From mboxrd@z Thu Jan 1 00:00:00 1970 From: Josh Coombs Subject: Re: Bug in MACSec - stops passing traffic after approx 5TB Date: Sun, 14 Oct 2018 16:52:24 -0400 Message-ID: References: <20181014202510.GA19253@bistromath.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: netdev@vger.kernel.org To: sd@queasysnail.net Return-path: Received: from mail-yw1-f47.google.com ([209.85.161.47]:46564 "EHLO mail-yw1-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726084AbeJOEfO (ORCPT ); Mon, 15 Oct 2018 00:35:14 -0400 Received: by mail-yw1-f47.google.com with SMTP id j202-v6so6822226ywa.13 for ; Sun, 14 Oct 2018 13:53:00 -0700 (PDT) In-Reply-To: <20181014202510.GA19253@bistromath.localdomain> Sender: netdev-owner@vger.kernel.org List-ID: On Sun, Oct 14, 2018 at 4:24 PM Sabrina Dubroca wrote: > > 2018-10-14, 10:59:31 -0400, Josh Coombs wrote: > > I initially mistook this for a traffic control issue, but after > > stripping the test beds down to just the MACSec component, I can still > > replicate the issue. After approximately 5TB of transfer / 4 billion > > packets over a MACSec link it stops passing traffic. > > I think you're just hitting packet number exhaustion. After 2^32 > packets, the packet number would wrap to 0 and start being reused, > which breaks the crypto used by macsec. Before this point, you have to > add a new SA, and tell the macsec device to switch to it. I had not considered that, I naively thought as long as I didn't specify a replay window, it'd roll the PN over on it's own and life would be good. I'll test that theory tomorrow, should be easy to prove out. > That's why you should be using wpa_supplicant. It will monitor the > growth of the packet number, and handle the rekey for you. Thank you for the heads up, I'll read up on this as well. Josh C