strongSwan

With the update SA used to manage MOBIKE address/port change, strongSwan queries for the current SA info and then sends an update SA with new address/port changes. However, if there are key information in the response to the SA query, it will also include that in the SA update.

src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c:

    if (response.key_encr)
    {
        PFKEY_EXT_COPY(msg, response.key_encr);
    }

    if (response.key_auth)
    {
        PFKEY_EXT_COPY(msg, response.key_auth);
    }

But the FreeBSD 11.1 kernel explicitly disallows key updates to established SA and so rejects the pfkey message:

sys/netipsec/key.c:

        /*
         * For DYING and MATURE SA we can change only state
         * and lifetimes. Report EINVAL if something else attempted
         * to change.
         */
        if (!SADB_CHECKHDR(mhp, SADB_EXT_KEY_ENCRYPT) ||
            !SADB_CHECKHDR(mhp, SADB_EXT_KEY_AUTH)) {
            key_freesav(&sav);
            return (key_senderror(so, m, EINVAL));
        }