[PATCH] xfrm: esp6: fix off-by-one IV counter causing AES-GCM nonce reuse

["Jérémy Jean" <Jeremy.Jean@oss.cyber.gouv.fr>]

An off-by-one error in esp6_xmit() advances the IV counter before
encrypting each software-GSO segment. For N segments with sequence
numbers X through X+N-1, the IV counters are therefore X+1 through X+N.
The following non-GSO packet uses X+N for both its sequence number and
IV counter, repeating the last segment's AES-GCM nonce under the same
key.

The repeated nonce allows first a passive attacker who knows partial
plaintext from one packet to recover corresponding bytes from another
one, and second, an active attacker to recover GCM authentication key
to forge authentication tags without recovering the AES key.

Fix this by saving the complete current sequence number in esp.seqno
before advancing the shared GSO sequence state.

Fixes: 3dca3f38cfb8 ("xfrm: Separate ESP handling from segmentation for GRO packets.")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 net/ipv6/esp6_offload.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index 2289552..05d13cc 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -346,6 +346,7 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb,  netdev_features
 	}
 
 	seq = xo->seq.low;
+	esp.seqno = cpu_to_be64(seq + ((u64)xo->seq.hi << 32));
 
 	esp.esph = ip_esp_hdr(skb);
 	esp.esph->spi = x->id.spi;
@@ -364,8 +365,6 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb,  netdev_features
 	if (xo->seq.low < seq)
 		xo->seq.hi++;
 
-	esp.seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32));
-
 	len = skb->len - sizeof(struct ipv6hdr);
 	if (len > IPV6_MAXPLEN)
 		len = 0;
-- 
2.47.3