lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <YwxlC5XrXchGWUUX@unreal> Date: Mon, 29 Aug 2022 10:04:43 +0300 From: Leon Romanovsky <leon@...nel.org> To: Hyong Youb Kim <hyonkim@...co.com> Cc: saeedm@...dia.com, netdev@...r.kernel.org, kuba@...nel.org, davem@...emloft.net, aviadye@...lanox.com, steffen.klassert@...unet.com, Raed Salem <raeds@...dia.com> Subject: Re: [PATCH] net/mlx5e: Do not increment ESN when updating IPsec ESN state On Sun, Aug 21, 2022 at 10:25:51PM -0700, Hyong Youb Kim wrote: > An offloaded SA stops receiving after about 2^32 + replay_window > packets. For example, when SA reaches <seq-hi 0x1, seq 0x2c>, all > subsequent packets get dropped with SA-icv-failure (integrity_failed). > > To reproduce the bug: > - ConnectX-6 Dx with crypto enabled (FW 22.30.1004) > - ipsec.conf: > nic-offload = yes > replay-window = 32 > esn = yes > salifetime=24h > - Run netperf for a long time to send more than 2^32 packets > netperf -H <device-under-test> -t TCP_STREAM -l 20000 > > When 2^32 + replay_window packets are received, the replay window > moves from the 2nd half of subspace (overlap=1) to the 1st half > (overlap=0). The driver then updates the 'esn' value in NIC > (i.e. seq_hi) as follows. > > seq_hi = xfrm_replay_seqhi(seq_bottom) > new esn in NIC = seq_hi + 1 > > The +1 increment is wrong, as seq_hi already contains the correct > seq_hi. For example, when seq_hi=1, the driver actually tells NIC to > use seq_hi=2 (esn). This incorrect esn value causes all subsequent > packets to fail integrity checks (SA-icv-failure). So, do not > increment. > > Fixes: cb01008390bb ("net/mlx5: IPSec, Add support for ESN") > Signed-off-by: Hyong Youb Kim <hyonkim@...co.com> > --- > drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 --- > 1 file changed, 3 deletions(-) > Thanks, Acked-by: Leon Romanovsky <leonro@...dia.com>
Powered by blists - more mailing lists