netdev - RE: Random packet loss using IPsec with AES128-SHA1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Dec 2015 16:36:06 +0100
From:	"Gabriele Beltrame" <belgab@...source.net>
To:	"'Steffen Klassert'" <steffen.klassert@...unet.com>
Cc:	<netdev@...r.kernel.org>
Subject: RE: Random packet loss using IPsec with AES128-SHA1

Hi Steffen,

I don't think it's IPsec (I can see the outbound packet in tcpdump), not
alone at least but the XEN /AWS Ethernet driver (or multiple things
concurring to the issue) actually... the odd thing is that it does seem to
affect AES-CBS only (3DES-CBS, AES-GCM are fine)
This is the short discussion on the Strongswan support wiki:
https://wiki.strongswan.org/issues/1220

Thanks,
Gabriele

-----Original Message-----
From: Steffen Klassert [mailto:steffen.klassert@...unet.com] 
Sent: mercoledì 16 dicembre 2015 11:00
To: Gabriele Beltrame <belgab@...source.net>
Cc: netdev@...r.kernel.org
Subject: Re: Random packet loss using IPsec with AES128-SHA1

On Wed, Dec 16, 2015 at 10:17:54AM +0100, Gabriele Beltrame wrote:
> Hi,
> 
> I'm running a few Strongswan 5.3.* CentOS (Kernel 3.16.7, 4.2.6, 
> 4.1.*) instances on AWS to terminate VPNs between each other and/or to 
> other devices across the Internet.
> While investigating some application issues, I've noticed that on 
> every VPNs I have random packet losses (from 1% to 4% over 100 to 300
requests sent).
> This only happens when the two following conditions are met: (a) AES 
> encryption used, (b) IP packet size shorter than about (150+8+20)Bytes.

I've never seen this.

If xfrm statistics are compiled in, a counter is bumped for each packet
dropped by IPsec. You can check these counters in /proc/net/xfrm_stat.

This will tell you at least whether IPsec is the reason for your packet
loss.

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html