lkml.org 
[lkml]   [2018]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.4 055/167] xfrm: fix state migration copy replay sequence numbers
    Date
    From: Antony Antony <antony@phenome.org>

    [ Upstream commit a486cd23661c9387fb076c3f6ae8b2aa9d20d54a ]

    During xfrm migration copy replay and preplay sequence numbers
    from the previous state.

    Here is a tcpdump output showing the problem.
    10.0.10.46 is running vanilla kernel, is the IKE/IPsec responder.
    After the migration it sent wrong sequence number, reset to 1.
    The migration is from 10.0.0.52 to 10.0.0.53.

    IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7cf), length 136
    IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7cf), length 136
    IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d0), length 136
    IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7d0), length 136

    IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I]
    IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R]
    IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I]
    IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R]

    IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d1), length 136

    NOTE: next sequence is wrong 0x1

    IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x1), length 136
    IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d2), length 136
    IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x2), length 136

    Signed-off-by: Antony Antony <antony@phenome.org>
    Reviewed-by: Richard Guy Briggs <rgb@tricolour.ca>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    net/xfrm/xfrm_state.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
    index 9895a8c56d8c..2cfa8105c437 100644
    --- a/net/xfrm/xfrm_state.c
    +++ b/net/xfrm/xfrm_state.c
    @@ -1208,6 +1208,8 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
    x->curlft.add_time = orig->curlft.add_time;
    x->km.state = orig->km.state;
    x->km.seq = orig->km.seq;
    + x->replay = orig->replay;
    + x->preplay = orig->preplay;

    return x;

    --
    2.14.1
    \
     
     \ /
      Last update: 2018-03-19 18:27    [W:4.519 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site