Package: libreswan Version: 4.10-2+deb12u1 When the IP address of a host behind NAT changes, libreswan fails to respond correctly when IKEv2 is used. This is a regression from IKEv1 as libreswan will correctly shut down the existing connection and initiate a new one when DPD kicks in.
Let the host behind NAT be A, and the server be B. When A's IP address changes, its data connection to B will be broken. However, B continues to respond to A's liveliness messages thus preventing A from tearing the broken connection down. This will only resolve itself when A's SA eventually times out and is rekeyed. Here is a packet dump on B's side showing this: A's old address: XXX.XXX.107.30.15410 A's new address: XXX.XXX.212.186.25610 B: XXX.XXX.189.96.4502 07:17:42.939963 IP XXX.XXX.212.186.25610 > XXX.XXX.189.96.4502: UDP, length 140 Packet is sent from A's new address. It is correctly processed by the kernel (Linux ignores the source address on inbound packets). 07:17:42.940182 IP XXX.XXX.189.96.4502 > XXX.XXX.107.30.15410: UDP-encap: ESP(spi=0xd4b2be8b,seq=0x1), length 140 Packet is sent back to A's old address, because libreswan has not updated the outbound SA to use the new address. This is suboptimal but not a regression as libreswan never had code to deal with this case. With IKEv1, DPD would eventually kick in and reestablish the connection. However, with IKEv2 we instead see this: 07:18:02.690370 IP XXX.XXX.212.186.25610 > XXX.XXX.189.96.4502: UDP, length 1 07:18:22.687887 IP XXX.XXX.212.186.25610 > XXX.XXX.189.96.4502: UDP, length 1 07:18:26.793134 IP XXX.XXX.212.186.25610 > XXX.XXX.189.96.4502: UDP, length 61 07:18:26.793398 IP XXX.XXX.189.96.4502 > XXX.XXX.212.186.25610: UDP, length 61 07:18:26.793439 IP XXX.XXX.189.96.4502 > XXX.XXX.212.186.25610: UDP, length 61 As you can see from this, libreswan on B responds to A's new IP address, making A think that the connection is still alive. This does not happen with IKEv1. B should either not respond to the packet from the new address, or it should tear down the old SAs and create new ones with the new address. Cheers, -- Email: Herbert Xu <herb...@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
