2 * Copyright (C)2002 USAGI/WIDE Project
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 * Mitsuru KANDA @USAGI : IPv6 Support
20 * Kazunori MIYAZAWA @USAGI :
21 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
23 * This file is derived from net/ipv4/esp.c
26 #define pr_fmt(fmt) "IPv6: " fmt
28 #include <crypto/aead.h>
29 #include <crypto/authenc.h>
30 #include <linux/err.h>
31 #include <linux/module.h>
35 #include <linux/scatterlist.h>
36 #include <linux/kernel.h>
37 #include <linux/pfkeyv2.h>
38 #include <linux/random.h>
39 #include <linux/slab.h>
40 #include <linux/spinlock.h>
41 #include <net/ip6_route.h>
44 #include <net/protocol.h>
45 #include <linux/icmpv6.h>
48 struct xfrm_skb_cb xfrm
;
52 #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
54 static u32
esp6_get_mtu(struct xfrm_state
*x
, int mtu
);
57 * Allocate an AEAD request structure with extra space for SG and IV.
59 * For alignment considerations the upper 32 bits of the sequence number are
60 * placed at the front, if present. Followed by the IV, the request and finally
63 * TODO: Use spare space in skb for this where possible.
65 static void *esp_alloc_tmp(struct crypto_aead
*aead
, int nfrags
, int seqihlen
)
71 len
+= crypto_aead_ivsize(aead
);
74 len
+= crypto_aead_alignmask(aead
) &
75 ~(crypto_tfm_ctx_alignment() - 1);
76 len
= ALIGN(len
, crypto_tfm_ctx_alignment());
79 len
+= sizeof(struct aead_givcrypt_request
) + crypto_aead_reqsize(aead
);
80 len
= ALIGN(len
, __alignof__(struct scatterlist
));
82 len
+= sizeof(struct scatterlist
) * nfrags
;
84 return kmalloc(len
, GFP_ATOMIC
);
87 static inline __be32
*esp_tmp_seqhi(void *tmp
)
89 return PTR_ALIGN((__be32
*)tmp
, __alignof__(__be32
));
92 static inline u8
*esp_tmp_iv(struct crypto_aead
*aead
, void *tmp
, int seqhilen
)
94 return crypto_aead_ivsize(aead
) ?
95 PTR_ALIGN((u8
*)tmp
+ seqhilen
,
96 crypto_aead_alignmask(aead
) + 1) : tmp
+ seqhilen
;
99 static inline struct aead_givcrypt_request
*esp_tmp_givreq(
100 struct crypto_aead
*aead
, u8
*iv
)
102 struct aead_givcrypt_request
*req
;
104 req
= (void *)PTR_ALIGN(iv
+ crypto_aead_ivsize(aead
),
105 crypto_tfm_ctx_alignment());
106 aead_givcrypt_set_tfm(req
, aead
);
110 static inline struct aead_request
*esp_tmp_req(struct crypto_aead
*aead
, u8
*iv
)
112 struct aead_request
*req
;
114 req
= (void *)PTR_ALIGN(iv
+ crypto_aead_ivsize(aead
),
115 crypto_tfm_ctx_alignment());
116 aead_request_set_tfm(req
, aead
);
120 static inline struct scatterlist
*esp_req_sg(struct crypto_aead
*aead
,
121 struct aead_request
*req
)
123 return (void *)ALIGN((unsigned long)(req
+ 1) +
124 crypto_aead_reqsize(aead
),
125 __alignof__(struct scatterlist
));
128 static inline struct scatterlist
*esp_givreq_sg(
129 struct crypto_aead
*aead
, struct aead_givcrypt_request
*req
)
131 return (void *)ALIGN((unsigned long)(req
+ 1) +
132 crypto_aead_reqsize(aead
),
133 __alignof__(struct scatterlist
));
136 static void esp_output_done(struct crypto_async_request
*base
, int err
)
138 struct sk_buff
*skb
= base
->data
;
140 kfree(ESP_SKB_CB(skb
)->tmp
);
141 xfrm_output_resume(skb
, err
);
144 static int esp6_output(struct xfrm_state
*x
, struct sk_buff
*skb
)
147 struct ip_esp_hdr
*esph
;
148 struct crypto_aead
*aead
;
149 struct aead_givcrypt_request
*req
;
150 struct scatterlist
*sg
;
151 struct scatterlist
*asg
;
152 struct sk_buff
*trailer
;
167 /* skb is pure payload to encrypt */
169 alen
= crypto_aead_authsize(aead
);
173 struct xfrm_dst
*dst
= (struct xfrm_dst
*)skb_dst(skb
);
176 padto
= min(x
->tfcpad
, esp6_get_mtu(x
, dst
->child_mtu_cached
));
177 if (skb
->len
< padto
)
178 tfclen
= padto
- skb
->len
;
180 blksize
= ALIGN(crypto_aead_blocksize(aead
), 4);
181 clen
= ALIGN(skb
->len
+ 2 + tfclen
, blksize
);
182 plen
= clen
- skb
->len
- tfclen
;
184 err
= skb_cow_data(skb
, tfclen
+ plen
+ alen
, &trailer
);
189 assoclen
= sizeof(*esph
);
193 if (x
->props
.flags
& XFRM_STATE_ESN
) {
195 seqhilen
+= sizeof(__be32
);
196 assoclen
+= seqhilen
;
199 tmp
= esp_alloc_tmp(aead
, nfrags
+ sglists
, seqhilen
);
205 seqhi
= esp_tmp_seqhi(tmp
);
206 iv
= esp_tmp_iv(aead
, tmp
, seqhilen
);
207 req
= esp_tmp_givreq(aead
, iv
);
208 asg
= esp_givreq_sg(aead
, req
);
211 /* Fill padding... */
212 tail
= skb_tail_pointer(trailer
);
214 memset(tail
, 0, tfclen
);
219 for (i
= 0; i
< plen
- 2; i
++)
222 tail
[plen
- 2] = plen
- 2;
223 tail
[plen
- 1] = *skb_mac_header(skb
);
224 pskb_put(skb
, trailer
, clen
- skb
->len
+ alen
);
226 skb_push(skb
, -skb_network_offset(skb
));
227 esph
= ip_esp_hdr(skb
);
228 *skb_mac_header(skb
) = IPPROTO_ESP
;
230 esph
->spi
= x
->id
.spi
;
231 esph
->seq_no
= htonl(XFRM_SKB_CB(skb
)->seq
.output
.low
);
233 sg_init_table(sg
, nfrags
);
234 skb_to_sgvec(skb
, sg
,
235 esph
->enc_data
+ crypto_aead_ivsize(aead
) - skb
->data
,
238 if ((x
->props
.flags
& XFRM_STATE_ESN
)) {
239 sg_init_table(asg
, 3);
240 sg_set_buf(asg
, &esph
->spi
, sizeof(__be32
));
241 *seqhi
= htonl(XFRM_SKB_CB(skb
)->seq
.output
.hi
);
242 sg_set_buf(asg
+ 1, seqhi
, seqhilen
);
243 sg_set_buf(asg
+ 2, &esph
->seq_no
, sizeof(__be32
));
245 sg_init_one(asg
, esph
, sizeof(*esph
));
247 aead_givcrypt_set_callback(req
, 0, esp_output_done
, skb
);
248 aead_givcrypt_set_crypt(req
, sg
, sg
, clen
, iv
);
249 aead_givcrypt_set_assoc(req
, asg
, assoclen
);
250 aead_givcrypt_set_giv(req
, esph
->enc_data
,
251 XFRM_SKB_CB(skb
)->seq
.output
.low
);
253 ESP_SKB_CB(skb
)->tmp
= tmp
;
254 err
= crypto_aead_givencrypt(req
);
255 if (err
== -EINPROGRESS
)
267 static int esp_input_done2(struct sk_buff
*skb
, int err
)
269 struct xfrm_state
*x
= xfrm_input_state(skb
);
270 struct crypto_aead
*aead
= x
->data
;
271 int alen
= crypto_aead_authsize(aead
);
272 int hlen
= sizeof(struct ip_esp_hdr
) + crypto_aead_ivsize(aead
);
273 int elen
= skb
->len
- hlen
;
274 int hdr_len
= skb_network_header_len(skb
);
278 kfree(ESP_SKB_CB(skb
)->tmp
);
283 if (skb_copy_bits(skb
, skb
->len
- alen
- 2, nexthdr
, 2))
288 if (padlen
+ 2 + alen
>= elen
) {
289 net_dbg_ratelimited("ipsec esp packet is garbage padlen=%d, elen=%d\n",
290 padlen
+ 2, elen
- alen
);
294 /* ... check padding bits here. Silly. :-) */
296 pskb_trim(skb
, skb
->len
- alen
- padlen
- 2);
297 __skb_pull(skb
, hlen
);
298 if (x
->props
.mode
== XFRM_MODE_TUNNEL
)
299 skb_reset_transport_header(skb
);
301 skb_set_transport_header(skb
, -hdr_len
);
305 /* RFC4303: Drop dummy packets without any error */
306 if (err
== IPPROTO_NONE
)
313 static void esp_input_done(struct crypto_async_request
*base
, int err
)
315 struct sk_buff
*skb
= base
->data
;
317 xfrm_input_resume(skb
, esp_input_done2(skb
, err
));
320 static int esp6_input(struct xfrm_state
*x
, struct sk_buff
*skb
)
322 struct ip_esp_hdr
*esph
;
323 struct crypto_aead
*aead
= x
->data
;
324 struct aead_request
*req
;
325 struct sk_buff
*trailer
;
326 int elen
= skb
->len
- sizeof(*esph
) - crypto_aead_ivsize(aead
);
335 struct scatterlist
*sg
;
336 struct scatterlist
*asg
;
338 if (!pskb_may_pull(skb
, sizeof(*esph
) + crypto_aead_ivsize(aead
))) {
348 if ((nfrags
= skb_cow_data(skb
, 0, &trailer
)) < 0) {
355 assoclen
= sizeof(*esph
);
359 if (x
->props
.flags
& XFRM_STATE_ESN
) {
361 seqhilen
+= sizeof(__be32
);
362 assoclen
+= seqhilen
;
365 tmp
= esp_alloc_tmp(aead
, nfrags
+ sglists
, seqhilen
);
369 ESP_SKB_CB(skb
)->tmp
= tmp
;
370 seqhi
= esp_tmp_seqhi(tmp
);
371 iv
= esp_tmp_iv(aead
, tmp
, seqhilen
);
372 req
= esp_tmp_req(aead
, iv
);
373 asg
= esp_req_sg(aead
, req
);
376 skb
->ip_summed
= CHECKSUM_NONE
;
378 esph
= (struct ip_esp_hdr
*)skb
->data
;
380 /* Get ivec. This can be wrong, check against another impls. */
383 sg_init_table(sg
, nfrags
);
384 skb_to_sgvec(skb
, sg
, sizeof(*esph
) + crypto_aead_ivsize(aead
), elen
);
386 if ((x
->props
.flags
& XFRM_STATE_ESN
)) {
387 sg_init_table(asg
, 3);
388 sg_set_buf(asg
, &esph
->spi
, sizeof(__be32
));
389 *seqhi
= XFRM_SKB_CB(skb
)->seq
.input
.hi
;
390 sg_set_buf(asg
+ 1, seqhi
, seqhilen
);
391 sg_set_buf(asg
+ 2, &esph
->seq_no
, sizeof(__be32
));
393 sg_init_one(asg
, esph
, sizeof(*esph
));
395 aead_request_set_callback(req
, 0, esp_input_done
, skb
);
396 aead_request_set_crypt(req
, sg
, sg
, elen
, iv
);
397 aead_request_set_assoc(req
, asg
, assoclen
);
399 ret
= crypto_aead_decrypt(req
);
400 if (ret
== -EINPROGRESS
)
403 ret
= esp_input_done2(skb
, ret
);
409 static u32
esp6_get_mtu(struct xfrm_state
*x
, int mtu
)
411 struct crypto_aead
*aead
= x
->data
;
412 u32 blksize
= ALIGN(crypto_aead_blocksize(aead
), 4);
413 unsigned int net_adj
;
415 if (x
->props
.mode
!= XFRM_MODE_TUNNEL
)
416 net_adj
= sizeof(struct ipv6hdr
);
420 return ((mtu
- x
->props
.header_len
- crypto_aead_authsize(aead
) -
421 net_adj
) & ~(blksize
- 1)) + net_adj
- 2;
424 static int esp6_err(struct sk_buff
*skb
, struct inet6_skb_parm
*opt
,
425 u8 type
, u8 code
, int offset
, __be32 info
)
427 struct net
*net
= dev_net(skb
->dev
);
428 const struct ipv6hdr
*iph
= (const struct ipv6hdr
*)skb
->data
;
429 struct ip_esp_hdr
*esph
= (struct ip_esp_hdr
*)(skb
->data
+ offset
);
430 struct xfrm_state
*x
;
432 if (type
!= ICMPV6_PKT_TOOBIG
&&
433 type
!= NDISC_REDIRECT
)
436 x
= xfrm_state_lookup(net
, skb
->mark
, (const xfrm_address_t
*)&iph
->daddr
,
437 esph
->spi
, IPPROTO_ESP
, AF_INET6
);
441 if (type
== NDISC_REDIRECT
)
442 ip6_redirect(skb
, net
, skb
->dev
->ifindex
, 0);
444 ip6_update_pmtu(skb
, net
, info
, 0, 0);
450 static void esp6_destroy(struct xfrm_state
*x
)
452 struct crypto_aead
*aead
= x
->data
;
457 crypto_free_aead(aead
);
460 static int esp_init_aead(struct xfrm_state
*x
)
462 struct crypto_aead
*aead
;
465 aead
= crypto_alloc_aead(x
->aead
->alg_name
, 0, 0);
472 err
= crypto_aead_setkey(aead
, x
->aead
->alg_key
,
473 (x
->aead
->alg_key_len
+ 7) / 8);
477 err
= crypto_aead_setauthsize(aead
, x
->aead
->alg_icv_len
/ 8);
485 static int esp_init_authenc(struct xfrm_state
*x
)
487 struct crypto_aead
*aead
;
488 struct crypto_authenc_key_param
*param
;
492 char authenc_name
[CRYPTO_MAX_ALG_NAME
];
502 if ((x
->props
.flags
& XFRM_STATE_ESN
)) {
503 if (snprintf(authenc_name
, CRYPTO_MAX_ALG_NAME
,
505 x
->aalg
? x
->aalg
->alg_name
: "digest_null",
506 x
->ealg
->alg_name
) >= CRYPTO_MAX_ALG_NAME
)
509 if (snprintf(authenc_name
, CRYPTO_MAX_ALG_NAME
,
511 x
->aalg
? x
->aalg
->alg_name
: "digest_null",
512 x
->ealg
->alg_name
) >= CRYPTO_MAX_ALG_NAME
)
516 aead
= crypto_alloc_aead(authenc_name
, 0, 0);
523 keylen
= (x
->aalg
? (x
->aalg
->alg_key_len
+ 7) / 8 : 0) +
524 (x
->ealg
->alg_key_len
+ 7) / 8 + RTA_SPACE(sizeof(*param
));
526 key
= kmalloc(keylen
, GFP_KERNEL
);
532 rta
->rta_type
= CRYPTO_AUTHENC_KEYA_PARAM
;
533 rta
->rta_len
= RTA_LENGTH(sizeof(*param
));
534 param
= RTA_DATA(rta
);
535 p
+= RTA_SPACE(sizeof(*param
));
538 struct xfrm_algo_desc
*aalg_desc
;
540 memcpy(p
, x
->aalg
->alg_key
, (x
->aalg
->alg_key_len
+ 7) / 8);
541 p
+= (x
->aalg
->alg_key_len
+ 7) / 8;
543 aalg_desc
= xfrm_aalg_get_byname(x
->aalg
->alg_name
, 0);
547 if (aalg_desc
->uinfo
.auth
.icv_fullbits
/ 8 !=
548 crypto_aead_authsize(aead
)) {
549 pr_info("ESP: %s digestsize %u != %hu\n",
551 crypto_aead_authsize(aead
),
552 aalg_desc
->uinfo
.auth
.icv_fullbits
/ 8);
556 err
= crypto_aead_setauthsize(
557 aead
, x
->aalg
->alg_trunc_len
/ 8);
562 param
->enckeylen
= cpu_to_be32((x
->ealg
->alg_key_len
+ 7) / 8);
563 memcpy(p
, x
->ealg
->alg_key
, (x
->ealg
->alg_key_len
+ 7) / 8);
565 err
= crypto_aead_setkey(aead
, key
, keylen
);
574 static int esp6_init_state(struct xfrm_state
*x
)
576 struct crypto_aead
*aead
;
586 err
= esp_init_aead(x
);
588 err
= esp_init_authenc(x
);
595 x
->props
.header_len
= sizeof(struct ip_esp_hdr
) +
596 crypto_aead_ivsize(aead
);
597 switch (x
->props
.mode
) {
599 if (x
->sel
.family
!= AF_INET6
)
600 x
->props
.header_len
+= IPV4_BEET_PHMAXLEN
+
601 (sizeof(struct ipv6hdr
) - sizeof(struct iphdr
));
603 case XFRM_MODE_TRANSPORT
:
605 case XFRM_MODE_TUNNEL
:
606 x
->props
.header_len
+= sizeof(struct ipv6hdr
);
612 align
= ALIGN(crypto_aead_blocksize(aead
), 4);
613 x
->props
.trailer_len
= align
+ 1 + crypto_aead_authsize(aead
);
619 static int esp6_rcv_cb(struct sk_buff
*skb
, int err
)
624 static const struct xfrm_type esp6_type
= {
625 .description
= "ESP6",
626 .owner
= THIS_MODULE
,
627 .proto
= IPPROTO_ESP
,
628 .flags
= XFRM_TYPE_REPLAY_PROT
,
629 .init_state
= esp6_init_state
,
630 .destructor
= esp6_destroy
,
631 .get_mtu
= esp6_get_mtu
,
633 .output
= esp6_output
,
634 .hdr_offset
= xfrm6_find_1stfragopt
,
637 static struct xfrm6_protocol esp6_protocol
= {
638 .handler
= xfrm6_rcv
,
639 .cb_handler
= esp6_rcv_cb
,
640 .err_handler
= esp6_err
,
644 static int __init
esp6_init(void)
646 if (xfrm_register_type(&esp6_type
, AF_INET6
) < 0) {
647 pr_info("%s: can't add xfrm type\n", __func__
);
650 if (xfrm6_protocol_register(&esp6_protocol
, IPPROTO_ESP
) < 0) {
651 pr_info("%s: can't add protocol\n", __func__
);
652 xfrm_unregister_type(&esp6_type
, AF_INET6
);
659 static void __exit
esp6_fini(void)
661 if (xfrm6_protocol_deregister(&esp6_protocol
, IPPROTO_ESP
) < 0)
662 pr_info("%s: can't remove protocol\n", __func__
);
663 if (xfrm_unregister_type(&esp6_type
, AF_INET6
) < 0)
664 pr_info("%s: can't remove xfrm type\n", __func__
);
667 module_init(esp6_init
);
668 module_exit(esp6_fini
);
670 MODULE_LICENSE("GPL");
671 MODULE_ALIAS_XFRM_TYPE(AF_INET6
, XFRM_PROTO_ESP
);