xfrm_replay.c 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * xfrm_replay.c - xfrm replay detection, derived from xfrm_state.c.
  4. *
  5. * Copyright (C) 2010 secunet Security Networks AG
  6. * Copyright (C) 2010 Steffen Klassert <steffen.klassert@secunet.com>
  7. */
  8. #include <linux/export.h>
  9. #include <net/xfrm.h>
  10. u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq)
  11. {
  12. u32 seq, seq_hi, bottom;
  13. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  14. if (!(x->props.flags & XFRM_STATE_ESN))
  15. return 0;
  16. seq = ntohl(net_seq);
  17. seq_hi = replay_esn->seq_hi;
  18. bottom = replay_esn->seq - replay_esn->replay_window + 1;
  19. if (likely(replay_esn->seq >= replay_esn->replay_window - 1)) {
  20. /* A. same subspace */
  21. if (unlikely(seq < bottom))
  22. seq_hi++;
  23. } else {
  24. /* B. window spans two subspaces */
  25. if (unlikely(seq >= bottom))
  26. seq_hi--;
  27. }
  28. return seq_hi;
  29. }
  30. EXPORT_SYMBOL(xfrm_replay_seqhi);
  31. ;
  32. static void xfrm_replay_notify(struct xfrm_state *x, int event)
  33. {
  34. struct km_event c;
  35. /* we send notify messages in case
  36. * 1. we updated on of the sequence numbers, and the seqno difference
  37. * is at least x->replay_maxdiff, in this case we also update the
  38. * timeout of our timer function
  39. * 2. if x->replay_maxage has elapsed since last update,
  40. * and there were changes
  41. *
  42. * The state structure must be locked!
  43. */
  44. switch (event) {
  45. case XFRM_REPLAY_UPDATE:
  46. if (!x->replay_maxdiff ||
  47. ((x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
  48. (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff))) {
  49. if (x->xflags & XFRM_TIME_DEFER)
  50. event = XFRM_REPLAY_TIMEOUT;
  51. else
  52. return;
  53. }
  54. break;
  55. case XFRM_REPLAY_TIMEOUT:
  56. if (memcmp(&x->replay, &x->preplay,
  57. sizeof(struct xfrm_replay_state)) == 0) {
  58. x->xflags |= XFRM_TIME_DEFER;
  59. return;
  60. }
  61. break;
  62. }
  63. memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
  64. c.event = XFRM_MSG_NEWAE;
  65. c.data.aevent = event;
  66. km_state_notify(x, &c);
  67. if (x->replay_maxage &&
  68. !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
  69. x->xflags &= ~XFRM_TIME_DEFER;
  70. }
  71. static int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
  72. {
  73. int err = 0;
  74. struct net *net = xs_net(x);
  75. if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
  76. XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
  77. XFRM_SKB_CB(skb)->seq.output.hi = 0;
  78. if (unlikely(x->replay.oseq == 0) &&
  79. !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
  80. x->replay.oseq--;
  81. xfrm_audit_state_replay_overflow(x, skb);
  82. err = -EOVERFLOW;
  83. return err;
  84. }
  85. if (xfrm_aevent_is_on(net))
  86. x->repl->notify(x, XFRM_REPLAY_UPDATE);
  87. }
  88. return err;
  89. }
  90. static int xfrm_replay_check(struct xfrm_state *x,
  91. struct sk_buff *skb, __be32 net_seq)
  92. {
  93. u32 diff;
  94. u32 seq = ntohl(net_seq);
  95. if (!x->props.replay_window)
  96. return 0;
  97. if (unlikely(seq == 0))
  98. goto err;
  99. if (likely(seq > x->replay.seq))
  100. return 0;
  101. diff = x->replay.seq - seq;
  102. if (diff >= x->props.replay_window) {
  103. x->stats.replay_window++;
  104. goto err;
  105. }
  106. if (x->replay.bitmap & (1U << diff)) {
  107. x->stats.replay++;
  108. goto err;
  109. }
  110. return 0;
  111. err:
  112. xfrm_audit_state_replay(x, skb, net_seq);
  113. return -EINVAL;
  114. }
  115. static void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
  116. {
  117. u32 diff;
  118. u32 seq = ntohl(net_seq);
  119. if (!x->props.replay_window)
  120. return;
  121. if (seq > x->replay.seq) {
  122. diff = seq - x->replay.seq;
  123. if (diff < x->props.replay_window)
  124. x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
  125. else
  126. x->replay.bitmap = 1;
  127. x->replay.seq = seq;
  128. } else {
  129. diff = x->replay.seq - seq;
  130. x->replay.bitmap |= (1U << diff);
  131. }
  132. if (xfrm_aevent_is_on(xs_net(x)))
  133. x->repl->notify(x, XFRM_REPLAY_UPDATE);
  134. }
  135. static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
  136. {
  137. int err = 0;
  138. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  139. struct net *net = xs_net(x);
  140. if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
  141. XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
  142. XFRM_SKB_CB(skb)->seq.output.hi = 0;
  143. if (unlikely(replay_esn->oseq == 0) &&
  144. !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
  145. replay_esn->oseq--;
  146. xfrm_audit_state_replay_overflow(x, skb);
  147. err = -EOVERFLOW;
  148. return err;
  149. }
  150. if (xfrm_aevent_is_on(net))
  151. x->repl->notify(x, XFRM_REPLAY_UPDATE);
  152. }
  153. return err;
  154. }
  155. static int xfrm_replay_check_bmp(struct xfrm_state *x,
  156. struct sk_buff *skb, __be32 net_seq)
  157. {
  158. unsigned int bitnr, nr;
  159. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  160. u32 pos;
  161. u32 seq = ntohl(net_seq);
  162. u32 diff = replay_esn->seq - seq;
  163. if (!replay_esn->replay_window)
  164. return 0;
  165. if (unlikely(seq == 0))
  166. goto err;
  167. if (likely(seq > replay_esn->seq))
  168. return 0;
  169. if (diff >= replay_esn->replay_window) {
  170. x->stats.replay_window++;
  171. goto err;
  172. }
  173. pos = (replay_esn->seq - 1) % replay_esn->replay_window;
  174. if (pos >= diff)
  175. bitnr = (pos - diff) % replay_esn->replay_window;
  176. else
  177. bitnr = replay_esn->replay_window - (diff - pos);
  178. nr = bitnr >> 5;
  179. bitnr = bitnr & 0x1F;
  180. if (replay_esn->bmp[nr] & (1U << bitnr))
  181. goto err_replay;
  182. return 0;
  183. err_replay:
  184. x->stats.replay++;
  185. err:
  186. xfrm_audit_state_replay(x, skb, net_seq);
  187. return -EINVAL;
  188. }
  189. static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
  190. {
  191. unsigned int bitnr, nr, i;
  192. u32 diff;
  193. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  194. u32 seq = ntohl(net_seq);
  195. u32 pos;
  196. if (!replay_esn->replay_window)
  197. return;
  198. pos = (replay_esn->seq - 1) % replay_esn->replay_window;
  199. if (seq > replay_esn->seq) {
  200. diff = seq - replay_esn->seq;
  201. if (diff < replay_esn->replay_window) {
  202. for (i = 1; i < diff; i++) {
  203. bitnr = (pos + i) % replay_esn->replay_window;
  204. nr = bitnr >> 5;
  205. bitnr = bitnr & 0x1F;
  206. replay_esn->bmp[nr] &= ~(1U << bitnr);
  207. }
  208. } else {
  209. nr = (replay_esn->replay_window - 1) >> 5;
  210. for (i = 0; i <= nr; i++)
  211. replay_esn->bmp[i] = 0;
  212. }
  213. bitnr = (pos + diff) % replay_esn->replay_window;
  214. replay_esn->seq = seq;
  215. } else {
  216. diff = replay_esn->seq - seq;
  217. if (pos >= diff)
  218. bitnr = (pos - diff) % replay_esn->replay_window;
  219. else
  220. bitnr = replay_esn->replay_window - (diff - pos);
  221. }
  222. nr = bitnr >> 5;
  223. bitnr = bitnr & 0x1F;
  224. replay_esn->bmp[nr] |= (1U << bitnr);
  225. if (xfrm_aevent_is_on(xs_net(x)))
  226. x->repl->notify(x, XFRM_REPLAY_UPDATE);
  227. }
  228. static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
  229. {
  230. struct km_event c;
  231. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  232. struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
  233. /* we send notify messages in case
  234. * 1. we updated on of the sequence numbers, and the seqno difference
  235. * is at least x->replay_maxdiff, in this case we also update the
  236. * timeout of our timer function
  237. * 2. if x->replay_maxage has elapsed since last update,
  238. * and there were changes
  239. *
  240. * The state structure must be locked!
  241. */
  242. switch (event) {
  243. case XFRM_REPLAY_UPDATE:
  244. if (!x->replay_maxdiff ||
  245. ((replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
  246. (replay_esn->oseq - preplay_esn->oseq
  247. < x->replay_maxdiff))) {
  248. if (x->xflags & XFRM_TIME_DEFER)
  249. event = XFRM_REPLAY_TIMEOUT;
  250. else
  251. return;
  252. }
  253. break;
  254. case XFRM_REPLAY_TIMEOUT:
  255. if (memcmp(x->replay_esn, x->preplay_esn,
  256. xfrm_replay_state_esn_len(replay_esn)) == 0) {
  257. x->xflags |= XFRM_TIME_DEFER;
  258. return;
  259. }
  260. break;
  261. }
  262. memcpy(x->preplay_esn, x->replay_esn,
  263. xfrm_replay_state_esn_len(replay_esn));
  264. c.event = XFRM_MSG_NEWAE;
  265. c.data.aevent = event;
  266. km_state_notify(x, &c);
  267. if (x->replay_maxage &&
  268. !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
  269. x->xflags &= ~XFRM_TIME_DEFER;
  270. }
  271. static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
  272. {
  273. u32 seq_diff, oseq_diff;
  274. struct km_event c;
  275. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  276. struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
  277. /* we send notify messages in case
  278. * 1. we updated on of the sequence numbers, and the seqno difference
  279. * is at least x->replay_maxdiff, in this case we also update the
  280. * timeout of our timer function
  281. * 2. if x->replay_maxage has elapsed since last update,
  282. * and there were changes
  283. *
  284. * The state structure must be locked!
  285. */
  286. switch (event) {
  287. case XFRM_REPLAY_UPDATE:
  288. if (x->replay_maxdiff) {
  289. if (replay_esn->seq_hi == preplay_esn->seq_hi)
  290. seq_diff = replay_esn->seq - preplay_esn->seq;
  291. else
  292. seq_diff = ~preplay_esn->seq + replay_esn->seq
  293. + 1;
  294. if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
  295. oseq_diff = replay_esn->oseq
  296. - preplay_esn->oseq;
  297. else
  298. oseq_diff = ~preplay_esn->oseq
  299. + replay_esn->oseq + 1;
  300. if (seq_diff >= x->replay_maxdiff ||
  301. oseq_diff >= x->replay_maxdiff)
  302. break;
  303. }
  304. if (x->xflags & XFRM_TIME_DEFER)
  305. event = XFRM_REPLAY_TIMEOUT;
  306. else
  307. return;
  308. break;
  309. case XFRM_REPLAY_TIMEOUT:
  310. if (memcmp(x->replay_esn, x->preplay_esn,
  311. xfrm_replay_state_esn_len(replay_esn)) == 0) {
  312. x->xflags |= XFRM_TIME_DEFER;
  313. return;
  314. }
  315. break;
  316. }
  317. memcpy(x->preplay_esn, x->replay_esn,
  318. xfrm_replay_state_esn_len(replay_esn));
  319. c.event = XFRM_MSG_NEWAE;
  320. c.data.aevent = event;
  321. km_state_notify(x, &c);
  322. if (x->replay_maxage &&
  323. !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
  324. x->xflags &= ~XFRM_TIME_DEFER;
  325. }
  326. static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb)
  327. {
  328. int err = 0;
  329. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  330. struct net *net = xs_net(x);
  331. if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
  332. XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
  333. XFRM_SKB_CB(skb)->seq.output.hi = replay_esn->oseq_hi;
  334. if (unlikely(replay_esn->oseq == 0)) {
  335. XFRM_SKB_CB(skb)->seq.output.hi = ++replay_esn->oseq_hi;
  336. if (replay_esn->oseq_hi == 0) {
  337. replay_esn->oseq--;
  338. replay_esn->oseq_hi--;
  339. xfrm_audit_state_replay_overflow(x, skb);
  340. err = -EOVERFLOW;
  341. return err;
  342. }
  343. }
  344. if (xfrm_aevent_is_on(net))
  345. x->repl->notify(x, XFRM_REPLAY_UPDATE);
  346. }
  347. return err;
  348. }
  349. static int xfrm_replay_check_esn(struct xfrm_state *x,
  350. struct sk_buff *skb, __be32 net_seq)
  351. {
  352. unsigned int bitnr, nr;
  353. u32 diff;
  354. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  355. u32 pos;
  356. u32 seq = ntohl(net_seq);
  357. u32 wsize = replay_esn->replay_window;
  358. u32 top = replay_esn->seq;
  359. u32 bottom = top - wsize + 1;
  360. if (!wsize)
  361. return 0;
  362. if (unlikely(seq == 0 && replay_esn->seq_hi == 0 &&
  363. (replay_esn->seq < replay_esn->replay_window - 1)))
  364. goto err;
  365. diff = top - seq;
  366. if (likely(top >= wsize - 1)) {
  367. /* A. same subspace */
  368. if (likely(seq > top) || seq < bottom)
  369. return 0;
  370. } else {
  371. /* B. window spans two subspaces */
  372. if (likely(seq > top && seq < bottom))
  373. return 0;
  374. if (seq >= bottom)
  375. diff = ~seq + top + 1;
  376. }
  377. if (diff >= replay_esn->replay_window) {
  378. x->stats.replay_window++;
  379. goto err;
  380. }
  381. pos = (replay_esn->seq - 1) % replay_esn->replay_window;
  382. if (pos >= diff)
  383. bitnr = (pos - diff) % replay_esn->replay_window;
  384. else
  385. bitnr = replay_esn->replay_window - (diff - pos);
  386. nr = bitnr >> 5;
  387. bitnr = bitnr & 0x1F;
  388. if (replay_esn->bmp[nr] & (1U << bitnr))
  389. goto err_replay;
  390. return 0;
  391. err_replay:
  392. x->stats.replay++;
  393. err:
  394. xfrm_audit_state_replay(x, skb, net_seq);
  395. return -EINVAL;
  396. }
  397. static int xfrm_replay_recheck_esn(struct xfrm_state *x,
  398. struct sk_buff *skb, __be32 net_seq)
  399. {
  400. if (unlikely(XFRM_SKB_CB(skb)->seq.input.hi !=
  401. htonl(xfrm_replay_seqhi(x, net_seq)))) {
  402. x->stats.replay_window++;
  403. return -EINVAL;
  404. }
  405. return xfrm_replay_check_esn(x, skb, net_seq);
  406. }
  407. static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
  408. {
  409. unsigned int bitnr, nr, i;
  410. int wrap;
  411. u32 diff, pos, seq, seq_hi;
  412. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  413. if (!replay_esn->replay_window)
  414. return;
  415. seq = ntohl(net_seq);
  416. pos = (replay_esn->seq - 1) % replay_esn->replay_window;
  417. seq_hi = xfrm_replay_seqhi(x, net_seq);
  418. wrap = seq_hi - replay_esn->seq_hi;
  419. if ((!wrap && seq > replay_esn->seq) || wrap > 0) {
  420. if (likely(!wrap))
  421. diff = seq - replay_esn->seq;
  422. else
  423. diff = ~replay_esn->seq + seq + 1;
  424. if (diff < replay_esn->replay_window) {
  425. for (i = 1; i < diff; i++) {
  426. bitnr = (pos + i) % replay_esn->replay_window;
  427. nr = bitnr >> 5;
  428. bitnr = bitnr & 0x1F;
  429. replay_esn->bmp[nr] &= ~(1U << bitnr);
  430. }
  431. } else {
  432. nr = (replay_esn->replay_window - 1) >> 5;
  433. for (i = 0; i <= nr; i++)
  434. replay_esn->bmp[i] = 0;
  435. }
  436. bitnr = (pos + diff) % replay_esn->replay_window;
  437. replay_esn->seq = seq;
  438. if (unlikely(wrap > 0))
  439. replay_esn->seq_hi++;
  440. } else {
  441. diff = replay_esn->seq - seq;
  442. if (pos >= diff)
  443. bitnr = (pos - diff) % replay_esn->replay_window;
  444. else
  445. bitnr = replay_esn->replay_window - (diff - pos);
  446. }
  447. xfrm_dev_state_advance_esn(x);
  448. nr = bitnr >> 5;
  449. bitnr = bitnr & 0x1F;
  450. replay_esn->bmp[nr] |= (1U << bitnr);
  451. if (xfrm_aevent_is_on(xs_net(x)))
  452. x->repl->notify(x, XFRM_REPLAY_UPDATE);
  453. }
  454. #ifdef CONFIG_XFRM_OFFLOAD
  455. static int xfrm_replay_overflow_offload(struct xfrm_state *x, struct sk_buff *skb)
  456. {
  457. int err = 0;
  458. struct net *net = xs_net(x);
  459. struct xfrm_offload *xo = xfrm_offload(skb);
  460. __u32 oseq = x->replay.oseq;
  461. if (!xo)
  462. return xfrm_replay_overflow(x, skb);
  463. if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
  464. if (!skb_is_gso(skb)) {
  465. XFRM_SKB_CB(skb)->seq.output.low = ++oseq;
  466. xo->seq.low = oseq;
  467. } else {
  468. XFRM_SKB_CB(skb)->seq.output.low = oseq + 1;
  469. xo->seq.low = oseq + 1;
  470. oseq += skb_shinfo(skb)->gso_segs;
  471. }
  472. XFRM_SKB_CB(skb)->seq.output.hi = 0;
  473. xo->seq.hi = 0;
  474. if (unlikely(oseq < x->replay.oseq) &&
  475. !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
  476. xfrm_audit_state_replay_overflow(x, skb);
  477. err = -EOVERFLOW;
  478. return err;
  479. }
  480. x->replay.oseq = oseq;
  481. if (xfrm_aevent_is_on(net))
  482. x->repl->notify(x, XFRM_REPLAY_UPDATE);
  483. }
  484. return err;
  485. }
  486. static int xfrm_replay_overflow_offload_bmp(struct xfrm_state *x, struct sk_buff *skb)
  487. {
  488. int err = 0;
  489. struct xfrm_offload *xo = xfrm_offload(skb);
  490. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  491. struct net *net = xs_net(x);
  492. __u32 oseq = replay_esn->oseq;
  493. if (!xo)
  494. return xfrm_replay_overflow_bmp(x, skb);
  495. if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
  496. if (!skb_is_gso(skb)) {
  497. XFRM_SKB_CB(skb)->seq.output.low = ++oseq;
  498. xo->seq.low = oseq;
  499. } else {
  500. XFRM_SKB_CB(skb)->seq.output.low = oseq + 1;
  501. xo->seq.low = oseq + 1;
  502. oseq += skb_shinfo(skb)->gso_segs;
  503. }
  504. XFRM_SKB_CB(skb)->seq.output.hi = 0;
  505. xo->seq.hi = 0;
  506. if (unlikely(oseq < replay_esn->oseq) &&
  507. !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
  508. xfrm_audit_state_replay_overflow(x, skb);
  509. err = -EOVERFLOW;
  510. return err;
  511. } else {
  512. replay_esn->oseq = oseq;
  513. }
  514. if (xfrm_aevent_is_on(net))
  515. x->repl->notify(x, XFRM_REPLAY_UPDATE);
  516. }
  517. return err;
  518. }
  519. static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff *skb)
  520. {
  521. int err = 0;
  522. struct xfrm_offload *xo = xfrm_offload(skb);
  523. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  524. struct net *net = xs_net(x);
  525. __u32 oseq = replay_esn->oseq;
  526. __u32 oseq_hi = replay_esn->oseq_hi;
  527. if (!xo)
  528. return xfrm_replay_overflow_esn(x, skb);
  529. if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
  530. if (!skb_is_gso(skb)) {
  531. XFRM_SKB_CB(skb)->seq.output.low = ++oseq;
  532. XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi;
  533. xo->seq.low = oseq;
  534. xo->seq.hi = oseq_hi;
  535. } else {
  536. XFRM_SKB_CB(skb)->seq.output.low = oseq + 1;
  537. XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi;
  538. xo->seq.low = oseq + 1;
  539. xo->seq.hi = oseq_hi;
  540. oseq += skb_shinfo(skb)->gso_segs;
  541. }
  542. if (unlikely(oseq < replay_esn->oseq)) {
  543. XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi;
  544. xo->seq.hi = oseq_hi;
  545. replay_esn->oseq_hi = oseq_hi;
  546. if (replay_esn->oseq_hi == 0) {
  547. replay_esn->oseq--;
  548. replay_esn->oseq_hi--;
  549. xfrm_audit_state_replay_overflow(x, skb);
  550. err = -EOVERFLOW;
  551. return err;
  552. }
  553. }
  554. replay_esn->oseq = oseq;
  555. if (xfrm_aevent_is_on(net))
  556. x->repl->notify(x, XFRM_REPLAY_UPDATE);
  557. }
  558. return err;
  559. }
  560. static const struct xfrm_replay xfrm_replay_legacy = {
  561. .advance = xfrm_replay_advance,
  562. .check = xfrm_replay_check,
  563. .recheck = xfrm_replay_check,
  564. .notify = xfrm_replay_notify,
  565. .overflow = xfrm_replay_overflow_offload,
  566. };
  567. static const struct xfrm_replay xfrm_replay_bmp = {
  568. .advance = xfrm_replay_advance_bmp,
  569. .check = xfrm_replay_check_bmp,
  570. .recheck = xfrm_replay_check_bmp,
  571. .notify = xfrm_replay_notify_bmp,
  572. .overflow = xfrm_replay_overflow_offload_bmp,
  573. };
  574. static const struct xfrm_replay xfrm_replay_esn = {
  575. .advance = xfrm_replay_advance_esn,
  576. .check = xfrm_replay_check_esn,
  577. .recheck = xfrm_replay_recheck_esn,
  578. .notify = xfrm_replay_notify_esn,
  579. .overflow = xfrm_replay_overflow_offload_esn,
  580. };
  581. #else
  582. static const struct xfrm_replay xfrm_replay_legacy = {
  583. .advance = xfrm_replay_advance,
  584. .check = xfrm_replay_check,
  585. .recheck = xfrm_replay_check,
  586. .notify = xfrm_replay_notify,
  587. .overflow = xfrm_replay_overflow,
  588. };
  589. static const struct xfrm_replay xfrm_replay_bmp = {
  590. .advance = xfrm_replay_advance_bmp,
  591. .check = xfrm_replay_check_bmp,
  592. .recheck = xfrm_replay_check_bmp,
  593. .notify = xfrm_replay_notify_bmp,
  594. .overflow = xfrm_replay_overflow_bmp,
  595. };
  596. static const struct xfrm_replay xfrm_replay_esn = {
  597. .advance = xfrm_replay_advance_esn,
  598. .check = xfrm_replay_check_esn,
  599. .recheck = xfrm_replay_recheck_esn,
  600. .notify = xfrm_replay_notify_esn,
  601. .overflow = xfrm_replay_overflow_esn,
  602. };
  603. #endif
  604. int xfrm_init_replay(struct xfrm_state *x)
  605. {
  606. struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
  607. if (replay_esn) {
  608. if (replay_esn->replay_window >
  609. replay_esn->bmp_len * sizeof(__u32) * 8)
  610. return -EINVAL;
  611. if (x->props.flags & XFRM_STATE_ESN) {
  612. if (replay_esn->replay_window == 0)
  613. return -EINVAL;
  614. x->repl = &xfrm_replay_esn;
  615. } else {
  616. x->repl = &xfrm_replay_bmp;
  617. }
  618. } else {
  619. x->repl = &xfrm_replay_legacy;
  620. }
  621. return 0;
  622. }
  623. EXPORT_SYMBOL(xfrm_init_replay);