Improve sequence number overflow detection in AH protocol
AbandonedPublic
Actions

Authored by jaz_semihalf.com on Nov 14 2019, 12:29 PM.

Details

Reviewers

mw
wma
jmg
pdk_semihalf.com
jhb
trasz

Group Reviewers

security
secteam

Summary

Since counter has always 64 bit size. Overflow detection has to be
splitted into scenarios where ESN is enabled and where is disabled.

Diff Detail

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

pdk_semihalf.com created this revision.Nov 14 2019, 12:29 PM

Herald added subscribers: ae, imp. · View Herald TranscriptNov 14 2019, 12:29 PM

pdk_semihalf.com added a reviewer: jmg.Nov 14 2019, 12:35 PM

@secteam Do you have any objections to this patch?

I don't think secteam is the right reviewer for this change. Has this been reviewed by folks on the freebsd-net mailing list?

trasz resigned from this revision.Jan 14 2020, 2:32 PM

jaz_semihalf.com commandeered this revision.May 14 2020, 2:23 PM

jaz_semihalf.com added a reviewer: pdk_semihalf.com.

Herald added a subscriber: melifaro. · View Herald TranscriptMay 14 2020, 2:23 PM

No changes - rebase only

emaste added a subscriber: emaste.Jun 23 2020, 4:52 PM

Rebase to HEAD

jaz_semihalf.com added a reviewer: jhb.Sep 24 2020, 4:20 PM

jhb added a child revision: D22369: Add support for IPSec ESN and pass relevant information to crypto layer.Sep 24 2020, 10:07 PM

Should this just be included in the commit for D22367?

Correct - I will squash it with D22367 and drop this one. Thank you

jaz_semihalf.com mentioned this in D22367: Implement anti-replay algorithm with ESN support.Oct 3 2020, 10:31 PM

Revision Contents
Changeset List

Path

Size

sys/

netipsec/

xform_ah.c

4 lines

Diff 76982

View Options

Improve sequence number overflow detection in AH protocolAbandonedPublicActions