1 #include <linux/module.h>
5 #include <linux/crypto.h>
6 #include <linux/pfkeyv2.h>
8 #include <net/protocol.h>
9 #include <asm/scatterlist.h>
12 /* Clear mutable options and find final destination to substitute
13 * into IP header for icv calculation. Options are already checked
14 * for validity, so paranoia is not required. */
16 static int ip_clear_mutable_options(struct iphdr
*iph
, u32
*daddr
)
18 unsigned char * optptr
= (unsigned char*)(iph
+1);
19 int l
= iph
->ihl
*4 - sizeof(struct iphdr
);
32 if (optlen
<2 || optlen
>l
)
36 case 0x85: /* Some "Extended Security" crap. */
37 case 0x86: /* Another "Commercial Security" crap. */
39 case 0x80|21: /* RFC1770 */
45 memcpy(daddr
, optptr
+optlen
-4, 4);
48 memset(optptr
+2, 0, optlen
-2);
56 static int ah_output(struct xfrm_state
*x
, struct sk_buff
*skb
)
59 struct iphdr
*iph
, *top_iph
;
60 struct ip_auth_hdr
*ah
;
67 top_iph
= skb
->nh
.iph
;
70 iph
->tos
= top_iph
->tos
;
71 iph
->ttl
= top_iph
->ttl
;
72 iph
->frag_off
= top_iph
->frag_off
;
74 if (top_iph
->ihl
!= 5) {
75 iph
->daddr
= top_iph
->daddr
;
76 memcpy(iph
+1, top_iph
+1, top_iph
->ihl
*4 - sizeof(struct iphdr
));
77 err
= ip_clear_mutable_options(top_iph
, &top_iph
->daddr
);
82 ah
= (struct ip_auth_hdr
*)((char *)top_iph
+top_iph
->ihl
*4);
83 ah
->nexthdr
= top_iph
->protocol
;
86 top_iph
->tot_len
= htons(skb
->len
);
87 top_iph
->frag_off
= 0;
89 top_iph
->protocol
= IPPROTO_AH
;
93 ah
->hdrlen
= (XFRM_ALIGN8(sizeof(struct ip_auth_hdr
) +
94 ahp
->icv_trunc_len
) >> 2) - 2;
98 ah
->seq_no
= htonl(++x
->replay
.oseq
);
99 xfrm_aevent_doreplay(x
);
100 ahp
->icv(ahp
, skb
, ah
->auth_data
);
102 top_iph
->tos
= iph
->tos
;
103 top_iph
->ttl
= iph
->ttl
;
104 top_iph
->frag_off
= iph
->frag_off
;
105 if (top_iph
->ihl
!= 5) {
106 top_iph
->daddr
= iph
->daddr
;
107 memcpy(top_iph
+1, iph
+1, top_iph
->ihl
*4 - sizeof(struct iphdr
));
110 ip_send_check(top_iph
);
118 static int ah_input(struct xfrm_state
*x
, struct sk_buff
*skb
)
123 struct ip_auth_hdr
*ah
;
127 if (!pskb_may_pull(skb
, sizeof(struct ip_auth_hdr
)))
130 ah
= (struct ip_auth_hdr
*)skb
->data
;
132 ah_hlen
= (ah
->hdrlen
+ 2) << 2;
134 if (ah_hlen
!= XFRM_ALIGN8(sizeof(struct ip_auth_hdr
) + ahp
->icv_full_len
) &&
135 ah_hlen
!= XFRM_ALIGN8(sizeof(struct ip_auth_hdr
) + ahp
->icv_trunc_len
))
138 if (!pskb_may_pull(skb
, ah_hlen
))
141 /* We are going to _remove_ AH header to keep sockets happy,
142 * so... Later this can change. */
143 if (skb_cloned(skb
) &&
144 pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
147 skb
->ip_summed
= CHECKSUM_NONE
;
149 ah
= (struct ip_auth_hdr
*)skb
->data
;
152 ihl
= skb
->data
- skb
->nh
.raw
;
153 memcpy(work_buf
, iph
, ihl
);
159 if (ihl
> sizeof(*iph
)) {
161 if (ip_clear_mutable_options(iph
, &dummy
))
165 u8 auth_data
[MAX_AH_AUTH_LEN
];
167 memcpy(auth_data
, ah
->auth_data
, ahp
->icv_trunc_len
);
169 ahp
->icv(ahp
, skb
, ah
->auth_data
);
170 if (memcmp(ah
->auth_data
, auth_data
, ahp
->icv_trunc_len
)) {
171 x
->stats
.integrity_failed
++;
175 ((struct iphdr
*)work_buf
)->protocol
= ah
->nexthdr
;
176 skb
->h
.raw
= memcpy(skb
->nh
.raw
+= ah_hlen
, work_buf
, ihl
);
177 __skb_pull(skb
, ah_hlen
+ ihl
);
185 static void ah4_err(struct sk_buff
*skb
, u32 info
)
187 struct iphdr
*iph
= (struct iphdr
*)skb
->data
;
188 struct ip_auth_hdr
*ah
= (struct ip_auth_hdr
*)(skb
->data
+(iph
->ihl
<<2));
189 struct xfrm_state
*x
;
191 if (skb
->h
.icmph
->type
!= ICMP_DEST_UNREACH
||
192 skb
->h
.icmph
->code
!= ICMP_FRAG_NEEDED
)
195 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, ah
->spi
, IPPROTO_AH
, AF_INET
);
198 printk(KERN_DEBUG
"pmtu discovery on SA AH/%08x/%08x\n",
199 ntohl(ah
->spi
), ntohl(iph
->daddr
));
203 static int ah_init_state(struct xfrm_state
*x
)
205 struct ah_data
*ahp
= NULL
;
206 struct xfrm_algo_desc
*aalg_desc
;
211 /* null auth can use a zero length key */
212 if (x
->aalg
->alg_key_len
> 512)
218 ahp
= kzalloc(sizeof(*ahp
), GFP_KERNEL
);
222 ahp
->key
= x
->aalg
->alg_key
;
223 ahp
->key_len
= (x
->aalg
->alg_key_len
+7)/8;
224 ahp
->tfm
= crypto_alloc_tfm(x
->aalg
->alg_name
, 0);
227 ahp
->icv
= ah_hmac_digest
;
230 * Lookup the algorithm description maintained by xfrm_algo,
231 * verify crypto transform properties, and store information
232 * we need for AH processing. This lookup cannot fail here
233 * after a successful crypto_alloc_tfm().
235 aalg_desc
= xfrm_aalg_get_byname(x
->aalg
->alg_name
, 0);
238 if (aalg_desc
->uinfo
.auth
.icv_fullbits
/8 !=
239 crypto_tfm_alg_digestsize(ahp
->tfm
)) {
240 printk(KERN_INFO
"AH: %s digestsize %u != %hu\n",
241 x
->aalg
->alg_name
, crypto_tfm_alg_digestsize(ahp
->tfm
),
242 aalg_desc
->uinfo
.auth
.icv_fullbits
/8);
246 ahp
->icv_full_len
= aalg_desc
->uinfo
.auth
.icv_fullbits
/8;
247 ahp
->icv_trunc_len
= aalg_desc
->uinfo
.auth
.icv_truncbits
/8;
249 BUG_ON(ahp
->icv_trunc_len
> MAX_AH_AUTH_LEN
);
251 ahp
->work_icv
= kmalloc(ahp
->icv_full_len
, GFP_KERNEL
);
255 x
->props
.header_len
= XFRM_ALIGN8(sizeof(struct ip_auth_hdr
) + ahp
->icv_trunc_len
);
257 x
->props
.header_len
+= sizeof(struct iphdr
);
264 kfree(ahp
->work_icv
);
265 crypto_free_tfm(ahp
->tfm
);
271 static void ah_destroy(struct xfrm_state
*x
)
273 struct ah_data
*ahp
= x
->data
;
278 kfree(ahp
->work_icv
);
279 ahp
->work_icv
= NULL
;
280 crypto_free_tfm(ahp
->tfm
);
286 static struct xfrm_type ah_type
=
288 .description
= "AH4",
289 .owner
= THIS_MODULE
,
291 .init_state
= ah_init_state
,
292 .destructor
= ah_destroy
,
297 static struct net_protocol ah4_protocol
= {
298 .handler
= xfrm4_rcv
,
299 .err_handler
= ah4_err
,
303 static int __init
ah4_init(void)
305 if (xfrm_register_type(&ah_type
, AF_INET
) < 0) {
306 printk(KERN_INFO
"ip ah init: can't add xfrm type\n");
309 if (inet_add_protocol(&ah4_protocol
, IPPROTO_AH
) < 0) {
310 printk(KERN_INFO
"ip ah init: can't add protocol\n");
311 xfrm_unregister_type(&ah_type
, AF_INET
);
317 static void __exit
ah4_fini(void)
319 if (inet_del_protocol(&ah4_protocol
, IPPROTO_AH
) < 0)
320 printk(KERN_INFO
"ip ah close: can't remove protocol\n");
321 if (xfrm_unregister_type(&ah_type
, AF_INET
) < 0)
322 printk(KERN_INFO
"ip ah close: can't remove xfrm type\n");
325 module_init(ah4_init
);
326 module_exit(ah4_fini
);
327 MODULE_LICENSE("GPL");