xfrm: introduce oseq-may-wrap flag

RFC 4303 in section 3.3.3 suggests to disable anti-replay for manually
distributed ICVs in which case the sender does not need to monitor or
reset the counter. However, the sender still increments the counter and
when it reaches the maximum value, the counter rolls over back to zero.

This patch introduces new extra_flag XFRM_SA_XFLAG_OSEQ_MAY_WRAP which
allows sequence number to cycle in outbound packets if set. This flag is
used only in legacy and bmp code, because esn should not be negotiated
if anti-replay is disabled (see note in 3.3.3 section).

Signed-off-by: Petr Vaněk <pv@excello.cz>
Acked-by: Christophe Gouault <christophe.gouault@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
index ff7cfdc6cb44dc98dde15e2e39ebebd80ec8f916..ffc6a5391bb7bb8f7543cb36fb16487596fd3255 100644 (file)
--- a/include/uapi/linux/xfrm.h
+++ b/include/uapi/linux/xfrm.h
@@ -387,6 +387,7 @@ struct xfrm_usersa_info {
 };
 
 #define XFRM_SA_XFLAG_DONT_ENCAP_DSCP  1
+#define XFRM_SA_XFLAG_OSEQ_MAY_WRAP    2
 
 struct xfrm_usersa_id {
        xfrm_address_t                  daddr;

diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 98943f8d01aa05843b1fd6ff71c8246d0ef5068f..c6a4338a0d08e82ee145e057012d61416f3b451f 100644 (file)
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -89,7 +89,8 @@ static int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
        if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
                XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
                XFRM_SKB_CB(skb)->seq.output.hi = 0;
-               if (unlikely(x->replay.oseq == 0)) {
+               if (unlikely(x->replay.oseq == 0) &&
+                   !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
                        x->replay.oseq--;
                        xfrm_audit_state_replay_overflow(x, skb);
                        err = -EOVERFLOW;
@@ -168,7 +169,8 @@ static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
        if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
                XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
                XFRM_SKB_CB(skb)->seq.output.hi = 0;
-               if (unlikely(replay_esn->oseq == 0)) {
+               if (unlikely(replay_esn->oseq == 0) &&
+                   !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
                        replay_esn->oseq--;
                        xfrm_audit_state_replay_overflow(x, skb);
                        err = -EOVERFLOW;
@@ -572,7 +574,8 @@ static int xfrm_replay_overflow_offload(struct xfrm_state *x, struct sk_buff *sk
 
                XFRM_SKB_CB(skb)->seq.output.hi = 0;
                xo->seq.hi = 0;
-               if (unlikely(oseq < x->replay.oseq)) {
+               if (unlikely(oseq < x->replay.oseq) &&
+                   !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
                        xfrm_audit_state_replay_overflow(x, skb);
                        err = -EOVERFLOW;
 
@@ -611,7 +614,8 @@ static int xfrm_replay_overflow_offload_bmp(struct xfrm_state *x, struct sk_buff
 
                XFRM_SKB_CB(skb)->seq.output.hi = 0;
                xo->seq.hi = 0;
-               if (unlikely(oseq < replay_esn->oseq)) {
+               if (unlikely(oseq < replay_esn->oseq) &&
+                   !(x->props.extra_flags & XFRM_SA_XFLAG_OSEQ_MAY_WRAP)) {
                        xfrm_audit_state_replay_overflow(x, skb);
                        err = -EOVERFLOW;