potential automatic mangle rules issues w.r.t. mark_in and mark_out settings about strongswan

[tobiasbrunner]

automatic mangle rules are added only if mark_in and mark_out are both defined.

What are you referring to exactly? The default updown script does not configure any marks at all but you don't seem to have configured an updown script in your config anyway. So what exactly installs those rules? Some plugin? (It won't be connmark as that only works with transport mode, maybe forecast? If so, maybe read the docs.)

In general, if you use marks, you are on your own and have to mark packets yourself.

[msoltyspl]

I wasn't using updown script or forecast plugin (also mark= option without suffixes mentioned on the forecast page doesn't even work (anymore?) recollecting the tests I did) - or any other plugin for that matter, at least not explicitly. mark_in / mark_out are documented in swanctl.conf - these are the ones I used - I assumed it was actually installed by charon without any help of a plugin and/or its script if applicable (which otherwise would be required to handle %unique / %unique-dir). That to say ... debian by default enables quite a lot.

I'll double check the configs later and see how it behaves on the latest version (and likely on different distro).

[tobiasbrunner]

I assumed it was actually installed by charon without any help of a plugin and/or its script

On the SAs and policies, but no firewall rules are installed because of these options.