dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

[IPSEC]: Reject packets within replay window but outside the bit mask 

Up until this point we've accepted replay window settings greater than
32 but our bit mask can only accomodate 32 packets.  Thus any packet
with a sequence number within the window but outside the bit mask would
be accepted.

This patch causes those packets to be rejected instead.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Herbert Xu 2007-04-05 00:07:39 -07:00 committed by David S. Miller
parent 60e5c16641
commit 4c4d51a731
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/xfrm/xfrm_state.c
View File

@ -1371,7 +1371,8 @@ int xfrm_replay_check(struct xfrm_state *x, __be32 net_seq)
return 0;
diff = x->replay.seq - seq;
if (diff >= x->props.replay_window) {
if (diff >= min_t(unsigned int, x->props.replay_window,
sizeof(x->replay.bitmap) * 8)) {
x->stats.replay_window++;
return -EINVAL;
}