F-11440: carry the full 64-bit ESP replay bitmap through the persistence callbacks

The replay window is 64 bits (ESP_REPLAY_WIN) but the state
persistence callbacks accepted and returned only a uint32_t bitmap:
esp_state_save dropped bits 32..63 and esp_state_restore
reconstituted only the lower half. A duplicate represented by a
discarded upper-half bit was therefore accepted after a restore,
still inside the active replay window (RFC 4303 s3.4.3).

widen the callback API (wolfIP_esp_state_write_cb/read_cb) to
uint64_t and use it in esp_state_restore. wolfIP is pre-1.0, so the
breaking typedef change lands now rather than a second callback pair.

Unit test (test_esp_state_persistence_keeps_64bit_bitmap): SA with a
window whose bitmap has bit 40 set; delete (save event) must hand the
write callback the full 64-bit value, and recreating the SA must
restore it so the upper-half duplicate (seq 60) is rejected. Fails
pre-fix: the bitmap arrives truncated to 1.

Author: danielinux

src/test/unit/unit_esp.c

@@ -2236,7 +2236,7 @@ static int     state_write_calls = 0;
 static uint32_t state_last_oseq = 0;
 
 static int state_test_read_cb(const uint8_t *spi, uint32_t *oseq,
-                              uint32_t *hi_seq, uint32_t *bitmap)
+                              uint32_t *hi_seq, uint64_t *bitmap)
 {
     state_read_calls++;
     if (memcmp(spi, state_test_spi, ESP_SPI_LEN) == 0) {
@@ -2248,7 +2248,7 @@ static int state_test_read_cb(const uint8_t *spi, uint32_t *oseq,
 }
 
 static int state_test_write_cb(const uint8_t *spi, uint32_t oseq,
-                               uint32_t hi_seq, uint32_t bitmap)
+                               uint32_t hi_seq, uint64_t bitmap)
 {
     state_write_calls++;
     if (memcmp(spi, state_test_spi, ESP_SPI_LEN) == 0) {
@@ -2273,7 +2273,7 @@ state_test_wire_seq(const struct wolfIP_ip_packet *ip)
 static uint8_t state_fail_spi[ESP_SPI_LEN] = {0x99, 0x88, 0x77, 0x66};
 
 static int state_fail_read_cb(const uint8_t *spi, uint32_t *oseq,
-                              uint32_t *hi_seq, uint32_t *bitmap)
+                              uint32_t *hi_seq, uint64_t *bitmap)
 {
     if (memcmp(spi, state_fail_spi, ESP_SPI_LEN) == 0) {
         *oseq   = 0xDEADBEEFU;
@@ -2319,6 +2319,99 @@ START_TEST(test_esp_state_restore_failed_read_keeps_fresh_state)
 }
 END_TEST
 
+/* F-11440: the persistence callbacks must carry the full 64-bit replay
+ * bitmap. The old uint32_t callback types truncated bits 32..63 on save
+ * and reconstituted only the lower half on restore, so a duplicate in
+ * the upper half of the window was accepted after a restore. */
+static uint8_t  state_64bit_spi[ESP_SPI_LEN] = {0x55, 0x44, 0x33, 0x22};
+static uint32_t state64_oseq   = 0;
+static uint32_t state64_hi_seq = 0;
+static uint64_t state64_bitmap = 0;
+
+static int state64_read_cb(const uint8_t *spi, uint32_t *oseq,
+                           uint32_t *hi_seq, uint64_t *bitmap)
+{
+    if (memcmp(spi, state_64bit_spi, ESP_SPI_LEN) == 0) {
+        *oseq   = state64_oseq;
+        *hi_seq = state64_hi_seq;
+        *bitmap = state64_bitmap;
+        return 0;
+    }
+    return -1; /* unknown SPI: start fresh */
+}
+
+static int state64_write_cb(const uint8_t *spi, uint32_t oseq,
+                            uint32_t hi_seq, uint64_t bitmap)
+{
+    if (memcmp(spi, state_64bit_spi, ESP_SPI_LEN) == 0) {
+        state64_oseq   = oseq;
+        state64_hi_seq = hi_seq;
+        state64_bitmap = bitmap;
+    }
+    return 0;
+}
+
+START_TEST(test_esp_state_persistence_keeps_64bit_bitmap)
+{
+    int ret;
+    wolfIP_esp_sa *esp_sa;
+
+    esp_setup();
+    state64_oseq = 0;
+    state64_hi_seq = 0;
+    state64_bitmap = 0;
+
+    ret = wolfIP_esp_state_set_cbs(state64_write_cb, state64_read_cb);
+    ck_assert_int_eq(ret, 0);
+
+    ret = wolfIP_esp_sa_new_cbc_hmac(1, state_64bit_spi,
+                                     atoip4(T_SRC), atoip4(T_DST),
+                                     (uint8_t *)k_aes128, sizeof(k_aes128),
+                                     ESP_AUTH_SHA256_RFC4868,
+                                     (uint8_t *)k_auth16, sizeof(k_auth16),
+                                     ESP_ICVLEN_HMAC_128);
+    ck_assert_int_eq(ret, 0);
+    esp_sa = esp_sa_get(1, state_64bit_spi);
+    ck_assert_ptr_nonnull(esp_sa);
+
+    /* A window with a set bit in the upper half of the bitmap:
+     * hi_seq 100, seq 60 already accepted (bit 100-60 = 40). */
+    esp_sa->replay.oseq   = 7;
+    esp_sa->replay.hi_seq = 100;
+    esp_sa->replay.bitmap = (1ULL << 40) | 1ULL;
+
+    /* SA deletion is a save event: the write callback must receive the
+     * full 64-bit bitmap. */
+    wolfIP_esp_sa_del(1, state_64bit_spi);
+    ck_assert_uint_eq(state64_bitmap, (1ULL << 40) | 1ULL);
+    ck_assert_uint_eq(state64_hi_seq, 100U);
+    ck_assert_uint_eq(state64_oseq, 7U);
+
+    /* Recreating the SA must restore the full window, upper half
+     * included. */
+    ret = wolfIP_esp_sa_new_cbc_hmac(1, state_64bit_spi,
+                                     atoip4(T_SRC), atoip4(T_DST),
+                                     (uint8_t *)k_aes128, sizeof(k_aes128),
+                                     ESP_AUTH_SHA256_RFC4868,
+                                     (uint8_t *)k_auth16, sizeof(k_auth16),
+                                     ESP_ICVLEN_HMAC_128);
+    ck_assert_int_eq(ret, 0);
+    esp_sa = esp_sa_get(1, state_64bit_spi);
+    ck_assert_ptr_nonnull(esp_sa);
+    ck_assert_uint_eq(esp_sa->replay.bitmap, (1ULL << 40) | 1ULL);
+    ck_assert_uint_eq(esp_sa->replay.hi_seq, 100U);
+    ck_assert_uint_eq(esp_sa->replay.oseq, 7U);
+
+    /* The restored window must actually reject the upper-half duplicate
+     * (seq 60) and still accept new sequences. */
+    ck_assert_int_ne(esp_replay_check(&esp_sa->replay, 60U), 0);
+    ck_assert_int_eq(esp_replay_check(&esp_sa->replay, 101U), 0);
+
+    wolfIP_esp_sa_del_all();
+    wolfIP_esp_state_set_cbs(NULL, NULL);
+}
+END_TEST
+
 START_TEST(test_esp_state_persistence_callbacks)
 {
     static uint8_t buf[LINK_MTU + 256];
@@ -2495,6 +2588,7 @@ static Suite *esp_suite(void)
     tcase_add_test(tc, test_sa_del_all);
     tcase_add_test(tc, test_esp_state_persistence_callbacks);
     tcase_add_test(tc, test_esp_state_restore_failed_read_keeps_fresh_state);
+    tcase_add_test(tc, test_esp_state_persistence_keeps_64bit_bitmap);
     suite_add_tcase(s, tc);
 
     /* Replay window */

src/wolfesp.c

@@ -61,7 +61,7 @@ esp_state_restore(wolfIP_esp_sa *sa)
 {
     uint32_t oseq;
     uint32_t hi_seq;
-    uint32_t bitmap;
+    uint64_t bitmap;
 
     if (esp_state_read_cb) {
         oseq   = sa->replay.oseq;

wolfesp.h

@@ -109,15 +109,19 @@ typedef struct wolfIP_esp_sa wolfIP_esp_sa;
  * The read callback is invoked when a new SA is created, keyed by SPI.
  * It may fill the (fresh) oseq/hi_seq/bitmap values with persisted state.
  * Return 0 if state was restored, anything else to start the SA fresh.
+ *
+ * The bitmap is the full 64-bit inbound replay window
+ * (ESP_REPLAY_WIN); persisting only half of it lets a duplicate in the
+ * upper half of the window be accepted after a restore.
  * */
 typedef int (*wolfIP_esp_state_write_cb)(const uint8_t *spi,
                                          uint32_t oseq,
                                          uint32_t hi_seq,
-                                         uint32_t bitmap);
+                                         uint64_t bitmap);
 typedef int (*wolfIP_esp_state_read_cb)(const uint8_t *spi,
                                         uint32_t *oseq,
                                         uint32_t *hi_seq,
-                                        uint32_t *bitmap);
+                                        uint64_t *bitmap);
 int  wolfIP_esp_state_set_cbs(wolfIP_esp_state_write_cb write,
                               wolfIP_esp_state_read_cb read);