(ends->r->sec_label, d->spd.this.sec_label) ||
+						    within_range((const char *)ends->r->sec_label.ptr, (const char *)d->spd.this.sec_label.ptr, logger)) {
 							dbg("ikev2ts #2: received label within range of our security label");
 							match_r = true;
+							if (selected_sec_label != NULL) {
+								*selected_sec_label = &cur->sec_label;
+							}
 						} else {
 							dbg("ikev2ts #2: received label not within range of our security label");
 							DBG_dump_hunk("ends->r->sec_label", ends->r->sec_label);
@@ -926,7 +936,8 @@
 	return require_label == recv_label_i && match_i && match_r;
 }
 #else
-static bool score_ends_seclabel(const struct ends *ends UNUSED,
+static bool score_ends_seclabel(const chunk_t **selected_sec_label,
+				const struct ends *ends UNUSED,
 				const struct connection *d UNUSED,
 				const struct traffic_selectors *tsi UNUSED,
 				const struct traffic_selectors *tsr UNUSED,
@@ -1030,6 +1041,7 @@
 	struct best_score best_score = NO_SCORE;
 	const struct spd_route *best_spd_route = NULL;
 	struct connection *best_connection = c;
+	const chunk_t *best_sec_label = NULL;
 
 	/* find best spd in c */
 
@@ -1042,7 +1054,8 @@
 			.r = &sra->this,
 		};
 
-		if (!score_ends_seclabel(&ends, c, &tsi, &tsr, child->sa.st_logger)) {
+		const chunk_t* selected_sec_label = NULL;
+		if (!score_ends_seclabel(&selected_sec_label, &ends, c, &tsi, &tsr, child->sa.st_logger)) {
 			continue;
 		}
 
@@ -1060,6 +1073,7 @@
 			    score.tsi - tsi.ts, score.tsr - tsr.ts);
 			best_score = score;
 			best_spd_route = sra;
+			best_sec_label = selected_sec_label;
 			passert(best_connection == c);
 		}
 	}
@@ -1143,7 +1157,8 @@
 					? END_NARROWER_THAN_TS
 					: END_EQUALS_TS;
 
-				if (!score_ends_seclabel(&ends, d, &tsi, &tsr,
+				const chunk_t* selected_sec_label = NULL;
+				if (!score_ends_seclabel(&selected_sec_label, &ends, d, &tsi, &tsr,
 					    child->sa.st_logger))
 					continue;
 
@@ -1159,6 +1174,7 @@
 					best_connection = d;
 					best_score = score;
 					best_spd_route = sr;
+					best_sec_label = selected_sec_label;
 				}
 			}
 		}
@@ -1389,6 +1405,13 @@
 	 */
 	update_state_connection(&child->sa, best_connection);
 
+	if (best_sec_label != NULL) {
+		if (child->sa.st_seen_sec_label.len != 0) {
+			free_chunk_content(&child->sa.st_seen_sec_label);
+		}
+		child->sa.st_seen_sec_label = clone_hunk(*best_sec_label, "st_seen_sec_label");
+	}
+
 	child->sa.st_ts_this = ikev2_end_to_ts(&best_spd_route->this, child->sa.st_acquired_sec_label);
 	child->sa.st_ts_that = ikev2_end_to_ts(&best_spd_route->that, child->sa.st_seen_sec_label);
 
@@ -1424,7 +1447,8 @@
 		? END_WIDER_THAN_TS
 		: END_EQUALS_TS;
 
-	if (!score_ends_seclabel(&e, c, &tsi, &tsr, child->sa.st_logger))
+	const chunk_t *selected_sec_label = NULL;
+	if (!score_ends_seclabel(&selected_sec_label, &e, c, &tsi, &tsr, child->sa.st_logger))
 		return false;
 
 	struct best_score best = score_ends_iprange(initiator_widening, c, &e, &tsi, &tsr);
@@ -1435,6 +1459,13 @@
 		return false;
 	}
 
+	if (selected_sec_label != NULL) {
+		if (child->sa.st_seen_sec_label.len != 0) {
+			free_chunk_content(&child->sa.st_seen_sec_label);
+		}
+		child->sa.st_seen_sec_label = clone_hunk(*selected_sec_label, "st_seen_sec_label");
+	}
+
 	/* XXX: check conversions */
 	dbg("initiator saving acceptable TSi response in this");
 	ts_to_end(best.tsi, &c->spd.this, &child->sa.st_ts_this);
@@ -1489,7 +1520,7 @@
 
 	enum fit fitness = END_NARROWER_THAN_TS;
 
-	if (!score_ends_seclabel(&ends, c, &their_tsis, &their_tsrs,
+	if (!score_ends_seclabel(NULL, &ends, c, &their_tsis, &their_tsrs,
 				 child->sa.st_logger)) {
 		log_state(RC_LOG_SERIOUS, &child->sa,
 			  "rekey: received Traffic Selectors mismatch configured selectors for Security Label");
diff -Naur libreswan-4.3-orig/programs/pluto/ikev2_parent.c libreswan-4.3/programs/pluto/ikev2_parent.c
--- libreswan-4.3-orig/programs/pluto/ikev2_parent.c	2021-02-21 12:03:03.000000000 -0500
+++ libreswan-4.3/programs/pluto/ikev2_parent.c	2021-03-01 10:31:49.667207958 -0500
@@ -5943,8 +5943,6 @@
 			 * from a policy we gave the kernel, so it _should_ be within our range?
 			 */
 			child->sa.st_acquired_sec_label = clone_hunk(p->sec_label, "st_acquired_sec_label");
-			c->spd.this.sec_label = clone_hunk(p->sec_label, "updated conn label");
-			c->spd.that.sec_label = clone_hunk(p->sec_label, "updated conn label");
 		}
 
 	} else {