[linux.git] / net / xfrm / xfrm_replay.c

/*
 * xfrm_replay.c - xfrm replay detection, derived from xfrm_state.c.
 *
 * Copyright (C) 2010 secunet Security Networks AG
 * Copyright (C) 2010 Steffen Klassert <[email protected]>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
 * version 2, as published by the Free Software Foundation.
 *
 * This program is distributed in the hope it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 * more details.
 *
 * You should have received a copy of the GNU General Public License along with
 * this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
 */

#include <linux/export.h>
#include <net/xfrm.h>

u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq)
{
	u32 seq, seq_hi, bottom;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;

	if (!(x->props.flags & XFRM_STATE_ESN))
		return 0;

	seq = ntohl(net_seq);
	seq_hi = replay_esn->seq_hi;
	bottom = replay_esn->seq - replay_esn->replay_window + 1;

	if (likely(replay_esn->seq >= replay_esn->replay_window - 1)) {
		/* A. same subspace */
		if (unlikely(seq < bottom))
			seq_hi++;
	} else {
		/* B. window spans two subspaces */
		if (unlikely(seq >= bottom))
			seq_hi--;
	}

	return seq_hi;
}

static void xfrm_replay_notify(struct xfrm_state *x, int event)
{
	struct km_event c;
	/* we send notify messages in case
	 *  1. we updated on of the sequence numbers, and the seqno difference
	 *     is at least x->replay_maxdiff, in this case we also update the
	 *     timeout of our timer function
	 *  2. if x->replay_maxage has elapsed since last update,
	 *     and there were changes
	 *
	 *  The state structure must be locked!
	 */

	switch (event) {
	case XFRM_REPLAY_UPDATE:
		if (!x->replay_maxdiff ||
		    ((x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
		    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff))) {
			if (x->xflags & XFRM_TIME_DEFER)
				event = XFRM_REPLAY_TIMEOUT;
			else
				return;
		}

		break;

	case XFRM_REPLAY_TIMEOUT:
		if (memcmp(&x->replay, &x->preplay,
			   sizeof(struct xfrm_replay_state)) == 0) {
			x->xflags |= XFRM_TIME_DEFER;
			return;
		}

		break;
	}

	memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
	c.event = XFRM_MSG_NEWAE;
	c.data.aevent = event;
	km_state_notify(x, &c);

	if (x->replay_maxage &&
	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
		x->xflags &= ~XFRM_TIME_DEFER;
}

static int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
{
	int err = 0;
	struct net *net = xs_net(x);

	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
		XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
		if (unlikely(x->replay.oseq == 0)) {
			x->replay.oseq--;
			xfrm_audit_state_replay_overflow(x, skb);
			err = -EOVERFLOW;

			return err;
		}
		if (xfrm_aevent_is_on(net))
			x->repl->notify(x, XFRM_REPLAY_UPDATE);
	}

	return err;
}

static int xfrm_replay_check(struct xfrm_state *x,
		      struct sk_buff *skb, __be32 net_seq)
{
	u32 diff;
	u32 seq = ntohl(net_seq);

	if (!x->props.replay_window)
		return 0;

	if (unlikely(seq == 0))
		goto err;

	if (likely(seq > x->replay.seq))
		return 0;

	diff = x->replay.seq - seq;
	if (diff >= x->props.replay_window) {
		x->stats.replay_window++;
		goto err;
	}

	if (x->replay.bitmap & (1U << diff)) {
		x->stats.replay++;
		goto err;
	}
	return 0;

err:
	xfrm_audit_state_replay(x, skb, net_seq);
	return -EINVAL;
}

static void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
{
	u32 diff;
	u32 seq = ntohl(net_seq);

	if (!x->props.replay_window)
		return;

	if (seq > x->replay.seq) {
		diff = seq - x->replay.seq;
		if (diff < x->props.replay_window)
			x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
		else
			x->replay.bitmap = 1;
		x->replay.seq = seq;
	} else {
		diff = x->replay.seq - seq;
		x->replay.bitmap |= (1U << diff);
	}

	if (xfrm_aevent_is_on(xs_net(x)))
		x->repl->notify(x, XFRM_REPLAY_UPDATE);
}

static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
{
	int err = 0;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	struct net *net = xs_net(x);

	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
		XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
		if (unlikely(replay_esn->oseq == 0)) {
			replay_esn->oseq--;
			xfrm_audit_state_replay_overflow(x, skb);
			err = -EOVERFLOW;

			return err;
		}
		if (xfrm_aevent_is_on(net))
			x->repl->notify(x, XFRM_REPLAY_UPDATE);
	}

	return err;
}

static int xfrm_replay_check_bmp(struct xfrm_state *x,
				 struct sk_buff *skb, __be32 net_seq)
{
	unsigned int bitnr, nr;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	u32 pos;
	u32 seq = ntohl(net_seq);
	u32 diff =  replay_esn->seq - seq;

	if (!replay_esn->replay_window)
		return 0;

	if (unlikely(seq == 0))
		goto err;

	if (likely(seq > replay_esn->seq))
		return 0;

	if (diff >= replay_esn->replay_window) {
		x->stats.replay_window++;
		goto err;
	}

	pos = (replay_esn->seq - 1) % replay_esn->replay_window;

	if (pos >= diff)
		bitnr = (pos - diff) % replay_esn->replay_window;
	else
		bitnr = replay_esn->replay_window - (diff - pos);

	nr = bitnr >> 5;
	bitnr = bitnr & 0x1F;
	if (replay_esn->bmp[nr] & (1U << bitnr))
		goto err_replay;

	return 0;

err_replay:
	x->stats.replay++;
err:
	xfrm_audit_state_replay(x, skb, net_seq);
	return -EINVAL;
}

static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
{
	unsigned int bitnr, nr, i;
	u32 diff;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	u32 seq = ntohl(net_seq);
	u32 pos;

	if (!replay_esn->replay_window)
		return;

	pos = (replay_esn->seq - 1) % replay_esn->replay_window;

	if (seq > replay_esn->seq) {
		diff = seq - replay_esn->seq;

		if (diff < replay_esn->replay_window) {
			for (i = 1; i < diff; i++) {
				bitnr = (pos + i) % replay_esn->replay_window;
				nr = bitnr >> 5;
				bitnr = bitnr & 0x1F;
				replay_esn->bmp[nr] &=  ~(1U << bitnr);
			}
		} else {
			nr = (replay_esn->replay_window - 1) >> 5;
			for (i = 0; i <= nr; i++)
				replay_esn->bmp[i] = 0;
		}

		bitnr = (pos + diff) % replay_esn->replay_window;
		replay_esn->seq = seq;
	} else {
		diff = replay_esn->seq - seq;

		if (pos >= diff)
			bitnr = (pos - diff) % replay_esn->replay_window;
		else
			bitnr = replay_esn->replay_window - (diff - pos);
	}

	nr = bitnr >> 5;
	bitnr = bitnr & 0x1F;
	replay_esn->bmp[nr] |= (1U << bitnr);

	if (xfrm_aevent_is_on(xs_net(x)))
		x->repl->notify(x, XFRM_REPLAY_UPDATE);
}

static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
{
	struct km_event c;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;

	/* we send notify messages in case
	 *  1. we updated on of the sequence numbers, and the seqno difference
	 *     is at least x->replay_maxdiff, in this case we also update the
	 *     timeout of our timer function
	 *  2. if x->replay_maxage has elapsed since last update,
	 *     and there were changes
	 *
	 *  The state structure must be locked!
	 */

	switch (event) {
	case XFRM_REPLAY_UPDATE:
		if (!x->replay_maxdiff ||
		    ((replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
		    (replay_esn->oseq - preplay_esn->oseq
		     < x->replay_maxdiff))) {
			if (x->xflags & XFRM_TIME_DEFER)
				event = XFRM_REPLAY_TIMEOUT;
			else
				return;
		}

		break;

	case XFRM_REPLAY_TIMEOUT:
		if (memcmp(x->replay_esn, x->preplay_esn,
			   xfrm_replay_state_esn_len(replay_esn)) == 0) {
			x->xflags |= XFRM_TIME_DEFER;
			return;
		}

		break;
	}

	memcpy(x->preplay_esn, x->replay_esn,
	       xfrm_replay_state_esn_len(replay_esn));
	c.event = XFRM_MSG_NEWAE;
	c.data.aevent = event;
	km_state_notify(x, &c);

	if (x->replay_maxage &&
	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
		x->xflags &= ~XFRM_TIME_DEFER;
}

static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
{
	u32 seq_diff, oseq_diff;
	struct km_event c;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;

	/* we send notify messages in case
	 *  1. we updated on of the sequence numbers, and the seqno difference
	 *     is at least x->replay_maxdiff, in this case we also update the
	 *     timeout of our timer function
	 *  2. if x->replay_maxage has elapsed since last update,
	 *     and there were changes
	 *
	 *  The state structure must be locked!
	 */

	switch (event) {
	case XFRM_REPLAY_UPDATE:
		if (x->replay_maxdiff) {
			if (replay_esn->seq_hi == preplay_esn->seq_hi)
				seq_diff = replay_esn->seq - preplay_esn->seq;
			else
				seq_diff = ~preplay_esn->seq + replay_esn->seq
					   + 1;

			if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
				oseq_diff = replay_esn->oseq
					    - preplay_esn->oseq;
			else
				oseq_diff = ~preplay_esn->oseq
					    + replay_esn->oseq + 1;

			if (seq_diff >= x->replay_maxdiff ||
			    oseq_diff >= x->replay_maxdiff)
				break;
		}

		if (x->xflags & XFRM_TIME_DEFER)
			event = XFRM_REPLAY_TIMEOUT;
		else
			return;

		break;

	case XFRM_REPLAY_TIMEOUT:
		if (memcmp(x->replay_esn, x->preplay_esn,
			   xfrm_replay_state_esn_len(replay_esn)) == 0) {
			x->xflags |= XFRM_TIME_DEFER;
			return;
		}

		break;
	}

	memcpy(x->preplay_esn, x->replay_esn,
	       xfrm_replay_state_esn_len(replay_esn));
	c.event = XFRM_MSG_NEWAE;
	c.data.aevent = event;
	km_state_notify(x, &c);

	if (x->replay_maxage &&
	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
		x->xflags &= ~XFRM_TIME_DEFER;
}

static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb)
{
	int err = 0;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	struct net *net = xs_net(x);

	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
		XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
		XFRM_SKB_CB(skb)->seq.output.hi = replay_esn->oseq_hi;

		if (unlikely(replay_esn->oseq == 0)) {
			XFRM_SKB_CB(skb)->seq.output.hi = ++replay_esn->oseq_hi;

			if (replay_esn->oseq_hi == 0) {
				replay_esn->oseq--;
				replay_esn->oseq_hi--;
				xfrm_audit_state_replay_overflow(x, skb);
				err = -EOVERFLOW;

				return err;
			}
		}
		if (xfrm_aevent_is_on(net))
			x->repl->notify(x, XFRM_REPLAY_UPDATE);
	}

	return err;
}

static int xfrm_replay_check_esn(struct xfrm_state *x,
				 struct sk_buff *skb, __be32 net_seq)
{
	unsigned int bitnr, nr;
	u32 diff;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	u32 pos;
	u32 seq = ntohl(net_seq);
	u32 wsize = replay_esn->replay_window;
	u32 top = replay_esn->seq;
	u32 bottom = top - wsize + 1;

	if (!wsize)
		return 0;

	if (unlikely(seq == 0 && replay_esn->seq_hi == 0 &&
		     (replay_esn->seq < replay_esn->replay_window - 1)))
		goto err;

	diff = top - seq;

	if (likely(top >= wsize - 1)) {
		/* A. same subspace */
		if (likely(seq > top) || seq < bottom)
			return 0;
	} else {
		/* B. window spans two subspaces */
		if (likely(seq > top && seq < bottom))
			return 0;
		if (seq >= bottom)
			diff = ~seq + top + 1;
	}

	if (diff >= replay_esn->replay_window) {
		x->stats.replay_window++;
		goto err;
	}

	pos = (replay_esn->seq - 1) % replay_esn->replay_window;

	if (pos >= diff)
		bitnr = (pos - diff) % replay_esn->replay_window;
	else
		bitnr = replay_esn->replay_window - (diff - pos);

	nr = bitnr >> 5;
	bitnr = bitnr & 0x1F;
	if (replay_esn->bmp[nr] & (1U << bitnr))
		goto err_replay;

	return 0;

err_replay:
	x->stats.replay++;
err:
	xfrm_audit_state_replay(x, skb, net_seq);
	return -EINVAL;
}

static int xfrm_replay_recheck_esn(struct xfrm_state *x,
				   struct sk_buff *skb, __be32 net_seq)
{
	if (unlikely(XFRM_SKB_CB(skb)->seq.input.hi !=
		     htonl(xfrm_replay_seqhi(x, net_seq)))) {
			x->stats.replay_window++;
			return -EINVAL;
	}

	return xfrm_replay_check_esn(x, skb, net_seq);
}

static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
{
	unsigned int bitnr, nr, i;
	int wrap;
	u32 diff, pos, seq, seq_hi;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;

	if (!replay_esn->replay_window)
		return;

	seq = ntohl(net_seq);
	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
	seq_hi = xfrm_replay_seqhi(x, net_seq);
	wrap = seq_hi - replay_esn->seq_hi;

	if ((!wrap && seq > replay_esn->seq) || wrap > 0) {
		if (likely(!wrap))
			diff = seq - replay_esn->seq;
		else
			diff = ~replay_esn->seq + seq + 1;

		if (diff < replay_esn->replay_window) {
			for (i = 1; i < diff; i++) {
				bitnr = (pos + i) % replay_esn->replay_window;
				nr = bitnr >> 5;
				bitnr = bitnr & 0x1F;
				replay_esn->bmp[nr] &=  ~(1U << bitnr);
			}
		} else {
			nr = (replay_esn->replay_window - 1) >> 5;
			for (i = 0; i <= nr; i++)
				replay_esn->bmp[i] = 0;
		}

		bitnr = (pos + diff) % replay_esn->replay_window;
		replay_esn->seq = seq;

		if (unlikely(wrap > 0))
			replay_esn->seq_hi++;
	} else {
		diff = replay_esn->seq - seq;

		if (pos >= diff)
			bitnr = (pos - diff) % replay_esn->replay_window;
		else
			bitnr = replay_esn->replay_window - (diff - pos);
	}

	nr = bitnr >> 5;
	bitnr = bitnr & 0x1F;
	replay_esn->bmp[nr] |= (1U << bitnr);

	if (xfrm_aevent_is_on(xs_net(x)))
		x->repl->notify(x, XFRM_REPLAY_UPDATE);
}

static struct xfrm_replay xfrm_replay_legacy = {
	.advance	= xfrm_replay_advance,
	.check		= xfrm_replay_check,
	.recheck	= xfrm_replay_check,
	.notify		= xfrm_replay_notify,
	.overflow	= xfrm_replay_overflow,
};

static struct xfrm_replay xfrm_replay_bmp = {
	.advance	= xfrm_replay_advance_bmp,
	.check		= xfrm_replay_check_bmp,
	.recheck	= xfrm_replay_check_bmp,
	.notify		= xfrm_replay_notify_bmp,
	.overflow	= xfrm_replay_overflow_bmp,
};

static struct xfrm_replay xfrm_replay_esn = {
	.advance	= xfrm_replay_advance_esn,
	.check		= xfrm_replay_check_esn,
	.recheck	= xfrm_replay_recheck_esn,
	.notify		= xfrm_replay_notify_esn,
	.overflow	= xfrm_replay_overflow_esn,
};

int xfrm_init_replay(struct xfrm_state *x)
{
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;

	if (replay_esn) {
		if (replay_esn->replay_window >
		    replay_esn->bmp_len * sizeof(__u32) * 8)
			return -EINVAL;

		if (x->props.flags & XFRM_STATE_ESN) {
			if (replay_esn->replay_window == 0)
				return -EINVAL;
			x->repl = &xfrm_replay_esn;
		} else
			x->repl = &xfrm_replay_bmp;
	} else
		x->repl = &xfrm_replay_legacy;

	return 0;
}
EXPORT_SYMBOL(xfrm_init_replay);
Commit	Line	Data
9fdc4883 SK	1	/*
9fdc4883 SK	2	* xfrm_replay.c - xfrm replay detection, derived from xfrm_state.c.
97e15c3a SK	3	*
	4	* Copyright (C) 2010 secunet Security Networks AG
	5	* Copyright (C) 2010 Steffen Klassert <[email protected]>
	6	*
	7	* This program is free software; you can redistribute it and/or modify it
	8	* under the terms and conditions of the GNU General Public License,
	9	* version 2, as published by the Free Software Foundation.
	10	*
	11	* This program is distributed in the hope it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
	14	* more details.
	15	*
	16	* You should have received a copy of the GNU General Public License along with
	17	* this program; if not, write to the Free Software Foundation, Inc.,
	18	* 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
9fdc4883 SK	19	*/
9fdc4883 SK	20
bc3b2d7f	21	#include <linux/export.h>
9fdc4883 SK	22	#include <net/xfrm.h>
9fdc4883 SK	23
2cd08467 SK	24	u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq)
	25	{
	26	u32 seq, seq_hi, bottom;
	27	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	28
	29	if (!(x->props.flags & XFRM_STATE_ESN))
	30	return 0;
	31
	32	seq = ntohl(net_seq);
	33	seq_hi = replay_esn->seq_hi;
	34	bottom = replay_esn->seq - replay_esn->replay_window + 1;
	35
	36	if (likely(replay_esn->seq >= replay_esn->replay_window - 1)) {
	37	/* A. same subspace */
	38	if (unlikely(seq < bottom))
	39	seq_hi++;
	40	} else {
	41	/* B. window spans two subspaces */
	42	if (unlikely(seq >= bottom))
	43	seq_hi--;
	44	}
	45
	46	return seq_hi;
	47	}
	48
9fdc4883 SK	49	static void xfrm_replay_notify(struct xfrm_state *x, int event)
	50	{
	51	struct km_event c;
	52	/* we send notify messages in case
	53	* 1. we updated on of the sequence numbers, and the seqno difference
	54	* is at least x->replay_maxdiff, in this case we also update the
	55	* timeout of our timer function
	56	* 2. if x->replay_maxage has elapsed since last update,
	57	* and there were changes
	58	*
	59	* The state structure must be locked!
	60	*/
	61
	62	switch (event) {
	63	case XFRM_REPLAY_UPDATE:
cd808fc9 TE	64	if (!x->replay_maxdiff \|\|
	65	((x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
	66	(x->replay.oseq - x->preplay.oseq < x->replay_maxdiff))) {
9fdc4883 SK	67	if (x->xflags & XFRM_TIME_DEFER)
	68	event = XFRM_REPLAY_TIMEOUT;
	69	else
	70	return;
	71	}
	72
	73	break;
	74
	75	case XFRM_REPLAY_TIMEOUT:
	76	if (memcmp(&x->replay, &x->preplay,
	77	sizeof(struct xfrm_replay_state)) == 0) {
	78	x->xflags \|= XFRM_TIME_DEFER;
	79	return;
	80	}
	81
	82	break;
	83	}
	84
	85	memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
	86	c.event = XFRM_MSG_NEWAE;
	87	c.data.aevent = event;
	88	km_state_notify(x, &c);
	89
	90	if (x->replay_maxage &&
	91	!mod_timer(&x->rtimer, jiffies + x->replay_maxage))
	92	x->xflags &= ~XFRM_TIME_DEFER;
	93	}
	94
	95	static int xfrm_replay_overflow(struct xfrm_state x, struct sk_buff skb)
	96	{
	97	int err = 0;
	98	struct net *net = xs_net(x);
	99
	100	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
	101	XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
	102	if (unlikely(x->replay.oseq == 0)) {
	103	x->replay.oseq--;
	104	xfrm_audit_state_replay_overflow(x, skb);
	105	err = -EOVERFLOW;
	106
	107	return err;
	108	}
	109	if (xfrm_aevent_is_on(net))
	110	x->repl->notify(x, XFRM_REPLAY_UPDATE);
	111	}
	112
	113	return err;
	114	}
	115
	116	static int xfrm_replay_check(struct xfrm_state *x,
	117	struct sk_buff *skb, __be32 net_seq)
	118	{
	119	u32 diff;
	120	u32 seq = ntohl(net_seq);
	121
36ae0148 SK	122	if (!x->props.replay_window)
	123	return 0;
	124
9fdc4883 SK	125	if (unlikely(seq == 0))
	126	goto err;
	127
	128	if (likely(seq > x->replay.seq))
	129	return 0;
	130
	131	diff = x->replay.seq - seq;
33fce60d	132	if (diff >= x->props.replay_window) {
9fdc4883 SK	133	x->stats.replay_window++;
	134	goto err;
	135	}
	136
	137	if (x->replay.bitmap & (1U << diff)) {
	138	x->stats.replay++;
	139	goto err;
	140	}
	141	return 0;
	142
	143	err:
	144	xfrm_audit_state_replay(x, skb, net_seq);
	145	return -EINVAL;
	146	}
	147
	148	static void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
	149	{
	150	u32 diff;
	151	u32 seq = ntohl(net_seq);
	152
	153	if (!x->props.replay_window)
	154	return;
	155
	156	if (seq > x->replay.seq) {
	157	diff = seq - x->replay.seq;
	158	if (diff < x->props.replay_window)
	159	x->replay.bitmap = ((x->replay.bitmap) << diff) \| 1;
	160	else
	161	x->replay.bitmap = 1;
	162	x->replay.seq = seq;
	163	} else {
	164	diff = x->replay.seq - seq;
	165	x->replay.bitmap \|= (1U << diff);
	166	}
	167
	168	if (xfrm_aevent_is_on(xs_net(x)))
1265fd61	169	x->repl->notify(x, XFRM_REPLAY_UPDATE);
9fdc4883 SK	170	}
9fdc4883 SK	171
97e15c3a SK	172	static int xfrm_replay_overflow_bmp(struct xfrm_state x, struct sk_buff skb)
	173	{
	174	int err = 0;
	175	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	176	struct net *net = xs_net(x);
	177
	178	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
	179	XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
	180	if (unlikely(replay_esn->oseq == 0)) {
	181	replay_esn->oseq--;
	182	xfrm_audit_state_replay_overflow(x, skb);
	183	err = -EOVERFLOW;
	184
	185	return err;
	186	}
	187	if (xfrm_aevent_is_on(net))
	188	x->repl->notify(x, XFRM_REPLAY_UPDATE);
	189	}
	190
	191	return err;
	192	}
	193
	194	static int xfrm_replay_check_bmp(struct xfrm_state *x,
	195	struct sk_buff *skb, __be32 net_seq)
	196	{
	197	unsigned int bitnr, nr;
	198	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
36ae0148	199	u32 pos;
97e15c3a SK	200	u32 seq = ntohl(net_seq);
97e15c3a SK	201	u32 diff = replay_esn->seq - seq;
36ae0148 SK	202
	203	if (!replay_esn->replay_window)
	204	return 0;
	205
97e15c3a SK	206	if (unlikely(seq == 0))
	207	goto err;
	208
	209	if (likely(seq > replay_esn->seq))
	210	return 0;
	211
	212	if (diff >= replay_esn->replay_window) {
	213	x->stats.replay_window++;
	214	goto err;
	215	}
	216
1d974374 SK	217	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
	218
	219	if (pos >= diff)
97e15c3a	220	bitnr = (pos - diff) % replay_esn->replay_window;
1d974374	221	else
97e15c3a	222	bitnr = replay_esn->replay_window - (diff - pos);
1d974374 SK	223
	224	nr = bitnr >> 5;
	225	bitnr = bitnr & 0x1F;
	226	if (replay_esn->bmp[nr] & (1U << bitnr))
	227	goto err_replay;
	228
97e15c3a SK	229	return 0;
	230
	231	err_replay:
	232	x->stats.replay++;
	233	err:
	234	xfrm_audit_state_replay(x, skb, net_seq);
	235	return -EINVAL;
	236	}
	237
	238	static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
	239	{
	240	unsigned int bitnr, nr, i;
	241	u32 diff;
	242	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	243	u32 seq = ntohl(net_seq);
e2f67259	244	u32 pos;
97e15c3a SK	245
	246	if (!replay_esn->replay_window)
	247	return;
	248
e2f67259 NZ	249	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
e2f67259 NZ	250
97e15c3a SK	251	if (seq > replay_esn->seq) {
	252	diff = seq - replay_esn->seq;
	253
	254	if (diff < replay_esn->replay_window) {
	255	for (i = 1; i < diff; i++) {
	256	bitnr = (pos + i) % replay_esn->replay_window;
	257	nr = bitnr >> 5;
	258	bitnr = bitnr & 0x1F;
	259	replay_esn->bmp[nr] &= ~(1U << bitnr);
	260	}
97e15c3a	261	} else {
e756682c	262	nr = (replay_esn->replay_window - 1) >> 5;
97e15c3a SK	263	for (i = 0; i <= nr; i++)
97e15c3a SK	264	replay_esn->bmp[i] = 0;
97e15c3a SK	265	}
97e15c3a SK	266
1d974374	267	bitnr = (pos + diff) % replay_esn->replay_window;
97e15c3a SK	268	replay_esn->seq = seq;
	269	} else {
	270	diff = replay_esn->seq - seq;
	271
1d974374	272	if (pos >= diff)
97e15c3a	273	bitnr = (pos - diff) % replay_esn->replay_window;
1d974374	274	else
97e15c3a	275	bitnr = replay_esn->replay_window - (diff - pos);
97e15c3a SK	276	}
97e15c3a SK	277
1d974374 SK	278	nr = bitnr >> 5;
	279	bitnr = bitnr & 0x1F;
	280	replay_esn->bmp[nr] \|= (1U << bitnr);
	281
97e15c3a	282	if (xfrm_aevent_is_on(xs_net(x)))
1265fd61	283	x->repl->notify(x, XFRM_REPLAY_UPDATE);
97e15c3a SK	284	}
	285
	286	static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
	287	{
	288	struct km_event c;
	289	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	290	struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
	291
	292	/* we send notify messages in case
	293	* 1. we updated on of the sequence numbers, and the seqno difference
	294	* is at least x->replay_maxdiff, in this case we also update the
	295	* timeout of our timer function
	296	* 2. if x->replay_maxage has elapsed since last update,
	297	* and there were changes
	298	*
	299	* The state structure must be locked!
	300	*/
	301
	302	switch (event) {
	303	case XFRM_REPLAY_UPDATE:
cd808fc9 TE	304	if (!x->replay_maxdiff \|\|
	305	((replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
	306	(replay_esn->oseq - preplay_esn->oseq
	307	< x->replay_maxdiff))) {
97e15c3a SK	308	if (x->xflags & XFRM_TIME_DEFER)
	309	event = XFRM_REPLAY_TIMEOUT;
	310	else
	311	return;
	312	}
	313
	314	break;
	315
	316	case XFRM_REPLAY_TIMEOUT:
	317	if (memcmp(x->replay_esn, x->preplay_esn,
	318	xfrm_replay_state_esn_len(replay_esn)) == 0) {
	319	x->xflags \|= XFRM_TIME_DEFER;
	320	return;
	321	}
	322
	323	break;
	324	}
	325
	326	memcpy(x->preplay_esn, x->replay_esn,
	327	xfrm_replay_state_esn_len(replay_esn));
	328	c.event = XFRM_MSG_NEWAE;
	329	c.data.aevent = event;
	330	km_state_notify(x, &c);
	331
	332	if (x->replay_maxage &&
	333	!mod_timer(&x->rtimer, jiffies + x->replay_maxage))
	334	x->xflags &= ~XFRM_TIME_DEFER;
	335	}
	336
0017c0b5 SK	337	static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
	338	{
	339	u32 seq_diff, oseq_diff;
	340	struct km_event c;
	341	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	342	struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
	343
	344	/* we send notify messages in case
	345	* 1. we updated on of the sequence numbers, and the seqno difference
	346	* is at least x->replay_maxdiff, in this case we also update the
	347	* timeout of our timer function
	348	* 2. if x->replay_maxage has elapsed since last update,
	349	* and there were changes
	350	*
	351	* The state structure must be locked!
	352	*/
	353
	354	switch (event) {
	355	case XFRM_REPLAY_UPDATE:
cd808fc9 TE	356	if (x->replay_maxdiff) {
	357	if (replay_esn->seq_hi == preplay_esn->seq_hi)
	358	seq_diff = replay_esn->seq - preplay_esn->seq;
	359	else
	360	seq_diff = ~preplay_esn->seq + replay_esn->seq
	361	+ 1;
0017c0b5	362
cd808fc9 TE	363	if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
	364	oseq_diff = replay_esn->oseq
	365	- preplay_esn->oseq;
0017c0b5	366	else
cd808fc9 TE	367	oseq_diff = ~preplay_esn->oseq
	368	+ replay_esn->oseq + 1;
	369
	370	if (seq_diff >= x->replay_maxdiff \|\|
	371	oseq_diff >= x->replay_maxdiff)
	372	break;
0017c0b5 SK	373	}
0017c0b5 SK	374
cd808fc9 TE	375	if (x->xflags & XFRM_TIME_DEFER)
	376	event = XFRM_REPLAY_TIMEOUT;
	377	else
	378	return;
	379
0017c0b5 SK	380	break;
	381
	382	case XFRM_REPLAY_TIMEOUT:
	383	if (memcmp(x->replay_esn, x->preplay_esn,
	384	xfrm_replay_state_esn_len(replay_esn)) == 0) {
	385	x->xflags \|= XFRM_TIME_DEFER;
	386	return;
	387	}
	388
	389	break;
	390	}
	391
	392	memcpy(x->preplay_esn, x->replay_esn,
	393	xfrm_replay_state_esn_len(replay_esn));
	394	c.event = XFRM_MSG_NEWAE;
	395	c.data.aevent = event;
	396	km_state_notify(x, &c);
	397
	398	if (x->replay_maxage &&
	399	!mod_timer(&x->rtimer, jiffies + x->replay_maxage))
	400	x->xflags &= ~XFRM_TIME_DEFER;
	401	}
	402
2cd08467 SK	403	static int xfrm_replay_overflow_esn(struct xfrm_state x, struct sk_buff skb)
	404	{
	405	int err = 0;
	406	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	407	struct net *net = xs_net(x);
	408
	409	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
	410	XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
	411	XFRM_SKB_CB(skb)->seq.output.hi = replay_esn->oseq_hi;
	412
	413	if (unlikely(replay_esn->oseq == 0)) {
	414	XFRM_SKB_CB(skb)->seq.output.hi = ++replay_esn->oseq_hi;
	415
	416	if (replay_esn->oseq_hi == 0) {
	417	replay_esn->oseq--;
	418	replay_esn->oseq_hi--;
	419	xfrm_audit_state_replay_overflow(x, skb);
	420	err = -EOVERFLOW;
	421
	422	return err;
	423	}
	424	}
	425	if (xfrm_aevent_is_on(net))
	426	x->repl->notify(x, XFRM_REPLAY_UPDATE);
	427	}
	428
	429	return err;
	430	}
	431
	432	static int xfrm_replay_check_esn(struct xfrm_state *x,
	433	struct sk_buff *skb, __be32 net_seq)
	434	{
	435	unsigned int bitnr, nr;
	436	u32 diff;
	437	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
36ae0148	438	u32 pos;
2cd08467	439	u32 seq = ntohl(net_seq);
2cd08467 SK	440	u32 wsize = replay_esn->replay_window;
	441	u32 top = replay_esn->seq;
	442	u32 bottom = top - wsize + 1;
	443
36ae0148 SK	444	if (!wsize)
	445	return 0;
	446
2cd08467 SK	447	if (unlikely(seq == 0 && replay_esn->seq_hi == 0 &&
	448	(replay_esn->seq < replay_esn->replay_window - 1)))
	449	goto err;
	450
	451	diff = top - seq;
	452
	453	if (likely(top >= wsize - 1)) {
	454	/* A. same subspace */
	455	if (likely(seq > top) \|\| seq < bottom)
	456	return 0;
	457	} else {
	458	/* B. window spans two subspaces */
	459	if (likely(seq > top && seq < bottom))
	460	return 0;
	461	if (seq >= bottom)
	462	diff = ~seq + top + 1;
	463	}
	464
	465	if (diff >= replay_esn->replay_window) {
	466	x->stats.replay_window++;
	467	goto err;
	468	}
	469
1d974374 SK	470	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
	471
	472	if (pos >= diff)
2cd08467	473	bitnr = (pos - diff) % replay_esn->replay_window;
1d974374	474	else
2cd08467	475	bitnr = replay_esn->replay_window - (diff - pos);
1d974374 SK	476
	477	nr = bitnr >> 5;
	478	bitnr = bitnr & 0x1F;
	479	if (replay_esn->bmp[nr] & (1U << bitnr))
	480	goto err_replay;
	481
2cd08467 SK	482	return 0;
	483
	484	err_replay:
	485	x->stats.replay++;
	486	err:
	487	xfrm_audit_state_replay(x, skb, net_seq);
	488	return -EINVAL;
	489	}
	490
3b59df46 SK	491	static int xfrm_replay_recheck_esn(struct xfrm_state *x,
	492	struct sk_buff *skb, __be32 net_seq)
	493	{
	494	if (unlikely(XFRM_SKB_CB(skb)->seq.input.hi !=
	495	htonl(xfrm_replay_seqhi(x, net_seq)))) {
	496	x->stats.replay_window++;
	497	return -EINVAL;
	498	}
	499
	500	return xfrm_replay_check_esn(x, skb, net_seq);
	501	}
	502
2cd08467 SK	503	static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
	504	{
	505	unsigned int bitnr, nr, i;
	506	int wrap;
	507	u32 diff, pos, seq, seq_hi;
	508	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	509
	510	if (!replay_esn->replay_window)
	511	return;
	512
	513	seq = ntohl(net_seq);
	514	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
	515	seq_hi = xfrm_replay_seqhi(x, net_seq);
	516	wrap = seq_hi - replay_esn->seq_hi;
	517
	518	if ((!wrap && seq > replay_esn->seq) \|\| wrap > 0) {
	519	if (likely(!wrap))
	520	diff = seq - replay_esn->seq;
	521	else
	522	diff = ~replay_esn->seq + seq + 1;
	523
	524	if (diff < replay_esn->replay_window) {
	525	for (i = 1; i < diff; i++) {
	526	bitnr = (pos + i) % replay_esn->replay_window;
	527	nr = bitnr >> 5;
	528	bitnr = bitnr & 0x1F;
	529	replay_esn->bmp[nr] &= ~(1U << bitnr);
	530	}
2cd08467	531	} else {
e756682c	532	nr = (replay_esn->replay_window - 1) >> 5;
2cd08467 SK	533	for (i = 0; i <= nr; i++)
2cd08467 SK	534	replay_esn->bmp[i] = 0;
2cd08467 SK	535	}
2cd08467 SK	536
1d974374	537	bitnr = (pos + diff) % replay_esn->replay_window;
2cd08467 SK	538	replay_esn->seq = seq;
	539
	540	if (unlikely(wrap > 0))
	541	replay_esn->seq_hi++;
	542	} else {
	543	diff = replay_esn->seq - seq;
	544
1d974374	545	if (pos >= diff)
2cd08467	546	bitnr = (pos - diff) % replay_esn->replay_window;
1d974374	547	else
2cd08467	548	bitnr = replay_esn->replay_window - (diff - pos);
2cd08467 SK	549	}
2cd08467 SK	550
1d974374 SK	551	nr = bitnr >> 5;
	552	bitnr = bitnr & 0x1F;
	553	replay_esn->bmp[nr] \|= (1U << bitnr);
	554
2cd08467	555	if (xfrm_aevent_is_on(xs_net(x)))
1265fd61	556	x->repl->notify(x, XFRM_REPLAY_UPDATE);
2cd08467 SK	557	}
2cd08467 SK	558
9fdc4883 SK	559	static struct xfrm_replay xfrm_replay_legacy = {
	560	.advance = xfrm_replay_advance,
	561	.check = xfrm_replay_check,
3b59df46	562	.recheck = xfrm_replay_check,
9fdc4883 SK	563	.notify = xfrm_replay_notify,
	564	.overflow = xfrm_replay_overflow,
	565	};
	566
97e15c3a SK	567	static struct xfrm_replay xfrm_replay_bmp = {
	568	.advance = xfrm_replay_advance_bmp,
	569	.check = xfrm_replay_check_bmp,
3b59df46	570	.recheck = xfrm_replay_check_bmp,
97e15c3a SK	571	.notify = xfrm_replay_notify_bmp,
	572	.overflow = xfrm_replay_overflow_bmp,
	573	};
	574
2cd08467 SK	575	static struct xfrm_replay xfrm_replay_esn = {
	576	.advance = xfrm_replay_advance_esn,
	577	.check = xfrm_replay_check_esn,
3b59df46	578	.recheck = xfrm_replay_recheck_esn,
0017c0b5	579	.notify = xfrm_replay_notify_esn,
2cd08467 SK	580	.overflow = xfrm_replay_overflow_esn,
	581	};
	582
9fdc4883 SK	583	int xfrm_init_replay(struct xfrm_state *x)
9fdc4883 SK	584	{
97e15c3a SK	585	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	586
	587	if (replay_esn) {
	588	if (replay_esn->replay_window >
3f602b08	589	replay_esn->bmp_len * sizeof(__u32) * 8)
97e15c3a SK	590	return -EINVAL;
97e15c3a SK	591
aafd0d88 UW	592	if (x->props.flags & XFRM_STATE_ESN) {
	593	if (replay_esn->replay_window == 0)
	594	return -EINVAL;
	595	x->repl = &xfrm_replay_esn;
	596	} else
	597	x->repl = &xfrm_replay_bmp;
97e15c3a SK	598	} else
	599	x->repl = &xfrm_replay_legacy;
	600
9fdc4883 SK	601	return 0;
	602	}
	603	EXPORT_SYMBOL(xfrm_init_replay);