Fix ESP replay problem

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

diff --git a/esp-seqno.c b/esp-seqno.c
index afb4542199c84d8386a6440817eabb0772dbf4c1..eef2ec9e08557ebaa7a9825536dd05b460642652 100644 (file)
--- a/esp-seqno.c
+++ b/esp-seqno.c
@@ -67,16 +67,19 @@ int verify_packet_seqno(struct openconnect_info *vpninfo,
                             _("Discarding ancient ESP packet with seq %u (expected %" PRIu64 ")\n"),
                             seq, esp->seq);
                return -EINVAL;
+       } else if (seq == esp->seq - 1) {
+               /* This is a repeat of the latest packet we already received. */
+       replayed:
+               vpn_progress(vpninfo, PRG_DEBUG,
+                            _("Discarding replayed ESP packet with seq %u\n"),
+                            seq);
+               return -EINVAL;
        } else if (seq < esp->seq) {
                /* Within the backlog window, so we remember whether we've seen it or not. */
                uint64_t mask = 1ULL << (esp->seq - seq - 2);
 
-               if (!(esp->seq_backlog & mask)) {
-                       vpn_progress(vpninfo, PRG_DEBUG,
-                                    _("Discarding replayed ESP packet with seq %u\n"),
-                                    seq);
-                       return -EINVAL;
-               }
+               if (!(esp->seq_backlog & mask))
+                       goto replayed;
 
                esp->seq_backlog &= ~mask;
                vpn_progress(vpninfo, PRG_TRACE,

diff --git a/tests/seqtest.c b/tests/seqtest.c
index 3c67a698902f415329f73e13fbb028480ed228b0..d38646cc92573f83bb5d3c1d220ab4f37821fb12 100644 (file)
--- a/tests/seqtest.c
+++ b/tests/seqtest.c
@@ -45,9 +45,11 @@ int main(void)
            !verify_packet_seqno(NULL, &esptest, 0) ||
            verify_packet_seqno(NULL, &esptest, 64) ||
            verify_packet_seqno(NULL, &esptest, 65) ||
+           !verify_packet_seqno(NULL, &esptest, 65) ||
            verify_packet_seqno(NULL, &esptest, 66) ||
            verify_packet_seqno(NULL, &esptest, 67) ||
            verify_packet_seqno(NULL, &esptest, 68) ||
+           !verify_packet_seqno(NULL, &esptest, 68) ||
            !verify_packet_seqno(NULL, &esptest, 2) ||
            !verify_packet_seqno(NULL, &esptest, 3) ||
            verify_packet_seqno(NULL, &esptest, 4) ||