* esp6: Use high-order sequence number bits for IV generation
@ 2015-05-13 7:27 Herbert Xu
2015-05-13 10:19 ` Steffen Klassert
0 siblings, 1 reply; 2+ messages in thread
From: Herbert Xu @ 2015-05-13 7:27 UTC (permalink / raw)
To: Steffen Klassert, netdev
I noticed we were only using the low-order bits for IV generation
when ESN is enabled. This is very bad because it means that the
IV can repeat. We must use the full 64 bits.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 31f1b5d..7c07ce3 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -248,7 +248,8 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
aead_givcrypt_set_assoc(req, asg, assoclen);
aead_givcrypt_set_giv(req, esph->enc_data,
- XFRM_SKB_CB(skb)->seq.output.low);
+ XFRM_SKB_CB(skb)->seq.output.low +
+ ((u64)XFRM_SKB_CB(skb)->seq.output.hi << 32));
ESP_SKB_CB(skb)->tmp = tmp;
err = crypto_aead_givencrypt(req);
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: esp6: Use high-order sequence number bits for IV generation
2015-05-13 7:27 esp6: Use high-order sequence number bits for IV generation Herbert Xu
@ 2015-05-13 10:19 ` Steffen Klassert
0 siblings, 0 replies; 2+ messages in thread
From: Steffen Klassert @ 2015-05-13 10:19 UTC (permalink / raw)
To: Herbert Xu; +Cc: netdev
On Wed, May 13, 2015 at 03:27:18PM +0800, Herbert Xu wrote:
> I noticed we were only using the low-order bits for IV generation
> when ESN is enabled. This is very bad because it means that the
> IV can repeat. We must use the full 64 bits.
>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Also applied to the ipsec tree. Thanks a lot Herbert!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-05-13 10:19 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-05-13 7:27 esp6: Use high-order sequence number bits for IV generation Herbert Xu
2015-05-13 10:19 ` Steffen Klassert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).