Subject: [IPsec] Query about SEq Number

From: Manish Aggarwal <[email-masked]>
Date: Fri, 18 Sep 2009 10:35:32 -0500

HI,
I have a query about the Sequence number in the ESP Header.
If for any packet, the receiver finds the seq number as ZERO, what is the
desired behavior..?

Should this result in the anti-replay check failure..?
Should this be treated as a corrupted packet..?

Appreciate your inputs.

Thanks
Manish

---

From: Dan McDonald <[email-masked]>
Date: Fri, 18 Sep 2009 11:47:58 -0400

> Should this be treated as a corrupted packet..?

Solaris/OpenSolaris treats 0-on-the-wire as an anti-replay failure.  Here's
the code that does early-replay-checking (i.e. replay checking so obvious you
don't need to crunch the authentication algorithm):

http://src.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/uts/common/inet/ip/sadb.c#6156

And here's ESP calling, and bumping the appropriate bean-counters for
"early-replay drop":

http://src.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/uts/common/inet/ip/ipsecesp.c#1239

Hmmm, the comment here is quite old.  We *do* check for collisions in
early-replay, and have since AH/ESP support arrived in Solaris.  Must've been
a leftover from bringup...

Hope this helps,
Dan

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Fri, 18 Sep 2009 09:34:26 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Dan McDonald
> Sent: Friday, September 18, 2009 11:48 AM
> To: Manish Aggarwal
> Cc: [email-masked]
> Subject: Re: [IPsec] Query about SEq Number
> 
> > If for any packet, the receiver finds the seq number as ZERO, what
is
> the
> Solaris/OpenSolaris treats 0-on-the-wire as an anti-replay failure.

That would be appropriate if:
- You have antireplay checking enabled
- You are not doing Extended Sequence Numbers.

In both of those cases, you can legitimately have a zero sequence number
in the ESP header.

> Here's
> http://src.opensolaris.org/source/xref/onnv/onnv-
> gate/usr/src/uts/common/inet/ip/sadb.c#6156
> 
> http://src.opensolaris.org/source/xref/onnv/onnv-
> gate/usr/src/uts/common/inet/ip/ipsecesp.c#1239
> 
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

---

From: Dan McDonald <[email-masked]>
Date: Fri, 18 Sep 2009 12:44:40 -0400

> - You have antireplay checking enabled

If you look at the early-replay code, we do just this.

> In both of those cases, you can legitimately have a zero sequence number

We don't support 64-bit sequence numbers yet, but when we do, obviously any
early-replay checks would have to be more careful about a 0 on the wire.

Thanks for the helpful reminders,
Dan