child-sa: Use SA matching mark as SA set mark if the latter is %same

For inbound processing, it can be rather useful to apply the mark to the
packet in the SA, so the associated policy with that mark implicitly matches.
When using %unique as match mark, we don't know the mark beforehand, so
we most likely want to set the mark we match against.

src/libcharon/sa/child_sa.c

@@ -900,6 +900,11 @@ static status_t install_internal(private_child_sa_t *this, chunk_t encr,
 		.update = update,
 	};
 
+	if (sa.mark.value == MARK_SAME)
+	{
+		sa.mark.value = inbound ? this->mark_in.value : this->mark_out.value;
+	}
+
 	status = charon->kernel->add_sa(charon->kernel, &id, &sa);
 
 	my_ts->destroy(my_ts);