pf: Free the stack key when attaching it collidesHEADmain

pf_state_key_attach() attaches the wire key first and then the stack
key, setting sks to NULL before the second pass.  When the stack key
collides with an existing state, the error path removes the wire key
again but then frees sks, which is NULL by then: the stack key leaks.

pfsync hits this.  A peer that gets a plain state in a bulk update
before a redirected state whose stack key is the plain state's key
fails to import the redirected state, leaks its stack key, and leaks
another one with every later update of that state.

Free sk, the key of the pass that collided (skw on the wire pass), and
add a test.

Reviewed by:		kp
Fixes:			371bd29d4b22 ("pf: fix potential state key leak")
MFC after:		1 week
Sponsored by:		Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D60951

0 files changed, 0 insertions, 0 deletions