Re: [devel-ipsec] [PATCH ipsec-next v6] xfrm: Add Direction to the SA in or out

[Steffen Klassert <steffen.klassert@secunet.com>]

On Wed, Apr 10, 2024 at 06:59:00PM +0200, Antony Antony via Devel wrote:
> On Wed, Apr 10, 2024 at 10:56:34AM +0200, Sabrina Dubroca wrote:
> > 2024-04-09, 19:23:04 +0200, Antony Antony wrote:
> > > On Mon, Apr 08, 2024 at 03:02:31PM +0200, Sabrina Dubroca wrote:
> > > > 2024-04-07, 10:23:21 +0200, Antony Antony wrote:
> > > 
> > > Current implemenation does not allow 0.
> > 
> > So we have to pass a replay window even if we know the SA is for
> > output? That's pretty bad.
> 
> we can default to 1 with ESN and when no replay-window is specified.  
> 
> > > Though supporting 0 is higly desired 
> > > feature and probably a hard to implement feature in xfrm code. 
> > 
> > Why would it be hard for outgoing SAs? The replay window should never
> > be used on those. And xfrm_replay_check_esn and xfrm_replay_check_bmp
> > already have checks for 0-sized replay window.
> 
> That information comes from hall way talks with Steffen. I can't explain 
> it:) May be he can elaborate why 0 is not allowed with ESN.

That is because the algorithm on the receive side does not work
with replay window 0. Once we have sepateted input and output SAs,
thereplay window can be 0 on outout.