Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 1 | #include <linux/err.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2 | #include <linux/module.h> |
| 3 | #include <net/ip.h> |
| 4 | #include <net/xfrm.h> |
| 5 | #include <net/esp.h> |
Adrian Bunk | 72998d8 | 2007-10-26 22:53:58 -0700 | [diff] [blame] | 6 | #include <linux/scatterlist.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 7 | #include <linux/crypto.h> |
Herbert Xu | a02a642 | 2005-10-10 21:11:08 -0700 | [diff] [blame] | 8 | #include <linux/kernel.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 9 | #include <linux/pfkeyv2.h> |
| 10 | #include <linux/random.h> |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 11 | #include <linux/spinlock.h> |
Thomas Graf | 2017a72 | 2007-12-10 16:53:05 -0800 | [diff] [blame] | 12 | #include <linux/in6.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 13 | #include <net/icmp.h> |
Arnaldo Carvalho de Melo | 14c8502 | 2005-12-27 02:43:12 -0200 | [diff] [blame] | 14 | #include <net/protocol.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 15 | #include <net/udp.h> |
| 16 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 17 | static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
| 18 | { |
| 19 | int err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 20 | struct ip_esp_hdr *esph; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 21 | struct crypto_blkcipher *tfm; |
| 22 | struct blkcipher_desc desc; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 23 | struct esp_data *esp; |
| 24 | struct sk_buff *trailer; |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 25 | u8 *tail; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 26 | int blksize; |
| 27 | int clen; |
| 28 | int alen; |
| 29 | int nfrags; |
| 30 | |
Herbert Xu | 7b277b1 | 2007-10-10 15:44:06 -0700 | [diff] [blame] | 31 | /* skb is pure payload to encrypt */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 32 | |
| 33 | err = -ENOMEM; |
| 34 | |
| 35 | /* Round to block size */ |
| 36 | clen = skb->len; |
| 37 | |
| 38 | esp = x->data; |
| 39 | alen = esp->auth.icv_trunc_len; |
| 40 | tfm = esp->conf.tfm; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 41 | desc.tfm = tfm; |
| 42 | desc.flags = 0; |
| 43 | blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4); |
Herbert Xu | a02a642 | 2005-10-10 21:11:08 -0700 | [diff] [blame] | 44 | clen = ALIGN(clen + 2, blksize); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | if (esp->conf.padlen) |
Herbert Xu | a02a642 | 2005-10-10 21:11:08 -0700 | [diff] [blame] | 46 | clen = ALIGN(clen, esp->conf.padlen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 47 | |
| 48 | if ((nfrags = skb_cow_data(skb, clen-skb->len+alen, &trailer)) < 0) |
| 49 | goto error; |
| 50 | |
| 51 | /* Fill padding... */ |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 52 | tail = skb_tail_pointer(trailer); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 53 | do { |
| 54 | int i; |
| 55 | for (i=0; i<clen-skb->len - 2; i++) |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 56 | tail[i] = i + 1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 57 | } while (0); |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 58 | tail[clen - skb->len - 2] = (clen - skb->len) - 2; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 59 | pskb_put(skb, trailer, clen - skb->len); |
| 60 | |
Herbert Xu | 7b277b1 | 2007-10-10 15:44:06 -0700 | [diff] [blame] | 61 | skb_push(skb, -skb_network_offset(skb)); |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 62 | esph = ip_esp_hdr(skb); |
Herbert Xu | 37fedd3 | 2007-10-10 15:44:44 -0700 | [diff] [blame] | 63 | *(skb_tail_pointer(trailer) - 1) = *skb_mac_header(skb); |
| 64 | *skb_mac_header(skb) = IPPROTO_ESP; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 65 | |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 66 | spin_lock_bh(&x->lock); |
| 67 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 68 | /* this is non-NULL only with UDP Encapsulation */ |
| 69 | if (x->encap) { |
| 70 | struct xfrm_encap_tmpl *encap = x->encap; |
| 71 | struct udphdr *uh; |
Al Viro | d5a0a1e | 2006-11-08 00:23:14 -0800 | [diff] [blame] | 72 | __be32 *udpdata32; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 73 | |
| 74 | uh = (struct udphdr *)esph; |
| 75 | uh->source = encap->encap_sport; |
| 76 | uh->dest = encap->encap_dport; |
Herbert Xu | ceb1eec8 | 2007-10-10 15:45:52 -0700 | [diff] [blame] | 77 | uh->len = htons(skb->len + alen - skb_transport_offset(skb)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 78 | uh->check = 0; |
| 79 | |
| 80 | switch (encap->encap_type) { |
| 81 | default: |
| 82 | case UDP_ENCAP_ESPINUDP: |
| 83 | esph = (struct ip_esp_hdr *)(uh + 1); |
| 84 | break; |
| 85 | case UDP_ENCAP_ESPINUDP_NON_IKE: |
Al Viro | d5a0a1e | 2006-11-08 00:23:14 -0800 | [diff] [blame] | 86 | udpdata32 = (__be32 *)(uh + 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 87 | udpdata32[0] = udpdata32[1] = 0; |
| 88 | esph = (struct ip_esp_hdr *)(udpdata32 + 2); |
| 89 | break; |
| 90 | } |
| 91 | |
Herbert Xu | 37fedd3 | 2007-10-10 15:44:44 -0700 | [diff] [blame] | 92 | *skb_mac_header(skb) = IPPROTO_UDP; |
| 93 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 94 | |
| 95 | esph->spi = x->id.spi; |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 96 | esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 97 | |
David S. Miller | e4bec82 | 2006-09-22 15:17:35 -0700 | [diff] [blame] | 98 | if (esp->conf.ivlen) { |
| 99 | if (unlikely(!esp->conf.ivinitted)) { |
| 100 | get_random_bytes(esp->conf.ivec, esp->conf.ivlen); |
| 101 | esp->conf.ivinitted = 1; |
| 102 | } |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 103 | crypto_blkcipher_set_iv(tfm, esp->conf.ivec, esp->conf.ivlen); |
David S. Miller | e4bec82 | 2006-09-22 15:17:35 -0700 | [diff] [blame] | 104 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 105 | |
| 106 | do { |
| 107 | struct scatterlist *sg = &esp->sgbuf[0]; |
| 108 | |
| 109 | if (unlikely(nfrags > ESP_NUM_FAST_SG)) { |
| 110 | sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC); |
| 111 | if (!sg) |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 112 | goto unlock; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 113 | } |
David S. Miller | ed0e7e0 | 2007-10-26 00:38:39 -0700 | [diff] [blame] | 114 | sg_init_table(sg, nfrags); |
David S. Miller | 51c739d | 2007-10-30 21:29:29 -0700 | [diff] [blame] | 115 | skb_to_sgvec(skb, sg, |
| 116 | esph->enc_data + |
| 117 | esp->conf.ivlen - |
| 118 | skb->data, clen); |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 119 | err = crypto_blkcipher_encrypt(&desc, sg, sg, clen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 120 | if (unlikely(sg != &esp->sgbuf[0])) |
| 121 | kfree(sg); |
| 122 | } while (0); |
| 123 | |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 124 | if (unlikely(err)) |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 125 | goto unlock; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 126 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 127 | if (esp->conf.ivlen) { |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 128 | memcpy(esph->enc_data, esp->conf.ivec, esp->conf.ivlen); |
| 129 | crypto_blkcipher_get_iv(tfm, esp->conf.ivec, esp->conf.ivlen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 130 | } |
| 131 | |
| 132 | if (esp->auth.icv_full_len) { |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 133 | err = esp_mac_digest(esp, skb, (u8 *)esph - skb->data, |
| 134 | sizeof(*esph) + esp->conf.ivlen + clen); |
| 135 | memcpy(pskb_put(skb, trailer, alen), esp->auth.work_icv, alen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 136 | } |
| 137 | |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 138 | unlock: |
| 139 | spin_unlock_bh(&x->lock); |
| 140 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 141 | error: |
| 142 | return err; |
| 143 | } |
| 144 | |
| 145 | /* |
| 146 | * Note: detecting truncated vs. non-truncated authentication data is very |
| 147 | * expensive, so we only support truncated data, which is the recommended |
| 148 | * and common case. |
| 149 | */ |
Herbert Xu | e695633 | 2006-04-01 00:52:46 -0800 | [diff] [blame] | 150 | static int esp_input(struct xfrm_state *x, struct sk_buff *skb) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 151 | { |
| 152 | struct iphdr *iph; |
| 153 | struct ip_esp_hdr *esph; |
| 154 | struct esp_data *esp = x->data; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 155 | struct crypto_blkcipher *tfm = esp->conf.tfm; |
| 156 | struct blkcipher_desc desc = { .tfm = tfm }; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 157 | struct sk_buff *trailer; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 158 | int blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 159 | int alen = esp->auth.icv_trunc_len; |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 160 | int elen = skb->len - sizeof(*esph) - esp->conf.ivlen - alen; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 161 | int nfrags; |
Herbert Xu | 31a4ab9 | 2006-05-27 23:06:13 -0700 | [diff] [blame] | 162 | int ihl; |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 163 | u8 nexthdr[2]; |
| 164 | struct scatterlist *sg; |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 165 | int padlen; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 166 | int err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 167 | |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 168 | if (!pskb_may_pull(skb, sizeof(*esph))) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 169 | goto out; |
| 170 | |
| 171 | if (elen <= 0 || (elen & (blksize-1))) |
| 172 | goto out; |
| 173 | |
| 174 | /* If integrity check is required, do this. */ |
| 175 | if (esp->auth.icv_full_len) { |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 176 | u8 sum[alen]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 177 | |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 178 | err = esp_mac_digest(esp, skb, 0, skb->len - alen); |
| 179 | if (err) |
| 180 | goto out; |
| 181 | |
| 182 | if (skb_copy_bits(skb, skb->len - alen, sum, alen)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 183 | BUG(); |
| 184 | |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 185 | if (unlikely(memcmp(esp->auth.work_icv, sum, alen))) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 186 | x->stats.integrity_failed++; |
| 187 | goto out; |
| 188 | } |
| 189 | } |
| 190 | |
| 191 | if ((nfrags = skb_cow_data(skb, 0, &trailer)) < 0) |
| 192 | goto out; |
| 193 | |
| 194 | skb->ip_summed = CHECKSUM_NONE; |
| 195 | |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 196 | esph = (struct ip_esp_hdr *)skb->data; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 197 | |
| 198 | /* Get ivec. This can be wrong, check against another impls. */ |
| 199 | if (esp->conf.ivlen) |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 200 | crypto_blkcipher_set_iv(tfm, esph->enc_data, esp->conf.ivlen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 201 | |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 202 | sg = &esp->sgbuf[0]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 203 | |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 204 | if (unlikely(nfrags > ESP_NUM_FAST_SG)) { |
| 205 | sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC); |
| 206 | if (!sg) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 207 | goto out; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 208 | } |
David S. Miller | ed0e7e0 | 2007-10-26 00:38:39 -0700 | [diff] [blame] | 209 | sg_init_table(sg, nfrags); |
David S. Miller | 51c739d | 2007-10-30 21:29:29 -0700 | [diff] [blame] | 210 | skb_to_sgvec(skb, sg, |
| 211 | sizeof(*esph) + esp->conf.ivlen, |
| 212 | elen); |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 213 | err = crypto_blkcipher_decrypt(&desc, sg, sg, elen); |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 214 | if (unlikely(sg != &esp->sgbuf[0])) |
| 215 | kfree(sg); |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 216 | if (unlikely(err)) |
| 217 | return err; |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 218 | |
| 219 | if (skb_copy_bits(skb, skb->len-alen-2, nexthdr, 2)) |
| 220 | BUG(); |
| 221 | |
| 222 | padlen = nexthdr[0]; |
| 223 | if (padlen+2 >= elen) |
| 224 | goto out; |
| 225 | |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 226 | /* ... check padding bits here. Silly. :-) */ |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 227 | |
Thomas Graf | 2017a72 | 2007-12-10 16:53:05 -0800 | [diff] [blame] | 228 | /* RFC4303: Drop dummy packets without any error */ |
| 229 | if (nexthdr[1] == IPPROTO_NONE) |
| 230 | goto out; |
| 231 | |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 232 | iph = ip_hdr(skb); |
Herbert Xu | 31a4ab9 | 2006-05-27 23:06:13 -0700 | [diff] [blame] | 233 | ihl = iph->ihl * 4; |
| 234 | |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 235 | if (x->encap) { |
| 236 | struct xfrm_encap_tmpl *encap = x->encap; |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 237 | struct udphdr *uh = (void *)(skb_network_header(skb) + ihl); |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 238 | |
| 239 | /* |
| 240 | * 1) if the NAT-T peer's IP or port changed then |
| 241 | * advertize the change to the keying daemon. |
| 242 | * This is an inbound SA, so just compare |
| 243 | * SRC ports. |
| 244 | */ |
| 245 | if (iph->saddr != x->props.saddr.a4 || |
| 246 | uh->source != encap->encap_sport) { |
| 247 | xfrm_address_t ipaddr; |
| 248 | |
| 249 | ipaddr.a4 = iph->saddr; |
| 250 | km_new_mapping(x, &ipaddr, uh->source); |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 251 | |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 252 | /* XXX: perhaps add an extra |
| 253 | * policy check here, to see |
| 254 | * if we should allow or |
| 255 | * reject a packet from a |
| 256 | * different source |
| 257 | * address/port. |
| 258 | */ |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 259 | } |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 260 | |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 261 | /* |
| 262 | * 2) ignore UDP/TCP checksums in case |
| 263 | * of NAT-T in Transport Mode, or |
| 264 | * perform other post-processing fixes |
| 265 | * as per draft-ietf-ipsec-udp-encaps-06, |
| 266 | * section 3.1.2 |
| 267 | */ |
Herbert Xu | 8bd1707 | 2007-10-10 15:41:41 -0700 | [diff] [blame] | 268 | if (x->props.mode == XFRM_MODE_TRANSPORT) |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 269 | skb->ip_summed = CHECKSUM_UNNECESSARY; |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 270 | } |
| 271 | |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 272 | pskb_trim(skb, skb->len - alen - padlen - 2); |
Arnaldo Carvalho de Melo | 967b05f | 2007-03-13 13:51:52 -0300 | [diff] [blame] | 273 | __skb_pull(skb, sizeof(*esph) + esp->conf.ivlen); |
| 274 | skb_set_transport_header(skb, -ihl); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 275 | |
Herbert Xu | 631a6698 | 2007-10-10 15:46:21 -0700 | [diff] [blame] | 276 | return nexthdr[1]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 277 | |
| 278 | out: |
| 279 | return -EINVAL; |
| 280 | } |
| 281 | |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 282 | static u32 esp4_get_mtu(struct xfrm_state *x, int mtu) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 283 | { |
| 284 | struct esp_data *esp = x->data; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 285 | u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4); |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 286 | u32 align = max_t(u32, blksize, esp->conf.padlen); |
| 287 | u32 rem; |
| 288 | |
| 289 | mtu -= x->props.header_len + esp->auth.icv_trunc_len; |
| 290 | rem = mtu & (align - 1); |
| 291 | mtu &= ~(align - 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 292 | |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 293 | switch (x->props.mode) { |
| 294 | case XFRM_MODE_TUNNEL: |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 295 | break; |
| 296 | default: |
| 297 | case XFRM_MODE_TRANSPORT: |
| 298 | /* The worst case */ |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 299 | mtu -= blksize - 4; |
| 300 | mtu += min_t(u32, blksize - 4, rem); |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 301 | break; |
| 302 | case XFRM_MODE_BEET: |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 303 | /* The worst case. */ |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 304 | mtu += min_t(u32, IPV4_BEET_PHMAXLEN, rem); |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 305 | break; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 306 | } |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 307 | |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 308 | return mtu - 2; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 309 | } |
| 310 | |
| 311 | static void esp4_err(struct sk_buff *skb, u32 info) |
| 312 | { |
| 313 | struct iphdr *iph = (struct iphdr*)skb->data; |
| 314 | struct ip_esp_hdr *esph = (struct ip_esp_hdr*)(skb->data+(iph->ihl<<2)); |
| 315 | struct xfrm_state *x; |
| 316 | |
Arnaldo Carvalho de Melo | 88c7664 | 2007-03-13 14:43:18 -0300 | [diff] [blame] | 317 | if (icmp_hdr(skb)->type != ICMP_DEST_UNREACH || |
| 318 | icmp_hdr(skb)->code != ICMP_FRAG_NEEDED) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 319 | return; |
| 320 | |
| 321 | x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET); |
| 322 | if (!x) |
| 323 | return; |
Patrick McHardy | 64ce207 | 2005-08-09 20:50:53 -0700 | [diff] [blame] | 324 | NETDEBUG(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n", |
| 325 | ntohl(esph->spi), ntohl(iph->daddr)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 326 | xfrm_state_put(x); |
| 327 | } |
| 328 | |
| 329 | static void esp_destroy(struct xfrm_state *x) |
| 330 | { |
| 331 | struct esp_data *esp = x->data; |
| 332 | |
| 333 | if (!esp) |
| 334 | return; |
| 335 | |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 336 | crypto_free_blkcipher(esp->conf.tfm); |
Jesper Juhl | 573dbd9 | 2005-09-01 17:44:29 -0700 | [diff] [blame] | 337 | esp->conf.tfm = NULL; |
| 338 | kfree(esp->conf.ivec); |
| 339 | esp->conf.ivec = NULL; |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 340 | crypto_free_hash(esp->auth.tfm); |
Jesper Juhl | 573dbd9 | 2005-09-01 17:44:29 -0700 | [diff] [blame] | 341 | esp->auth.tfm = NULL; |
| 342 | kfree(esp->auth.work_icv); |
| 343 | esp->auth.work_icv = NULL; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 344 | kfree(esp); |
| 345 | } |
| 346 | |
Herbert Xu | 72cb696 | 2005-06-20 13:18:08 -0700 | [diff] [blame] | 347 | static int esp_init_state(struct xfrm_state *x) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 348 | { |
| 349 | struct esp_data *esp = NULL; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 350 | struct crypto_blkcipher *tfm; |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 351 | u32 align; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 352 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 353 | if (x->ealg == NULL) |
| 354 | goto error; |
| 355 | |
Panagiotis Issaris | 0da974f | 2006-07-21 14:51:30 -0700 | [diff] [blame] | 356 | esp = kzalloc(sizeof(*esp), GFP_KERNEL); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 357 | if (esp == NULL) |
| 358 | return -ENOMEM; |
| 359 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 360 | if (x->aalg) { |
| 361 | struct xfrm_algo_desc *aalg_desc; |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 362 | struct crypto_hash *hash; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 363 | |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 364 | hash = crypto_alloc_hash(x->aalg->alg_name, 0, |
| 365 | CRYPTO_ALG_ASYNC); |
| 366 | if (IS_ERR(hash)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 367 | goto error; |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 368 | |
| 369 | esp->auth.tfm = hash; |
Herbert Xu | 4b7137f | 2007-10-08 17:13:44 -0700 | [diff] [blame] | 370 | if (crypto_hash_setkey(hash, x->aalg->alg_key, |
| 371 | (x->aalg->alg_key_len + 7) / 8)) |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 372 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 373 | |
| 374 | aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0); |
| 375 | BUG_ON(!aalg_desc); |
| 376 | |
| 377 | if (aalg_desc->uinfo.auth.icv_fullbits/8 != |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 378 | crypto_hash_digestsize(hash)) { |
Patrick McHardy | 64ce207 | 2005-08-09 20:50:53 -0700 | [diff] [blame] | 379 | NETDEBUG(KERN_INFO "ESP: %s digestsize %u != %hu\n", |
| 380 | x->aalg->alg_name, |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 381 | crypto_hash_digestsize(hash), |
Patrick McHardy | 64ce207 | 2005-08-09 20:50:53 -0700 | [diff] [blame] | 382 | aalg_desc->uinfo.auth.icv_fullbits/8); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 383 | goto error; |
| 384 | } |
| 385 | |
| 386 | esp->auth.icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8; |
| 387 | esp->auth.icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8; |
| 388 | |
| 389 | esp->auth.work_icv = kmalloc(esp->auth.icv_full_len, GFP_KERNEL); |
| 390 | if (!esp->auth.work_icv) |
| 391 | goto error; |
| 392 | } |
Herbert Xu | 4b7137f | 2007-10-08 17:13:44 -0700 | [diff] [blame] | 393 | |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 394 | tfm = crypto_alloc_blkcipher(x->ealg->alg_name, 0, CRYPTO_ALG_ASYNC); |
| 395 | if (IS_ERR(tfm)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 396 | goto error; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 397 | esp->conf.tfm = tfm; |
| 398 | esp->conf.ivlen = crypto_blkcipher_ivsize(tfm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 399 | esp->conf.padlen = 0; |
| 400 | if (esp->conf.ivlen) { |
| 401 | esp->conf.ivec = kmalloc(esp->conf.ivlen, GFP_KERNEL); |
| 402 | if (unlikely(esp->conf.ivec == NULL)) |
| 403 | goto error; |
David S. Miller | e4bec82 | 2006-09-22 15:17:35 -0700 | [diff] [blame] | 404 | esp->conf.ivinitted = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 405 | } |
Herbert Xu | 4b7137f | 2007-10-08 17:13:44 -0700 | [diff] [blame] | 406 | if (crypto_blkcipher_setkey(tfm, x->ealg->alg_key, |
| 407 | (x->ealg->alg_key_len + 7) / 8)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 408 | goto error; |
| 409 | x->props.header_len = sizeof(struct ip_esp_hdr) + esp->conf.ivlen; |
Masahide NAKAMURA | 7e49e6d | 2006-09-22 15:05:15 -0700 | [diff] [blame] | 410 | if (x->props.mode == XFRM_MODE_TUNNEL) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 411 | x->props.header_len += sizeof(struct iphdr); |
Patrick McHardy | ac758e3 | 2007-04-09 11:47:58 -0700 | [diff] [blame] | 412 | else if (x->props.mode == XFRM_MODE_BEET) |
| 413 | x->props.header_len += IPV4_BEET_PHMAXLEN; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 414 | if (x->encap) { |
| 415 | struct xfrm_encap_tmpl *encap = x->encap; |
| 416 | |
| 417 | switch (encap->encap_type) { |
| 418 | default: |
| 419 | goto error; |
| 420 | case UDP_ENCAP_ESPINUDP: |
| 421 | x->props.header_len += sizeof(struct udphdr); |
| 422 | break; |
| 423 | case UDP_ENCAP_ESPINUDP_NON_IKE: |
| 424 | x->props.header_len += sizeof(struct udphdr) + 2 * sizeof(u32); |
| 425 | break; |
| 426 | } |
| 427 | } |
| 428 | x->data = esp; |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 429 | align = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4); |
| 430 | if (esp->conf.padlen) |
| 431 | align = max_t(u32, align, esp->conf.padlen); |
| 432 | x->props.trailer_len = align + 1 + esp->auth.icv_trunc_len; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 433 | return 0; |
| 434 | |
| 435 | error: |
| 436 | x->data = esp; |
| 437 | esp_destroy(x); |
| 438 | x->data = NULL; |
| 439 | return -EINVAL; |
| 440 | } |
| 441 | |
| 442 | static struct xfrm_type esp_type = |
| 443 | { |
| 444 | .description = "ESP4", |
| 445 | .owner = THIS_MODULE, |
| 446 | .proto = IPPROTO_ESP, |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 447 | .flags = XFRM_TYPE_REPLAY_PROT, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 448 | .init_state = esp_init_state, |
| 449 | .destructor = esp_destroy, |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 450 | .get_mtu = esp4_get_mtu, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 451 | .input = esp_input, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 452 | .output = esp_output |
| 453 | }; |
| 454 | |
| 455 | static struct net_protocol esp4_protocol = { |
| 456 | .handler = xfrm4_rcv, |
| 457 | .err_handler = esp4_err, |
| 458 | .no_policy = 1, |
| 459 | }; |
| 460 | |
| 461 | static int __init esp4_init(void) |
| 462 | { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 463 | if (xfrm_register_type(&esp_type, AF_INET) < 0) { |
| 464 | printk(KERN_INFO "ip esp init: can't add xfrm type\n"); |
| 465 | return -EAGAIN; |
| 466 | } |
| 467 | if (inet_add_protocol(&esp4_protocol, IPPROTO_ESP) < 0) { |
| 468 | printk(KERN_INFO "ip esp init: can't add protocol\n"); |
| 469 | xfrm_unregister_type(&esp_type, AF_INET); |
| 470 | return -EAGAIN; |
| 471 | } |
| 472 | return 0; |
| 473 | } |
| 474 | |
| 475 | static void __exit esp4_fini(void) |
| 476 | { |
| 477 | if (inet_del_protocol(&esp4_protocol, IPPROTO_ESP) < 0) |
| 478 | printk(KERN_INFO "ip esp close: can't remove protocol\n"); |
| 479 | if (xfrm_unregister_type(&esp_type, AF_INET) < 0) |
| 480 | printk(KERN_INFO "ip esp close: can't remove xfrm type\n"); |
| 481 | } |
| 482 | |
| 483 | module_init(esp4_init); |
| 484 | module_exit(esp4_fini); |
| 485 | MODULE_LICENSE("GPL"); |
Masahide NAKAMURA | d3d6dd3 | 2007-06-26 23:57:49 -0700 | [diff] [blame] | 486 | MODULE_ALIAS_XFRM_TYPE(AF_INET, XFRM_PROTO_ESP); |