1 #include <linux/config.h>
2 #include <linux/module.h>
3 #include <net/inet_ecn.h>
7 #include <linux/crypto.h>
8 #include <linux/pfkeyv2.h>
10 #include <asm/scatterlist.h>
13 /* Clear mutable options and find final destination to substitute
14 * into IP header for icv calculation. Options are already checked
15 * for validity, so paranoia is not required. */
17 static int ip_clear_mutable_options(struct iphdr *iph, u32 *daddr)
19 unsigned char * optptr = (unsigned char*)(iph+1);
20 int l = iph->ihl*4 - sizeof(struct iphdr);
33 if (optlen<2 || optlen>l)
37 case 0x85: /* Some "Extended Security" crap. */
38 case 0x86: /* Another "Commercial Security" crap. */
40 case 0x80|21: /* RFC1770 */
46 memcpy(daddr, optptr+optlen-4, 4);
49 memset(optptr+2, 0, optlen-2);
57 static int ah_output(struct sk_buff *skb)
60 struct dst_entry *dst = skb->dst;
61 struct xfrm_state *x = dst->xfrm;
62 struct iphdr *iph, *top_iph;
63 struct ip_auth_hdr *ah;
70 if (skb->ip_summed == CHECKSUM_HW && skb_checksum_help(skb) == NULL) {
75 spin_lock_bh(&x->lock);
76 err = xfrm_check_output(x, skb, AF_INET);
82 top_iph = (struct iphdr*)skb_push(skb, x->props.header_len);
86 top_iph->tot_len = htons(skb->len);
87 top_iph->frag_off = 0;
88 if (!(iph->frag_off&htons(IP_DF)))
89 __ip_select_ident(top_iph, dst, 0);
91 top_iph->protocol = IPPROTO_AH;
93 top_iph->saddr = x->props.saddr.a4;
94 top_iph->daddr = x->id.daddr.a4;
95 ah = (struct ip_auth_hdr*)(top_iph+1);
96 ah->nexthdr = IPPROTO_IPIP;
98 memcpy(&tmp_iph, skb->data, iph->ihl*4);
99 top_iph = (struct iphdr*)skb_push(skb, x->props.header_len);
100 memcpy(top_iph, &tmp_iph, iph->ihl*4);
103 top_iph->tot_len = htons(skb->len);
104 top_iph->frag_off = 0;
106 top_iph->protocol = IPPROTO_AH;
108 if (top_iph->ihl != 5) {
109 err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
113 ah = (struct ip_auth_hdr*)((char*)top_iph+iph->ihl*4);
114 ah->nexthdr = iph->protocol;
117 ah->hdrlen = (XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
118 ahp->icv_trunc_len) >> 2) - 2;
122 ah->seq_no = htonl(++x->replay.oseq);
123 ahp->icv(ahp, skb, ah->auth_data);
124 top_iph->tos = iph->tos;
125 top_iph->ttl = iph->ttl;
127 if (x->props.flags & XFRM_STATE_NOECN)
128 IP_ECN_clear(top_iph);
129 top_iph->frag_off = iph->frag_off&~htons(IP_MF|IP_OFFSET);
130 memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
132 top_iph->frag_off = iph->frag_off;
133 top_iph->daddr = iph->daddr;
135 memcpy(top_iph+1, iph+1, iph->ihl*4 - sizeof(struct iphdr));
137 ip_send_check(top_iph);
139 skb->nh.raw = skb->data;
141 x->curlft.bytes += skb->len;
143 spin_unlock_bh(&x->lock);
144 if ((skb->dst = dst_pop(dst)) == NULL) {
148 return NET_XMIT_BYPASS;
151 spin_unlock_bh(&x->lock);
157 int ah_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
161 struct ip_auth_hdr *ah;
165 if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
168 ah = (struct ip_auth_hdr*)skb->data;
170 ah_hlen = (ah->hdrlen + 2) << 2;
172 if (ah_hlen != XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_full_len) &&
173 ah_hlen != XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len))
176 if (!pskb_may_pull(skb, ah_hlen))
179 /* We are going to _remove_ AH header to keep sockets happy,
180 * so... Later this can change. */
181 if (skb_cloned(skb) &&
182 pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
185 skb->ip_summed = CHECKSUM_NONE;
187 ah = (struct ip_auth_hdr*)skb->data;
190 memcpy(work_buf, iph, iph->ihl*4);
198 if (ip_clear_mutable_options(iph, &dummy))
202 u8 auth_data[MAX_AH_AUTH_LEN];
204 memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
205 skb_push(skb, skb->data - skb->nh.raw);
206 ahp->icv(ahp, skb, ah->auth_data);
207 if (memcmp(ah->auth_data, auth_data, ahp->icv_trunc_len)) {
208 x->stats.integrity_failed++;
212 ((struct iphdr*)work_buf)->protocol = ah->nexthdr;
213 skb->nh.raw = skb_pull(skb, ah_hlen);
214 memcpy(skb->nh.raw, work_buf, iph->ihl*4);
215 skb->nh.iph->tot_len = htons(skb->len);
216 skb_pull(skb, skb->nh.iph->ihl*4);
217 skb->h.raw = skb->data;
225 void ah4_err(struct sk_buff *skb, u32 info)
227 struct iphdr *iph = (struct iphdr*)skb->data;
228 struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+(iph->ihl<<2));
229 struct xfrm_state *x;
231 if (skb->h.icmph->type != ICMP_DEST_UNREACH ||
232 skb->h.icmph->code != ICMP_FRAG_NEEDED)
235 x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
238 printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
239 ntohl(ah->spi), ntohl(iph->daddr));
243 static int ah_init_state(struct xfrm_state *x, void *args)
245 struct ah_data *ahp = NULL;
246 struct xfrm_algo_desc *aalg_desc;
251 /* null auth can use a zero length key */
252 if (x->aalg->alg_key_len > 512)
255 ahp = kmalloc(sizeof(*ahp), GFP_KERNEL);
259 memset(ahp, 0, sizeof(*ahp));
261 ahp->key = x->aalg->alg_key;
262 ahp->key_len = (x->aalg->alg_key_len+7)/8;
263 ahp->tfm = crypto_alloc_tfm(x->aalg->alg_name, 0);
266 ahp->icv = ah_hmac_digest;
269 * Lookup the algorithm description maintained by xfrm_algo,
270 * verify crypto transform properties, and store information
271 * we need for AH processing. This lookup cannot fail here
272 * after a successful crypto_alloc_tfm().
274 aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name);
277 if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
278 crypto_tfm_alg_digestsize(ahp->tfm)) {
279 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
280 x->aalg->alg_name, crypto_tfm_alg_digestsize(ahp->tfm),
281 aalg_desc->uinfo.auth.icv_fullbits/8);
285 ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
286 ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
288 BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
290 ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
294 x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len);
296 x->props.header_len += sizeof(struct iphdr);
304 kfree(ahp->work_icv);
306 crypto_free_tfm(ahp->tfm);
312 static void ah_destroy(struct xfrm_state *x)
314 struct ah_data *ahp = x->data;
320 kfree(ahp->work_icv);
321 ahp->work_icv = NULL;
324 crypto_free_tfm(ahp->tfm);
331 static struct xfrm_type ah_type =
333 .description = "AH4",
334 .owner = THIS_MODULE,
336 .init_state = ah_init_state,
337 .destructor = ah_destroy,
342 static struct inet_protocol ah4_protocol = {
343 .handler = xfrm4_rcv,
344 .err_handler = ah4_err,
348 static int __init ah4_init(void)
350 if (xfrm_register_type(&ah_type, AF_INET) < 0) {
351 printk(KERN_INFO "ip ah init: can't add xfrm type\n");
354 if (inet_add_protocol(&ah4_protocol, IPPROTO_AH) < 0) {
355 printk(KERN_INFO "ip ah init: can't add protocol\n");
356 xfrm_unregister_type(&ah_type, AF_INET);
362 static void __exit ah4_fini(void)
364 if (inet_del_protocol(&ah4_protocol, IPPROTO_AH) < 0)
365 printk(KERN_INFO "ip ah close: can't remove protocol\n");
366 if (xfrm_unregister_type(&ah_type, AF_INET) < 0)
367 printk(KERN_INFO "ip ah close: can't remove xfrm type\n");
370 module_init(ah4_init);
371 module_exit(ah4_fini);
372 MODULE_LICENSE("GPL");