From: Patrick McHardy <kaber@trash.net>
To: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Paul Moore <paul.moore@hp.com>,
netdev@vger.kernel.org, latten@us.ibm.com
Subject: Re: IPsec replay sequence number overflow behavior? (RFC4303 section 3.3.3)
Date: Mon, 10 Dec 2007 04:16:36 +0100 [thread overview]
Message-ID: <475CAF94.7020306@trash.net> (raw)
In-Reply-To: <20071210030653.GA31566@gondor.apana.org.au>
Herbert Xu wrote:
> On Sun, Dec 09, 2007 at 09:37:56AM -0500, Paul Moore wrote:
>
>> Thanks for clearing that up, I'll send a patch this week; complete with an
>> unlikely (similar to the RFC quality IPsec audit patch I sent on Friday) and
>> a decrement to the sequence counter in case of rollover.
>>
>
> Actually I think we should just use the SA expire mechanism
> to do this. The reason is that the overflow we want to detect
> only applies to 32-bit sequence numbers. In future we will be
> making our sequence numbers 64-bit.
>
> When we do that we can no longer just check against wrapping
> to zero since we need to know whether ESNs are in use or not.
>
> The easiest fix is to just force the hard_packet_limit to 2^32.
> upon SA creation.
Won't this break with manually installed SAs (without a keying
daemon)?
next prev parent reply other threads:[~2007-12-10 3:16 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-12-07 16:04 IPsec replay sequence number overflow behavior? (RFC4303 section 3.3.3) Paul Moore
2007-12-09 2:13 ` Herbert Xu
2007-12-09 14:37 ` Paul Moore
2007-12-10 3:06 ` Herbert Xu
2007-12-10 3:16 ` Patrick McHardy [this message]
2007-12-10 3:43 ` Herbert Xu
2007-12-18 16:14 ` Paul Moore
-- strict thread matches above, loose matches on Subject: below --
2007-12-19 6:36 Joy Latten
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=475CAF94.7020306@trash.net \
--to=kaber@trash.net \
--cc=herbert@gondor.apana.org.au \
--cc=latten@us.ibm.com \
--cc=netdev@vger.kernel.org \
--cc=paul.moore@hp.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.