Bug 1572425 - libreswan: shared IKE SA leads to rekey interop issues
Summary: libreswan: shared IKE SA leads to rekey interop issues
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libreswan
Version: 7.6
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Paul Wouters
QA Contact: Ondrej Moriš
Depends On:
Blocks: 1574456
TreeView+ depends on / blocked
Reported: 2018-04-27 01:36 UTC by Paul Wouters
Modified: 2018-10-30 10:52 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1574456 (view as bug list)
Last Closed: 2018-10-30 10:51:34 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2018:3174 0 None None None 2018-10-30 10:52:02 UTC

Description Paul Wouters 2018-04-27 01:36:40 UTC
When multiple IPsec SA's share the same IKE SA and a rekey events take place, not all state is properly transferred to the new connection. That can lead to multiple IKE SA's. Some devices, such as Cisco, will not allow this and return INVALID_IKE_SPI and delete all their IKE SA's

Comment 2 Ondrej Moriš 2018-04-30 08:37:11 UTC
This sounds like it should not be hard to reproduce - with two IPSEC SA sharing a single IKE SA when rekeying happens what should I expect? Just a single IKE SA, right?

Comment 7 errata-xmlrpc 2018-10-30 10:51:34 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.