1 #include <linux/config.h>
2 #include <linux/module.h>
6 #include <linux/crypto.h>
7 #include <linux/pfkeyv2.h>
9 #include <asm/scatterlist.h>
12 /* Clear mutable options and find final destination to substitute
13 * into IP header for icv calculation. Options are already checked
14 * for validity, so paranoia is not required. */
16 static int ip_clear_mutable_options(struct iphdr
*iph
, u32
*daddr
)
18 unsigned char * optptr
= (unsigned char*)(iph
+1);
19 int l
= iph
->ihl
*4 - sizeof(struct iphdr
);
32 if (optlen
<2 || optlen
>l
)
36 case 0x85: /* Some "Extended Security" crap. */
37 case 0x86: /* Another "Commercial Security" crap. */
39 case 0x80|21: /* RFC1770 */
45 memcpy(daddr
, optptr
+optlen
-4, 4);
48 memset(optptr
+2, 0, optlen
-2);
56 static int ah_output(struct sk_buff
*skb
)
59 struct dst_entry
*dst
= skb
->dst
;
60 struct xfrm_state
*x
= dst
->xfrm
;
61 struct iphdr
*iph
, *top_iph
;
62 struct ip_auth_hdr
*ah
;
69 top_iph
= skb
->nh
.iph
;
72 iph
->tos
= top_iph
->tos
;
73 iph
->ttl
= top_iph
->ttl
;
74 iph
->frag_off
= top_iph
->frag_off
;
76 if (top_iph
->ihl
!= 5) {
77 iph
->daddr
= top_iph
->daddr
;
78 memcpy(iph
+1, top_iph
+1, top_iph
->ihl
*4 - sizeof(struct iphdr
));
79 err
= ip_clear_mutable_options(top_iph
, &top_iph
->daddr
);
84 ah
= (struct ip_auth_hdr
*)((char *)top_iph
+top_iph
->ihl
*4);
85 ah
->nexthdr
= top_iph
->protocol
;
88 top_iph
->tot_len
= htons(skb
->len
);
89 top_iph
->frag_off
= 0;
91 top_iph
->protocol
= IPPROTO_AH
;
95 ah
->hdrlen
= (XFRM_ALIGN8(sizeof(struct ip_auth_hdr
) +
96 ahp
->icv_trunc_len
) >> 2) - 2;
100 ah
->seq_no
= htonl(++x
->replay
.oseq
);
101 ahp
->icv(ahp
, skb
, ah
->auth_data
);
103 top_iph
->tos
= iph
->tos
;
104 top_iph
->ttl
= iph
->ttl
;
105 top_iph
->frag_off
= iph
->frag_off
;
106 if (top_iph
->ihl
!= 5) {
107 top_iph
->daddr
= iph
->daddr
;
108 memcpy(top_iph
+1, iph
+1, top_iph
->ihl
*4 - sizeof(struct iphdr
));
111 ip_send_check(top_iph
);
119 static int ah_input(struct xfrm_state
*x
, struct xfrm_decap_state
*decap
, struct sk_buff
*skb
)
123 struct ip_auth_hdr
*ah
;
127 if (!pskb_may_pull(skb
, sizeof(struct ip_auth_hdr
)))
130 ah
= (struct ip_auth_hdr
*)skb
->data
;
132 ah_hlen
= (ah
->hdrlen
+ 2) << 2;
134 if (ah_hlen
!= XFRM_ALIGN8(sizeof(struct ip_auth_hdr
) + ahp
->icv_full_len
) &&
135 ah_hlen
!= XFRM_ALIGN8(sizeof(struct ip_auth_hdr
) + ahp
->icv_trunc_len
))
138 if (!pskb_may_pull(skb
, ah_hlen
))
141 /* We are going to _remove_ AH header to keep sockets happy,
142 * so... Later this can change. */
143 if (skb_cloned(skb
) &&
144 pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
147 skb
->ip_summed
= CHECKSUM_NONE
;
149 ah
= (struct ip_auth_hdr
*)skb
->data
;
152 memcpy(work_buf
, iph
, iph
->ihl
*4);
160 if (ip_clear_mutable_options(iph
, &dummy
))
164 u8 auth_data
[MAX_AH_AUTH_LEN
];
166 memcpy(auth_data
, ah
->auth_data
, ahp
->icv_trunc_len
);
167 skb_push(skb
, skb
->data
- skb
->nh
.raw
);
168 ahp
->icv(ahp
, skb
, ah
->auth_data
);
169 if (memcmp(ah
->auth_data
, auth_data
, ahp
->icv_trunc_len
)) {
170 x
->stats
.integrity_failed
++;
174 ((struct iphdr
*)work_buf
)->protocol
= ah
->nexthdr
;
175 skb
->nh
.raw
= skb_pull(skb
, ah_hlen
);
176 memcpy(skb
->nh
.raw
, work_buf
, iph
->ihl
*4);
177 skb
->nh
.iph
->tot_len
= htons(skb
->len
);
178 skb_pull(skb
, skb
->nh
.iph
->ihl
*4);
179 skb
->h
.raw
= skb
->data
;
187 static void ah4_err(struct sk_buff
*skb
, u32 info
)
189 struct iphdr
*iph
= (struct iphdr
*)skb
->data
;
190 struct ip_auth_hdr
*ah
= (struct ip_auth_hdr
*)(skb
->data
+(iph
->ihl
<<2));
191 struct xfrm_state
*x
;
193 if (skb
->h
.icmph
->type
!= ICMP_DEST_UNREACH
||
194 skb
->h
.icmph
->code
!= ICMP_FRAG_NEEDED
)
197 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, ah
->spi
, IPPROTO_AH
, AF_INET
);
200 printk(KERN_DEBUG
"pmtu discovery on SA AH/%08x/%08x\n",
201 ntohl(ah
->spi
), ntohl(iph
->daddr
));
205 static int ah_init_state(struct xfrm_state
*x
, void *args
)
207 struct ah_data
*ahp
= NULL
;
208 struct xfrm_algo_desc
*aalg_desc
;
213 /* null auth can use a zero length key */
214 if (x
->aalg
->alg_key_len
> 512)
220 ahp
= kmalloc(sizeof(*ahp
), GFP_KERNEL
);
224 memset(ahp
, 0, sizeof(*ahp
));
226 ahp
->key
= x
->aalg
->alg_key
;
227 ahp
->key_len
= (x
->aalg
->alg_key_len
+7)/8;
228 ahp
->tfm
= crypto_alloc_tfm(x
->aalg
->alg_name
, 0);
231 ahp
->icv
= ah_hmac_digest
;
234 * Lookup the algorithm description maintained by xfrm_algo,
235 * verify crypto transform properties, and store information
236 * we need for AH processing. This lookup cannot fail here
237 * after a successful crypto_alloc_tfm().
239 aalg_desc
= xfrm_aalg_get_byname(x
->aalg
->alg_name
);
242 if (aalg_desc
->uinfo
.auth
.icv_fullbits
/8 !=
243 crypto_tfm_alg_digestsize(ahp
->tfm
)) {
244 printk(KERN_INFO
"AH: %s digestsize %u != %hu\n",
245 x
->aalg
->alg_name
, crypto_tfm_alg_digestsize(ahp
->tfm
),
246 aalg_desc
->uinfo
.auth
.icv_fullbits
/8);
250 ahp
->icv_full_len
= aalg_desc
->uinfo
.auth
.icv_fullbits
/8;
251 ahp
->icv_trunc_len
= aalg_desc
->uinfo
.auth
.icv_truncbits
/8;
253 BUG_ON(ahp
->icv_trunc_len
> MAX_AH_AUTH_LEN
);
255 ahp
->work_icv
= kmalloc(ahp
->icv_full_len
, GFP_KERNEL
);
259 x
->props
.header_len
= XFRM_ALIGN8(sizeof(struct ip_auth_hdr
) + ahp
->icv_trunc_len
);
261 x
->props
.header_len
+= sizeof(struct iphdr
);
269 kfree(ahp
->work_icv
);
271 crypto_free_tfm(ahp
->tfm
);
277 static void ah_destroy(struct xfrm_state
*x
)
279 struct ah_data
*ahp
= x
->data
;
285 kfree(ahp
->work_icv
);
286 ahp
->work_icv
= NULL
;
289 crypto_free_tfm(ahp
->tfm
);
296 static struct xfrm_type ah_type
=
298 .description
= "AH4",
299 .owner
= THIS_MODULE
,
301 .init_state
= ah_init_state
,
302 .destructor
= ah_destroy
,
307 static struct net_protocol ah4_protocol
= {
308 .handler
= xfrm4_rcv
,
309 .err_handler
= ah4_err
,
313 static int __init
ah4_init(void)
315 if (xfrm_register_type(&ah_type
, AF_INET
) < 0) {
316 printk(KERN_INFO
"ip ah init: can't add xfrm type\n");
319 if (inet_add_protocol(&ah4_protocol
, IPPROTO_AH
) < 0) {
320 printk(KERN_INFO
"ip ah init: can't add protocol\n");
321 xfrm_unregister_type(&ah_type
, AF_INET
);
327 static void __exit
ah4_fini(void)
329 if (inet_del_protocol(&ah4_protocol
, IPPROTO_AH
) < 0)
330 printk(KERN_INFO
"ip ah close: can't remove protocol\n");
331 if (xfrm_unregister_type(&ah_type
, AF_INET
) < 0)
332 printk(KERN_INFO
"ip ah close: can't remove xfrm type\n");
335 module_init(ah4_init
);
336 module_exit(ah4_fini
);
337 MODULE_LICENSE("GPL");