netdev - Re: [PATCH] net/mlx5e: Do not increment ESN when updating IPsec ESN state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 29 Aug 2022 10:04:43 +0300
From:   Leon Romanovsky <leon@...nel.org>
To:     Hyong Youb Kim <hyonkim@...co.com>
Cc:     saeedm@...dia.com, netdev@...r.kernel.org, kuba@...nel.org,
        davem@...emloft.net, aviadye@...lanox.com,
        steffen.klassert@...unet.com, Raed Salem <raeds@...dia.com>
Subject: Re: [PATCH] net/mlx5e: Do not increment ESN when updating IPsec ESN
 state

On Sun, Aug 21, 2022 at 10:25:51PM -0700, Hyong Youb Kim wrote:
> An offloaded SA stops receiving after about 2^32 + replay_window
> packets. For example, when SA reaches <seq-hi 0x1, seq 0x2c>, all
> subsequent packets get dropped with SA-icv-failure (integrity_failed).
> 
> To reproduce the bug:
> - ConnectX-6 Dx with crypto enabled (FW 22.30.1004)
> - ipsec.conf:
>   nic-offload = yes
>   replay-window = 32
>   esn = yes
>   salifetime=24h
> - Run netperf for a long time to send more than 2^32 packets
>   netperf -H <device-under-test> -t TCP_STREAM -l 20000
> 
> When 2^32 + replay_window packets are received, the replay window
> moves from the 2nd half of subspace (overlap=1) to the 1st half
> (overlap=0). The driver then updates the 'esn' value in NIC
> (i.e. seq_hi) as follows.
> 
>  seq_hi = xfrm_replay_seqhi(seq_bottom)
>  new esn in NIC = seq_hi + 1
> 
> The +1 increment is wrong, as seq_hi already contains the correct
> seq_hi. For example, when seq_hi=1, the driver actually tells NIC to
> use seq_hi=2 (esn). This incorrect esn value causes all subsequent
> packets to fail integrity checks (SA-icv-failure). So, do not
> increment.
> 
> Fixes: cb01008390bb ("net/mlx5: IPSec, Add support for ESN")
> Signed-off-by: Hyong Youb Kim <hyonkim@...co.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 ---
>  1 file changed, 3 deletions(-)
> 

Thanks,
Acked-by: Leon Romanovsky <leonro@...dia.com>