[IPSEC]: Reject packets within replay window but outside the bit mask

4c4d51a7 · Herbert Xu <[email protected]> · 2007-04-05 00:07:39 -07:00

Up until this point we've accepted replay window settings greater than
32 but our bit mask can only accomodate 32 packets.  Thus any packet
with a sequence number within the window but outside the bit mask would
be accepted.

This patch causes those packets to be rejected instead.

Signed-off-by: Herbert Xu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

Commit: 4c4d51a7316b164ba08af61aa0c124a88bc60450
Parents: 60e5c166

Changes

1 files changed · +2 −1

File	Status	Add	Del	Content
net/xfrm/xfrm_state.c	modified	+2	−1	View file

net/xfrm/xfrm_state.c

View file

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5c5f6dc..e3a0bcf 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1371,7 +1371,8 @@ int xfrm_replay_check(struct xfrm_state *x, __be32 net_seq)
 		return 0;
 
 	diff = x->replay.seq - seq;
-	if (diff >= x->props.replay_window) {
+	if (diff >= min_t(unsigned int, x->props.replay_window,
+			  sizeof(x->replay.bitmap) * 8)) {
 		x->stats.replay_window++;
 		return -EINVAL;
 	}