net/mlx5e: Ensure that IPsec sequence packet number starts from 1
authorLeon Romanovsky <leonro@nvidia.com>
Wed, 20 Sep 2023 07:07:13 +0000 (10:07 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Dec 2023 16:01:43 +0000 (17:01 +0100)
commit80299a1c685fff46755f336faed4b7a29cbd44fb
tree39749997dc640937c1b81be8a733e5c58ef9b234
parent17e600e438c6b597ac1cf8c592b2ab53c680f6e4
net/mlx5e: Ensure that IPsec sequence packet number starts from 1

[ Upstream commit 3d42c8cc67a8fcbff0181f9ed6d03d353edcee07 ]

According to RFC4303, section "3.3.3. Sequence Number Generation",
the first packet sent using a given SA will contain a sequence
number of 1.

However if user didn't set seq/oseq, the HW used zero as first sequence
packet number. Such misconfiguration causes to drop of first packet
if replay window protection was enabled in SA.

To fix it, set sequence number to be at least 1.

Fixes: 7db21ef4566e ("net/mlx5e: Set IPsec replay sequence numbers")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c