[PATCH ipsec v2 0/7] xfrm: fix ESP IV generation and ESN authentication

[Jérémy Jean]

Hello,

This series fixes nonce reuse in AES-GCM and ESN authentication errors
in the IPv4 and IPv6 ESP offload paths:
* 1/7 and 2/7: Save the current sequence number before incrementing it,
               so that GCM IV construction prevents nonce reuse,
* 3/7: Use the current sequence for software AAD and hardware offload,
* 4/7: Give each early GSO segment a private secpath,
* 5/7: Use the packet sequence directly for mlx5 IV generation,
* 6/7: Segment untrusted GSO packets before allocating sequence numbers,
* 7/7: Keep the sequence counter unchanged after full ESN overflow.

Note that triggering the bug fixed by 7/7 is impractical: it requires
processing about 2^64 packets under a single key. Yet, I still believe
it's cleaner to fix it.

On the crypto side, as a reminder, reusing a nonce under the same GCM
key is catastrophic for security: it exposes the XOR of the plaintexts
and can reveal GCM authentication key, which opens the possibilty for
an adversary to forge ciphertexts without recovering the AES key.

This series combines and extends these two individual reports:
* https://lore.kernel.org/all/20260925095105.446269-2-Jeremy.Jean@xxxxxxxxxxxxxxxxx/
* https://lore.kernel.org/all/20260925095128.446450-2-Jeremy.Jean@xxxxxxxxxxxxxxxxx/

Recent discussion with Sabrina Dubroca may also be of interest:
https://lore.kernel.org/all/c443bad568f4e03d05b848b1b245707d@xxxxxxxxxxxxxxxxx/T/#u

Regards,
Jérémy

---

Changes in v2:
- Rebase onto ipsec/master.
- Clarify Patch 4's description and comment.
- Remove the duplicate mlx5 IV helper and callback in Patch 5.

Jérémy Jean (7):
  xfrm: esp6: use the current sequence number for the IV
  xfrm: esp4: use the current sequence number for the IV
  xfrm: esp: use the current sequence number for AAD and offload
  xfrm: prevent AES-GCM nonce reuse after early GSO
  net/mlx5e: Use the packet sequence number for the IPsec IV
  xfrm: segment untrusted GSO packets before sequence allocation
  xfrm: leave the sequence counter unchanged on ESN overflow

 .../mellanox/mlx5/core/en_accel/ipsec.c       | 18 -----------
 .../mellanox/mlx5/core/en_accel/ipsec.h       |  2 --
 .../mellanox/mlx5/core/en_accel/ipsec_rxtx.c  | 31 +++----------------
 .../mellanox/mlx5/core/en_accel/ipsec_rxtx.h  |  4 ---
 net/ipv4/esp4.c                               | 13 +++-----
 net/ipv4/esp4_offload.c                       |  7 +++--
 net/ipv6/esp6.c                               | 13 +++-----
 net/ipv6/esp6_offload.c                       |  7 +++--
 net/xfrm/xfrm_output.c                        | 16 ++++++++--
 net/xfrm/xfrm_replay.c                        |  1 -
 10 files changed, 36 insertions(+), 76 deletions(-)

-- 
2.47.3