Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1880466

Summary: Labeled IPsec not working in RHEL-8.3.0 beta
Product: Red Hat Enterprise Linux 8 Reporter: Stepan Broz <sbroz>
Component: libreswanAssignee: Paul Wouters <pwouters>
Status: CLOSED CURRENTRELEASE QA Contact: Ondrej Moriš <omoris>
Severity: high Docs Contact:
Priority: high    
Version: 8.3CC: lmiksik, omoris, pwouters, sahana, ssorce
Target Milestone: rcKeywords: EasyFix, Patch, Regression, Triaged, ZStream
Target Release: 8.0Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1882449 (view as bug list) Environment:
Last Closed: 2020-11-03 16:43:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1882449    

Description Stepan Broz 2020-09-18 15:50:08 UTC 
Description of problem:
Labeled IPsec is broken for RHEL-8.3.0 beta. The configuration is not parsed and used properly.

Missing upstream commits:
https://github.com/libreswan/libreswan/commit/3a8c1097fb8509949e56711add5a699ce07e3dab
https://github.com/libreswan/libreswan/commit/998aa5f18bad901d6f5c834494d06ee405053b59

Version-Release number of selected component (if applicable):
libreswan-3.32-3.el8.x86_64
libreswan-3.32-6.el8.x86_64 (current from nightly)

How reproducible:
Always

Steps to Reproduce:
1. Configure labeled IPsec in /etc/ipsec.conf:

config setup
	secctx-attr-type=32001

2. Configure labeled IPsec in the connection configuration:

conn labeltest
  left=host1.example.com
  leftcert="host1cert"
  right=host2.example.com
  leftid=%fromcert
  rightid=%fromcert
  ikev2=no
  authby=rsasig
  labeled-ipsec=yes
  policy-label=system_u:object_r:ipsec_spd_t:s0
  ike=aes256-sha256;modp2048
  esp=aes128-sha256;modp2048
  auto=add

3. Start the "ipsec" service:

    # systemctl start ipsec

4. Check "ipsec status" for "policy_label", affected version shows "unset".

5. Bring the connection up:

    # ipsec auto --up labeltest

6. Check "ip xfrm pol", affected version does not have security context set.


Actual results:

ipsec status:
000 "labeltest":   policy_label:unset;

ip xfrm policy:
src 192.0.2.254/32 dst 192.0.2.120/32 
	dir out priority 2080702 ptype main 
	tmpl src 192.0.2.254 dst 192.0.2.120
		proto esp reqid 16389 mode tunnel
src 192.0.2.120/32 dst 192.0.2.254/32 
	dir fwd priority 2080702 ptype main 
	tmpl src 192.0.2.120 dst 192.0.2.254
		proto esp reqid 16389 mode tunnel
src 192.0.2.120/32 dst 192.0.2.254/32 
	dir in priority 2080702 ptype main 
	tmpl src 192.0.2.120 dst 192.0.2.254
		proto esp reqid 16389 mode tunnel


Expected results:

ipsec status:
000 "labeltest":   policy_label:system_u:object_r:ipsec_spd_t:s0;

ip xfrm policy:
src 192.0.2.254/32 dst 192.0.2.120/32 
	security context system_u:object_r:ipsec_spd_t:s0 
	dir out priority 2080702 ptype main 
	tmpl src 192.0.2.254 dst 192.0.2.120
		proto esp reqid 16389 mode tunnel
src 192.0.2.120/32 dst 192.0.2.254/32 
	security context system_u:object_r:ipsec_spd_t:s0 
	dir fwd priority 2080702 ptype main 
	tmpl src 192.0.2.120 dst 192.0.2.254
		proto esp reqid 16389 mode tunnel
src 192.0.2.120/32 dst 192.0.2.254/32 
	security context system_u:object_r:ipsec_spd_t:s0 
	dir in priority 2080702 ptype main 
	tmpl src 192.0.2.120 dst 192.0.2.254
		proto esp reqid 16389 mode tunnel


Additional info:
Tested a scratch with the two upstream commits added, seems OK.