Doubt regarding key_do_allocsa_policy in ipsec path

[Reji Thomas]

Hi,

The key_do_allocsa_policy searches and deletes the non preferred sas if
there are multiple sas that match the search parameters . I see that if
there are multiple sas of same parameters established between end points,
this end up in deletion of all "outbound sa" but the preferred sa. Since
the deletion occurs only on the outbound sa, this ends up in a scenario
where the corresponding inbound ipsec sas gets unpaired and not cleaned up
particularly when the ike daemon doesnt send a delete notification of sa to
the other peer. ( racoon2 ikev1 doesnt seem to do this).

In such a scenario, what should be the proper thing to do?.

1. Make sure that a delete notification is sent by the iked so that the
peers can cleanup the unpaired sa.
2. Since ipsec sas are always paired, should we delete the unpaired sa in
the kernel  at the same time?



Thanks
Reji