Enable ESN in fastdp-crypto

.gitmodules

@@ -3,7 +3,7 @@
 	url = https://github.com/weaveworks/build-tools
 [submodule "vendor/github.com/vishvananda/netlink"]
 	path = vendor/github.com/vishvananda/netlink
-	url = https://github.com/brb/netlink.git
+	url = https://github.com/weaveworks/netlink.git
 [submodule "vendor/github.com/gorilla/mux"]
 	path = vendor/github.com/gorilla/mux
 	url = https://github.com/gorilla/mux.git

docs/fastdp-crypto.md

@@ -126,7 +126,10 @@ iptables -t filter -A OUTPUT ! -p esp -m policy --dir out --pol none \
          -m mark --mark ${MARK} -j DROP
 ```
 
-# Misc
+## ESN
+
+To prevent from cycling SeqNo which makes replay attacks possible, we use
+64-bit extended sequence numbers known as [ESN](esn).
 
 ## MTU
 

net/ipsec/ipsec.go

@@ -195,7 +195,6 @@ func (ipsec *IPSec) Destroy(localPeer, remotePeer mesh.PeerName, connUID uint64,
 	defer ipsec.Unlock()
 
 	// Destroy inbound
-	ipsec.log.Infof(">>>>>>>>>>>>>>>>>> DESTROY <<<<<<<<<<<<<<<<<<<<<<")
 
 	if inSPIInfo, ok := ipsec.spiInfo[inSPIID]; ok {
 		ipsec.log.Infof("ipsec: destroy: in %s -> %s 0x%x", remoteIP, localIP, inSPIInfo.spi)
@@ -444,7 +443,8 @@ func xfrmAllocSpiState(srcIP, dstIP net.IP) *netlink.XfrmState {
 		Dst:          dstIP,
 		Proto:        netlink.XFRM_PROTO_ESP,
 		Mode:         netlink.XFRM_MODE_TRANSPORT,
-		ReplayWindow: 32,
+		ReplayWindow: 256,
+		ESN:          true,
 	}
 }