Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C)2002 USAGI/WIDE Project |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 3 | * |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 4 | * This program is free software; you can redistribute it and/or modify |
| 5 | * it under the terms of the GNU General Public License as published by |
| 6 | * the Free Software Foundation; either version 2 of the License, or |
| 7 | * (at your option) any later version. |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 8 | * |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 9 | * This program is distributed in the hope that it will be useful, |
| 10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 12 | * GNU General Public License for more details. |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 13 | * |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 14 | * You should have received a copy of the GNU General Public License |
Jeff Kirsher | a99421d | 2013-12-06 09:13:39 -0800 | [diff] [blame] | 15 | * along with this program; if not, see <http://www.gnu.org/licenses/>. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 16 | * |
| 17 | * Authors |
| 18 | * |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 19 | * Mitsuru KANDA @USAGI : IPv6 Support |
Ian Morris | 67ba415 | 2014-08-24 21:53:10 +0100 | [diff] [blame] | 20 | * Kazunori MIYAZAWA @USAGI : |
| 21 | * Kunihiro Ishiguro <kunihiro@ipinfusion.com> |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 22 | * |
Ian Morris | 67ba415 | 2014-08-24 21:53:10 +0100 | [diff] [blame] | 23 | * This file is derived from net/ipv4/esp.c |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 24 | */ |
| 25 | |
Joe Perches | f321383 | 2012-05-15 14:11:53 +0000 | [diff] [blame] | 26 | #define pr_fmt(fmt) "IPv6: " fmt |
| 27 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 28 | #include <crypto/aead.h> |
| 29 | #include <crypto/authenc.h> |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 30 | #include <linux/err.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 31 | #include <linux/module.h> |
| 32 | #include <net/ip.h> |
| 33 | #include <net/xfrm.h> |
| 34 | #include <net/esp.h> |
Adrian Bunk | 72998d8 | 2007-10-26 22:53:58 -0700 | [diff] [blame] | 35 | #include <linux/scatterlist.h> |
Herbert Xu | a02a642 | 2005-10-10 21:11:08 -0700 | [diff] [blame] | 36 | #include <linux/kernel.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 37 | #include <linux/pfkeyv2.h> |
| 38 | #include <linux/random.h> |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 39 | #include <linux/slab.h> |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 40 | #include <linux/spinlock.h> |
David S. Miller | 81aded2 | 2012-06-15 14:54:11 -0700 | [diff] [blame] | 41 | #include <net/ip6_route.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 42 | #include <net/icmp.h> |
| 43 | #include <net/ipv6.h> |
Arnaldo Carvalho de Melo | 14c8502 | 2005-12-27 02:43:12 -0200 | [diff] [blame] | 44 | #include <net/protocol.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | #include <linux/icmpv6.h> |
| 46 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 47 | struct esp_skb_cb { |
| 48 | struct xfrm_skb_cb xfrm; |
| 49 | void *tmp; |
| 50 | }; |
| 51 | |
| 52 | #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0])) |
| 53 | |
Martin Willi | 040253c | 2010-12-08 04:37:51 +0000 | [diff] [blame] | 54 | static u32 esp6_get_mtu(struct xfrm_state *x, int mtu); |
| 55 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 56 | /* |
| 57 | * Allocate an AEAD request structure with extra space for SG and IV. |
| 58 | * |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 59 | * For alignment considerations the upper 32 bits of the sequence number are |
| 60 | * placed at the front, if present. Followed by the IV, the request and finally |
| 61 | * the SG list. |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 62 | * |
| 63 | * TODO: Use spare space in skb for this where possible. |
| 64 | */ |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 65 | static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqihlen) |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 66 | { |
| 67 | unsigned int len; |
| 68 | |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 69 | len = seqihlen; |
| 70 | |
| 71 | len += crypto_aead_ivsize(aead); |
| 72 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 73 | if (len) { |
| 74 | len += crypto_aead_alignmask(aead) & |
| 75 | ~(crypto_tfm_ctx_alignment() - 1); |
| 76 | len = ALIGN(len, crypto_tfm_ctx_alignment()); |
| 77 | } |
| 78 | |
| 79 | len += sizeof(struct aead_givcrypt_request) + crypto_aead_reqsize(aead); |
| 80 | len = ALIGN(len, __alignof__(struct scatterlist)); |
| 81 | |
| 82 | len += sizeof(struct scatterlist) * nfrags; |
| 83 | |
| 84 | return kmalloc(len, GFP_ATOMIC); |
| 85 | } |
| 86 | |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 87 | static inline __be32 *esp_tmp_seqhi(void *tmp) |
| 88 | { |
| 89 | return PTR_ALIGN((__be32 *)tmp, __alignof__(__be32)); |
| 90 | } |
| 91 | |
| 92 | static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int seqhilen) |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 93 | { |
| 94 | return crypto_aead_ivsize(aead) ? |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 95 | PTR_ALIGN((u8 *)tmp + seqhilen, |
| 96 | crypto_aead_alignmask(aead) + 1) : tmp + seqhilen; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 97 | } |
| 98 | |
| 99 | static inline struct aead_givcrypt_request *esp_tmp_givreq( |
| 100 | struct crypto_aead *aead, u8 *iv) |
| 101 | { |
| 102 | struct aead_givcrypt_request *req; |
| 103 | |
| 104 | req = (void *)PTR_ALIGN(iv + crypto_aead_ivsize(aead), |
| 105 | crypto_tfm_ctx_alignment()); |
| 106 | aead_givcrypt_set_tfm(req, aead); |
| 107 | return req; |
| 108 | } |
| 109 | |
| 110 | static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv) |
| 111 | { |
| 112 | struct aead_request *req; |
| 113 | |
| 114 | req = (void *)PTR_ALIGN(iv + crypto_aead_ivsize(aead), |
| 115 | crypto_tfm_ctx_alignment()); |
| 116 | aead_request_set_tfm(req, aead); |
| 117 | return req; |
| 118 | } |
| 119 | |
| 120 | static inline struct scatterlist *esp_req_sg(struct crypto_aead *aead, |
| 121 | struct aead_request *req) |
| 122 | { |
| 123 | return (void *)ALIGN((unsigned long)(req + 1) + |
| 124 | crypto_aead_reqsize(aead), |
| 125 | __alignof__(struct scatterlist)); |
| 126 | } |
| 127 | |
| 128 | static inline struct scatterlist *esp_givreq_sg( |
| 129 | struct crypto_aead *aead, struct aead_givcrypt_request *req) |
| 130 | { |
| 131 | return (void *)ALIGN((unsigned long)(req + 1) + |
| 132 | crypto_aead_reqsize(aead), |
| 133 | __alignof__(struct scatterlist)); |
| 134 | } |
| 135 | |
| 136 | static void esp_output_done(struct crypto_async_request *base, int err) |
| 137 | { |
| 138 | struct sk_buff *skb = base->data; |
| 139 | |
| 140 | kfree(ESP_SKB_CB(skb)->tmp); |
| 141 | xfrm_output_resume(skb, err); |
| 142 | } |
| 143 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 144 | static int esp6_output(struct xfrm_state *x, struct sk_buff *skb) |
| 145 | { |
| 146 | int err; |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 147 | struct ip_esp_hdr *esph; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 148 | struct crypto_aead *aead; |
| 149 | struct aead_givcrypt_request *req; |
| 150 | struct scatterlist *sg; |
| 151 | struct scatterlist *asg; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 152 | struct sk_buff *trailer; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 153 | void *tmp; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 154 | int blksize; |
| 155 | int clen; |
| 156 | int alen; |
Martin Willi | 040253c | 2010-12-08 04:37:51 +0000 | [diff] [blame] | 157 | int plen; |
| 158 | int tfclen; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 159 | int nfrags; |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 160 | int assoclen; |
| 161 | int sglists; |
| 162 | int seqhilen; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 163 | u8 *iv; |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 164 | u8 *tail; |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 165 | __be32 *seqhi; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 166 | |
Herbert Xu | 7b277b1 | 2007-10-10 15:44:06 -0700 | [diff] [blame] | 167 | /* skb is pure payload to encrypt */ |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 168 | aead = x->data; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 169 | alen = crypto_aead_authsize(aead); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 170 | |
Martin Willi | 040253c | 2010-12-08 04:37:51 +0000 | [diff] [blame] | 171 | tfclen = 0; |
| 172 | if (x->tfcpad) { |
| 173 | struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb); |
| 174 | u32 padto; |
| 175 | |
| 176 | padto = min(x->tfcpad, esp6_get_mtu(x, dst->child_mtu_cached)); |
| 177 | if (skb->len < padto) |
| 178 | tfclen = padto - skb->len; |
| 179 | } |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 180 | blksize = ALIGN(crypto_aead_blocksize(aead), 4); |
Martin Willi | 040253c | 2010-12-08 04:37:51 +0000 | [diff] [blame] | 181 | clen = ALIGN(skb->len + 2 + tfclen, blksize); |
Martin Willi | 040253c | 2010-12-08 04:37:51 +0000 | [diff] [blame] | 182 | plen = clen - skb->len - tfclen; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 183 | |
Martin Willi | 040253c | 2010-12-08 04:37:51 +0000 | [diff] [blame] | 184 | err = skb_cow_data(skb, tfclen + plen + alen, &trailer); |
| 185 | if (err < 0) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 186 | goto error; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 187 | nfrags = err; |
| 188 | |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 189 | assoclen = sizeof(*esph); |
| 190 | sglists = 1; |
| 191 | seqhilen = 0; |
| 192 | |
| 193 | if (x->props.flags & XFRM_STATE_ESN) { |
| 194 | sglists += 2; |
| 195 | seqhilen += sizeof(__be32); |
| 196 | assoclen += seqhilen; |
| 197 | } |
| 198 | |
| 199 | tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen); |
Julia Lawall | 48f125c | 2012-08-29 06:49:12 +0000 | [diff] [blame] | 200 | if (!tmp) { |
| 201 | err = -ENOMEM; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 202 | goto error; |
Julia Lawall | 48f125c | 2012-08-29 06:49:12 +0000 | [diff] [blame] | 203 | } |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 204 | |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 205 | seqhi = esp_tmp_seqhi(tmp); |
| 206 | iv = esp_tmp_iv(aead, tmp, seqhilen); |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 207 | req = esp_tmp_givreq(aead, iv); |
| 208 | asg = esp_givreq_sg(aead, req); |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 209 | sg = asg + sglists; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 210 | |
| 211 | /* Fill padding... */ |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 212 | tail = skb_tail_pointer(trailer); |
Martin Willi | 040253c | 2010-12-08 04:37:51 +0000 | [diff] [blame] | 213 | if (tfclen) { |
| 214 | memset(tail, 0, tfclen); |
| 215 | tail += tfclen; |
| 216 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 217 | do { |
| 218 | int i; |
Martin Willi | 040253c | 2010-12-08 04:37:51 +0000 | [diff] [blame] | 219 | for (i = 0; i < plen - 2; i++) |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 220 | tail[i] = i + 1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 221 | } while (0); |
Martin Willi | 040253c | 2010-12-08 04:37:51 +0000 | [diff] [blame] | 222 | tail[plen - 2] = plen - 2; |
| 223 | tail[plen - 1] = *skb_mac_header(skb); |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 224 | pskb_put(skb, trailer, clen - skb->len + alen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 225 | |
Herbert Xu | 7b277b1 | 2007-10-10 15:44:06 -0700 | [diff] [blame] | 226 | skb_push(skb, -skb_network_offset(skb)); |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 227 | esph = ip_esp_hdr(skb); |
Herbert Xu | 007f021 | 2007-10-09 13:25:59 -0700 | [diff] [blame] | 228 | *skb_mac_header(skb) = IPPROTO_ESP; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 229 | |
| 230 | esph->spi = x->id.spi; |
Steffen Klassert | 1ce3644 | 2011-03-08 00:06:31 +0000 | [diff] [blame] | 231 | esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 232 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 233 | sg_init_table(sg, nfrags); |
| 234 | skb_to_sgvec(skb, sg, |
| 235 | esph->enc_data + crypto_aead_ivsize(aead) - skb->data, |
| 236 | clen + alen); |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 237 | |
| 238 | if ((x->props.flags & XFRM_STATE_ESN)) { |
| 239 | sg_init_table(asg, 3); |
| 240 | sg_set_buf(asg, &esph->spi, sizeof(__be32)); |
| 241 | *seqhi = htonl(XFRM_SKB_CB(skb)->seq.output.hi); |
| 242 | sg_set_buf(asg + 1, seqhi, seqhilen); |
| 243 | sg_set_buf(asg + 2, &esph->seq_no, sizeof(__be32)); |
| 244 | } else |
| 245 | sg_init_one(asg, esph, sizeof(*esph)); |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 246 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 247 | aead_givcrypt_set_callback(req, 0, esp_output_done, skb); |
| 248 | aead_givcrypt_set_crypt(req, sg, sg, clen, iv); |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 249 | aead_givcrypt_set_assoc(req, asg, assoclen); |
Herbert Xu | b318e0e | 2008-02-12 22:50:35 -0800 | [diff] [blame] | 250 | aead_givcrypt_set_giv(req, esph->enc_data, |
Herbert Xu | 6d7258c | 2015-05-13 15:27:18 +0800 | [diff] [blame] | 251 | XFRM_SKB_CB(skb)->seq.output.low + |
| 252 | ((u64)XFRM_SKB_CB(skb)->seq.output.hi << 32)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 253 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 254 | ESP_SKB_CB(skb)->tmp = tmp; |
| 255 | err = crypto_aead_givencrypt(req); |
| 256 | if (err == -EINPROGRESS) |
| 257 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 258 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 259 | if (err == -EBUSY) |
| 260 | err = NET_XMIT_DROP; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 261 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 262 | kfree(tmp); |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 263 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 264 | error: |
| 265 | return err; |
| 266 | } |
| 267 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 268 | static int esp_input_done2(struct sk_buff *skb, int err) |
| 269 | { |
| 270 | struct xfrm_state *x = xfrm_input_state(skb); |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 271 | struct crypto_aead *aead = x->data; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 272 | int alen = crypto_aead_authsize(aead); |
| 273 | int hlen = sizeof(struct ip_esp_hdr) + crypto_aead_ivsize(aead); |
| 274 | int elen = skb->len - hlen; |
| 275 | int hdr_len = skb_network_header_len(skb); |
| 276 | int padlen; |
| 277 | u8 nexthdr[2]; |
| 278 | |
| 279 | kfree(ESP_SKB_CB(skb)->tmp); |
| 280 | |
| 281 | if (unlikely(err)) |
| 282 | goto out; |
| 283 | |
| 284 | if (skb_copy_bits(skb, skb->len - alen - 2, nexthdr, 2)) |
| 285 | BUG(); |
| 286 | |
| 287 | err = -EINVAL; |
| 288 | padlen = nexthdr[0]; |
| 289 | if (padlen + 2 + alen >= elen) { |
Joe Perches | ba7a46f | 2014-11-11 10:59:17 -0800 | [diff] [blame] | 290 | net_dbg_ratelimited("ipsec esp packet is garbage padlen=%d, elen=%d\n", |
| 291 | padlen + 2, elen - alen); |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 292 | goto out; |
| 293 | } |
| 294 | |
| 295 | /* ... check padding bits here. Silly. :-) */ |
| 296 | |
| 297 | pskb_trim(skb, skb->len - alen - padlen - 2); |
| 298 | __skb_pull(skb, hlen); |
Li RongQing | a9403f8 | 2013-01-08 15:41:12 +0800 | [diff] [blame] | 299 | if (x->props.mode == XFRM_MODE_TUNNEL) |
| 300 | skb_reset_transport_header(skb); |
| 301 | else |
| 302 | skb_set_transport_header(skb, -hdr_len); |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 303 | |
| 304 | err = nexthdr[1]; |
| 305 | |
| 306 | /* RFC4303: Drop dummy packets without any error */ |
| 307 | if (err == IPPROTO_NONE) |
| 308 | err = -EINVAL; |
| 309 | |
| 310 | out: |
| 311 | return err; |
| 312 | } |
| 313 | |
| 314 | static void esp_input_done(struct crypto_async_request *base, int err) |
| 315 | { |
| 316 | struct sk_buff *skb = base->data; |
| 317 | |
| 318 | xfrm_input_resume(skb, esp_input_done2(skb, err)); |
| 319 | } |
| 320 | |
Herbert Xu | e695633 | 2006-04-01 00:52:46 -0800 | [diff] [blame] | 321 | static int esp6_input(struct xfrm_state *x, struct sk_buff *skb) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 322 | { |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 323 | struct ip_esp_hdr *esph; |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 324 | struct crypto_aead *aead = x->data; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 325 | struct aead_request *req; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 326 | struct sk_buff *trailer; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 327 | int elen = skb->len - sizeof(*esph) - crypto_aead_ivsize(aead); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 328 | int nfrags; |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 329 | int assoclen; |
| 330 | int sglists; |
| 331 | int seqhilen; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 332 | int ret = 0; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 333 | void *tmp; |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 334 | __be32 *seqhi; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 335 | u8 *iv; |
| 336 | struct scatterlist *sg; |
| 337 | struct scatterlist *asg; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 338 | |
Thomas Graf | 920fc94 | 2008-03-27 16:08:03 -0700 | [diff] [blame] | 339 | if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead))) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 340 | ret = -EINVAL; |
Herbert Xu | 31a4ab9 | 2006-05-27 23:06:13 -0700 | [diff] [blame] | 341 | goto out; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 342 | } |
| 343 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 344 | if (elen <= 0) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 345 | ret = -EINVAL; |
Herbert Xu | 31a4ab9 | 2006-05-27 23:06:13 -0700 | [diff] [blame] | 346 | goto out; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 347 | } |
| 348 | |
Ian Morris | e5d08d7 | 2014-11-23 21:28:43 +0000 | [diff] [blame] | 349 | nfrags = skb_cow_data(skb, 0, &trailer); |
| 350 | if (nfrags < 0) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 351 | ret = -EINVAL; |
| 352 | goto out; |
| 353 | } |
| 354 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 355 | ret = -ENOMEM; |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 356 | |
| 357 | assoclen = sizeof(*esph); |
| 358 | sglists = 1; |
| 359 | seqhilen = 0; |
| 360 | |
| 361 | if (x->props.flags & XFRM_STATE_ESN) { |
| 362 | sglists += 2; |
| 363 | seqhilen += sizeof(__be32); |
| 364 | assoclen += seqhilen; |
| 365 | } |
| 366 | |
| 367 | tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen); |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 368 | if (!tmp) |
Herbert Xu | 0ebea8e | 2007-11-13 21:45:58 -0800 | [diff] [blame] | 369 | goto out; |
| 370 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 371 | ESP_SKB_CB(skb)->tmp = tmp; |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 372 | seqhi = esp_tmp_seqhi(tmp); |
| 373 | iv = esp_tmp_iv(aead, tmp, seqhilen); |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 374 | req = esp_tmp_req(aead, iv); |
| 375 | asg = esp_req_sg(aead, req); |
Steffen Klassert | c0a56e6 | 2011-04-25 19:40:23 +0000 | [diff] [blame] | 376 | sg = asg + sglists; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 377 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 378 | skb->ip_summed = CHECKSUM_NONE; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 379 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 380 | esph = (struct ip_esp_hdr *)skb->data; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 381 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 382 | /* Get ivec. This can be wrong, check against another impls. */ |
| 383 | iv = esph->enc_data; |
Thomas Graf | 95a02cf | 2007-12-10 16:53:29 -0800 | [diff] [blame] | 384 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 385 | sg_init_table(sg, nfrags); |
| 386 | skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen); |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 387 | |
| 388 | if ((x->props.flags & XFRM_STATE_ESN)) { |
| 389 | sg_init_table(asg, 3); |
| 390 | sg_set_buf(asg, &esph->spi, sizeof(__be32)); |
| 391 | *seqhi = XFRM_SKB_CB(skb)->seq.input.hi; |
| 392 | sg_set_buf(asg + 1, seqhi, seqhilen); |
| 393 | sg_set_buf(asg + 2, &esph->seq_no, sizeof(__be32)); |
| 394 | } else |
| 395 | sg_init_one(asg, esph, sizeof(*esph)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 396 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 397 | aead_request_set_callback(req, 0, esp_input_done, skb); |
| 398 | aead_request_set_crypt(req, sg, sg, elen, iv); |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 399 | aead_request_set_assoc(req, asg, assoclen); |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 400 | |
| 401 | ret = crypto_aead_decrypt(req); |
| 402 | if (ret == -EINPROGRESS) |
| 403 | goto out; |
| 404 | |
| 405 | ret = esp_input_done2(skb, ret); |
| 406 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 407 | out: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 408 | return ret; |
| 409 | } |
| 410 | |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 411 | static u32 esp6_get_mtu(struct xfrm_state *x, int mtu) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 412 | { |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 413 | struct crypto_aead *aead = x->data; |
| 414 | u32 blksize = ALIGN(crypto_aead_blocksize(aead), 4); |
Benjamin Poirier | 91657ea | 2012-05-24 11:32:38 +0000 | [diff] [blame] | 415 | unsigned int net_adj; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 416 | |
Benjamin Poirier | 91657ea | 2012-05-24 11:32:38 +0000 | [diff] [blame] | 417 | if (x->props.mode != XFRM_MODE_TUNNEL) |
| 418 | net_adj = sizeof(struct ipv6hdr); |
| 419 | else |
| 420 | net_adj = 0; |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 421 | |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 422 | return ((mtu - x->props.header_len - crypto_aead_authsize(aead) - |
Mathias Krause | 123b0d1 | 2013-10-18 12:09:04 +0200 | [diff] [blame] | 423 | net_adj) & ~(blksize - 1)) + net_adj - 2; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 424 | } |
| 425 | |
Steffen Klassert | d5860c5 | 2014-03-14 07:28:07 +0100 | [diff] [blame] | 426 | static int esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, |
| 427 | u8 type, u8 code, int offset, __be32 info) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 428 | { |
Alexey Dobriyan | 4fb236b | 2008-11-25 17:59:27 -0800 | [diff] [blame] | 429 | struct net *net = dev_net(skb->dev); |
Eric Dumazet | b71d1d4 | 2011-04-22 04:53:02 +0000 | [diff] [blame] | 430 | const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data; |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 431 | struct ip_esp_hdr *esph = (struct ip_esp_hdr *)(skb->data + offset); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 432 | struct xfrm_state *x; |
| 433 | |
Steffen Klassert | b3b2b9e | 2013-09-10 13:43:09 +0200 | [diff] [blame] | 434 | if (type != ICMPV6_PKT_TOOBIG && |
David S. Miller | ec18d9a | 2012-07-12 00:25:15 -0700 | [diff] [blame] | 435 | type != NDISC_REDIRECT) |
Steffen Klassert | d5860c5 | 2014-03-14 07:28:07 +0100 | [diff] [blame] | 436 | return 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 437 | |
Eric Dumazet | b71d1d4 | 2011-04-22 04:53:02 +0000 | [diff] [blame] | 438 | x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr, |
| 439 | esph->spi, IPPROTO_ESP, AF_INET6); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 440 | if (!x) |
Steffen Klassert | d5860c5 | 2014-03-14 07:28:07 +0100 | [diff] [blame] | 441 | return 0; |
David S. Miller | ec18d9a | 2012-07-12 00:25:15 -0700 | [diff] [blame] | 442 | |
| 443 | if (type == NDISC_REDIRECT) |
Duan Jiong | b55b76b | 2013-09-04 19:44:21 +0800 | [diff] [blame] | 444 | ip6_redirect(skb, net, skb->dev->ifindex, 0); |
David S. Miller | ec18d9a | 2012-07-12 00:25:15 -0700 | [diff] [blame] | 445 | else |
| 446 | ip6_update_pmtu(skb, net, info, 0, 0); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 447 | xfrm_state_put(x); |
Steffen Klassert | d5860c5 | 2014-03-14 07:28:07 +0100 | [diff] [blame] | 448 | |
| 449 | return 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 450 | } |
| 451 | |
| 452 | static void esp6_destroy(struct xfrm_state *x) |
| 453 | { |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 454 | struct crypto_aead *aead = x->data; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 455 | |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 456 | if (!aead) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 457 | return; |
| 458 | |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 459 | crypto_free_aead(aead); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 460 | } |
| 461 | |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 462 | static int esp_init_aead(struct xfrm_state *x) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 463 | { |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 464 | struct crypto_aead *aead; |
| 465 | int err; |
| 466 | |
| 467 | aead = crypto_alloc_aead(x->aead->alg_name, 0, 0); |
| 468 | err = PTR_ERR(aead); |
| 469 | if (IS_ERR(aead)) |
| 470 | goto error; |
| 471 | |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 472 | x->data = aead; |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 473 | |
| 474 | err = crypto_aead_setkey(aead, x->aead->alg_key, |
| 475 | (x->aead->alg_key_len + 7) / 8); |
| 476 | if (err) |
| 477 | goto error; |
| 478 | |
| 479 | err = crypto_aead_setauthsize(aead, x->aead->alg_icv_len / 8); |
| 480 | if (err) |
| 481 | goto error; |
| 482 | |
| 483 | error: |
| 484 | return err; |
| 485 | } |
| 486 | |
| 487 | static int esp_init_authenc(struct xfrm_state *x) |
| 488 | { |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 489 | struct crypto_aead *aead; |
| 490 | struct crypto_authenc_key_param *param; |
| 491 | struct rtattr *rta; |
| 492 | char *key; |
| 493 | char *p; |
| 494 | char authenc_name[CRYPTO_MAX_ALG_NAME]; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 495 | unsigned int keylen; |
| 496 | int err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 497 | |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 498 | err = -EINVAL; |
Ian Morris | 63159f2 | 2015-03-29 14:00:04 +0100 | [diff] [blame] | 499 | if (!x->ealg) |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 500 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 501 | |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 502 | err = -ENAMETOOLONG; |
Steffen Klassert | d212a4c | 2011-03-08 00:07:51 +0000 | [diff] [blame] | 503 | |
| 504 | if ((x->props.flags & XFRM_STATE_ESN)) { |
| 505 | if (snprintf(authenc_name, CRYPTO_MAX_ALG_NAME, |
| 506 | "authencesn(%s,%s)", |
| 507 | x->aalg ? x->aalg->alg_name : "digest_null", |
| 508 | x->ealg->alg_name) >= CRYPTO_MAX_ALG_NAME) |
| 509 | goto error; |
| 510 | } else { |
| 511 | if (snprintf(authenc_name, CRYPTO_MAX_ALG_NAME, |
| 512 | "authenc(%s,%s)", |
| 513 | x->aalg ? x->aalg->alg_name : "digest_null", |
| 514 | x->ealg->alg_name) >= CRYPTO_MAX_ALG_NAME) |
| 515 | goto error; |
| 516 | } |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 517 | |
| 518 | aead = crypto_alloc_aead(authenc_name, 0, 0); |
| 519 | err = PTR_ERR(aead); |
| 520 | if (IS_ERR(aead)) |
| 521 | goto error; |
| 522 | |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 523 | x->data = aead; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 524 | |
| 525 | keylen = (x->aalg ? (x->aalg->alg_key_len + 7) / 8 : 0) + |
| 526 | (x->ealg->alg_key_len + 7) / 8 + RTA_SPACE(sizeof(*param)); |
| 527 | err = -ENOMEM; |
| 528 | key = kmalloc(keylen, GFP_KERNEL); |
| 529 | if (!key) |
| 530 | goto error; |
| 531 | |
| 532 | p = key; |
| 533 | rta = (void *)p; |
| 534 | rta->rta_type = CRYPTO_AUTHENC_KEYA_PARAM; |
| 535 | rta->rta_len = RTA_LENGTH(sizeof(*param)); |
| 536 | param = RTA_DATA(rta); |
| 537 | p += RTA_SPACE(sizeof(*param)); |
| 538 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 539 | if (x->aalg) { |
| 540 | struct xfrm_algo_desc *aalg_desc; |
| 541 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 542 | memcpy(p, x->aalg->alg_key, (x->aalg->alg_key_len + 7) / 8); |
| 543 | p += (x->aalg->alg_key_len + 7) / 8; |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 544 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 545 | aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0); |
| 546 | BUG_ON(!aalg_desc); |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 547 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 548 | err = -EINVAL; |
Joe Perches | 4508349 | 2014-11-05 15:36:08 -0800 | [diff] [blame] | 549 | if (aalg_desc->uinfo.auth.icv_fullbits / 8 != |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 550 | crypto_aead_authsize(aead)) { |
Joe Perches | 4508349 | 2014-11-05 15:36:08 -0800 | [diff] [blame] | 551 | pr_info("ESP: %s digestsize %u != %hu\n", |
| 552 | x->aalg->alg_name, |
| 553 | crypto_aead_authsize(aead), |
| 554 | aalg_desc->uinfo.auth.icv_fullbits / 8); |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 555 | goto free_key; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 556 | } |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 557 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 558 | err = crypto_aead_setauthsize( |
Martin Willi | 8f8a088 | 2009-11-25 00:29:53 +0000 | [diff] [blame] | 559 | aead, x->aalg->alg_trunc_len / 8); |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 560 | if (err) |
| 561 | goto free_key; |
| 562 | } |
YOSHIFUJI Hideaki | 1ab1457 | 2007-02-09 23:24:49 +0900 | [diff] [blame] | 563 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 564 | param->enckeylen = cpu_to_be32((x->ealg->alg_key_len + 7) / 8); |
| 565 | memcpy(p, x->ealg->alg_key, (x->ealg->alg_key_len + 7) / 8); |
| 566 | |
| 567 | err = crypto_aead_setkey(aead, key, keylen); |
| 568 | |
| 569 | free_key: |
| 570 | kfree(key); |
| 571 | |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 572 | error: |
| 573 | return err; |
| 574 | } |
| 575 | |
| 576 | static int esp6_init_state(struct xfrm_state *x) |
| 577 | { |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 578 | struct crypto_aead *aead; |
| 579 | u32 align; |
| 580 | int err; |
| 581 | |
| 582 | if (x->encap) |
| 583 | return -EINVAL; |
| 584 | |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 585 | x->data = NULL; |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 586 | |
| 587 | if (x->aead) |
| 588 | err = esp_init_aead(x); |
| 589 | else |
| 590 | err = esp_init_authenc(x); |
| 591 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 592 | if (err) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 593 | goto error; |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 594 | |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 595 | aead = x->data; |
Herbert Xu | 1a6509d | 2008-01-28 19:37:29 -0800 | [diff] [blame] | 596 | |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 597 | x->props.header_len = sizeof(struct ip_esp_hdr) + |
| 598 | crypto_aead_ivsize(aead); |
Herbert Xu | ca68145 | 2007-10-17 21:35:15 -0700 | [diff] [blame] | 599 | switch (x->props.mode) { |
| 600 | case XFRM_MODE_BEET: |
Joakim Koskela | abf5cdb | 2008-08-06 02:40:25 -0700 | [diff] [blame] | 601 | if (x->sel.family != AF_INET6) |
| 602 | x->props.header_len += IPV4_BEET_PHMAXLEN + |
Ian Morris | 67ba415 | 2014-08-24 21:53:10 +0100 | [diff] [blame] | 603 | (sizeof(struct ipv6hdr) - sizeof(struct iphdr)); |
Joakim Koskela | abf5cdb | 2008-08-06 02:40:25 -0700 | [diff] [blame] | 604 | break; |
Herbert Xu | ca68145 | 2007-10-17 21:35:15 -0700 | [diff] [blame] | 605 | case XFRM_MODE_TRANSPORT: |
| 606 | break; |
| 607 | case XFRM_MODE_TUNNEL: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 608 | x->props.header_len += sizeof(struct ipv6hdr); |
Masahide NAKAMURA | ea2c47b | 2007-10-22 02:30:15 -0700 | [diff] [blame] | 609 | break; |
Herbert Xu | ca68145 | 2007-10-17 21:35:15 -0700 | [diff] [blame] | 610 | default: |
| 611 | goto error; |
| 612 | } |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 613 | |
| 614 | align = ALIGN(crypto_aead_blocksize(aead), 4); |
Mathias Krause | 1c5ad13 | 2013-10-18 12:09:05 +0200 | [diff] [blame] | 615 | x->props.trailer_len = align + 1 + crypto_aead_authsize(aead); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 616 | |
| 617 | error: |
Herbert Xu | 38320c7 | 2008-01-28 19:35:05 -0800 | [diff] [blame] | 618 | return err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 619 | } |
| 620 | |
Steffen Klassert | d5860c5 | 2014-03-14 07:28:07 +0100 | [diff] [blame] | 621 | static int esp6_rcv_cb(struct sk_buff *skb, int err) |
| 622 | { |
| 623 | return 0; |
| 624 | } |
| 625 | |
Ian Morris | cc24bec | 2014-08-24 21:53:11 +0100 | [diff] [blame] | 626 | static const struct xfrm_type esp6_type = { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 627 | .description = "ESP6", |
Ian Morris | cc24bec | 2014-08-24 21:53:11 +0100 | [diff] [blame] | 628 | .owner = THIS_MODULE, |
| 629 | .proto = IPPROTO_ESP, |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 630 | .flags = XFRM_TYPE_REPLAY_PROT, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 631 | .init_state = esp6_init_state, |
| 632 | .destructor = esp6_destroy, |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 633 | .get_mtu = esp6_get_mtu, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 634 | .input = esp6_input, |
Masahide NAKAMURA | aee5adb | 2006-08-23 17:57:28 -0700 | [diff] [blame] | 635 | .output = esp6_output, |
| 636 | .hdr_offset = xfrm6_find_1stfragopt, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 637 | }; |
| 638 | |
Steffen Klassert | d5860c5 | 2014-03-14 07:28:07 +0100 | [diff] [blame] | 639 | static struct xfrm6_protocol esp6_protocol = { |
| 640 | .handler = xfrm6_rcv, |
| 641 | .cb_handler = esp6_rcv_cb, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 642 | .err_handler = esp6_err, |
Steffen Klassert | d5860c5 | 2014-03-14 07:28:07 +0100 | [diff] [blame] | 643 | .priority = 0, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 644 | }; |
| 645 | |
| 646 | static int __init esp6_init(void) |
| 647 | { |
| 648 | if (xfrm_register_type(&esp6_type, AF_INET6) < 0) { |
Joe Perches | f321383 | 2012-05-15 14:11:53 +0000 | [diff] [blame] | 649 | pr_info("%s: can't add xfrm type\n", __func__); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 650 | return -EAGAIN; |
| 651 | } |
Steffen Klassert | d5860c5 | 2014-03-14 07:28:07 +0100 | [diff] [blame] | 652 | if (xfrm6_protocol_register(&esp6_protocol, IPPROTO_ESP) < 0) { |
Joe Perches | f321383 | 2012-05-15 14:11:53 +0000 | [diff] [blame] | 653 | pr_info("%s: can't add protocol\n", __func__); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 654 | xfrm_unregister_type(&esp6_type, AF_INET6); |
| 655 | return -EAGAIN; |
| 656 | } |
| 657 | |
| 658 | return 0; |
| 659 | } |
| 660 | |
| 661 | static void __exit esp6_fini(void) |
| 662 | { |
Steffen Klassert | d5860c5 | 2014-03-14 07:28:07 +0100 | [diff] [blame] | 663 | if (xfrm6_protocol_deregister(&esp6_protocol, IPPROTO_ESP) < 0) |
Joe Perches | f321383 | 2012-05-15 14:11:53 +0000 | [diff] [blame] | 664 | pr_info("%s: can't remove protocol\n", __func__); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 665 | if (xfrm_unregister_type(&esp6_type, AF_INET6) < 0) |
Joe Perches | f321383 | 2012-05-15 14:11:53 +0000 | [diff] [blame] | 666 | pr_info("%s: can't remove xfrm type\n", __func__); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 667 | } |
| 668 | |
| 669 | module_init(esp6_init); |
| 670 | module_exit(esp6_fini); |
| 671 | |
| 672 | MODULE_LICENSE("GPL"); |
Masahide NAKAMURA | d3d6dd3 | 2007-06-26 23:57:49 -0700 | [diff] [blame] | 673 | MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_ESP); |