Function ipsec_updatereplay

freebsd/netipsec/ipsec.c:1363–1449

* Check replay counter whether to update or not. * OUT: 0: OK * 1: NG */

 *	1:	NG
 */
int
ipsec_updatereplay(uint32_t seq, struct secasvar *sav)
{
	struct secreplay *replay;
	uint32_t window;
	uint32_t tl, th, bl;
	uint32_t seqh;

	IPSEC_ASSERT(sav != NULL, ("Null SA"));
	IPSEC_ASSERT(sav->replay != NULL, ("Null replay state"));

	replay = sav->replay;

	/* No need to check replay if disabled. */
	if (replay->wsize == 0)
		return (0);

	/* Zero sequence number is not allowed. */
	if (seq == 0 && replay->last == 0)
		return (1);

	window = replay->wsize << 3;		/* Size of window */
	tl = (uint32_t)replay->last;		/* Top of window, lower part */
	th = (uint32_t)(replay->last >> 32);	/* Top of window, high part */
	bl = tl - window + 1;			/* Bottom of window, lower part */

	/*
	 * We keep the high part intact when:
	 * 1) the seq is within [bl, 0xffffffff] and the whole window is
	 *    within one subspace;
	 * 2) the seq is within [0, bl) and window spans two subspaces.
	 */
	if ((tl >= window - 1 && seq >= bl) ||
	    (tl < window - 1 && seq < bl)) {
		seqh = th;
		if (seq <= tl) {
			/* Sequence number inside window - check against replay */
			if (check_window(replay, seq))
				return (1);
			set_window(replay, seq);
		} else {
			advance_window(replay, ((uint64_t)seqh << 32) | seq);
			set_window(replay, seq);
			replay->last = ((uint64_t)seqh << 32) | seq;
		}

		/* Sequence number above top of window or not found in bitmap */
		replay->count++;
		return (0);
	}

	if (!(sav->flags & SADB_X_SAFLAGS_ESN))
		return (1);

	/*
	 * Seq is within [bl, 0xffffffff] and bl is within
	 * [0xffffffff-window, 0xffffffff].  This means we got a seq
	 * which is within our replay window, but in the previous