1 #include <linux/config.h>
2 #include <linux/module.h>
6 #include <asm/scatterlist.h>
7 #include <linux/crypto.h>
8 #include <linux/kernel.h>
9 #include <linux/pfkeyv2.h>
10 #include <linux/random.h>
12 #include <net/protocol.h>
15 /* decapsulation data for use when post-processing */
16 struct esp_decap_data
{
22 static int esp_output(struct xfrm_state
*x
, struct sk_buff
*skb
)
25 struct iphdr
*top_iph
;
26 struct ip_esp_hdr
*esph
;
27 struct crypto_tfm
*tfm
;
29 struct sk_buff
*trailer
;
35 /* Strip IP+ESP header. */
36 __skb_pull(skb
, skb
->h
.raw
- skb
->data
);
37 /* Now skb is pure payload to encrypt */
41 /* Round to block size */
45 alen
= esp
->auth
.icv_trunc_len
;
47 blksize
= ALIGN(crypto_tfm_alg_blocksize(tfm
), 4);
48 clen
= ALIGN(clen
+ 2, blksize
);
50 clen
= ALIGN(clen
, esp
->conf
.padlen
);
52 if ((nfrags
= skb_cow_data(skb
, clen
-skb
->len
+alen
, &trailer
)) < 0)
58 for (i
=0; i
<clen
-skb
->len
- 2; i
++)
59 *(u8
*)(trailer
->tail
+ i
) = i
+1;
61 *(u8
*)(trailer
->tail
+ clen
-skb
->len
- 2) = (clen
- skb
->len
)-2;
62 pskb_put(skb
, trailer
, clen
- skb
->len
);
64 __skb_push(skb
, skb
->data
- skb
->nh
.raw
);
65 top_iph
= skb
->nh
.iph
;
66 esph
= (struct ip_esp_hdr
*)(skb
->nh
.raw
+ top_iph
->ihl
*4);
67 top_iph
->tot_len
= htons(skb
->len
+ alen
);
68 *(u8
*)(trailer
->tail
- 1) = top_iph
->protocol
;
70 /* this is non-NULL only with UDP Encapsulation */
72 struct xfrm_encap_tmpl
*encap
= x
->encap
;
76 uh
= (struct udphdr
*)esph
;
77 uh
->source
= encap
->encap_sport
;
78 uh
->dest
= encap
->encap_dport
;
79 uh
->len
= htons(skb
->len
+ alen
- top_iph
->ihl
*4);
82 switch (encap
->encap_type
) {
84 case UDP_ENCAP_ESPINUDP
:
85 esph
= (struct ip_esp_hdr
*)(uh
+ 1);
87 case UDP_ENCAP_ESPINUDP_NON_IKE
:
88 udpdata32
= (u32
*)(uh
+ 1);
89 udpdata32
[0] = udpdata32
[1] = 0;
90 esph
= (struct ip_esp_hdr
*)(udpdata32
+ 2);
94 top_iph
->protocol
= IPPROTO_UDP
;
96 top_iph
->protocol
= IPPROTO_ESP
;
98 esph
->spi
= x
->id
.spi
;
99 esph
->seq_no
= htonl(++x
->replay
.oseq
);
102 crypto_cipher_set_iv(tfm
, esp
->conf
.ivec
, crypto_tfm_alg_ivsize(tfm
));
105 struct scatterlist
*sg
= &esp
->sgbuf
[0];
107 if (unlikely(nfrags
> ESP_NUM_FAST_SG
)) {
108 sg
= kmalloc(sizeof(struct scatterlist
)*nfrags
, GFP_ATOMIC
);
112 skb_to_sgvec(skb
, sg
, esph
->enc_data
+esp
->conf
.ivlen
-skb
->data
, clen
);
113 crypto_cipher_encrypt(tfm
, sg
, sg
, clen
);
114 if (unlikely(sg
!= &esp
->sgbuf
[0]))
118 if (esp
->conf
.ivlen
) {
119 memcpy(esph
->enc_data
, esp
->conf
.ivec
, crypto_tfm_alg_ivsize(tfm
));
120 crypto_cipher_get_iv(tfm
, esp
->conf
.ivec
, crypto_tfm_alg_ivsize(tfm
));
123 if (esp
->auth
.icv_full_len
) {
124 esp
->auth
.icv(esp
, skb
, (u8
*)esph
-skb
->data
,
125 sizeof(struct ip_esp_hdr
) + esp
->conf
.ivlen
+clen
, trailer
->tail
);
126 pskb_put(skb
, trailer
, alen
);
129 ip_send_check(top_iph
);
138 * Note: detecting truncated vs. non-truncated authentication data is very
139 * expensive, so we only support truncated data, which is the recommended
142 static int esp_input(struct xfrm_state
*x
, struct xfrm_decap_state
*decap
, struct sk_buff
*skb
)
145 struct ip_esp_hdr
*esph
;
146 struct esp_data
*esp
= x
->data
;
147 struct sk_buff
*trailer
;
148 int blksize
= ALIGN(crypto_tfm_alg_blocksize(esp
->conf
.tfm
), 4);
149 int alen
= esp
->auth
.icv_trunc_len
;
150 int elen
= skb
->len
- sizeof(struct ip_esp_hdr
) - esp
->conf
.ivlen
- alen
;
154 if (!pskb_may_pull(skb
, sizeof(struct ip_esp_hdr
)))
157 if (elen
<= 0 || (elen
& (blksize
-1)))
160 /* If integrity check is required, do this. */
161 if (esp
->auth
.icv_full_len
) {
162 u8 sum
[esp
->auth
.icv_full_len
];
165 esp
->auth
.icv(esp
, skb
, 0, skb
->len
-alen
, sum
);
167 if (skb_copy_bits(skb
, skb
->len
-alen
, sum1
, alen
))
170 if (unlikely(memcmp(sum
, sum1
, alen
))) {
171 x
->stats
.integrity_failed
++;
176 if ((nfrags
= skb_cow_data(skb
, 0, &trailer
)) < 0)
179 skb
->ip_summed
= CHECKSUM_NONE
;
181 esph
= (struct ip_esp_hdr
*)skb
->data
;
184 /* Get ivec. This can be wrong, check against another impls. */
186 crypto_cipher_set_iv(esp
->conf
.tfm
, esph
->enc_data
, crypto_tfm_alg_ivsize(esp
->conf
.tfm
));
190 struct scatterlist
*sg
= &esp
->sgbuf
[0];
194 if (unlikely(nfrags
> ESP_NUM_FAST_SG
)) {
195 sg
= kmalloc(sizeof(struct scatterlist
)*nfrags
, GFP_ATOMIC
);
199 skb_to_sgvec(skb
, sg
, sizeof(struct ip_esp_hdr
) + esp
->conf
.ivlen
, elen
);
200 crypto_cipher_decrypt(esp
->conf
.tfm
, sg
, sg
, elen
);
201 if (unlikely(sg
!= &esp
->sgbuf
[0]))
204 if (skb_copy_bits(skb
, skb
->len
-alen
-2, nexthdr
, 2))
208 if (padlen
+2 >= elen
)
211 /* ... check padding bits here. Silly. :-) */
213 if (x
->encap
&& decap
&& decap
->decap_type
) {
214 struct esp_decap_data
*encap_data
;
215 struct udphdr
*uh
= (struct udphdr
*) (iph
+1);
217 encap_data
= (struct esp_decap_data
*) (decap
->decap_data
);
218 encap_data
->proto
= 0;
220 switch (decap
->decap_type
) {
221 case UDP_ENCAP_ESPINUDP
:
222 case UDP_ENCAP_ESPINUDP_NON_IKE
:
223 encap_data
->proto
= AF_INET
;
224 encap_data
->saddr
.a4
= iph
->saddr
;
225 encap_data
->sport
= uh
->source
;
226 encap_len
= (void*)esph
- (void*)uh
;
234 iph
->protocol
= nexthdr
[1];
235 pskb_trim(skb
, skb
->len
- alen
- padlen
- 2);
236 memcpy(workbuf
, skb
->nh
.raw
, iph
->ihl
*4);
237 skb
->h
.raw
= skb_pull(skb
, sizeof(struct ip_esp_hdr
) + esp
->conf
.ivlen
);
238 skb
->nh
.raw
+= encap_len
+ sizeof(struct ip_esp_hdr
) + esp
->conf
.ivlen
;
239 memcpy(skb
->nh
.raw
, workbuf
, iph
->ihl
*4);
240 skb
->nh
.iph
->tot_len
= htons(skb
->len
);
249 static int esp_post_input(struct xfrm_state
*x
, struct xfrm_decap_state
*decap
, struct sk_buff
*skb
)
253 struct xfrm_encap_tmpl
*encap
;
254 struct esp_decap_data
*decap_data
;
257 decap_data
= (struct esp_decap_data
*)(decap
->decap_data
);
259 /* first, make sure that the decap type == the encap type */
260 if (encap
->encap_type
!= decap
->decap_type
)
263 switch (encap
->encap_type
) {
265 case UDP_ENCAP_ESPINUDP
:
266 case UDP_ENCAP_ESPINUDP_NON_IKE
:
268 * 1) if the NAT-T peer's IP or port changed then
269 * advertize the change to the keying daemon.
270 * This is an inbound SA, so just compare
273 if (decap_data
->proto
== AF_INET
&&
274 (decap_data
->saddr
.a4
!= x
->props
.saddr
.a4
||
275 decap_data
->sport
!= encap
->encap_sport
)) {
276 xfrm_address_t ipaddr
;
278 ipaddr
.a4
= decap_data
->saddr
.a4
;
279 km_new_mapping(x
, &ipaddr
, decap_data
->sport
);
281 /* XXX: perhaps add an extra
282 * policy check here, to see
283 * if we should allow or
284 * reject a packet from a
291 * 2) ignore UDP/TCP checksums in case
292 * of NAT-T in Transport Mode, or
293 * perform other post-processing fixes
294 * as per * draft-ietf-ipsec-udp-encaps-06,
298 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
306 static u32
esp4_get_max_size(struct xfrm_state
*x
, int mtu
)
308 struct esp_data
*esp
= x
->data
;
309 u32 blksize
= ALIGN(crypto_tfm_alg_blocksize(esp
->conf
.tfm
), 4);
312 mtu
= ALIGN(mtu
+ 2, blksize
);
314 /* The worst case. */
315 mtu
= ALIGN(mtu
+ 2, 4) + blksize
- 4;
317 if (esp
->conf
.padlen
)
318 mtu
= ALIGN(mtu
, esp
->conf
.padlen
);
320 return mtu
+ x
->props
.header_len
+ esp
->auth
.icv_trunc_len
;
323 static void esp4_err(struct sk_buff
*skb
, u32 info
)
325 struct iphdr
*iph
= (struct iphdr
*)skb
->data
;
326 struct ip_esp_hdr
*esph
= (struct ip_esp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
327 struct xfrm_state
*x
;
329 if (skb
->h
.icmph
->type
!= ICMP_DEST_UNREACH
||
330 skb
->h
.icmph
->code
!= ICMP_FRAG_NEEDED
)
333 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, esph
->spi
, IPPROTO_ESP
, AF_INET
);
336 NETDEBUG(KERN_DEBUG
"pmtu discovery on SA ESP/%08x/%08x\n",
337 ntohl(esph
->spi
), ntohl(iph
->daddr
));
341 static void esp_destroy(struct xfrm_state
*x
)
343 struct esp_data
*esp
= x
->data
;
348 crypto_free_tfm(esp
->conf
.tfm
);
349 esp
->conf
.tfm
= NULL
;
350 kfree(esp
->conf
.ivec
);
351 esp
->conf
.ivec
= NULL
;
352 crypto_free_tfm(esp
->auth
.tfm
);
353 esp
->auth
.tfm
= NULL
;
354 kfree(esp
->auth
.work_icv
);
355 esp
->auth
.work_icv
= NULL
;
359 static int esp_init_state(struct xfrm_state
*x
)
361 struct esp_data
*esp
= NULL
;
363 /* null auth and encryption can have zero length keys */
365 if (x
->aalg
->alg_key_len
> 512)
371 esp
= kmalloc(sizeof(*esp
), GFP_KERNEL
);
375 memset(esp
, 0, sizeof(*esp
));
378 struct xfrm_algo_desc
*aalg_desc
;
380 esp
->auth
.key
= x
->aalg
->alg_key
;
381 esp
->auth
.key_len
= (x
->aalg
->alg_key_len
+7)/8;
382 esp
->auth
.tfm
= crypto_alloc_tfm(x
->aalg
->alg_name
, 0);
383 if (esp
->auth
.tfm
== NULL
)
385 esp
->auth
.icv
= esp_hmac_digest
;
387 aalg_desc
= xfrm_aalg_get_byname(x
->aalg
->alg_name
, 0);
390 if (aalg_desc
->uinfo
.auth
.icv_fullbits
/8 !=
391 crypto_tfm_alg_digestsize(esp
->auth
.tfm
)) {
392 NETDEBUG(KERN_INFO
"ESP: %s digestsize %u != %hu\n",
394 crypto_tfm_alg_digestsize(esp
->auth
.tfm
),
395 aalg_desc
->uinfo
.auth
.icv_fullbits
/8);
399 esp
->auth
.icv_full_len
= aalg_desc
->uinfo
.auth
.icv_fullbits
/8;
400 esp
->auth
.icv_trunc_len
= aalg_desc
->uinfo
.auth
.icv_truncbits
/8;
402 esp
->auth
.work_icv
= kmalloc(esp
->auth
.icv_full_len
, GFP_KERNEL
);
403 if (!esp
->auth
.work_icv
)
406 esp
->conf
.key
= x
->ealg
->alg_key
;
407 esp
->conf
.key_len
= (x
->ealg
->alg_key_len
+7)/8;
408 if (x
->props
.ealgo
== SADB_EALG_NULL
)
409 esp
->conf
.tfm
= crypto_alloc_tfm(x
->ealg
->alg_name
, CRYPTO_TFM_MODE_ECB
);
411 esp
->conf
.tfm
= crypto_alloc_tfm(x
->ealg
->alg_name
, CRYPTO_TFM_MODE_CBC
);
412 if (esp
->conf
.tfm
== NULL
)
414 esp
->conf
.ivlen
= crypto_tfm_alg_ivsize(esp
->conf
.tfm
);
415 esp
->conf
.padlen
= 0;
416 if (esp
->conf
.ivlen
) {
417 esp
->conf
.ivec
= kmalloc(esp
->conf
.ivlen
, GFP_KERNEL
);
418 if (unlikely(esp
->conf
.ivec
== NULL
))
420 get_random_bytes(esp
->conf
.ivec
, esp
->conf
.ivlen
);
422 if (crypto_cipher_setkey(esp
->conf
.tfm
, esp
->conf
.key
, esp
->conf
.key_len
))
424 x
->props
.header_len
= sizeof(struct ip_esp_hdr
) + esp
->conf
.ivlen
;
426 x
->props
.header_len
+= sizeof(struct iphdr
);
428 struct xfrm_encap_tmpl
*encap
= x
->encap
;
430 switch (encap
->encap_type
) {
433 case UDP_ENCAP_ESPINUDP
:
434 x
->props
.header_len
+= sizeof(struct udphdr
);
436 case UDP_ENCAP_ESPINUDP_NON_IKE
:
437 x
->props
.header_len
+= sizeof(struct udphdr
) + 2 * sizeof(u32
);
442 x
->props
.trailer_len
= esp4_get_max_size(x
, 0) - x
->props
.header_len
;
452 static struct xfrm_type esp_type
=
454 .description
= "ESP4",
455 .owner
= THIS_MODULE
,
456 .proto
= IPPROTO_ESP
,
457 .init_state
= esp_init_state
,
458 .destructor
= esp_destroy
,
459 .get_max_size
= esp4_get_max_size
,
461 .post_input
= esp_post_input
,
465 static struct net_protocol esp4_protocol
= {
466 .handler
= xfrm4_rcv
,
467 .err_handler
= esp4_err
,
471 static int __init
esp4_init(void)
473 struct xfrm_decap_state decap
;
475 if (sizeof(struct esp_decap_data
) >
476 sizeof(decap
.decap_data
)) {
477 extern void decap_data_too_small(void);
479 decap_data_too_small();
482 if (xfrm_register_type(&esp_type
, AF_INET
) < 0) {
483 printk(KERN_INFO
"ip esp init: can't add xfrm type\n");
486 if (inet_add_protocol(&esp4_protocol
, IPPROTO_ESP
) < 0) {
487 printk(KERN_INFO
"ip esp init: can't add protocol\n");
488 xfrm_unregister_type(&esp_type
, AF_INET
);
494 static void __exit
esp4_fini(void)
496 if (inet_del_protocol(&esp4_protocol
, IPPROTO_ESP
) < 0)
497 printk(KERN_INFO
"ip esp close: can't remove protocol\n");
498 if (xfrm_unregister_type(&esp_type
, AF_INET
) < 0)
499 printk(KERN_INFO
"ip esp close: can't remove xfrm type\n");
502 module_init(esp4_init
);
503 module_exit(esp4_fini
);
504 MODULE_LICENSE("GPL");