Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 407d34ef authored by Herbert Xu's avatar Herbert Xu Committed by Steffen Klassert
Browse files

xfrm: Always zero high-order sequence number bits 



As we're now always including the high bits of the sequence number
in the IV generation process we need to ensure that they don't
contain crap.

This patch ensures that the high sequence bits are always zeroed
so that we don't leak random data into the IV.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 6d7258ca

net/xfrm/xfrm_replay.c

+2 −0
Original line number Diff line number Diff line
@@ -99,6 +99,7 @@ static int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb) 


	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {

		XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;

		XFRM_SKB_CB(skb)->seq.output.hi = 0;

		if (unlikely(x->replay.oseq == 0)) {

			x->replay.oseq--;

			xfrm_audit_state_replay_overflow(x, skb);
@@ -177,6 +178,7 @@ static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb) 


	if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {

		XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;

		XFRM_SKB_CB(skb)->seq.output.hi = 0;

		if (unlikely(replay_esn->oseq == 0)) {

			replay_esn->oseq--;

			xfrm_audit_state_replay_overflow(x, skb);