[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
kern/53708: ipsec: a lingering sah (struct secashead) may force a wrong mode to newly added SAs
>Synopsis: ipsec: a lingering sah (struct secashead) may force a wrong mode to newly added SAs
>Arrival-Date: Wed Nov 07 09:35:00 +0000 2018
>Originator: Ryota Ozaki
NetBSD kvm 8.99.25 NetBSD 8.99.25 (KVM) #1569: Tue Nov 6 13:24:47 JST 2018
In the kernel, an SA represents as struct secashead (sah) and struct secasvar (sav).
When you create an SA, one sah and one sav are created. If you delete the SA,
the sav is deleted immediately, however, sah remains for some reasons. After that,
if you create another SA with the same parameters (src/dst) but with a different
mode, then the remaining sah is reused as is wrongly and you'll get a new SA
with the old mode unexpectedly (see below).
The unexpected behavior occurs on add, update and getspi APIs.
## start of script
setkey -c <<-EOF
add $src $dst esp $spi -m transport -E null;
delete $src $dst esp $spi;
add $src $dst esp $spi -m tunnel -E null;
## end of script
A result looks like this (see "mode=transport").
esp mode=transport spi=1000(0x000003e8) reqid=0(0x00000000)
seq=0x00000000 replay=0 flags=0x00000040 state=mature
created: Nov 7 18:05:41 2018 current: Nov 7 18:05:41 2018
diff: 0(s) hard: 0(s) soft: 0(s)
last: Nov 6 13:29:06 2018 hard: 0(s) soft: 0(s)
current: 0(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 0 hard: 0 soft: 0
sadb_seq=0 pid=3260 refcnt=0
Remove an sah immediately when belonging savs disappear and/or
when adding a new SA while there is an SA with a different mode,
remove the old SA or return an error.
Or treat SAs with different modes as different SAs on add/update/getspi.
(I'm not sure if the change is acceptable...)
Main Index |
Thread Index |