1 #include <linux/config.h>
2 #include <linux/module.h>
3 #include <net/inet_ecn.h>
7 #include <linux/crypto.h>
8 #include <linux/pfkeyv2.h>
10 #include <asm/scatterlist.h>
13 /* Clear mutable options and find final destination to substitute
14 * into IP header for icv calculation. Options are already checked
15 * for validity, so paranoia is not required. */
17 static int ip_clear_mutable_options(struct iphdr *iph, u32 *daddr)
19 unsigned char * optptr = (unsigned char*)(iph+1);
20 int l = iph->ihl*4 - sizeof(struct iphdr);
33 if (optlen<2 || optlen>l)
37 case 0x85: /* Some "Extended Security" crap. */
38 case 0x86: /* Another "Commercial Security" crap. */
40 case 0x80|21: /* RFC1770 */
46 memcpy(daddr, optptr+optlen-4, 4);
49 memset(optptr+2, 0, optlen-2);
57 static int ah_output(struct sk_buff **pskb)
60 struct dst_entry *dst = (*pskb)->dst;
61 struct xfrm_state *x = dst->xfrm;
62 struct iphdr *iph, *top_iph;
63 struct ip_auth_hdr *ah;
70 if ((*pskb)->ip_summed == CHECKSUM_HW) {
71 err = skb_checksum_help(pskb, 0);
76 spin_lock_bh(&x->lock);
77 err = xfrm_check_output(x, *pskb, AF_INET);
81 iph = (*pskb)->nh.iph;
83 top_iph = (struct iphdr*)skb_push(*pskb, x->props.header_len);
87 top_iph->tot_len = htons((*pskb)->len);
88 top_iph->frag_off = 0;
89 if (!(iph->frag_off&htons(IP_DF)))
90 __ip_select_ident(top_iph, dst, 0);
92 top_iph->protocol = IPPROTO_AH;
94 top_iph->saddr = x->props.saddr.a4;
95 top_iph->daddr = x->id.daddr.a4;
96 ah = (struct ip_auth_hdr*)(top_iph+1);
97 ah->nexthdr = IPPROTO_IPIP;
99 memcpy(&tmp_iph, (*pskb)->data, iph->ihl*4);
100 top_iph = (struct iphdr*)skb_push(*pskb, x->props.header_len);
101 memcpy(top_iph, &tmp_iph, iph->ihl*4);
104 top_iph->tot_len = htons((*pskb)->len);
105 top_iph->frag_off = 0;
107 top_iph->protocol = IPPROTO_AH;
109 if (top_iph->ihl != 5) {
110 err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
114 ah = (struct ip_auth_hdr*)((char*)top_iph+iph->ihl*4);
115 ah->nexthdr = iph->protocol;
118 ah->hdrlen = (XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
119 ahp->icv_trunc_len) >> 2) - 2;
123 ah->seq_no = htonl(++x->replay.oseq);
124 ahp->icv(ahp, *pskb, ah->auth_data);
125 top_iph->tos = iph->tos;
126 top_iph->ttl = iph->ttl;
128 if (x->props.flags & XFRM_STATE_NOECN)
129 IP_ECN_clear(top_iph);
130 top_iph->frag_off = iph->frag_off&~htons(IP_MF|IP_OFFSET);
131 memset(&(IPCB(*pskb)->opt), 0, sizeof(struct ip_options));
133 top_iph->frag_off = iph->frag_off;
134 top_iph->daddr = iph->daddr;
136 memcpy(top_iph+1, iph+1, iph->ihl*4 - sizeof(struct iphdr));
138 ip_send_check(top_iph);
140 (*pskb)->nh.raw = (*pskb)->data;
142 x->curlft.bytes += (*pskb)->len;
144 spin_unlock_bh(&x->lock);
145 if (((*pskb)->dst = dst_pop(dst)) == NULL) {
149 return NET_XMIT_BYPASS;
152 spin_unlock_bh(&x->lock);
158 int ah_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
162 struct ip_auth_hdr *ah;
166 if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
169 ah = (struct ip_auth_hdr*)skb->data;
171 ah_hlen = (ah->hdrlen + 2) << 2;
173 if (ah_hlen != XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_full_len) &&
174 ah_hlen != XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len))
177 if (!pskb_may_pull(skb, ah_hlen))
180 /* We are going to _remove_ AH header to keep sockets happy,
181 * so... Later this can change. */
182 if (skb_cloned(skb) &&
183 pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
186 skb->ip_summed = CHECKSUM_NONE;
188 ah = (struct ip_auth_hdr*)skb->data;
191 memcpy(work_buf, iph, iph->ihl*4);
199 if (ip_clear_mutable_options(iph, &dummy))
203 u8 auth_data[MAX_AH_AUTH_LEN];
205 memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
206 skb_push(skb, skb->data - skb->nh.raw);
207 ahp->icv(ahp, skb, ah->auth_data);
208 if (memcmp(ah->auth_data, auth_data, ahp->icv_trunc_len)) {
209 x->stats.integrity_failed++;
213 ((struct iphdr*)work_buf)->protocol = ah->nexthdr;
214 skb->nh.raw = skb_pull(skb, ah_hlen);
215 memcpy(skb->nh.raw, work_buf, iph->ihl*4);
216 skb->nh.iph->tot_len = htons(skb->len);
217 skb_pull(skb, skb->nh.iph->ihl*4);
218 skb->h.raw = skb->data;
226 void ah4_err(struct sk_buff *skb, u32 info)
228 struct iphdr *iph = (struct iphdr*)skb->data;
229 struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+(iph->ihl<<2));
230 struct xfrm_state *x;
232 if (skb->h.icmph->type != ICMP_DEST_UNREACH ||
233 skb->h.icmph->code != ICMP_FRAG_NEEDED)
236 x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
239 printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
240 ntohl(ah->spi), ntohl(iph->daddr));
244 static int ah_init_state(struct xfrm_state *x, void *args)
246 struct ah_data *ahp = NULL;
247 struct xfrm_algo_desc *aalg_desc;
252 /* null auth can use a zero length key */
253 if (x->aalg->alg_key_len > 512)
256 ahp = kmalloc(sizeof(*ahp), GFP_KERNEL);
260 memset(ahp, 0, sizeof(*ahp));
262 ahp->key = x->aalg->alg_key;
263 ahp->key_len = (x->aalg->alg_key_len+7)/8;
264 ahp->tfm = crypto_alloc_tfm(x->aalg->alg_name, 0);
267 ahp->icv = ah_hmac_digest;
270 * Lookup the algorithm description maintained by xfrm_algo,
271 * verify crypto transform properties, and store information
272 * we need for AH processing. This lookup cannot fail here
273 * after a successful crypto_alloc_tfm().
275 aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name);
278 if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
279 crypto_tfm_alg_digestsize(ahp->tfm)) {
280 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
281 x->aalg->alg_name, crypto_tfm_alg_digestsize(ahp->tfm),
282 aalg_desc->uinfo.auth.icv_fullbits/8);
286 ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
287 ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
289 BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
291 ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
295 x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len);
297 x->props.header_len += sizeof(struct iphdr);
305 kfree(ahp->work_icv);
307 crypto_free_tfm(ahp->tfm);
313 static void ah_destroy(struct xfrm_state *x)
315 struct ah_data *ahp = x->data;
321 kfree(ahp->work_icv);
322 ahp->work_icv = NULL;
325 crypto_free_tfm(ahp->tfm);
332 static struct xfrm_type ah_type =
334 .description = "AH4",
335 .owner = THIS_MODULE,
337 .init_state = ah_init_state,
338 .destructor = ah_destroy,
343 static struct inet_protocol ah4_protocol = {
344 .handler = xfrm4_rcv,
345 .err_handler = ah4_err,
349 static int __init ah4_init(void)
351 if (xfrm_register_type(&ah_type, AF_INET) < 0) {
352 printk(KERN_INFO "ip ah init: can't add xfrm type\n");
355 if (inet_add_protocol(&ah4_protocol, IPPROTO_AH) < 0) {
356 printk(KERN_INFO "ip ah init: can't add protocol\n");
357 xfrm_unregister_type(&ah_type, AF_INET);
363 static void __exit ah4_fini(void)
365 if (inet_del_protocol(&ah4_protocol, IPPROTO_AH) < 0)
366 printk(KERN_INFO "ip ah close: can't remove protocol\n");
367 if (xfrm_unregister_type(&ah_type, AF_INET) < 0)
368 printk(KERN_INFO "ip ah close: can't remove xfrm type\n");
371 module_init(ah4_init);
372 module_exit(ah4_fini);
373 MODULE_LICENSE("GPL");