What were you trying to do that didn't work?

When authby= option is used in %default connection configuration, it is not interpreted correctly. 

What is the impact of this issue to you?

%default connection is used to propagate system-wide crypto policy to libreswan and because of this the libreswan peer authentication does not work as it was intended by crypto policies. 

Please provide the package NVR for which the bug is seen:

libreswan-4.5-1.el8

How reproducible is this bug?:

100%

Steps to reproduce

1. Configure /etc/ipsec.conf with %default connection and two additional ones as follows:

conn %default
  authby=ecdsa-sha2_256,ecdsa-sha2_384,ecdsa-sha2_512,rsa-sha2_256,rsa-sha2_384,rsa-sha2_512

conn test-1
  left=%defaultroute
  right=1.2.3.4
  auto=add

conn test-2
  left=%defaultroute
  right=1.2.3.5
  authby=ecdsa-sha2_256,ecdsa-sha2_384,ecdsa-sha2_512,rsa-sha2_256,rsa-sha2_384,rsa-sha2_512
  auto=add

Notice that test-1 is using authby from the %default while test-2 is using the very same value but not from the %default. So essentially both test-1 and test-2 should have the same authby setting. 

2. Start the ipsec service and look in ipsec status, look for policy and hash policy values, they should be the same (containing all three hashes and policy should have both ecdsa and rsasig)

# service ipsec restart
# ipsec status | grep 'policy: '

Expected results

000 "test-1":   policy: IKEv2+RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO;
000 "test-1":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512; 
000 "test-2":   policy: IKEv2+RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO;
000 "test-2":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512; 

Actual results

000 "test-1":   policy: IKEv2+ECDSA+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO;
000 "test-1":   v2-auth-hash-policy: SHA2_256;
000 "test-2":   policy: IKEv2+RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO;
000 "test-2":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;

Additional information

This problem is still present in libreswan-4.6 but it is longer present in libreswan-4.9.