2 * Copyright (C)2002 USAGI/WIDE Project
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 * Mitsuru KANDA @USAGI : IPv6 Support
21 * Kazunori MIYAZAWA @USAGI :
22 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
24 * This file is derived from net/ipv4/ah.c.
27 #include <linux/module.h>
30 #include <linux/crypto.h>
31 #include <linux/pfkeyv2.h>
32 #include <linux/string.h>
35 #include <net/protocol.h>
37 #include <asm/scatterlist.h>
39 static int zero_out_mutable_opts(struct ipv6_opt_hdr
*opthdr
)
41 u8
*opt
= (u8
*)opthdr
;
42 int len
= ipv6_optlen(opthdr
);
59 optlen
= opt
[off
+1]+2;
63 memset(&opt
[off
+2], 0, opt
[off
+1]);
78 * ipv6_rearrange_rthdr - rearrange IPv6 routing header
80 * @rthdr: routing header
82 * Rearrange the destination address in @iph and the addresses in @rthdr
83 * so that they appear in the order they will at the final destination.
84 * See Appendix A2 of RFC 2402 for details.
86 static void ipv6_rearrange_rthdr(struct ipv6hdr
*iph
, struct ipv6_rt_hdr
*rthdr
)
88 int segments
, segments_left
;
89 struct in6_addr
*addrs
;
90 struct in6_addr final_addr
;
92 segments_left
= rthdr
->segments_left
;
93 if (segments_left
== 0)
95 rthdr
->segments_left
= 0;
97 /* The value of rthdr->hdrlen has been verified either by the system
98 * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming
99 * packets. So we can assume that it is even and that segments is
100 * greater than or equal to segments_left.
102 * For the same reason we can assume that this option is of type 0.
104 segments
= rthdr
->hdrlen
>> 1;
106 addrs
= ((struct rt0_hdr
*)rthdr
)->addr
;
107 ipv6_addr_copy(&final_addr
, addrs
+ segments
- 1);
109 addrs
+= segments
- segments_left
;
110 memmove(addrs
+ 1, addrs
, (segments_left
- 1) * sizeof(*addrs
));
112 ipv6_addr_copy(addrs
, &iph
->daddr
);
113 ipv6_addr_copy(&iph
->daddr
, &final_addr
);
116 static int ipv6_clear_mutable_options(struct ipv6hdr
*iph
, int len
)
120 struct ipv6_opt_hdr
*opth
;
121 struct ipv6_rt_hdr
*rth
;
123 } exthdr
= { .iph
= iph
};
124 char *end
= exthdr
.raw
+ len
;
125 int nexthdr
= iph
->nexthdr
;
129 while (exthdr
.raw
< end
) {
133 if (!zero_out_mutable_opts(exthdr
.opth
)) {
135 KERN_WARNING
"overrun %sopts\n",
136 nexthdr
== NEXTHDR_HOP
?
142 case NEXTHDR_ROUTING
:
143 ipv6_rearrange_rthdr(iph
, exthdr
.rth
);
150 nexthdr
= exthdr
.opth
->nexthdr
;
151 exthdr
.raw
+= ipv6_optlen(exthdr
.opth
);
157 static int ah6_output(struct xfrm_state
*x
, struct sk_buff
*skb
)
161 struct ipv6hdr
*top_iph
;
162 struct ip_auth_hdr
*ah
;
167 struct in6_addr daddr
;
171 top_iph
= (struct ipv6hdr
*)skb
->data
;
172 top_iph
->payload_len
= htons(skb
->len
- sizeof(*top_iph
));
174 nexthdr
= *skb
->nh
.raw
;
175 *skb
->nh
.raw
= IPPROTO_AH
;
177 /* When there are no extension headers, we only need to save the first
178 * 8 bytes of the base IP header.
180 memcpy(tmp_base
, top_iph
, sizeof(tmp_base
));
183 extlen
= skb
->h
.raw
- (unsigned char *)(top_iph
+ 1);
185 extlen
+= sizeof(*tmp_ext
);
186 tmp_ext
= kmalloc(extlen
, GFP_ATOMIC
);
191 memcpy(tmp_ext
, &top_iph
->daddr
, extlen
);
192 err
= ipv6_clear_mutable_options(top_iph
,
193 extlen
- sizeof(*tmp_ext
) +
199 ah
= (struct ip_auth_hdr
*)skb
->h
.raw
;
200 ah
->nexthdr
= nexthdr
;
202 top_iph
->priority
= 0;
203 top_iph
->flow_lbl
[0] = 0;
204 top_iph
->flow_lbl
[1] = 0;
205 top_iph
->flow_lbl
[2] = 0;
206 top_iph
->hop_limit
= 0;
209 ah
->hdrlen
= (XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr
) +
210 ahp
->icv_trunc_len
) >> 2) - 2;
214 ah
->seq_no
= htonl(++x
->replay
.oseq
);
215 xfrm_aevent_doreplay(x
);
216 err
= ah_mac_digest(ahp
, skb
, ah
->auth_data
);
219 memcpy(ah
->auth_data
, ahp
->work_icv
, ahp
->icv_trunc_len
);
223 memcpy(top_iph
, tmp_base
, sizeof(tmp_base
));
225 memcpy(&top_iph
->daddr
, tmp_ext
, extlen
);
234 static int ah6_input(struct xfrm_state
*x
, struct sk_buff
*skb
)
238 * [IPv6][Ext1][Ext2][AH][Dest][Payload]
239 * |<-------------->| hdr_len
242 * Keeping copy of cleared headers. After AH processing,
243 * Moving the pointer of skb->nh.raw by using skb_pull as long as AH
244 * header length. Then copy back the copy as long as hdr_len
245 * If destination header following AH exists, copy it into after [Ext2].
247 * |<>|[IPv6][Ext1][Ext2][Dest][Payload]
248 * There is offset of AH before IPv6 header after the process.
251 struct ipv6_auth_hdr
*ah
;
253 unsigned char *tmp_hdr
= NULL
;
259 if (!pskb_may_pull(skb
, sizeof(struct ip_auth_hdr
)))
262 /* We are going to _remove_ AH header to keep sockets happy,
263 * so... Later this can change. */
264 if (skb_cloned(skb
) &&
265 pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
268 hdr_len
= skb
->data
- skb
->nh
.raw
;
269 ah
= (struct ipv6_auth_hdr
*)skb
->data
;
271 nexthdr
= ah
->nexthdr
;
272 ah_hlen
= (ah
->hdrlen
+ 2) << 2;
274 if (ah_hlen
!= XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr
) + ahp
->icv_full_len
) &&
275 ah_hlen
!= XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr
) + ahp
->icv_trunc_len
))
278 if (!pskb_may_pull(skb
, ah_hlen
))
281 tmp_hdr
= kmalloc(hdr_len
, GFP_ATOMIC
);
284 memcpy(tmp_hdr
, skb
->nh
.raw
, hdr_len
);
285 if (ipv6_clear_mutable_options(skb
->nh
.ipv6h
, hdr_len
))
287 skb
->nh
.ipv6h
->priority
= 0;
288 skb
->nh
.ipv6h
->flow_lbl
[0] = 0;
289 skb
->nh
.ipv6h
->flow_lbl
[1] = 0;
290 skb
->nh
.ipv6h
->flow_lbl
[2] = 0;
291 skb
->nh
.ipv6h
->hop_limit
= 0;
294 u8 auth_data
[MAX_AH_AUTH_LEN
];
296 memcpy(auth_data
, ah
->auth_data
, ahp
->icv_trunc_len
);
297 memset(ah
->auth_data
, 0, ahp
->icv_trunc_len
);
298 skb_push(skb
, hdr_len
);
299 err
= ah_mac_digest(ahp
, skb
, ah
->auth_data
);
303 if (memcmp(ahp
->work_icv
, auth_data
, ahp
->icv_trunc_len
)) {
304 LIMIT_NETDEBUG(KERN_WARNING
"ipsec ah authentication error\n");
305 x
->stats
.integrity_failed
++;
310 skb
->h
.raw
= memcpy(skb
->nh
.raw
+= ah_hlen
, tmp_hdr
, hdr_len
);
311 __skb_pull(skb
, ah_hlen
+ hdr_len
);
323 static void ah6_err(struct sk_buff
*skb
, struct inet6_skb_parm
*opt
,
324 int type
, int code
, int offset
, __u32 info
)
326 struct ipv6hdr
*iph
= (struct ipv6hdr
*)skb
->data
;
327 struct ip_auth_hdr
*ah
= (struct ip_auth_hdr
*)(skb
->data
+offset
);
328 struct xfrm_state
*x
;
330 if (type
!= ICMPV6_DEST_UNREACH
&&
331 type
!= ICMPV6_PKT_TOOBIG
)
334 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, ah
->spi
, IPPROTO_AH
, AF_INET6
);
338 NETDEBUG(KERN_DEBUG
"pmtu discovery on SA AH/%08x/" NIP6_FMT
"\n",
339 ntohl(ah
->spi
), NIP6(iph
->daddr
));
344 static int ah6_init_state(struct xfrm_state
*x
)
346 struct ah_data
*ahp
= NULL
;
347 struct xfrm_algo_desc
*aalg_desc
;
348 struct crypto_hash
*tfm
;
353 /* null auth can use a zero length key */
354 if (x
->aalg
->alg_key_len
> 512)
360 ahp
= kzalloc(sizeof(*ahp
), GFP_KERNEL
);
364 ahp
->key
= x
->aalg
->alg_key
;
365 ahp
->key_len
= (x
->aalg
->alg_key_len
+7)/8;
366 tfm
= crypto_alloc_hash(x
->aalg
->alg_name
, 0, CRYPTO_ALG_ASYNC
);
371 if (crypto_hash_setkey(tfm
, ahp
->key
, ahp
->key_len
))
375 * Lookup the algorithm description maintained by xfrm_algo,
376 * verify crypto transform properties, and store information
377 * we need for AH processing. This lookup cannot fail here
378 * after a successful crypto_alloc_hash().
380 aalg_desc
= xfrm_aalg_get_byname(x
->aalg
->alg_name
, 0);
383 if (aalg_desc
->uinfo
.auth
.icv_fullbits
/8 !=
384 crypto_hash_digestsize(tfm
)) {
385 printk(KERN_INFO
"AH: %s digestsize %u != %hu\n",
386 x
->aalg
->alg_name
, crypto_hash_digestsize(tfm
),
387 aalg_desc
->uinfo
.auth
.icv_fullbits
/8);
391 ahp
->icv_full_len
= aalg_desc
->uinfo
.auth
.icv_fullbits
/8;
392 ahp
->icv_trunc_len
= aalg_desc
->uinfo
.auth
.icv_truncbits
/8;
394 BUG_ON(ahp
->icv_trunc_len
> MAX_AH_AUTH_LEN
);
396 ahp
->work_icv
= kmalloc(ahp
->icv_full_len
, GFP_KERNEL
);
400 x
->props
.header_len
= XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr
) + ahp
->icv_trunc_len
);
402 x
->props
.header_len
+= sizeof(struct ipv6hdr
);
409 kfree(ahp
->work_icv
);
410 crypto_free_hash(ahp
->tfm
);
416 static void ah6_destroy(struct xfrm_state
*x
)
418 struct ah_data
*ahp
= x
->data
;
423 kfree(ahp
->work_icv
);
424 ahp
->work_icv
= NULL
;
425 crypto_free_hash(ahp
->tfm
);
430 static struct xfrm_type ah6_type
=
432 .description
= "AH6",
433 .owner
= THIS_MODULE
,
435 .init_state
= ah6_init_state
,
436 .destructor
= ah6_destroy
,
441 static struct inet6_protocol ah6_protocol
= {
442 .handler
= xfrm6_rcv
,
443 .err_handler
= ah6_err
,
444 .flags
= INET6_PROTO_NOPOLICY
,
447 static int __init
ah6_init(void)
449 if (xfrm_register_type(&ah6_type
, AF_INET6
) < 0) {
450 printk(KERN_INFO
"ipv6 ah init: can't add xfrm type\n");
454 if (inet6_add_protocol(&ah6_protocol
, IPPROTO_AH
) < 0) {
455 printk(KERN_INFO
"ipv6 ah init: can't add protocol\n");
456 xfrm_unregister_type(&ah6_type
, AF_INET6
);
463 static void __exit
ah6_fini(void)
465 if (inet6_del_protocol(&ah6_protocol
, IPPROTO_AH
) < 0)
466 printk(KERN_INFO
"ipv6 ah close: can't remove protocol\n");
468 if (xfrm_unregister_type(&ah6_type
, AF_INET6
) < 0)
469 printk(KERN_INFO
"ipv6 ah close: can't remove xfrm type\n");
473 module_init(ah6_init
);
474 module_exit(ah6_fini
);
476 MODULE_LICENSE("GPL");