netdev - Re: [PATCHv2 net] xfrm: Guard IPsec anti replay window against replay bitmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20130918111646.GQ7660@secunet.com>
Date:	Wed, 18 Sep 2013 13:16:46 +0200
From:	Steffen Klassert <steffen.klassert@...unet.com>
To:	Fan Du <fan.du@...driver.com>
Cc:	davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCHv2 net] xfrm: Guard IPsec anti replay window against
 replay bitmap

On Tue, Sep 17, 2013 at 03:14:13PM +0800, Fan Du wrote:
> For legacy IPsec anti replay mechanism:
> 
> bitmap in struct xfrm_replay_state could only provide a 32 bits
> window size limit in current design, thus user level parameter
> sadb_sa_replay should honor this limit, otherwise misleading
> outputs("replay=244") by setkey -D will be:
> 
> 192.168.25.2 192.168.22.2
> 	esp mode=transport spi=147561170(0x08cb9ad2) reqid=0(0x00000000)
> 	E: aes-cbc  9a8d7468 7655cf0b 719d27be b0ddaac2
> 	A: hmac-sha1  2d2115c2 ebf7c126 1c54f186 3b139b58 264a7331
> 	seq=0x00000000 replay=244 flags=0x00000000 state=mature
> 	created: Sep 17 14:00:00 2013	current: Sep 17 14:00:22 2013
> 	diff: 22(s)	hard: 30(s)	soft: 26(s)
> 	last: Sep 17 14:00:00 2013	hard: 0(s)	soft: 0(s)
> 	current: 1408(bytes)	hard: 0(bytes)	soft: 0(bytes)
> 	allocated: 22	hard: 0	soft: 0
> 	sadb_seq=1 pid=4854 refcnt=0
> 192.168.22.2 192.168.25.2
> 	esp mode=transport spi=255302123(0x0f3799eb) reqid=0(0x00000000)
> 	E: aes-cbc  6485d990 f61a6bd5 e5660252 608ad282
> 	A: hmac-sha1  0cca811a eb4fa893 c47ae56c 98f6e413 87379a88
> 	seq=0x00000000 replay=244 flags=0x00000000 state=mature
> 	created: Sep 17 14:00:00 2013	current: Sep 17 14:00:22 2013
> 	diff: 22(s)	hard: 30(s)	soft: 26(s)
> 	last: Sep 17 14:00:00 2013	hard: 0(s)	soft: 0(s)
> 	current: 1408(bytes)	hard: 0(bytes)	soft: 0(bytes)
> 	allocated: 22	hard: 0	soft: 0
> 	sadb_seq=0 pid=4854 refcnt=0
> 
> And also, optimizing xfrm_replay_check window checking by setting the
> desirable x->props.replay_window with only doing the comparison once
> for all when xfrm_state is first born.
> 
> Signed-off-by: Fan Du <fan.du@...driver.com>

Applied to ipsec, thanks!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html