[Bug 223382] PFKey SA Update Prevents UDP-Encap SA From Updated Correctly

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=223382

            Bug ID: 223382
           Summary: PFKey SA Update Prevents UDP-Encap SA From Updated
                    Correctly
           Product: Base System
           Version: 11.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: garrisoncreek at gmail.com

When a UDP-encap SA is being updated with port change (e.g., MOBIKE update SA),
the updated SA is now an ESP SA.

The bug is in the function key_updateaddresses. Instead of setting up the right
NAT info on the new updated SA, it does it on the old SA (which is about to be
freed). As a result, the updated SA has an empty NAT-T structure which means
ESP.

sys/netipsec/key.c

    newsav->natt = NULL;
    newsav->sah = sah;
    newsav->state = SADB_SASTATE_MATURE;
    error = key_setnatt(sav, mhp);
    if (error != 0)
        goto fail;

When this is patched to:

    error = key_setnatt(newsav, mhp);

UDP-encap info (if any) is preserved.

NOTE: There are other SA address updates, it may be that key_setnatt(sav, mhp)
makes sense for them. I have not tested all scenarios.

-- 
You are receiving this mail because:
You are the assignee for the bug.