I see it reusing SAs, so I'm good. Joshua Coombs
On Wed, Oct 17, 2018 at 9:45 AM Josh Coombs <jcoo...@staff.gwi.net> wrote: > > I've got wpa_supplicant working with macsec on Fedora, my test bed has > shuffled 16 billion packets so far without interruption. I am a bit > concerned that I've just pushed the resource exhaustion issue down the > road though, looking at the output of ip macsec show I see four SAs > for TX and RX, it appears to negotiate a new pair every 3 to 3.5 > billion packets. It doesn't appear to be ripping down old SAs. What > happens when available SA slots run out? > > Joshua Coombs > GWI > > office 207-494-2140 > www.gwi.net > > On Mon, Oct 15, 2018 at 11:45 AM Josh Coombs <jcoo...@staff.gwi.net> wrote: > > > > And confirmed, starting with a high packet number results in a very > > short testbed run, 296 packets and then nothing, just as you surmised. > > Sorry for raising the alarm falsely. Looks like I need to roll my own > > build of wpa_supplicant as the ubuntu builds don't include the macsec > > driver, haven't tested Gentoo's ebuilds yet to see if they do. > > > > Josh Coombs > > > > On Sun, Oct 14, 2018 at 4:52 PM Josh Coombs <jcoo...@staff.gwi.net> wrote: > > > > > > On Sun, Oct 14, 2018 at 4:24 PM Sabrina Dubroca <s...@queasysnail.net> > > > wrote: > > > > > > > > 2018-10-14, 10:59:31 -0400, Josh Coombs wrote: > > > > > I initially mistook this for a traffic control issue, but after > > > > > stripping the test beds down to just the MACSec component, I can still > > > > > replicate the issue. After approximately 5TB of transfer / 4 billion > > > > > packets over a MACSec link it stops passing traffic. > > > > > > > > I think you're just hitting packet number exhaustion. After 2^32 > > > > packets, the packet number would wrap to 0 and start being reused, > > > > which breaks the crypto used by macsec. Before this point, you have to > > > > add a new SA, and tell the macsec device to switch to it. > > > > > > I had not considered that, I naively thought as long as I didn't > > > specify a replay window, it'd roll the PN over on it's own and life > > > would be good. I'll test that theory tomorrow, should be easy to > > > prove out. > > > > > > > That's why you should be using wpa_supplicant. It will monitor the > > > > growth of the packet number, and handle the rekey for you. > > > > > > Thank you for the heads up, I'll read up on this as well. > > > > > > Josh C
