netdev - Re: [devel-ipsec] [PATCH ipsec-next v6] xfrm: Add Direction to the SA in or out

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZhfCNOG550lAWRsP@gauss3.secunet.de>
Date: Thu, 11 Apr 2024 12:57:56 +0200
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Antony Antony <antony@...nome.org>
CC: Sabrina Dubroca <sd@...asysnail.net>, Nicolas Dichtel
	<nicolas.dichtel@...nd.com>, Antony Antony <antony.antony@...unet.com>,
	Herbert Xu <herbert@...dor.apana.org.au>, <netdev@...r.kernel.org>,
	<devel@...ux-ipsec.org>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski
	<kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "David S. Miller"
	<davem@...emloft.net>
Subject: Re: [devel-ipsec] [PATCH ipsec-next v6] xfrm: Add Direction to the
 SA in or out

On Wed, Apr 10, 2024 at 06:59:00PM +0200, Antony Antony via Devel wrote:
> On Wed, Apr 10, 2024 at 10:56:34AM +0200, Sabrina Dubroca wrote:
> > 2024-04-09, 19:23:04 +0200, Antony Antony wrote:
> > > On Mon, Apr 08, 2024 at 03:02:31PM +0200, Sabrina Dubroca wrote:
> > > > 2024-04-07, 10:23:21 +0200, Antony Antony wrote:
> > > 
> > > Current implemenation does not allow 0.
> > 
> > So we have to pass a replay window even if we know the SA is for
> > output? That's pretty bad.
> 
> we can default to 1 with ESN and when no replay-window is specified.  
> 
> > > Though supporting 0 is higly desired 
> > > feature and probably a hard to implement feature in xfrm code. 
> > 
> > Why would it be hard for outgoing SAs? The replay window should never
> > be used on those. And xfrm_replay_check_esn and xfrm_replay_check_bmp
> > already have checks for 0-sized replay window.
> 
> That information comes from hall way talks with Steffen. I can't explain 
> it:) May be he can elaborate why 0 is not allowed with ESN.

That is because the algorithm on the receive side does not work
with replay window 0. Once we have sepateted input and output SAs,
thereplay window can be 0 on outout.