netdev - Re: Question about esp sequence number and anti-reply window logic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 3 Jun 2014 11:09:12 +0800
From:	Xufeng Zhang <xufengzhang.main@...il.com>
To:	Steffen Klassert <steffen.klassert@...unet.com>
Cc:	netdev <netdev@...r.kernel.org>
Subject: Re: Question about esp sequence number and anti-reply window logic

Hi Steffen,

Do you have an idea about why xfrm don't comply with the below RFC
specification?
is this a bug or something?


Thanks,
Xufeng

On 5/28/14, Xufeng Zhang <xufengzhang.main@...il.com> wrote:
> Hi All,
>
> Per RFC4303:
> The sender assumes anti-replay is enabled as a default, unless
> otherwise notified by the receiver (see Section 3.4.3). Thus,
> typical behavior of an ESP implementation calls for the sender to
> establish a new SA when the Sequence Number (or ESN) cycles, or in
> anticipation of this value cycling.
>
> But currently the xfrm implementation don't establish a new SA when
> the Sequence Number cycles, it just give a notification to user.
> I know this might be a well-known limitation, but is there any document
> declare this about why xfrm didn't implement this?
>
> I also found a similar bug opened for this issue but without any response:
> https://bugzilla.kernel.org/show_bug.cgi?id=76791
>
>
> Thanks a lot!
> Xufeng
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html