1/*
2 * rdbx.c
3 *
4 * a replay database with extended range, using a rollover counter
5 *
6 * David A. McGrew
7 * Cisco Systems, Inc.
8 */
9
10/*
11 *
12 * Copyright (c) 2001-2006, Cisco Systems, Inc.
13 * All rights reserved.
14 *
15 * Redistribution and use in source and binary forms, with or without
16 * modification, are permitted provided that the following conditions
17 * are met:
18 *
19 *   Redistributions of source code must retain the above copyright
20 *   notice, this list of conditions and the following disclaimer.
21 *
22 *   Redistributions in binary form must reproduce the above
23 *   copyright notice, this list of conditions and the following
24 *   disclaimer in the documentation and/or other materials provided
25 *   with the distribution.
26 *
27 *   Neither the name of the Cisco Systems, Inc. nor the names of its
28 *   contributors may be used to endorse or promote products derived
29 *   from this software without specific prior written permission.
30 *
31 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
32 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
33 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
34 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
35 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
36 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
37 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
38 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
39 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
40 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
41 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
42 * OF THE POSSIBILITY OF SUCH DAMAGE.
43 *
44 */
45
46#include "rdbx.h"
47
48
49/*
50 * from draft-ietf-avt-srtp-00.txt:
51 *
52 * A receiver reconstructs the index i of a packet with sequence
53 *  number s using the estimate
54 *
55 * i = 65,536 * t + s,
56 *
57 * where t is chosen from the set { r-1, r, r+1 } such that i is
58 * closest to the value 65,536 * r + s_l.  If the value r+1 is used,
59 * then the rollover counter r in the cryptographic context is
60 * incremented by one (if the packet containing s is authentic).
61 */
62
63
64
65/*
66 * rdbx implementation notes
67 *
68 * A xtd_seq_num_t is essentially a sequence number for which some of
69 * the data on the wire are implicit.  It logically consists of a
70 * rollover counter and a sequence number; the sequence number is the
71 * explicit part, and the rollover counter is the implicit part.
72 *
73 * Upon receiving a sequence_number (e.g. in a newly received SRTP
74 * packet), the complete xtd_seq_num_t can be estimated by using a
75 * local xtd_seq_num_t as a basis.  This is done using the function
76 * index_guess(&local, &guess, seq_from_packet).  This function
77 * returns the difference of the guess and the local value.  The local
78 * xtd_seq_num_t can be moved forward to the guess using the function
79 * index_advance(&guess, delta), where delta is the difference.
80 *
81 *
82 * A rdbx_t consists of a xtd_seq_num_t and a bitmask.  The index is highest
83 * sequence number that has been received, and the bitmask indicates
84 * which of the recent indicies have been received as well.  The
85 * highest bit in the bitmask corresponds to the index in the bitmask.
86 */
87
88
89void
90index_init(xtd_seq_num_t *pi) {
91#ifdef NO_64BIT_MATH
92  *pi = make64(0,0);
93#else
94  *pi = 0;
95#endif
96}
97
98void
99index_advance(xtd_seq_num_t *pi, sequence_number_t s) {
100#ifdef NO_64BIT_MATH
101  /* a > ~b means a+b will generate a carry */
102  /* s is uint16 here */
103  *pi = make64(high32(*pi) + (s > ~low32(*pi) ? 1 : 0),low32(*pi) + s);
104#else
105  *pi += s;
106#endif
107}
108
109
110/*
111 * index_guess(local, guess, s)
112 *
113 * given a xtd_seq_num_t local (which represents the last
114 * known-to-be-good received xtd_seq_num_t) and a sequence number s
115 * (from a newly arrived packet), sets the contents of *guess to
116 * contain the best guess of the packet index to which s corresponds,
117 * and returns the difference between *guess and *local
118 *
119 * nota bene - the output is a signed integer, DON'T cast it to a
120 * unsigned integer!
121 */
122
123int
124index_guess(const xtd_seq_num_t *local,
125		   xtd_seq_num_t *guess,
126		   sequence_number_t s) {
127#ifdef NO_64BIT_MATH
128  uint32_t local_roc = ((high32(*local) << 16) |
129						(low32(*local) >> 16));
130  uint16_t local_seq = (uint16_t) (low32(*local));
131#else
132  uint32_t local_roc = (uint32_t)(*local >> 16);
133  uint16_t local_seq = (uint16_t) *local;
134#endif
135#ifdef NO_64BIT_MATH
136  uint32_t guess_roc = ((high32(*guess) << 16) |
137						(low32(*guess) >> 16));
138  uint16_t guess_seq = (uint16_t) (low32(*guess));
139#else
140  uint32_t guess_roc = (uint32_t)(*guess >> 16);
141  uint16_t guess_seq = (uint16_t) *guess;
142#endif
143  int difference;
144
145  if (local_seq < seq_num_median) {
146    if (s - local_seq > seq_num_median) {
147      guess_roc = local_roc - 1;
148      // The return value is the relative difference from local_seq to s.
149      // The original value is negation of its purpose.  According to document
150      // http://www.ietf.org/rfc/rfc3711.txt, when this condition is true, the
151      // resulting new index should be (local_roc-1, s).  But original logic
152      // will end up positive difference and rdbx_check would pass.  Hence after
153      // rdbx_add_index would make local index to be the wrong value because
154      // local index should not be updated in this case.  For example, when
155      // local index is (1, 100) and next sequence is 65530, the wrong updated
156      // index would be (1, 205).
157      difference = s - local_seq - seq_num_max;
158    } else {
159      guess_roc = local_roc;
160      difference = s - local_seq;
161    }
162  } else {
163    if (local_seq - seq_num_median > s) {
164      guess_roc = local_roc+1;
165      difference = seq_num_max - local_seq + s;
166    } else {
167      difference = s - local_seq;
168      guess_roc = local_roc;
169    }
170  }
171  guess_seq = s;
172
173  /* Note: guess_roc is 32 bits, so this generates a 48-bit result! */
174#ifdef NO_64BIT_MATH
175  *guess = make64(guess_roc >> 16,
176				  (guess_roc << 16) | guess_seq);
177#else
178  *guess = (((uint64_t) guess_roc) << 16) | guess_seq;
179#endif
180
181  return difference;
182}
183
184/*
185 * rdbx
186 *
187 */
188
189
190/*
191 *  rdbx_init(&r, ws) initializes the rdbx_t pointed to by r with window size ws
192 */
193
194err_status_t
195rdbx_init(rdbx_t *rdbx, unsigned long ws) {
196  if (ws == 0)
197    return err_status_bad_param;
198
199  if (bitvector_alloc(&rdbx->bitmask, ws) != 0)
200    return err_status_alloc_fail;
201
202  index_init(&rdbx->index);
203
204  return err_status_ok;
205}
206
207/*
208 *  rdbx_uninit(&r) uninitializes the rdbx_t pointed to by r
209 */
210
211err_status_t
212rdbx_uninit(rdbx_t *rdbx) {
213  bitvector_dealloc(&rdbx->bitmask);
214
215  return err_status_ok;
216}
217
218/*
219 * rdbx_set_roc(rdbx, roc) initalizes the rdbx_t at the location rdbx
220 * to have the rollover counter value roc.  If that value is less than
221 * the current rollover counter value, then the function returns
222 * err_status_replay_old; otherwise, err_status_ok is returned.
223 *
224 */
225
226err_status_t
227rdbx_set_roc(rdbx_t *rdbx, uint32_t roc) {
228  bitvector_set_to_zero(&rdbx->bitmask);
229
230#ifdef NO_64BIT_MATH
231  #error not yet implemented
232#else
233
234  /* make sure that we're not moving backwards */
235  if (roc < (rdbx->index >> 16))
236    return err_status_replay_old;
237
238  rdbx->index &= 0xffff;   /* retain lowest 16 bits */
239  rdbx->index |= ((uint64_t)roc) << 16;  /* set ROC */
240#endif
241
242  return err_status_ok;
243}
244
245/*
246 * rdbx_get_packet_index(rdbx) returns the value of the packet index
247 * for the rdbx_t pointed to by rdbx
248 *
249 */
250
251xtd_seq_num_t
252rdbx_get_packet_index(const rdbx_t *rdbx) {
253  return rdbx->index;
254}
255
256/*
257 * rdbx_get_window_size(rdbx) returns the value of the window size
258 * for the rdbx_t pointed to by rdbx
259 *
260 */
261
262unsigned long
263rdbx_get_window_size(const rdbx_t *rdbx) {
264  return bitvector_get_length(&rdbx->bitmask);
265}
266
267/*
268 * rdbx_check(&r, delta) checks to see if the xtd_seq_num_t
269 * which is at rdbx->index + delta is in the rdb
270 */
271
272err_status_t
273rdbx_check(const rdbx_t *rdbx, int delta) {
274
275  if (delta > 0) {       /* if delta is positive, it's good */
276    return err_status_ok;
277  } else if ((int)(bitvector_get_length(&rdbx->bitmask) - 1) + delta < 0) {
278                         /* if delta is lower than the bitmask, it's bad */
279    return err_status_replay_old;
280  } else if (bitvector_get_bit(&rdbx->bitmask,
281			  (int)(bitvector_get_length(&rdbx->bitmask) - 1) + delta) == 1) {
282                         /* delta is within the window, so check the bitmask */
283    return err_status_replay_fail;
284  }
285 /* otherwise, the index is okay */
286
287  return err_status_ok;
288}
289
290/*
291 * rdbx_add_index adds the xtd_seq_num_t at rdbx->window_start + d to
292 * replay_db (and does *not* check if that xtd_seq_num_t appears in db)
293 *
294 * this function should be called only after replay_check has
295 * indicated that the index does not appear in the rdbx, e.g., a mutex
296 * should protect the rdbx between these calls if need be
297 */
298
299err_status_t
300rdbx_add_index(rdbx_t *rdbx, int delta) {
301
302  if (delta > 0) {
303    /* shift forward by delta */
304    index_advance(&rdbx->index, delta);
305    bitvector_left_shift(&rdbx->bitmask, delta);
306    bitvector_set_bit(&rdbx->bitmask, bitvector_get_length(&rdbx->bitmask) - 1);
307  } else {
308    /* delta is in window, so flip bit in bitmask */
309    bitvector_set_bit(&rdbx->bitmask, -delta);
310  }
311
312  /* note that we need not consider the case that delta == 0 */
313
314  return err_status_ok;
315}
316
317
318
319/*
320 * rdbx_estimate_index(rdbx, guess, s)
321 *
322 * given an rdbx and a sequence number s (from a newly arrived packet),
323 * sets the contents of *guess to contain the best guess of the packet
324 * index to which s corresponds, and returns the difference between
325 * *guess and the locally stored synch info
326 */
327
328int
329rdbx_estimate_index(const rdbx_t *rdbx,
330		    xtd_seq_num_t *guess,
331		    sequence_number_t s) {
332
333  /*
334   * if the sequence number and rollover counter in the rdbx are
335   * non-zero, then use the index_guess(...) function, otherwise, just
336   * set the rollover counter to zero (since the index_guess(...)
337   * function might incorrectly guess that the rollover counter is
338   * 0xffffffff)
339   */
340
341#ifdef NO_64BIT_MATH
342  /* seq_num_median = 0x8000 */
343  if (high32(rdbx->index) > 0 ||
344	  low32(rdbx->index) > seq_num_median)
345#else
346  if (rdbx->index > seq_num_median)
347#endif
348    return index_guess(&rdbx->index, guess, s);
349
350#ifdef NO_64BIT_MATH
351  *guess = make64(0,(uint32_t) s);
352#else
353  *guess = s;
354#endif
355
356#ifdef NO_64BIT_MATH
357  return s - (uint16_t) low32(rdbx->index);
358#else
359  return s - (uint16_t) rdbx->index;
360#endif
361}
362