Describe the bug
The libreswan-4.12-3.amzn2023.0.2 package shipped in AL2023 contains a known upstream race condition in IKEv2 Child SA rekeying. When both IPsec peers initiate a CREATE_CHILD_SA rekey within milliseconds of each other on the same IKE SA, the IKEv2 message ID windows desynchronize. All subsequent IKE messages (including DPD/liveness keepalives) are then rejected as stale, which leads to tunnel teardown.
The diagnostic signature in the pluto logs is:
EXPECTATION FAILED: ike->sa.st_v2_msgid_windows.responder.recv ==
ike->sa.st_v2_msgid_windows.responder.sent
(is_duplicate_request_msgid() +1364 /programs/pluto/ikev2.c)
The probability of collision scales with the number of Child SAs per IKE SA, so tunnels carrying many subnets are disproportionately affected.
To Reproduce
- Install
libreswan-4.12-3.amzn2023.0.2 on AL2023 (kernel 6.12).
- Establish an IKEv2 tunnel with multiple Child SAs (multiple subnets) to a peer.
- Cause both peers to initiate a Child SA rekey at ~the same time (more likely when SA lifetimes on both ends are aligned).
- Observe the message ID window desync in the pluto logs and the resulting tunnel drop.
Expected behavior
Libreswan should handle simultaneous (cross) Child SA rekey requests from both peers without desynchronizing the IKEv2 message ID windows or dropping the tunnel.
Additional context
This is fixed upstream in Libreswan v5.1 (released 2024-10-08). From the upstream CHANGES (https://github.com/libreswan/libreswan/blob/main/CHANGES):
v5.1 (Oct 8, 2024)
* IKEv2:
- fix race when initiator-responder cross rekey requests [Andrew]
The fix is in ikev2_msgid.c.
Suggested fix: because a 4.x -> 5.x move is a major jump (5.0 removed IKEv1 and changed some config syntax), a backport of this isolated fix onto the 4.12 branch would be preferable. This is consistent with how the AL2023 libreswan package is already maintained — targeted backports have been applied to 4.12 for CVE-2024-2357 and CVE-2024-3652 (see https://alas.aws.amazon.com/). If a backport isn't feasible, making 5.1+ available as an AL2023 package would also resolve it.
The only mitigation available without the fix is manually staggering SA lifetimes per peer to avoid simultaneous rekey initiation; this does not eliminate the underlying race.
Environment
- OS: Amazon Linux 2023
- Kernel: 6.12
- Package: libreswan-4.12-3.amzn2023.0.2.x86_64
- IKE: IKEv2 only, PSK authentication
Describe the bug
The
libreswan-4.12-3.amzn2023.0.2package shipped in AL2023 contains a known upstream race condition in IKEv2 Child SA rekeying. When both IPsec peers initiate a CREATE_CHILD_SA rekey within milliseconds of each other on the same IKE SA, the IKEv2 message ID windows desynchronize. All subsequent IKE messages (including DPD/liveness keepalives) are then rejected as stale, which leads to tunnel teardown.The diagnostic signature in the pluto logs is:
The probability of collision scales with the number of Child SAs per IKE SA, so tunnels carrying many subnets are disproportionately affected.
To Reproduce
libreswan-4.12-3.amzn2023.0.2on AL2023 (kernel 6.12).Expected behavior
Libreswan should handle simultaneous (cross) Child SA rekey requests from both peers without desynchronizing the IKEv2 message ID windows or dropping the tunnel.
Additional context
This is fixed upstream in Libreswan v5.1 (released 2024-10-08). From the upstream CHANGES (https://github.com/libreswan/libreswan/blob/main/CHANGES):
The fix is in
ikev2_msgid.c.Suggested fix: because a 4.x -> 5.x move is a major jump (5.0 removed IKEv1 and changed some config syntax), a backport of this isolated fix onto the 4.12 branch would be preferable. This is consistent with how the AL2023 libreswan package is already maintained — targeted backports have been applied to 4.12 for CVE-2024-2357 and CVE-2024-3652 (see https://alas.aws.amazon.com/). If a backport isn't feasible, making 5.1+ available as an AL2023 package would also resolve it.
The only mitigation available without the fix is manually staggering SA lifetimes per peer to avoid simultaneous rekey initiation; this does not eliminate the underlying race.
Environment