[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / xfrm / xfrm_replay.c

/*
 * xfrm_replay.c - xfrm replay detection, derived from xfrm_state.c.
 *
 * Copyright (C) 2010 secunet Security Networks AG
 * Copyright (C) 2010 Steffen Klassert <steffen.klassert@secunet.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
 * version 2, as published by the Free Software Foundation.
 *
 * This program is distributed in the hope it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 * more details.
 *
 * You should have received a copy of the GNU General Public License along with
 * this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
 */

#include <linux/export.h>
#include <net/xfrm.h>

u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq)
{
	u32 seq, seq_hi, bottom;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;

	if (!(x->props.flags & XFRM_STATE_ESN))
		return 0;

	seq = ntohl(net_seq);
	seq_hi = replay_esn->seq_hi;
	bottom = replay_esn->seq - replay_esn->replay_window + 1;

	if (likely(replay_esn->seq >= replay_esn->replay_window - 1)) {
		/* A. same subspace */
		if (unlikely(seq < bottom))
			seq_hi++;
	} else {
		/* B. window spans two subspaces */
		if (unlikely(seq >= bottom))
			seq_hi--;
	}

	return seq_hi;
}

static void xfrm_replay_notify(struct xfrm_state *x, int event)
{
	struct km_event c;
	/* we send notify messages in case
	 *  1. we updated on of the sequence numbers, and the seqno difference
	 *     is at least x->replay_maxdiff, in this case we also update the
	 *     timeout of our timer function
	 *  2. if x->replay_maxage has elapsed since last update,
	 *     and there were changes
	 *
	 *  The state structure must be locked!
	 */

	switch (event) {
	case XFRM_REPLAY_UPDATE:
		if (x->replay_maxdiff &&
		    (x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
		    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
			if (x->xflags & XFRM_TIME_DEFER)
				event = XFRM_REPLAY_TIMEOUT;
			else
				return;
		}

		break;

	case XFRM_REPLAY_TIMEOUT:
		if (memcmp(&x->replay, &x->preplay,
			   sizeof(struct xfrm_replay_state)) == 0) {
			x->xflags |= XFRM_TIME_DEFER;
			return;
		}

		break;
	}

	memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
	c.event = XFRM_MSG_NEWAE;
	c.data.aevent = event;
	km_state_notify(x, &c);

	if (x->replay_maxage &&
	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
		x->xflags &= ~XFRM_TIME_DEFER;
}

static int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
{
	int err = 0;
	struct net *net = xs_net(x);

	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
		XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
		if (unlikely(x->replay.oseq == 0)) {
			x->replay.oseq--;
			xfrm_audit_state_replay_overflow(x, skb);
			err = -EOVERFLOW;

			return err;
		}
		if (xfrm_aevent_is_on(net))
			x->repl->notify(x, XFRM_REPLAY_UPDATE);
	}

	return err;
}

static int xfrm_replay_check(struct xfrm_state *x,
		      struct sk_buff *skb, __be32 net_seq)
{
	u32 diff;
	u32 seq = ntohl(net_seq);

	if (!x->props.replay_window)
		return 0;

	if (unlikely(seq == 0))
		goto err;

	if (likely(seq > x->replay.seq))
		return 0;

	diff = x->replay.seq - seq;
	if (diff >= min_t(unsigned int, x->props.replay_window,
			  sizeof(x->replay.bitmap) * 8)) {
		x->stats.replay_window++;
		goto err;
	}

	if (x->replay.bitmap & (1U << diff)) {
		x->stats.replay++;
		goto err;
	}
	return 0;

err:
	xfrm_audit_state_replay(x, skb, net_seq);
	return -EINVAL;
}

static void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
{
	u32 diff;
	u32 seq = ntohl(net_seq);

	if (!x->props.replay_window)
		return;

	if (seq > x->replay.seq) {
		diff = seq - x->replay.seq;
		if (diff < x->props.replay_window)
			x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
		else
			x->replay.bitmap = 1;
		x->replay.seq = seq;
	} else {
		diff = x->replay.seq - seq;
		x->replay.bitmap |= (1U << diff);
	}

	if (xfrm_aevent_is_on(xs_net(x)))
		xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
}

static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
{
	int err = 0;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	struct net *net = xs_net(x);

	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
		XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
		if (unlikely(replay_esn->oseq == 0)) {
			replay_esn->oseq--;
			xfrm_audit_state_replay_overflow(x, skb);
			err = -EOVERFLOW;

			return err;
		}
		if (xfrm_aevent_is_on(net))
			x->repl->notify(x, XFRM_REPLAY_UPDATE);
	}

	return err;
}

static int xfrm_replay_check_bmp(struct xfrm_state *x,
				 struct sk_buff *skb, __be32 net_seq)
{
	unsigned int bitnr, nr;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	u32 pos;
	u32 seq = ntohl(net_seq);
	u32 diff =  replay_esn->seq - seq;

	if (!replay_esn->replay_window)
		return 0;

	if (unlikely(seq == 0))
		goto err;

	if (likely(seq > replay_esn->seq))
		return 0;

	if (diff >= replay_esn->replay_window) {
		x->stats.replay_window++;
		goto err;
	}

	pos = (replay_esn->seq - 1) % replay_esn->replay_window;

	if (pos >= diff)
		bitnr = (pos - diff) % replay_esn->replay_window;
	else
		bitnr = replay_esn->replay_window - (diff - pos);

	nr = bitnr >> 5;
	bitnr = bitnr & 0x1F;
	if (replay_esn->bmp[nr] & (1U << bitnr))
		goto err_replay;

	return 0;

err_replay:
	x->stats.replay++;
err:
	xfrm_audit_state_replay(x, skb, net_seq);
	return -EINVAL;
}

static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
{
	unsigned int bitnr, nr, i;
	u32 diff;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	u32 seq = ntohl(net_seq);
	u32 pos = (replay_esn->seq - 1) % replay_esn->replay_window;

	if (!replay_esn->replay_window)
		return;

	if (seq > replay_esn->seq) {
		diff = seq - replay_esn->seq;

		if (diff < replay_esn->replay_window) {
			for (i = 1; i < diff; i++) {
				bitnr = (pos + i) % replay_esn->replay_window;
				nr = bitnr >> 5;
				bitnr = bitnr & 0x1F;
				replay_esn->bmp[nr] &=  ~(1U << bitnr);
			}
		} else {
			nr = (replay_esn->replay_window - 1) >> 5;
			for (i = 0; i <= nr; i++)
				replay_esn->bmp[i] = 0;
		}

		bitnr = (pos + diff) % replay_esn->replay_window;
		replay_esn->seq = seq;
	} else {
		diff = replay_esn->seq - seq;

		if (pos >= diff)
			bitnr = (pos - diff) % replay_esn->replay_window;
		else
			bitnr = replay_esn->replay_window - (diff - pos);
	}

	nr = bitnr >> 5;
	bitnr = bitnr & 0x1F;
	replay_esn->bmp[nr] |= (1U << bitnr);

	if (xfrm_aevent_is_on(xs_net(x)))
		xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
}

static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
{
	struct km_event c;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;

	/* we send notify messages in case
	 *  1. we updated on of the sequence numbers, and the seqno difference
	 *     is at least x->replay_maxdiff, in this case we also update the
	 *     timeout of our timer function
	 *  2. if x->replay_maxage has elapsed since last update,
	 *     and there were changes
	 *
	 *  The state structure must be locked!
	 */

	switch (event) {
	case XFRM_REPLAY_UPDATE:
		if (x->replay_maxdiff &&
		    (replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
		    (replay_esn->oseq - preplay_esn->oseq < x->replay_maxdiff)) {
			if (x->xflags & XFRM_TIME_DEFER)
				event = XFRM_REPLAY_TIMEOUT;
			else
				return;
		}

		break;

	case XFRM_REPLAY_TIMEOUT:
		if (memcmp(x->replay_esn, x->preplay_esn,
			   xfrm_replay_state_esn_len(replay_esn)) == 0) {
			x->xflags |= XFRM_TIME_DEFER;
			return;
		}

		break;
	}

	memcpy(x->preplay_esn, x->replay_esn,
	       xfrm_replay_state_esn_len(replay_esn));
	c.event = XFRM_MSG_NEWAE;
	c.data.aevent = event;
	km_state_notify(x, &c);

	if (x->replay_maxage &&
	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
		x->xflags &= ~XFRM_TIME_DEFER;
}

static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb)
{
	int err = 0;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	struct net *net = xs_net(x);

	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
		XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
		XFRM_SKB_CB(skb)->seq.output.hi = replay_esn->oseq_hi;

		if (unlikely(replay_esn->oseq == 0)) {
			XFRM_SKB_CB(skb)->seq.output.hi = ++replay_esn->oseq_hi;

			if (replay_esn->oseq_hi == 0) {
				replay_esn->oseq--;
				replay_esn->oseq_hi--;
				xfrm_audit_state_replay_overflow(x, skb);
				err = -EOVERFLOW;

				return err;
			}
		}
		if (xfrm_aevent_is_on(net))
			x->repl->notify(x, XFRM_REPLAY_UPDATE);
	}

	return err;
}

static int xfrm_replay_check_esn(struct xfrm_state *x,
				 struct sk_buff *skb, __be32 net_seq)
{
	unsigned int bitnr, nr;
	u32 diff;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	u32 pos;
	u32 seq = ntohl(net_seq);
	u32 wsize = replay_esn->replay_window;
	u32 top = replay_esn->seq;
	u32 bottom = top - wsize + 1;

	if (!wsize)
		return 0;

	if (unlikely(seq == 0 && replay_esn->seq_hi == 0 &&
		     (replay_esn->seq < replay_esn->replay_window - 1)))
		goto err;

	diff = top - seq;

	if (likely(top >= wsize - 1)) {
		/* A. same subspace */
		if (likely(seq > top) || seq < bottom)
			return 0;
	} else {
		/* B. window spans two subspaces */
		if (likely(seq > top && seq < bottom))
			return 0;
		if (seq >= bottom)
			diff = ~seq + top + 1;
	}

	if (diff >= replay_esn->replay_window) {
		x->stats.replay_window++;
		goto err;
	}

	pos = (replay_esn->seq - 1) % replay_esn->replay_window;

	if (pos >= diff)
		bitnr = (pos - diff) % replay_esn->replay_window;
	else
		bitnr = replay_esn->replay_window - (diff - pos);

	nr = bitnr >> 5;
	bitnr = bitnr & 0x1F;
	if (replay_esn->bmp[nr] & (1U << bitnr))
		goto err_replay;

	return 0;

err_replay:
	x->stats.replay++;
err:
	xfrm_audit_state_replay(x, skb, net_seq);
	return -EINVAL;
}

static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
{
	unsigned int bitnr, nr, i;
	int wrap;
	u32 diff, pos, seq, seq_hi;
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;

	if (!replay_esn->replay_window)
		return;

	seq = ntohl(net_seq);
	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
	seq_hi = xfrm_replay_seqhi(x, net_seq);
	wrap = seq_hi - replay_esn->seq_hi;

	if ((!wrap && seq > replay_esn->seq) || wrap > 0) {
		if (likely(!wrap))
			diff = seq - replay_esn->seq;
		else
			diff = ~replay_esn->seq + seq + 1;

		if (diff < replay_esn->replay_window) {
			for (i = 1; i < diff; i++) {
				bitnr = (pos + i) % replay_esn->replay_window;
				nr = bitnr >> 5;
				bitnr = bitnr & 0x1F;
				replay_esn->bmp[nr] &=  ~(1U << bitnr);
			}
		} else {
			nr = (replay_esn->replay_window - 1) >> 5;
			for (i = 0; i <= nr; i++)
				replay_esn->bmp[i] = 0;
		}

		bitnr = (pos + diff) % replay_esn->replay_window;
		replay_esn->seq = seq;

		if (unlikely(wrap > 0))
			replay_esn->seq_hi++;
	} else {
		diff = replay_esn->seq - seq;

		if (pos >= diff)
			bitnr = (pos - diff) % replay_esn->replay_window;
		else
			bitnr = replay_esn->replay_window - (diff - pos);
	}

	nr = bitnr >> 5;
	bitnr = bitnr & 0x1F;
	replay_esn->bmp[nr] |= (1U << bitnr);

	if (xfrm_aevent_is_on(xs_net(x)))
		xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
}

static struct xfrm_replay xfrm_replay_legacy = {
	.advance	= xfrm_replay_advance,
	.check		= xfrm_replay_check,
	.notify		= xfrm_replay_notify,
	.overflow	= xfrm_replay_overflow,
};

static struct xfrm_replay xfrm_replay_bmp = {
	.advance	= xfrm_replay_advance_bmp,
	.check		= xfrm_replay_check_bmp,
	.notify		= xfrm_replay_notify_bmp,
	.overflow	= xfrm_replay_overflow_bmp,
};

static struct xfrm_replay xfrm_replay_esn = {
	.advance	= xfrm_replay_advance_esn,
	.check		= xfrm_replay_check_esn,
	.notify		= xfrm_replay_notify_bmp,
	.overflow	= xfrm_replay_overflow_esn,
};

int xfrm_init_replay(struct xfrm_state *x)
{
	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;

	if (replay_esn) {
		if (replay_esn->replay_window >
		    replay_esn->bmp_len * sizeof(__u32) * 8)
			return -EINVAL;

	if ((x->props.flags & XFRM_STATE_ESN) && replay_esn->replay_window == 0)
		return -EINVAL;

	if ((x->props.flags & XFRM_STATE_ESN) && x->replay_esn)
		x->repl = &xfrm_replay_esn;
	else
		x->repl = &xfrm_replay_bmp;
	} else
		x->repl = &xfrm_replay_legacy;

	return 0;
}
EXPORT_SYMBOL(xfrm_init_replay);
Commit	Line	Data
9fdc4883 SK	1	/*
9fdc4883 SK	2	* xfrm_replay.c - xfrm replay detection, derived from xfrm_state.c.
97e15c3a SK	3	*
	4	* Copyright (C) 2010 secunet Security Networks AG
	5	* Copyright (C) 2010 Steffen Klassert <steffen.klassert@secunet.com>
	6	*
	7	* This program is free software; you can redistribute it and/or modify it
	8	* under the terms and conditions of the GNU General Public License,
	9	* version 2, as published by the Free Software Foundation.
	10	*
	11	* This program is distributed in the hope it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
	14	* more details.
	15	*
	16	* You should have received a copy of the GNU General Public License along with
	17	* this program; if not, write to the Free Software Foundation, Inc.,
	18	* 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
9fdc4883 SK	19	*/
9fdc4883 SK	20
bc3b2d7f	21	#include <linux/export.h>
9fdc4883 SK	22	#include <net/xfrm.h>
9fdc4883 SK	23
2cd08467 SK	24	u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq)
	25	{
	26	u32 seq, seq_hi, bottom;
	27	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	28
	29	if (!(x->props.flags & XFRM_STATE_ESN))
	30	return 0;
	31
	32	seq = ntohl(net_seq);
	33	seq_hi = replay_esn->seq_hi;
	34	bottom = replay_esn->seq - replay_esn->replay_window + 1;
	35
	36	if (likely(replay_esn->seq >= replay_esn->replay_window - 1)) {
	37	/* A. same subspace */
	38	if (unlikely(seq < bottom))
	39	seq_hi++;
	40	} else {
	41	/* B. window spans two subspaces */
	42	if (unlikely(seq >= bottom))
	43	seq_hi--;
	44	}
	45
	46	return seq_hi;
	47	}
	48
9fdc4883 SK	49	static void xfrm_replay_notify(struct xfrm_state *x, int event)
	50	{
	51	struct km_event c;
	52	/* we send notify messages in case
	53	* 1. we updated on of the sequence numbers, and the seqno difference
	54	* is at least x->replay_maxdiff, in this case we also update the
	55	* timeout of our timer function
	56	* 2. if x->replay_maxage has elapsed since last update,
	57	* and there were changes
	58	*
	59	* The state structure must be locked!
	60	*/
	61
	62	switch (event) {
	63	case XFRM_REPLAY_UPDATE:
	64	if (x->replay_maxdiff &&
	65	(x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
	66	(x->replay.oseq - x->preplay.oseq < x->replay_maxdiff)) {
	67	if (x->xflags & XFRM_TIME_DEFER)
	68	event = XFRM_REPLAY_TIMEOUT;
	69	else
	70	return;
	71	}
	72
	73	break;
	74
	75	case XFRM_REPLAY_TIMEOUT:
	76	if (memcmp(&x->replay, &x->preplay,
	77	sizeof(struct xfrm_replay_state)) == 0) {
	78	x->xflags \|= XFRM_TIME_DEFER;
	79	return;
	80	}
	81
	82	break;
	83	}
	84
	85	memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
	86	c.event = XFRM_MSG_NEWAE;
	87	c.data.aevent = event;
	88	km_state_notify(x, &c);
	89
	90	if (x->replay_maxage &&
	91	!mod_timer(&x->rtimer, jiffies + x->replay_maxage))
	92	x->xflags &= ~XFRM_TIME_DEFER;
	93	}
	94
	95	static int xfrm_replay_overflow(struct xfrm_state x, struct sk_buff skb)
	96	{
	97	int err = 0;
	98	struct net *net = xs_net(x);
	99
	100	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
	101	XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
	102	if (unlikely(x->replay.oseq == 0)) {
	103	x->replay.oseq--;
	104	xfrm_audit_state_replay_overflow(x, skb);
	105	err = -EOVERFLOW;
	106
	107	return err;
	108	}
	109	if (xfrm_aevent_is_on(net))
	110	x->repl->notify(x, XFRM_REPLAY_UPDATE);
	111	}
	112
113	return err;
114	}
115
116	static int xfrm_replay_check(struct xfrm_state *x,
117	struct sk_buff *skb, __be32 net_seq)
118	{
119	u32 diff;
120	u32 seq = ntohl(net_seq);
121
36ae0148 SK	122	if (!x->props.replay_window)
	123	return 0;
	124
9fdc4883 SK	125	if (unlikely(seq == 0))
	126	goto err;
	127
	128	if (likely(seq > x->replay.seq))
	129	return 0;
	130
	131	diff = x->replay.seq - seq;
	132	if (diff >= min_t(unsigned int, x->props.replay_window,
	133	sizeof(x->replay.bitmap) * 8)) {
	134	x->stats.replay_window++;
	135	goto err;
	136	}
	137
	138	if (x->replay.bitmap & (1U << diff)) {
	139	x->stats.replay++;
	140	goto err;
	141	}
	142	return 0;
	143
	144	err:
	145	xfrm_audit_state_replay(x, skb, net_seq);
	146	return -EINVAL;
	147	}
	148
	149	static void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
	150	{
	151	u32 diff;
	152	u32 seq = ntohl(net_seq);
	153
	154	if (!x->props.replay_window)
	155	return;
	156
	157	if (seq > x->replay.seq) {
	158	diff = seq - x->replay.seq;
	159	if (diff < x->props.replay_window)
	160	x->replay.bitmap = ((x->replay.bitmap) << diff) \| 1;
	161	else
	162	x->replay.bitmap = 1;
	163	x->replay.seq = seq;
	164	} else {
	165	diff = x->replay.seq - seq;
	166	x->replay.bitmap \|= (1U << diff);
	167	}
	168
	169	if (xfrm_aevent_is_on(xs_net(x)))
	170	xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
	171	}
	172
97e15c3a SK	173	static int xfrm_replay_overflow_bmp(struct xfrm_state x, struct sk_buff skb)
	174	{
	175	int err = 0;
	176	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	177	struct net *net = xs_net(x);
	178
	179	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
	180	XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
	181	if (unlikely(replay_esn->oseq == 0)) {
	182	replay_esn->oseq--;
	183	xfrm_audit_state_replay_overflow(x, skb);
	184	err = -EOVERFLOW;
	185
	186	return err;
	187	}
	188	if (xfrm_aevent_is_on(net))
	189	x->repl->notify(x, XFRM_REPLAY_UPDATE);
	190	}
	191
	192	return err;
	193	}
	194
	195	static int xfrm_replay_check_bmp(struct xfrm_state *x,
	196	struct sk_buff *skb, __be32 net_seq)
	197	{
	198	unsigned int bitnr, nr;
	199	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
36ae0148	200	u32 pos;
97e15c3a SK	201	u32 seq = ntohl(net_seq);
97e15c3a SK	202	u32 diff = replay_esn->seq - seq;
36ae0148 SK	203
	204	if (!replay_esn->replay_window)
	205	return 0;
	206
97e15c3a SK	207	if (unlikely(seq == 0))
	208	goto err;
	209
	210	if (likely(seq > replay_esn->seq))
	211	return 0;
	212
	213	if (diff >= replay_esn->replay_window) {
	214	x->stats.replay_window++;
	215	goto err;
	216	}
	217
1d974374 SK	218	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
	219
	220	if (pos >= diff)
97e15c3a	221	bitnr = (pos - diff) % replay_esn->replay_window;
1d974374	222	else
97e15c3a	223	bitnr = replay_esn->replay_window - (diff - pos);
1d974374 SK	224
	225	nr = bitnr >> 5;
	226	bitnr = bitnr & 0x1F;
	227	if (replay_esn->bmp[nr] & (1U << bitnr))
	228	goto err_replay;
	229
97e15c3a SK	230	return 0;
	231
	232	err_replay:
	233	x->stats.replay++;
	234	err:
	235	xfrm_audit_state_replay(x, skb, net_seq);
	236	return -EINVAL;
	237	}
	238
	239	static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
	240	{
	241	unsigned int bitnr, nr, i;
	242	u32 diff;
	243	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	244	u32 seq = ntohl(net_seq);
	245	u32 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
	246
	247	if (!replay_esn->replay_window)
	248	return;
	249
	250	if (seq > replay_esn->seq) {
	251	diff = seq - replay_esn->seq;
	252
	253	if (diff < replay_esn->replay_window) {
	254	for (i = 1; i < diff; i++) {
	255	bitnr = (pos + i) % replay_esn->replay_window;
	256	nr = bitnr >> 5;
	257	bitnr = bitnr & 0x1F;
	258	replay_esn->bmp[nr] &= ~(1U << bitnr);
	259	}
97e15c3a	260	} else {
e756682c	261	nr = (replay_esn->replay_window - 1) >> 5;
97e15c3a SK	262	for (i = 0; i <= nr; i++)
97e15c3a SK	263	replay_esn->bmp[i] = 0;
97e15c3a SK	264	}
97e15c3a SK	265
1d974374	266	bitnr = (pos + diff) % replay_esn->replay_window;
97e15c3a SK	267	replay_esn->seq = seq;
	268	} else {
	269	diff = replay_esn->seq - seq;
	270
1d974374	271	if (pos >= diff)
97e15c3a	272	bitnr = (pos - diff) % replay_esn->replay_window;
1d974374	273	else
97e15c3a	274	bitnr = replay_esn->replay_window - (diff - pos);
97e15c3a SK	275	}
97e15c3a SK	276
1d974374 SK	277	nr = bitnr >> 5;
	278	bitnr = bitnr & 0x1F;
	279	replay_esn->bmp[nr] \|= (1U << bitnr);
	280
97e15c3a SK	281	if (xfrm_aevent_is_on(xs_net(x)))
	282	xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
	283	}
	284
	285	static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
	286	{
	287	struct km_event c;
	288	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	289	struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
	290
	291	/* we send notify messages in case
	292	* 1. we updated on of the sequence numbers, and the seqno difference
	293	* is at least x->replay_maxdiff, in this case we also update the
	294	* timeout of our timer function
	295	* 2. if x->replay_maxage has elapsed since last update,
	296	* and there were changes
	297	*
	298	* The state structure must be locked!
	299	*/
	300
	301	switch (event) {
	302	case XFRM_REPLAY_UPDATE:
	303	if (x->replay_maxdiff &&
	304	(replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
	305	(replay_esn->oseq - preplay_esn->oseq < x->replay_maxdiff)) {
	306	if (x->xflags & XFRM_TIME_DEFER)
	307	event = XFRM_REPLAY_TIMEOUT;
	308	else
	309	return;
	310	}
	311
	312	break;
	313
	314	case XFRM_REPLAY_TIMEOUT:
	315	if (memcmp(x->replay_esn, x->preplay_esn,
	316	xfrm_replay_state_esn_len(replay_esn)) == 0) {
	317	x->xflags \|= XFRM_TIME_DEFER;
	318	return;
	319	}
	320
	321	break;
	322	}
	323
	324	memcpy(x->preplay_esn, x->replay_esn,
	325	xfrm_replay_state_esn_len(replay_esn));
	326	c.event = XFRM_MSG_NEWAE;
	327	c.data.aevent = event;
	328	km_state_notify(x, &c);
	329
	330	if (x->replay_maxage &&
	331	!mod_timer(&x->rtimer, jiffies + x->replay_maxage))
	332	x->xflags &= ~XFRM_TIME_DEFER;
	333	}
	334
2cd08467 SK	335	static int xfrm_replay_overflow_esn(struct xfrm_state x, struct sk_buff skb)
	336	{
	337	int err = 0;
	338	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	339	struct net *net = xs_net(x);
	340
	341	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
	342	XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
	343	XFRM_SKB_CB(skb)->seq.output.hi = replay_esn->oseq_hi;
	344
	345	if (unlikely(replay_esn->oseq == 0)) {
	346	XFRM_SKB_CB(skb)->seq.output.hi = ++replay_esn->oseq_hi;
	347
	348	if (replay_esn->oseq_hi == 0) {
	349	replay_esn->oseq--;
	350	replay_esn->oseq_hi--;
	351	xfrm_audit_state_replay_overflow(x, skb);
	352	err = -EOVERFLOW;
	353
	354	return err;
	355	}
	356	}
	357	if (xfrm_aevent_is_on(net))
	358	x->repl->notify(x, XFRM_REPLAY_UPDATE);
	359	}
	360
	361	return err;
	362	}
	363
	364	static int xfrm_replay_check_esn(struct xfrm_state *x,
	365	struct sk_buff *skb, __be32 net_seq)
	366	{
	367	unsigned int bitnr, nr;
	368	u32 diff;
	369	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
36ae0148	370	u32 pos;
2cd08467	371	u32 seq = ntohl(net_seq);
2cd08467 SK	372	u32 wsize = replay_esn->replay_window;
	373	u32 top = replay_esn->seq;
	374	u32 bottom = top - wsize + 1;
	375
36ae0148 SK	376	if (!wsize)
	377	return 0;
	378
2cd08467 SK	379	if (unlikely(seq == 0 && replay_esn->seq_hi == 0 &&
	380	(replay_esn->seq < replay_esn->replay_window - 1)))
	381	goto err;
	382
	383	diff = top - seq;
	384
	385	if (likely(top >= wsize - 1)) {
	386	/* A. same subspace */
	387	if (likely(seq > top) \|\| seq < bottom)
	388	return 0;
	389	} else {
	390	/* B. window spans two subspaces */
	391	if (likely(seq > top && seq < bottom))
	392	return 0;
	393	if (seq >= bottom)
	394	diff = ~seq + top + 1;
	395	}
	396
	397	if (diff >= replay_esn->replay_window) {
	398	x->stats.replay_window++;
	399	goto err;
	400	}
	401
1d974374 SK	402	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
	403
	404	if (pos >= diff)
2cd08467	405	bitnr = (pos - diff) % replay_esn->replay_window;
1d974374	406	else
2cd08467	407	bitnr = replay_esn->replay_window - (diff - pos);
1d974374 SK	408
	409	nr = bitnr >> 5;
	410	bitnr = bitnr & 0x1F;
	411	if (replay_esn->bmp[nr] & (1U << bitnr))
	412	goto err_replay;
	413
2cd08467 SK	414	return 0;
	415
	416	err_replay:
	417	x->stats.replay++;
	418	err:
	419	xfrm_audit_state_replay(x, skb, net_seq);
	420	return -EINVAL;
	421	}
	422
	423	static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
	424	{
	425	unsigned int bitnr, nr, i;
	426	int wrap;
	427	u32 diff, pos, seq, seq_hi;
	428	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	429
	430	if (!replay_esn->replay_window)
	431	return;
	432
	433	seq = ntohl(net_seq);
	434	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
	435	seq_hi = xfrm_replay_seqhi(x, net_seq);
	436	wrap = seq_hi - replay_esn->seq_hi;
	437
	438	if ((!wrap && seq > replay_esn->seq) \|\| wrap > 0) {
	439	if (likely(!wrap))
	440	diff = seq - replay_esn->seq;
	441	else
	442	diff = ~replay_esn->seq + seq + 1;
	443
	444	if (diff < replay_esn->replay_window) {
	445	for (i = 1; i < diff; i++) {
	446	bitnr = (pos + i) % replay_esn->replay_window;
	447	nr = bitnr >> 5;
	448	bitnr = bitnr & 0x1F;
	449	replay_esn->bmp[nr] &= ~(1U << bitnr);
	450	}
2cd08467	451	} else {
e756682c	452	nr = (replay_esn->replay_window - 1) >> 5;
2cd08467 SK	453	for (i = 0; i <= nr; i++)
2cd08467 SK	454	replay_esn->bmp[i] = 0;
2cd08467 SK	455	}
2cd08467 SK	456
1d974374	457	bitnr = (pos + diff) % replay_esn->replay_window;
2cd08467 SK	458	replay_esn->seq = seq;
	459
	460	if (unlikely(wrap > 0))
	461	replay_esn->seq_hi++;
	462	} else {
	463	diff = replay_esn->seq - seq;
	464
1d974374	465	if (pos >= diff)
2cd08467	466	bitnr = (pos - diff) % replay_esn->replay_window;
1d974374	467	else
2cd08467	468	bitnr = replay_esn->replay_window - (diff - pos);
2cd08467 SK	469	}
2cd08467 SK	470
1d974374 SK	471	nr = bitnr >> 5;
	472	bitnr = bitnr & 0x1F;
	473	replay_esn->bmp[nr] \|= (1U << bitnr);
	474
2cd08467 SK	475	if (xfrm_aevent_is_on(xs_net(x)))
	476	xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
	477	}
	478
9fdc4883 SK	479	static struct xfrm_replay xfrm_replay_legacy = {
	480	.advance = xfrm_replay_advance,
	481	.check = xfrm_replay_check,
	482	.notify = xfrm_replay_notify,
	483	.overflow = xfrm_replay_overflow,
	484	};
	485
97e15c3a SK	486	static struct xfrm_replay xfrm_replay_bmp = {
	487	.advance = xfrm_replay_advance_bmp,
	488	.check = xfrm_replay_check_bmp,
	489	.notify = xfrm_replay_notify_bmp,
	490	.overflow = xfrm_replay_overflow_bmp,
	491	};
	492
2cd08467 SK	493	static struct xfrm_replay xfrm_replay_esn = {
	494	.advance = xfrm_replay_advance_esn,
	495	.check = xfrm_replay_check_esn,
	496	.notify = xfrm_replay_notify_bmp,
	497	.overflow = xfrm_replay_overflow_esn,
	498	};
	499
9fdc4883 SK	500	int xfrm_init_replay(struct xfrm_state *x)
9fdc4883 SK	501	{
97e15c3a SK	502	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
	503
	504	if (replay_esn) {
	505	if (replay_esn->replay_window >
3f602b08	506	replay_esn->bmp_len * sizeof(__u32) * 8)
97e15c3a SK	507	return -EINVAL;
97e15c3a SK	508
6fa5ddcc SK	509	if ((x->props.flags & XFRM_STATE_ESN) && replay_esn->replay_window == 0)
	510	return -EINVAL;
	511
2cd08467 SK	512	if ((x->props.flags & XFRM_STATE_ESN) && x->replay_esn)
	513	x->repl = &xfrm_replay_esn;
	514	else
97e15c3a SK	515	x->repl = &xfrm_replay_bmp;
	516	} else
	517	x->repl = &xfrm_replay_legacy;
	518
9fdc4883 SK	519	return 0;
	520	}
	521	EXPORT_SYMBOL(xfrm_init_replay);