lkml.org 
[lkml]   [2018]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 035/121] xfrm: fix state migration copy replay sequence numbers
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Antony Antony <antony@phenome.org>


    [ Upstream commit a486cd23661c9387fb076c3f6ae8b2aa9d20d54a ]

    During xfrm migration copy replay and preplay sequence numbers
    from the previous state.

    Here is a tcpdump output showing the problem.
    10.0.10.46 is running vanilla kernel, is the IKE/IPsec responder.
    After the migration it sent wrong sequence number, reset to 1.
    The migration is from 10.0.0.52 to 10.0.0.53.

    IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7cf), length 136
    IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7cf), length 136
    IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d0), length 136
    IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7d0), length 136

    IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I]
    IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R]
    IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I]
    IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R]

    IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d1), length 136

    NOTE: next sequence is wrong 0x1

    IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x1), length 136
    IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d2), length 136
    IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x2), length 136

    Signed-off-by: Antony Antony <antony@phenome.org>
    Reviewed-by: Richard Guy Briggs <rgb@tricolour.ca>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/xfrm/xfrm_state.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/net/xfrm/xfrm_state.c
    +++ b/net/xfrm/xfrm_state.c
    @@ -1208,6 +1208,8 @@ static struct xfrm_state *xfrm_state_clo
    x->curlft.add_time = orig->curlft.add_time;
    x->km.state = orig->km.state;
    x->km.seq = orig->km.seq;
    + x->replay = orig->replay;
    + x->preplay = orig->preplay;

    return x;


    \
     
     \ /
      Last update: 2018-04-11 23:22    [W:2.818 / U:0.244 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site