bsd/netinet6/ipsec.c

2652  * Check the variable replay window.
2653  * ipsec_chkreplay() performs replay check before ICV verification.
2654  * ipsec_updatereplay() updates replay bitmap.  This must be called after
2655  * ICV verification (it also performs replay check, which is usually done
2666 	const struct secreplay *replay;
2678 	replay = sav->replay;
2680 	if (replay->wsize == 0) {
2682 		return 1;	/* no need to check replay. */
2686 	frlast = replay->wsize - 1;
2687 	wsizeb = replay->wsize << 3;
2696 	if (replay->count == 0) {
2701 	if (seq > replay->lastseq) {
2707 		diff = replay->lastseq - seq;
2718 		if ((replay->bitmap)[fr] & (1 << (diff % 8))) {
2730  * check replay counter whether to update or not.
2739 	struct secreplay *replay;
2750 	replay = sav->replay;
2752 	if (replay->wsize == 0)
2753 		goto ok;	/* no need to check replay. */
2756 	frlast = replay->wsize - 1;
2757 	wsizeb = replay->wsize << 3;
2764 	if (replay->count == 0) {
2765 		replay->lastseq = seq;
2766 		bzero(replay->bitmap, replay->wsize);
2767 		(replay->bitmap)[frlast] = 1;
2771 	if (seq > replay->lastseq) {
2773 		diff = seq - replay->lastseq;
2779 			vshiftl((unsigned char *) replay->bitmap, diff, replay->wsize);
2780 			(replay->bitmap)[frlast] |= 1;
2783 			bzero(replay->bitmap, replay->wsize);
2784 			(replay->bitmap)[frlast] = 1;
2786 		replay->lastseq = seq;
2791 		diff = replay->lastseq - seq;
2802 		if ((replay->bitmap)[fr] & (1 << (diff % 8))) {
2808 		(replay->bitmap)[fr] |= (1 << (diff % 8));
2814 	if (replay->count == ~0) {
2817 		replay->overflow++;
2825 		ipseclog((LOG_WARNING, "replay counter made %d cycle. %s\n",
2826 		    replay->overflow, ipsec_logsastr(sav)));
2829 	replay->count++;