xfrm: Guard IPsec anti replay window against replay bitmap
authorFan Du <fan.du@windriver.com>
Tue, 17 Sep 2013 07:14:13 +0000 (15:14 +0800)
committerSteffen Klassert <steffen.klassert@secunet.com>
Tue, 17 Sep 2013 10:17:10 +0000 (12:17 +0200)
commit33fce60d6a6e137035f8e23a89d7fd55f3a24cda
treeee3024fec1098859d27911d3e69f7888ecdf0b5e
parentb3b2b9e192d5811f91f9cd92aeec489cecabc92e
xfrm: Guard IPsec anti replay window against replay bitmap

For legacy IPsec anti replay mechanism:

bitmap in struct xfrm_replay_state could only provide a 32 bits
window size limit in current design, thus user level parameter
sadb_sa_replay should honor this limit, otherwise misleading
outputs("replay=244") by setkey -D will be:

192.168.25.2 192.168.22.2
esp mode=transport spi=147561170(0x08cb9ad2) reqid=0(0x00000000)
E: aes-cbc  9a8d7468 7655cf0b 719d27be b0ddaac2
A: hmac-sha1  2d2115c2 ebf7c126 1c54f186 3b139b58 264a7331
seq=0x00000000 replay=244 flags=0x00000000 state=mature
created: Sep 17 14:00:00 2013 current: Sep 17 14:00:22 2013
diff: 22(s) hard: 30(s) soft: 26(s)
last: Sep 17 14:00:00 2013 hard: 0(s) soft: 0(s)
current: 1408(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 22 hard: 0 soft: 0
sadb_seq=1 pid=4854 refcnt=0
192.168.22.2 192.168.25.2
esp mode=transport spi=255302123(0x0f3799eb) reqid=0(0x00000000)
E: aes-cbc  6485d990 f61a6bd5 e5660252 608ad282
A: hmac-sha1  0cca811a eb4fa893 c47ae56c 98f6e413 87379a88
seq=0x00000000 replay=244 flags=0x00000000 state=mature
created: Sep 17 14:00:00 2013 current: Sep 17 14:00:22 2013
diff: 22(s) hard: 30(s) soft: 26(s)
last: Sep 17 14:00:00 2013 hard: 0(s) soft: 0(s)
current: 1408(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 22 hard: 0 soft: 0
sadb_seq=0 pid=4854 refcnt=0

And also, optimizing xfrm_replay_check window checking by setting the
desirable x->props.replay_window with only doing the comparison once
for all when xfrm_state is first born.

Signed-off-by: Fan Du <fan.du@windriver.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/key/af_key.c
net/xfrm/xfrm_replay.c
net/xfrm/xfrm_user.c