xfrm: Don't allow esn with disabled anti replay detection

Unlike the standard case, disabled anti replay detection needs some nontrivial extra treatment on ESN. RFC 4303 states: Note: If a receiver chooses to not enable anti-replay for an SA, then the receiver SHOULD NOT negotiate ESN in an SA management protocol. Use of ESN creates a need for the receiver to manage the anti-replay window (in order to determine the correct value for the high-order bits of the ESN, which are employed in the ICV computation), which is generally contrary to the notion of disabling anti-replay for an SA. So return an error if an ESN state with disabled anti replay detection is inserted for now and add the extra treatment later if we need it. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>

xfrm: Don't allow esn with disabled anti replay detection
Unlike the standard case, disabled anti replay detection needs some nontrivial extra treatment on ESN. RFC 4303 states: Note: If a receiver chooses to not enable anti-replay for an SA, then the receiver SHOULD NOT negotiate ESN in an SA management protocol. Use of ESN creates a need for the receiver to manage the anti-replay window (in order to determine the correct value for the high-order bits of the ESN, which are employed in the ICV computation), which is generally contrary to the notion of disabling anti-replay for an SA. So return an error if an ESN state with disabled anti replay detection is inserted for now and add the extra treatment later if we need it. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Steffen Klassert · David S. Miller
1 parent 43a4dea4c9
Showing 1 changed file with 3 additions and 0 deletions Side-by-side Diff
net/xfrm/xfrm_replay.c
@@ -535,6 +535,9 @@
 		    replay_esn->bmp_len * sizeof(__u32) * 8)
 			return -EINVAL;
  
+	if ((x->props.flags & XFRM_STATE_ESN) && replay_esn->replay_window == 0)
+		return -EINVAL;
+
 	if ((x->props.flags & XFRM_STATE_ESN) && x->replay_esn)
 		x->repl = &xfrm_replay_esn;
 	else
...	...	@@ -535,6 +535,9 @@
535	535	replay_esn->bmp_len * sizeof(__u32) * 8)
536	536	return -EINVAL;
537	537
	538	+ if ((x->props.flags & XFRM_STATE_ESN) && replay_esn->replay_window == 0)
	539	+ return -EINVAL;
	540	+
538	541	if ((x->props.flags & XFRM_STATE_ESN) && x->replay_esn)
539	542	x->repl = &xfrm_replay_esn;
540	543	else