2 #include <linux/module.h>
6 #include <linux/crypto.h>
7 #include <linux/pfkeyv2.h>
8 #include <linux/spinlock.h>
10 #include <net/protocol.h>
11 #include <asm/scatterlist.h>
14 /* Clear mutable options and find final destination to substitute
15 * into IP header for icv calculation. Options are already checked
16 * for validity, so paranoia is not required. */
18 static int ip_clear_mutable_options(struct iphdr
*iph
, __be32
*daddr
)
20 unsigned char * optptr
= (unsigned char*)(iph
+1);
21 int l
= iph
->ihl
*4 - sizeof(struct iphdr
);
34 if (optlen
<2 || optlen
>l
)
38 case 0x85: /* Some "Extended Security" crap. */
41 case 0x80|21: /* RFC1770 */
47 memcpy(daddr
, optptr
+optlen
-4, 4);
50 memset(optptr
, 0, optlen
);
58 static int ah_output(struct xfrm_state
*x
, struct sk_buff
*skb
)
61 struct iphdr
*iph
, *top_iph
;
62 struct ip_auth_hdr
*ah
;
69 skb_push(skb
, -skb_network_offset(skb
));
70 top_iph
= ip_hdr(skb
);
73 iph
->tos
= top_iph
->tos
;
74 iph
->ttl
= top_iph
->ttl
;
75 iph
->frag_off
= top_iph
->frag_off
;
77 if (top_iph
->ihl
!= 5) {
78 iph
->daddr
= top_iph
->daddr
;
79 memcpy(iph
+1, top_iph
+1, top_iph
->ihl
*4 - sizeof(struct iphdr
));
80 err
= ip_clear_mutable_options(top_iph
, &top_iph
->daddr
);
85 ah
= ip_auth_hdr(skb
);
86 ah
->nexthdr
= *skb_mac_header(skb
);
87 *skb_mac_header(skb
) = IPPROTO_AH
;
90 top_iph
->tot_len
= htons(skb
->len
);
91 top_iph
->frag_off
= 0;
96 ah
->hdrlen
= (XFRM_ALIGN8(sizeof(*ah
) + ahp
->icv_trunc_len
) >> 2) - 2;
100 ah
->seq_no
= htonl(XFRM_SKB_CB(skb
)->seq
);
102 spin_lock_bh(&x
->lock
);
103 err
= ah_mac_digest(ahp
, skb
, ah
->auth_data
);
104 memcpy(ah
->auth_data
, ahp
->work_icv
, ahp
->icv_trunc_len
);
105 spin_unlock_bh(&x
->lock
);
110 top_iph
->tos
= iph
->tos
;
111 top_iph
->ttl
= iph
->ttl
;
112 top_iph
->frag_off
= iph
->frag_off
;
113 if (top_iph
->ihl
!= 5) {
114 top_iph
->daddr
= iph
->daddr
;
115 memcpy(top_iph
+1, iph
+1, top_iph
->ihl
*4 - sizeof(struct iphdr
));
118 ip_send_check(top_iph
);
126 static int ah_input(struct xfrm_state
*x
, struct sk_buff
*skb
)
132 struct ip_auth_hdr
*ah
;
136 if (!pskb_may_pull(skb
, sizeof(*ah
)))
139 ah
= (struct ip_auth_hdr
*)skb
->data
;
141 ah_hlen
= (ah
->hdrlen
+ 2) << 2;
143 if (ah_hlen
!= XFRM_ALIGN8(sizeof(*ah
) + ahp
->icv_full_len
) &&
144 ah_hlen
!= XFRM_ALIGN8(sizeof(*ah
) + ahp
->icv_trunc_len
))
147 if (!pskb_may_pull(skb
, ah_hlen
))
150 /* We are going to _remove_ AH header to keep sockets happy,
151 * so... Later this can change. */
152 if (skb_cloned(skb
) &&
153 pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
156 skb
->ip_summed
= CHECKSUM_NONE
;
158 ah
= (struct ip_auth_hdr
*)skb
->data
;
161 ihl
= skb
->data
- skb_network_header(skb
);
162 memcpy(work_buf
, iph
, ihl
);
168 if (ihl
> sizeof(*iph
)) {
170 if (ip_clear_mutable_options(iph
, &dummy
))
174 u8 auth_data
[MAX_AH_AUTH_LEN
];
176 memcpy(auth_data
, ah
->auth_data
, ahp
->icv_trunc_len
);
178 err
= ah_mac_digest(ahp
, skb
, ah
->auth_data
);
182 if (memcmp(ahp
->work_icv
, auth_data
, ahp
->icv_trunc_len
)) {
183 x
->stats
.integrity_failed
++;
187 ((struct iphdr
*)work_buf
)->protocol
= ah
->nexthdr
;
188 skb
->network_header
+= ah_hlen
;
189 memcpy(skb_network_header(skb
), work_buf
, ihl
);
190 skb
->transport_header
= skb
->network_header
;
191 __skb_pull(skb
, ah_hlen
+ ihl
);
199 static void ah4_err(struct sk_buff
*skb
, u32 info
)
201 struct iphdr
*iph
= (struct iphdr
*)skb
->data
;
202 struct ip_auth_hdr
*ah
= (struct ip_auth_hdr
*)(skb
->data
+(iph
->ihl
<<2));
203 struct xfrm_state
*x
;
205 if (icmp_hdr(skb
)->type
!= ICMP_DEST_UNREACH
||
206 icmp_hdr(skb
)->code
!= ICMP_FRAG_NEEDED
)
209 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, ah
->spi
, IPPROTO_AH
, AF_INET
);
212 printk(KERN_DEBUG
"pmtu discovery on SA AH/%08x/%08x\n",
213 ntohl(ah
->spi
), ntohl(iph
->daddr
));
217 static int ah_init_state(struct xfrm_state
*x
)
219 struct ah_data
*ahp
= NULL
;
220 struct xfrm_algo_desc
*aalg_desc
;
221 struct crypto_hash
*tfm
;
229 ahp
= kzalloc(sizeof(*ahp
), GFP_KERNEL
);
233 tfm
= crypto_alloc_hash(x
->aalg
->alg_name
, 0, CRYPTO_ALG_ASYNC
);
238 if (crypto_hash_setkey(tfm
, x
->aalg
->alg_key
,
239 (x
->aalg
->alg_key_len
+ 7) / 8))
243 * Lookup the algorithm description maintained by xfrm_algo,
244 * verify crypto transform properties, and store information
245 * we need for AH processing. This lookup cannot fail here
246 * after a successful crypto_alloc_hash().
248 aalg_desc
= xfrm_aalg_get_byname(x
->aalg
->alg_name
, 0);
251 if (aalg_desc
->uinfo
.auth
.icv_fullbits
/8 !=
252 crypto_hash_digestsize(tfm
)) {
253 printk(KERN_INFO
"AH: %s digestsize %u != %hu\n",
254 x
->aalg
->alg_name
, crypto_hash_digestsize(tfm
),
255 aalg_desc
->uinfo
.auth
.icv_fullbits
/8);
259 ahp
->icv_full_len
= aalg_desc
->uinfo
.auth
.icv_fullbits
/8;
260 ahp
->icv_trunc_len
= aalg_desc
->uinfo
.auth
.icv_truncbits
/8;
262 BUG_ON(ahp
->icv_trunc_len
> MAX_AH_AUTH_LEN
);
264 ahp
->work_icv
= kmalloc(ahp
->icv_full_len
, GFP_KERNEL
);
268 x
->props
.header_len
= XFRM_ALIGN8(sizeof(struct ip_auth_hdr
) +
270 if (x
->props
.mode
== XFRM_MODE_TUNNEL
)
271 x
->props
.header_len
+= sizeof(struct iphdr
);
278 kfree(ahp
->work_icv
);
279 crypto_free_hash(ahp
->tfm
);
285 static void ah_destroy(struct xfrm_state
*x
)
287 struct ah_data
*ahp
= x
->data
;
292 kfree(ahp
->work_icv
);
293 ahp
->work_icv
= NULL
;
294 crypto_free_hash(ahp
->tfm
);
300 static struct xfrm_type ah_type
=
302 .description
= "AH4",
303 .owner
= THIS_MODULE
,
305 .flags
= XFRM_TYPE_REPLAY_PROT
,
306 .init_state
= ah_init_state
,
307 .destructor
= ah_destroy
,
312 static struct net_protocol ah4_protocol
= {
313 .handler
= xfrm4_rcv
,
314 .err_handler
= ah4_err
,
318 static int __init
ah4_init(void)
320 if (xfrm_register_type(&ah_type
, AF_INET
) < 0) {
321 printk(KERN_INFO
"ip ah init: can't add xfrm type\n");
324 if (inet_add_protocol(&ah4_protocol
, IPPROTO_AH
) < 0) {
325 printk(KERN_INFO
"ip ah init: can't add protocol\n");
326 xfrm_unregister_type(&ah_type
, AF_INET
);
332 static void __exit
ah4_fini(void)
334 if (inet_del_protocol(&ah4_protocol
, IPPROTO_AH
) < 0)
335 printk(KERN_INFO
"ip ah close: can't remove protocol\n");
336 if (xfrm_unregister_type(&ah_type
, AF_INET
) < 0)
337 printk(KERN_INFO
"ip ah close: can't remove xfrm type\n");
340 module_init(ah4_init
);
341 module_exit(ah4_fini
);
342 MODULE_LICENSE("GPL");
343 MODULE_ALIAS_XFRM_TYPE(AF_INET
, XFRM_PROTO_AH
);