netdev - Question about esp sequence number and anti-reply window logic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 28 May 2014 10:30:16 +0800
From:	Xufeng Zhang <xufengzhang.main@...il.com>
To:	Steffen Klassert <steffen.klassert@...unet.com>,
	Herbert Xu <herbert@...dor.apana.org.au>
Cc:	netdev <netdev@...r.kernel.org>
Subject: Question about esp sequence number and anti-reply window logic

Hi All,

Per RFC4303:
The sender assumes anti-replay is enabled as a default, unless
otherwise notified by the receiver (see Section 3.4.3). Thus,
typical behavior of an ESP implementation calls for the sender to
establish a new SA when the Sequence Number (or ESN) cycles, or in
anticipation of this value cycling.

But currently the xfrm implementation don't establish a new SA when
the Sequence Number cycles, it just give a notification to user.
I know this might be a well-known limitation, but is there any document
declare this about why xfrm didn't implement this?

I also found a similar bug opened for this issue but without any response:
https://bugzilla.kernel.org/show_bug.cgi?id=76791

Thanks a lot!
Xufeng
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html