xref: /linux/net/xfrm/xfrm_replay.c (revision 0be3ff0c) 
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * xfrm_replay.c - xfrm replay detection, derived from xfrm_state.c.
4  *
5  * Copyright (C) 2010 secunet Security Networks AG
6  * Copyright (C) 2010 Steffen Klassert <steffen.klassert@secunet.com>
7  */
8 
9 #include <linux/export.h>
10 #include <net/xfrm.h>
11 
12 u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq)
13 {
14 	u32 seq, seq_hi, bottom;
15 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
16 
17 	if (!(x->props.flags & XFRM_STATE_ESN))
18 		return 0;
19 
20 	seq = ntohl(net_seq);
21 	seq_hi = replay_esn->seq_hi;
22 	bottom = replay_esn->seq - replay_esn->replay_window + 1;
23 
24 	if (likely(replay_esn->seq >= replay_esn->replay_window - 1)) {
25 		/* A. same subspace */
26 		if (unlikely(seq < bottom))
27 			seq_hi++;
28 	} else {
29 		/* B. window spans two subspaces */
30 		if (unlikely(seq >= bottom))
31 			seq_hi--;
32 	}
33 
34 	return seq_hi;
35 }
36 EXPORT_SYMBOL(xfrm_replay_seqhi);
37 
38 static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event);
39 static void xfrm_replay_notify_esn(struct xfrm_state *x, int event);
40 
41 void xfrm_replay_notify(struct xfrm_state *x, int event)
42 {
43 	struct km_event c;
44 	/* we send notify messages in case
45 	 *  1. we updated on of the sequence numbers, and the seqno difference
46 	 *     is at least x->replay_maxdiff, in this case we also update the
47 	 *     timeout of our timer function
48 	 *  2. if x->replay_maxage has elapsed since last update,
49 	 *     and there were changes
50 	 *
51 	 *  The state structure must be locked!
52 	 */
53 
54 	switch (x->repl_mode) {
55 	case XFRM_REPLAY_MODE_LEGACY:
56 		break;
57 	case XFRM_REPLAY_MODE_BMP:
58 		xfrm_replay_notify_bmp(x, event);
59 		return;
60 	case XFRM_REPLAY_MODE_ESN:
61 		xfrm_replay_notify_esn(x, event);
62 		return;
63 	}
64 
65 	switch (event) {
66 	case XFRM_REPLAY_UPDATE:
67 		if (!x->replay_maxdiff ||
68 		    ((x->replay.seq - x->preplay.seq < x->replay_maxdiff) &&
69 		    (x->replay.oseq - x->preplay.oseq < x->replay_maxdiff))) {
70 			if (x->xflags & XFRM_TIME_DEFER)
71 				event = XFRM_REPLAY_TIMEOUT;
72 			else
73 				return;
74 		}
75 
76 		break;
77 
78 	case XFRM_REPLAY_TIMEOUT:
79 		if (memcmp(&x->replay, &x->preplay,
80 			   sizeof(struct xfrm_replay_state)) == 0) {
81 			x->xflags |= XFRM_TIME_DEFER;
82 			return;
83 		}
84 
85 		break;
86 	}
87 
88 	memcpy(&x->preplay, &x->replay, sizeof(struct xfrm_replay_state));
89 	c.event = XFRM_MSG_NEWAE;
90 	c.data.aevent = event;
91 	km_state_notify(x, &c);
92 
93 	if (x->replay_maxage &&
94 	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
95 		x->xflags &= ~XFRM_TIME_DEFER;
96 }
97 
98 static int __xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
99 {
100 	int err = 0;
101 	struct net *net = xs_net(x);
102 
103 	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
104 		XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
105 		XFRM_SKB_CB(skb)->seq.output.hi = 0;
106 		if (unlikely(x->replay.oseq == 0) &&
107 		    !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
108 			x->replay.oseq--;
109 			xfrm_audit_state_replay_overflow(x, skb);
110 			err = -EOVERFLOW;
111 
112 			return err;
113 		}
114 		if (xfrm_aevent_is_on(net))
115 			xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
116 	}
117 
118 	return err;
119 }
120 
121 static int xfrm_replay_check_legacy(struct xfrm_state *x,
122 				    struct sk_buff *skb, __be32 net_seq)
123 {
124 	u32 diff;
125 	u32 seq = ntohl(net_seq);
126 
127 	if (!x->props.replay_window)
128 		return 0;
129 
130 	if (unlikely(seq == 0))
131 		goto err;
132 
133 	if (likely(seq > x->replay.seq))
134 		return 0;
135 
136 	diff = x->replay.seq - seq;
137 	if (diff >= x->props.replay_window) {
138 		x->stats.replay_window++;
139 		goto err;
140 	}
141 
142 	if (x->replay.bitmap & (1U << diff)) {
143 		x->stats.replay++;
144 		goto err;
145 	}
146 	return 0;
147 
148 err:
149 	xfrm_audit_state_replay(x, skb, net_seq);
150 	return -EINVAL;
151 }
152 
153 static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq);
154 static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq);
155 
156 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
157 {
158 	u32 diff, seq;
159 
160 	switch (x->repl_mode) {
161 	case XFRM_REPLAY_MODE_LEGACY:
162 		break;
163 	case XFRM_REPLAY_MODE_BMP:
164 		return xfrm_replay_advance_bmp(x, net_seq);
165 	case XFRM_REPLAY_MODE_ESN:
166 		return xfrm_replay_advance_esn(x, net_seq);
167 	}
168 
169 	if (!x->props.replay_window)
170 		return;
171 
172 	seq = ntohl(net_seq);
173 	if (seq > x->replay.seq) {
174 		diff = seq - x->replay.seq;
175 		if (diff < x->props.replay_window)
176 			x->replay.bitmap = ((x->replay.bitmap) << diff) | 1;
177 		else
178 			x->replay.bitmap = 1;
179 		x->replay.seq = seq;
180 	} else {
181 		diff = x->replay.seq - seq;
182 		x->replay.bitmap |= (1U << diff);
183 	}
184 
185 	if (xfrm_aevent_is_on(xs_net(x)))
186 		xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
187 }
188 
189 static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
190 {
191 	int err = 0;
192 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
193 	struct net *net = xs_net(x);
194 
195 	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
196 		XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
197 		XFRM_SKB_CB(skb)->seq.output.hi = 0;
198 		if (unlikely(replay_esn->oseq == 0) &&
199 		    !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
200 			replay_esn->oseq--;
201 			xfrm_audit_state_replay_overflow(x, skb);
202 			err = -EOVERFLOW;
203 
204 			return err;
205 		}
206 		if (xfrm_aevent_is_on(net))
207 			xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
208 	}
209 
210 	return err;
211 }
212 
213 static int xfrm_replay_check_bmp(struct xfrm_state *x,
214 				 struct sk_buff *skb, __be32 net_seq)
215 {
216 	unsigned int bitnr, nr;
217 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
218 	u32 pos;
219 	u32 seq = ntohl(net_seq);
220 	u32 diff =  replay_esn->seq - seq;
221 
222 	if (!replay_esn->replay_window)
223 		return 0;
224 
225 	if (unlikely(seq == 0))
226 		goto err;
227 
228 	if (likely(seq > replay_esn->seq))
229 		return 0;
230 
231 	if (diff >= replay_esn->replay_window) {
232 		x->stats.replay_window++;
233 		goto err;
234 	}
235 
236 	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
237 
238 	if (pos >= diff)
239 		bitnr = (pos - diff) % replay_esn->replay_window;
240 	else
241 		bitnr = replay_esn->replay_window - (diff - pos);
242 
243 	nr = bitnr >> 5;
244 	bitnr = bitnr & 0x1F;
245 	if (replay_esn->bmp[nr] & (1U << bitnr))
246 		goto err_replay;
247 
248 	return 0;
249 
250 err_replay:
251 	x->stats.replay++;
252 err:
253 	xfrm_audit_state_replay(x, skb, net_seq);
254 	return -EINVAL;
255 }
256 
257 static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
258 {
259 	unsigned int bitnr, nr, i;
260 	u32 diff;
261 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
262 	u32 seq = ntohl(net_seq);
263 	u32 pos;
264 
265 	if (!replay_esn->replay_window)
266 		return;
267 
268 	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
269 
270 	if (seq > replay_esn->seq) {
271 		diff = seq - replay_esn->seq;
272 
273 		if (diff < replay_esn->replay_window) {
274 			for (i = 1; i < diff; i++) {
275 				bitnr = (pos + i) % replay_esn->replay_window;
276 				nr = bitnr >> 5;
277 				bitnr = bitnr & 0x1F;
278 				replay_esn->bmp[nr] &=  ~(1U << bitnr);
279 			}
280 		} else {
281 			nr = (replay_esn->replay_window - 1) >> 5;
282 			for (i = 0; i <= nr; i++)
283 				replay_esn->bmp[i] = 0;
284 		}
285 
286 		bitnr = (pos + diff) % replay_esn->replay_window;
287 		replay_esn->seq = seq;
288 	} else {
289 		diff = replay_esn->seq - seq;
290 
291 		if (pos >= diff)
292 			bitnr = (pos - diff) % replay_esn->replay_window;
293 		else
294 			bitnr = replay_esn->replay_window - (diff - pos);
295 	}
296 
297 	nr = bitnr >> 5;
298 	bitnr = bitnr & 0x1F;
299 	replay_esn->bmp[nr] |= (1U << bitnr);
300 
301 	if (xfrm_aevent_is_on(xs_net(x)))
302 		xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
303 }
304 
305 static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
306 {
307 	struct km_event c;
308 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
309 	struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
310 
311 	/* we send notify messages in case
312 	 *  1. we updated on of the sequence numbers, and the seqno difference
313 	 *     is at least x->replay_maxdiff, in this case we also update the
314 	 *     timeout of our timer function
315 	 *  2. if x->replay_maxage has elapsed since last update,
316 	 *     and there were changes
317 	 *
318 	 *  The state structure must be locked!
319 	 */
320 
321 	switch (event) {
322 	case XFRM_REPLAY_UPDATE:
323 		if (!x->replay_maxdiff ||
324 		    ((replay_esn->seq - preplay_esn->seq < x->replay_maxdiff) &&
325 		    (replay_esn->oseq - preplay_esn->oseq
326 		     < x->replay_maxdiff))) {
327 			if (x->xflags & XFRM_TIME_DEFER)
328 				event = XFRM_REPLAY_TIMEOUT;
329 			else
330 				return;
331 		}
332 
333 		break;
334 
335 	case XFRM_REPLAY_TIMEOUT:
336 		if (memcmp(x->replay_esn, x->preplay_esn,
337 			   xfrm_replay_state_esn_len(replay_esn)) == 0) {
338 			x->xflags |= XFRM_TIME_DEFER;
339 			return;
340 		}
341 
342 		break;
343 	}
344 
345 	memcpy(x->preplay_esn, x->replay_esn,
346 	       xfrm_replay_state_esn_len(replay_esn));
347 	c.event = XFRM_MSG_NEWAE;
348 	c.data.aevent = event;
349 	km_state_notify(x, &c);
350 
351 	if (x->replay_maxage &&
352 	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
353 		x->xflags &= ~XFRM_TIME_DEFER;
354 }
355 
356 static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
357 {
358 	u32 seq_diff, oseq_diff;
359 	struct km_event c;
360 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
361 	struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
362 
363 	/* we send notify messages in case
364 	 *  1. we updated on of the sequence numbers, and the seqno difference
365 	 *     is at least x->replay_maxdiff, in this case we also update the
366 	 *     timeout of our timer function
367 	 *  2. if x->replay_maxage has elapsed since last update,
368 	 *     and there were changes
369 	 *
370 	 *  The state structure must be locked!
371 	 */
372 
373 	switch (event) {
374 	case XFRM_REPLAY_UPDATE:
375 		if (x->replay_maxdiff) {
376 			if (replay_esn->seq_hi == preplay_esn->seq_hi)
377 				seq_diff = replay_esn->seq - preplay_esn->seq;
378 			else
379 				seq_diff = ~preplay_esn->seq + replay_esn->seq
380 					   + 1;
381 
382 			if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
383 				oseq_diff = replay_esn->oseq
384 					    - preplay_esn->oseq;
385 			else
386 				oseq_diff = ~preplay_esn->oseq
387 					    + replay_esn->oseq + 1;
388 
389 			if (seq_diff >= x->replay_maxdiff ||
390 			    oseq_diff >= x->replay_maxdiff)
391 				break;
392 		}
393 
394 		if (x->xflags & XFRM_TIME_DEFER)
395 			event = XFRM_REPLAY_TIMEOUT;
396 		else
397 			return;
398 
399 		break;
400 
401 	case XFRM_REPLAY_TIMEOUT:
402 		if (memcmp(x->replay_esn, x->preplay_esn,
403 			   xfrm_replay_state_esn_len(replay_esn)) == 0) {
404 			x->xflags |= XFRM_TIME_DEFER;
405 			return;
406 		}
407 
408 		break;
409 	}
410 
411 	memcpy(x->preplay_esn, x->replay_esn,
412 	       xfrm_replay_state_esn_len(replay_esn));
413 	c.event = XFRM_MSG_NEWAE;
414 	c.data.aevent = event;
415 	km_state_notify(x, &c);
416 
417 	if (x->replay_maxage &&
418 	    !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
419 		x->xflags &= ~XFRM_TIME_DEFER;
420 }
421 
422 static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb)
423 {
424 	int err = 0;
425 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
426 	struct net *net = xs_net(x);
427 
428 	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
429 		XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
430 		XFRM_SKB_CB(skb)->seq.output.hi = replay_esn->oseq_hi;
431 
432 		if (unlikely(replay_esn->oseq == 0)) {
433 			XFRM_SKB_CB(skb)->seq.output.hi = ++replay_esn->oseq_hi;
434 
435 			if (replay_esn->oseq_hi == 0) {
436 				replay_esn->oseq--;
437 				replay_esn->oseq_hi--;
438 				xfrm_audit_state_replay_overflow(x, skb);
439 				err = -EOVERFLOW;
440 
441 				return err;
442 			}
443 		}
444 		if (xfrm_aevent_is_on(net))
445 			xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
446 	}
447 
448 	return err;
449 }
450 
451 static int xfrm_replay_check_esn(struct xfrm_state *x,
452 				 struct sk_buff *skb, __be32 net_seq)
453 {
454 	unsigned int bitnr, nr;
455 	u32 diff;
456 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
457 	u32 pos;
458 	u32 seq = ntohl(net_seq);
459 	u32 wsize = replay_esn->replay_window;
460 	u32 top = replay_esn->seq;
461 	u32 bottom = top - wsize + 1;
462 
463 	if (!wsize)
464 		return 0;
465 
466 	if (unlikely(seq == 0 && replay_esn->seq_hi == 0 &&
467 		     (replay_esn->seq < replay_esn->replay_window - 1)))
468 		goto err;
469 
470 	diff = top - seq;
471 
472 	if (likely(top >= wsize - 1)) {
473 		/* A. same subspace */
474 		if (likely(seq > top) || seq < bottom)
475 			return 0;
476 	} else {
477 		/* B. window spans two subspaces */
478 		if (likely(seq > top && seq < bottom))
479 			return 0;
480 		if (seq >= bottom)
481 			diff = ~seq + top + 1;
482 	}
483 
484 	if (diff >= replay_esn->replay_window) {
485 		x->stats.replay_window++;
486 		goto err;
487 	}
488 
489 	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
490 
491 	if (pos >= diff)
492 		bitnr = (pos - diff) % replay_esn->replay_window;
493 	else
494 		bitnr = replay_esn->replay_window - (diff - pos);
495 
496 	nr = bitnr >> 5;
497 	bitnr = bitnr & 0x1F;
498 	if (replay_esn->bmp[nr] & (1U << bitnr))
499 		goto err_replay;
500 
501 	return 0;
502 
503 err_replay:
504 	x->stats.replay++;
505 err:
506 	xfrm_audit_state_replay(x, skb, net_seq);
507 	return -EINVAL;
508 }
509 
510 int xfrm_replay_check(struct xfrm_state *x,
511 		      struct sk_buff *skb, __be32 net_seq)
512 {
513 	switch (x->repl_mode) {
514 	case XFRM_REPLAY_MODE_LEGACY:
515 		break;
516 	case XFRM_REPLAY_MODE_BMP:
517 		return xfrm_replay_check_bmp(x, skb, net_seq);
518 	case XFRM_REPLAY_MODE_ESN:
519 		return xfrm_replay_check_esn(x, skb, net_seq);
520 	}
521 
522 	return xfrm_replay_check_legacy(x, skb, net_seq);
523 }
524 
525 static int xfrm_replay_recheck_esn(struct xfrm_state *x,
526 				   struct sk_buff *skb, __be32 net_seq)
527 {
528 	if (unlikely(XFRM_SKB_CB(skb)->seq.input.hi !=
529 		     htonl(xfrm_replay_seqhi(x, net_seq)))) {
530 			x->stats.replay_window++;
531 			return -EINVAL;
532 	}
533 
534 	return xfrm_replay_check_esn(x, skb, net_seq);
535 }
536 
537 int xfrm_replay_recheck(struct xfrm_state *x,
538 			struct sk_buff *skb, __be32 net_seq)
539 {
540 	switch (x->repl_mode) {
541 	case XFRM_REPLAY_MODE_LEGACY:
542 		break;
543 	case XFRM_REPLAY_MODE_BMP:
544 		/* no special recheck treatment */
545 		return xfrm_replay_check_bmp(x, skb, net_seq);
546 	case XFRM_REPLAY_MODE_ESN:
547 		return xfrm_replay_recheck_esn(x, skb, net_seq);
548 	}
549 
550 	return xfrm_replay_check_legacy(x, skb, net_seq);
551 }
552 
553 static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
554 {
555 	unsigned int bitnr, nr, i;
556 	int wrap;
557 	u32 diff, pos, seq, seq_hi;
558 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
559 
560 	if (!replay_esn->replay_window)
561 		return;
562 
563 	seq = ntohl(net_seq);
564 	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
565 	seq_hi = xfrm_replay_seqhi(x, net_seq);
566 	wrap = seq_hi - replay_esn->seq_hi;
567 
568 	if ((!wrap && seq > replay_esn->seq) || wrap > 0) {
569 		if (likely(!wrap))
570 			diff = seq - replay_esn->seq;
571 		else
572 			diff = ~replay_esn->seq + seq + 1;
573 
574 		if (diff < replay_esn->replay_window) {
575 			for (i = 1; i < diff; i++) {
576 				bitnr = (pos + i) % replay_esn->replay_window;
577 				nr = bitnr >> 5;
578 				bitnr = bitnr & 0x1F;
579 				replay_esn->bmp[nr] &=  ~(1U << bitnr);
580 			}
581 		} else {
582 			nr = (replay_esn->replay_window - 1) >> 5;
583 			for (i = 0; i <= nr; i++)
584 				replay_esn->bmp[i] = 0;
585 		}
586 
587 		bitnr = (pos + diff) % replay_esn->replay_window;
588 		replay_esn->seq = seq;
589 
590 		if (unlikely(wrap > 0))
591 			replay_esn->seq_hi++;
592 	} else {
593 		diff = replay_esn->seq - seq;
594 
595 		if (pos >= diff)
596 			bitnr = (pos - diff) % replay_esn->replay_window;
597 		else
598 			bitnr = replay_esn->replay_window - (diff - pos);
599 	}
600 
601 	xfrm_dev_state_advance_esn(x);
602 
603 	nr = bitnr >> 5;
604 	bitnr = bitnr & 0x1F;
605 	replay_esn->bmp[nr] |= (1U << bitnr);
606 
607 	if (xfrm_aevent_is_on(xs_net(x)))
608 		xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
609 }
610 
611 #ifdef CONFIG_XFRM_OFFLOAD
612 static int xfrm_replay_overflow_offload(struct xfrm_state *x, struct sk_buff *skb)
613 {
614 	int err = 0;
615 	struct net *net = xs_net(x);
616 	struct xfrm_offload *xo = xfrm_offload(skb);
617 	__u32 oseq = x->replay.oseq;
618 
619 	if (!xo)
620 		return __xfrm_replay_overflow(x, skb);
621 
622 	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
623 		if (!skb_is_gso(skb)) {
624 			XFRM_SKB_CB(skb)->seq.output.low = ++oseq;
625 			xo->seq.low = oseq;
626 		} else {
627 			XFRM_SKB_CB(skb)->seq.output.low = oseq + 1;
628 			xo->seq.low = oseq + 1;
629 			oseq += skb_shinfo(skb)->gso_segs;
630 		}
631 
632 		XFRM_SKB_CB(skb)->seq.output.hi = 0;
633 		xo->seq.hi = 0;
634 		if (unlikely(oseq < x->replay.oseq) &&
635 		    !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
636 			xfrm_audit_state_replay_overflow(x, skb);
637 			err = -EOVERFLOW;
638 
639 			return err;
640 		}
641 
642 		x->replay.oseq = oseq;
643 
644 		if (xfrm_aevent_is_on(net))
645 			xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
646 	}
647 
648 	return err;
649 }
650 
651 static int xfrm_replay_overflow_offload_bmp(struct xfrm_state *x, struct sk_buff *skb)
652 {
653 	int err = 0;
654 	struct xfrm_offload *xo = xfrm_offload(skb);
655 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
656 	struct net *net = xs_net(x);
657 	__u32 oseq = replay_esn->oseq;
658 
659 	if (!xo)
660 		return xfrm_replay_overflow_bmp(x, skb);
661 
662 	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
663 		if (!skb_is_gso(skb)) {
664 			XFRM_SKB_CB(skb)->seq.output.low = ++oseq;
665 			xo->seq.low = oseq;
666 		} else {
667 			XFRM_SKB_CB(skb)->seq.output.low = oseq + 1;
668 			xo->seq.low = oseq + 1;
669 			oseq += skb_shinfo(skb)->gso_segs;
670 		}
671 
672 		XFRM_SKB_CB(skb)->seq.output.hi = 0;
673 		xo->seq.hi = 0;
674 		if (unlikely(oseq < replay_esn->oseq) &&
675 		    !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
676 			xfrm_audit_state_replay_overflow(x, skb);
677 			err = -EOVERFLOW;
678 
679 			return err;
680 		} else {
681 			replay_esn->oseq = oseq;
682 		}
683 
684 		if (xfrm_aevent_is_on(net))
685 			xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
686 	}
687 
688 	return err;
689 }
690 
691 static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff *skb)
692 {
693 	int err = 0;
694 	struct xfrm_offload *xo = xfrm_offload(skb);
695 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
696 	struct net *net = xs_net(x);
697 	__u32 oseq = replay_esn->oseq;
698 	__u32 oseq_hi = replay_esn->oseq_hi;
699 
700 	if (!xo)
701 		return xfrm_replay_overflow_esn(x, skb);
702 
703 	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
704 		if (!skb_is_gso(skb)) {
705 			XFRM_SKB_CB(skb)->seq.output.low = ++oseq;
706 			XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi;
707 			xo->seq.low = oseq;
708 			xo->seq.hi = oseq_hi;
709 		} else {
710 			XFRM_SKB_CB(skb)->seq.output.low = oseq + 1;
711 			XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi;
712 			xo->seq.low = oseq + 1;
713 			xo->seq.hi = oseq_hi;
714 			oseq += skb_shinfo(skb)->gso_segs;
715 		}
716 
717 		if (unlikely(oseq < replay_esn->oseq)) {
718 			XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi;
719 			xo->seq.hi = oseq_hi;
720 			replay_esn->oseq_hi = oseq_hi;
721 			if (replay_esn->oseq_hi == 0) {
722 				replay_esn->oseq--;
723 				replay_esn->oseq_hi--;
724 				xfrm_audit_state_replay_overflow(x, skb);
725 				err = -EOVERFLOW;
726 
727 				return err;
728 			}
729 		}
730 
731 		replay_esn->oseq = oseq;
732 
733 		if (xfrm_aevent_is_on(net))
734 			xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
735 	}
736 
737 	return err;
738 }
739 
740 int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
741 {
742 	switch (x->repl_mode) {
743 	case XFRM_REPLAY_MODE_LEGACY:
744 		break;
745 	case XFRM_REPLAY_MODE_BMP:
746 		return xfrm_replay_overflow_offload_bmp(x, skb);
747 	case XFRM_REPLAY_MODE_ESN:
748 		return xfrm_replay_overflow_offload_esn(x, skb);
749 	}
750 
751 	return xfrm_replay_overflow_offload(x, skb);
752 }
753 #else
754 int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
755 {
756 	switch (x->repl_mode) {
757 	case XFRM_REPLAY_MODE_LEGACY:
758 		break;
759 	case XFRM_REPLAY_MODE_BMP:
760 		return xfrm_replay_overflow_bmp(x, skb);
761 	case XFRM_REPLAY_MODE_ESN:
762 		return xfrm_replay_overflow_esn(x, skb);
763 	}
764 
765 	return __xfrm_replay_overflow(x, skb);
766 }
767 #endif
768 
769 int xfrm_init_replay(struct xfrm_state *x)
770 {
771 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
772 
773 	if (replay_esn) {
774 		if (replay_esn->replay_window >
775 		    replay_esn->bmp_len * sizeof(__u32) * 8)
776 			return -EINVAL;
777 
778 		if (x->props.flags & XFRM_STATE_ESN) {
779 			if (replay_esn->replay_window == 0)
780 				return -EINVAL;
781 			x->repl_mode = XFRM_REPLAY_MODE_ESN;
782 		} else {
783 			x->repl_mode = XFRM_REPLAY_MODE_BMP;
784 		}
785 	} else {
786 		x->repl_mode = XFRM_REPLAY_MODE_LEGACY;
787 	}
788 
789 	return 0;
790 }
791 EXPORT_SYMBOL(xfrm_init_replay);
792