netipsec: Do not leak the SAH when an SA is clonedHEADmain

key_updateaddresses() gives the clone of an SA a new SAH reference when
the SA index comes from key_newsah() or key_getsah(), but nothing
releases the reference of the old SA: key_delsav() leaves the SAH alone,
because key_unlinksav() normally releases it, and an SA that is replaced
never goes through that.  The SAH then stays allocated for good, after
its SAs are flushed and after the vnet is destroyed, as an SADB_UPDATE
with a new address does each time an IKE daemon moves an SA.

The old SA cannot release the reference when it is replaced, since a
sender that still holds it reads its SAH.  Release it in key_delsav()
instead.  When only the NAT-T config changes, the clone used to take over
the reference of the old SA; take a new one in that case as well, so that
every SA holds its own.

Reviewed by:		kib, markj
MFC after:		1 week
Sponsored by:		Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D61101

0 files changed, 0 insertions, 0 deletions