https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=223382
Bug ID: 223382
Summary: PFKey SA Update Prevents UDP-Encap SA From Updated
Correctly
Product: Base System
Version: 11.1-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
When a UDP-encap SA is being updated with port change (e.g., MOBIKE update SA),
the updated SA is now an ESP SA.
The bug is in the function key_updateaddresses. Instead of setting up the right
NAT info on the new updated SA, it does it on the old SA (which is about to be
freed). As a result, the updated SA has an empty NAT-T structure which means
ESP.
sys/netipsec/key.c
newsav->natt = NULL;
newsav->sah = sah;
newsav->state = SADB_SASTATE_MATURE;
error = key_setnatt(sav, mhp);
if (error != 0)
goto fail;
When this is patched to:
error = key_setnatt(newsav, mhp);
UDP-encap info (if any) is preserved.
NOTE: There are other SA address updates, it may be that key_setnatt(sav, mhp)
makes sense for them. I have not tested all scenarios.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
