blob: 04e1aea58bc947b8bbef38a5bb39246228aa7910 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm algorithm interface
3 *
4 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the Free
8 * Software Foundation; either version 2 of the License, or (at your option)
9 * any later version.
10 */
11
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/module.h>
13#include <linux/kernel.h>
14#include <linux/pfkeyv2.h>
15#include <linux/crypto.h>
16#include <net/xfrm.h>
17#if defined(CONFIG_INET_AH) || defined(CONFIG_INET_AH_MODULE) || defined(CONFIG_INET6_AH) || defined(CONFIG_INET6_AH_MODULE)
18#include <net/ah.h>
19#endif
20#if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
21#include <net/esp.h>
22#endif
23#include <asm/scatterlist.h>
24
25/*
26 * Algorithms supported by IPsec. These entries contain properties which
27 * are used in key negotiation and xfrm processing, and are used to verify
28 * that instantiated crypto transforms have correct parameters for IPsec
29 * purposes.
30 */
31static struct xfrm_algo_desc aalg_list[] = {
32{
33 .name = "digest_null",
34
35 .uinfo = {
36 .auth = {
37 .icv_truncbits = 0,
38 .icv_fullbits = 0,
39 }
40 },
41
42 .desc = {
43 .sadb_alg_id = SADB_X_AALG_NULL,
44 .sadb_alg_ivlen = 0,
45 .sadb_alg_minbits = 0,
46 .sadb_alg_maxbits = 0
47 }
48},
49{
50 .name = "md5",
51
52 .uinfo = {
53 .auth = {
54 .icv_truncbits = 96,
55 .icv_fullbits = 128,
56 }
57 },
58
59 .desc = {
60 .sadb_alg_id = SADB_AALG_MD5HMAC,
61 .sadb_alg_ivlen = 0,
62 .sadb_alg_minbits = 128,
63 .sadb_alg_maxbits = 128
64 }
65},
66{
67 .name = "sha1",
68
69 .uinfo = {
70 .auth = {
71 .icv_truncbits = 96,
72 .icv_fullbits = 160,
73 }
74 },
75
76 .desc = {
77 .sadb_alg_id = SADB_AALG_SHA1HMAC,
78 .sadb_alg_ivlen = 0,
79 .sadb_alg_minbits = 160,
80 .sadb_alg_maxbits = 160
81 }
82},
83{
84 .name = "sha256",
85
86 .uinfo = {
87 .auth = {
88 .icv_truncbits = 96,
89 .icv_fullbits = 256,
90 }
91 },
92
93 .desc = {
94 .sadb_alg_id = SADB_X_AALG_SHA2_256HMAC,
95 .sadb_alg_ivlen = 0,
96 .sadb_alg_minbits = 256,
97 .sadb_alg_maxbits = 256
98 }
99},
100{
101 .name = "ripemd160",
102
103 .uinfo = {
104 .auth = {
105 .icv_truncbits = 96,
106 .icv_fullbits = 160,
107 }
108 },
109
110 .desc = {
111 .sadb_alg_id = SADB_X_AALG_RIPEMD160HMAC,
112 .sadb_alg_ivlen = 0,
113 .sadb_alg_minbits = 160,
114 .sadb_alg_maxbits = 160
115 }
116},
117};
118
119static struct xfrm_algo_desc ealg_list[] = {
120{
121 .name = "cipher_null",
122
123 .uinfo = {
124 .encr = {
125 .blockbits = 8,
126 .defkeybits = 0,
127 }
128 },
129
130 .desc = {
131 .sadb_alg_id = SADB_EALG_NULL,
132 .sadb_alg_ivlen = 0,
133 .sadb_alg_minbits = 0,
134 .sadb_alg_maxbits = 0
135 }
136},
137{
138 .name = "des",
139
140 .uinfo = {
141 .encr = {
142 .blockbits = 64,
143 .defkeybits = 64,
144 }
145 },
146
147 .desc = {
148 .sadb_alg_id = SADB_EALG_DESCBC,
149 .sadb_alg_ivlen = 8,
150 .sadb_alg_minbits = 64,
151 .sadb_alg_maxbits = 64
152 }
153},
154{
155 .name = "des3_ede",
156
157 .uinfo = {
158 .encr = {
159 .blockbits = 64,
160 .defkeybits = 192,
161 }
162 },
163
164 .desc = {
165 .sadb_alg_id = SADB_EALG_3DESCBC,
166 .sadb_alg_ivlen = 8,
167 .sadb_alg_minbits = 192,
168 .sadb_alg_maxbits = 192
169 }
170},
171{
172 .name = "cast128",
173
174 .uinfo = {
175 .encr = {
176 .blockbits = 64,
177 .defkeybits = 128,
178 }
179 },
180
181 .desc = {
182 .sadb_alg_id = SADB_X_EALG_CASTCBC,
183 .sadb_alg_ivlen = 8,
184 .sadb_alg_minbits = 40,
185 .sadb_alg_maxbits = 128
186 }
187},
188{
189 .name = "blowfish",
190
191 .uinfo = {
192 .encr = {
193 .blockbits = 64,
194 .defkeybits = 128,
195 }
196 },
197
198 .desc = {
199 .sadb_alg_id = SADB_X_EALG_BLOWFISHCBC,
200 .sadb_alg_ivlen = 8,
201 .sadb_alg_minbits = 40,
202 .sadb_alg_maxbits = 448
203 }
204},
205{
206 .name = "aes",
207
208 .uinfo = {
209 .encr = {
210 .blockbits = 128,
211 .defkeybits = 128,
212 }
213 },
214
215 .desc = {
216 .sadb_alg_id = SADB_X_EALG_AESCBC,
217 .sadb_alg_ivlen = 8,
218 .sadb_alg_minbits = 128,
219 .sadb_alg_maxbits = 256
220 }
221},
222{
223 .name = "serpent",
224
225 .uinfo = {
226 .encr = {
227 .blockbits = 128,
228 .defkeybits = 128,
229 }
230 },
231
232 .desc = {
233 .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
234 .sadb_alg_ivlen = 8,
235 .sadb_alg_minbits = 128,
236 .sadb_alg_maxbits = 256,
237 }
238},
239{
240 .name = "twofish",
241
242 .uinfo = {
243 .encr = {
244 .blockbits = 128,
245 .defkeybits = 128,
246 }
247 },
248
249 .desc = {
250 .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
251 .sadb_alg_ivlen = 8,
252 .sadb_alg_minbits = 128,
253 .sadb_alg_maxbits = 256
254 }
255},
256};
257
258static struct xfrm_algo_desc calg_list[] = {
259{
260 .name = "deflate",
261 .uinfo = {
262 .comp = {
263 .threshold = 90,
264 }
265 },
266 .desc = { .sadb_alg_id = SADB_X_CALG_DEFLATE }
267},
268{
269 .name = "lzs",
270 .uinfo = {
271 .comp = {
272 .threshold = 90,
273 }
274 },
275 .desc = { .sadb_alg_id = SADB_X_CALG_LZS }
276},
277{
278 .name = "lzjh",
279 .uinfo = {
280 .comp = {
281 .threshold = 50,
282 }
283 },
284 .desc = { .sadb_alg_id = SADB_X_CALG_LZJH }
285},
286};
287
288static inline int aalg_entries(void)
289{
290 return ARRAY_SIZE(aalg_list);
291}
292
293static inline int ealg_entries(void)
294{
295 return ARRAY_SIZE(ealg_list);
296}
297
298static inline int calg_entries(void)
299{
300 return ARRAY_SIZE(calg_list);
301}
302
303/* Todo: generic iterators */
304struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
305{
306 int i;
307
308 for (i = 0; i < aalg_entries(); i++) {
309 if (aalg_list[i].desc.sadb_alg_id == alg_id) {
310 if (aalg_list[i].available)
311 return &aalg_list[i];
312 else
313 break;
314 }
315 }
316 return NULL;
317}
318EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
319
320struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
321{
322 int i;
323
324 for (i = 0; i < ealg_entries(); i++) {
325 if (ealg_list[i].desc.sadb_alg_id == alg_id) {
326 if (ealg_list[i].available)
327 return &ealg_list[i];
328 else
329 break;
330 }
331 }
332 return NULL;
333}
334EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
335
336struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
337{
338 int i;
339
340 for (i = 0; i < calg_entries(); i++) {
341 if (calg_list[i].desc.sadb_alg_id == alg_id) {
342 if (calg_list[i].available)
343 return &calg_list[i];
344 else
345 break;
346 }
347 }
348 return NULL;
349}
350EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
351
352static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
353 int entries, char *name,
354 int probe)
355{
356 int i, status;
357
358 if (!name)
359 return NULL;
360
361 for (i = 0; i < entries; i++) {
362 if (strcmp(name, list[i].name))
363 continue;
364
365 if (list[i].available)
366 return &list[i];
367
368 if (!probe)
369 break;
370
371 status = crypto_alg_available(name, 0);
372 if (!status)
373 break;
374
375 list[i].available = status;
376 return &list[i];
377 }
378 return NULL;
379}
380
381struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe)
382{
383 return xfrm_get_byname(aalg_list, aalg_entries(), name, probe);
384}
385EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname);
386
387struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe)
388{
389 return xfrm_get_byname(ealg_list, ealg_entries(), name, probe);
390}
391EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname);
392
393struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe)
394{
395 return xfrm_get_byname(calg_list, calg_entries(), name, probe);
396}
397EXPORT_SYMBOL_GPL(xfrm_calg_get_byname);
398
399struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx)
400{
401 if (idx >= aalg_entries())
402 return NULL;
403
404 return &aalg_list[idx];
405}
406EXPORT_SYMBOL_GPL(xfrm_aalg_get_byidx);
407
408struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx)
409{
410 if (idx >= ealg_entries())
411 return NULL;
412
413 return &ealg_list[idx];
414}
415EXPORT_SYMBOL_GPL(xfrm_ealg_get_byidx);
416
417/*
418 * Probe for the availability of crypto algorithms, and set the available
419 * flag for any algorithms found on the system. This is typically called by
420 * pfkey during userspace SA add, update or register.
421 */
422void xfrm_probe_algs(void)
423{
424#ifdef CONFIG_CRYPTO
425 int i, status;
426
427 BUG_ON(in_softirq());
428
429 for (i = 0; i < aalg_entries(); i++) {
430 status = crypto_alg_available(aalg_list[i].name, 0);
431 if (aalg_list[i].available != status)
432 aalg_list[i].available = status;
433 }
434
435 for (i = 0; i < ealg_entries(); i++) {
436 status = crypto_alg_available(ealg_list[i].name, 0);
437 if (ealg_list[i].available != status)
438 ealg_list[i].available = status;
439 }
440
441 for (i = 0; i < calg_entries(); i++) {
442 status = crypto_alg_available(calg_list[i].name, 0);
443 if (calg_list[i].available != status)
444 calg_list[i].available = status;
445 }
446#endif
447}
448EXPORT_SYMBOL_GPL(xfrm_probe_algs);
449
450int xfrm_count_auth_supported(void)
451{
452 int i, n;
453
454 for (i = 0, n = 0; i < aalg_entries(); i++)
455 if (aalg_list[i].available)
456 n++;
457 return n;
458}
459EXPORT_SYMBOL_GPL(xfrm_count_auth_supported);
460
461int xfrm_count_enc_supported(void)
462{
463 int i, n;
464
465 for (i = 0, n = 0; i < ealg_entries(); i++)
466 if (ealg_list[i].available)
467 n++;
468 return n;
469}
470EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
471
472/* Move to common area: it is shared with AH. */
473
474void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
475 int offset, int len, icv_update_fn_t icv_update)
476{
477 int start = skb_headlen(skb);
478 int i, copy = start - offset;
479 struct scatterlist sg;
480
481 /* Checksum header. */
482 if (copy > 0) {
483 if (copy > len)
484 copy = len;
485
486 sg.page = virt_to_page(skb->data + offset);
487 sg.offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
488 sg.length = copy;
489
490 icv_update(tfm, &sg, 1);
491
492 if ((len -= copy) == 0)
493 return;
494 offset += copy;
495 }
496
497 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
498 int end;
499
500 BUG_TRAP(start <= offset + len);
501
502 end = start + skb_shinfo(skb)->frags[i].size;
503 if ((copy = end - offset) > 0) {
504 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
505
506 if (copy > len)
507 copy = len;
508
509 sg.page = frag->page;
510 sg.offset = frag->page_offset + offset-start;
511 sg.length = copy;
512
513 icv_update(tfm, &sg, 1);
514
515 if (!(len -= copy))
516 return;
517 offset += copy;
518 }
519 start = end;
520 }
521
522 if (skb_shinfo(skb)->frag_list) {
523 struct sk_buff *list = skb_shinfo(skb)->frag_list;
524
525 for (; list; list = list->next) {
526 int end;
527
528 BUG_TRAP(start <= offset + len);
529
530 end = start + list->len;
531 if ((copy = end - offset) > 0) {
532 if (copy > len)
533 copy = len;
534 skb_icv_walk(list, tfm, offset-start, copy, icv_update);
535 if ((len -= copy) == 0)
536 return;
537 offset += copy;
538 }
539 start = end;
540 }
541 }
Kris Katterjohn09a62662006-01-08 22:24:28 -0800542 BUG_ON(len);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700543}
544EXPORT_SYMBOL_GPL(skb_icv_walk);
545
546#if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
547
548/* Looking generic it is not used in another places. */
549
550int
551skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
552{
553 int start = skb_headlen(skb);
554 int i, copy = start - offset;
555 int elt = 0;
556
557 if (copy > 0) {
558 if (copy > len)
559 copy = len;
560 sg[elt].page = virt_to_page(skb->data + offset);
561 sg[elt].offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
562 sg[elt].length = copy;
563 elt++;
564 if ((len -= copy) == 0)
565 return elt;
566 offset += copy;
567 }
568
569 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
570 int end;
571
572 BUG_TRAP(start <= offset + len);
573
574 end = start + skb_shinfo(skb)->frags[i].size;
575 if ((copy = end - offset) > 0) {
576 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
577
578 if (copy > len)
579 copy = len;
580 sg[elt].page = frag->page;
581 sg[elt].offset = frag->page_offset+offset-start;
582 sg[elt].length = copy;
583 elt++;
584 if (!(len -= copy))
585 return elt;
586 offset += copy;
587 }
588 start = end;
589 }
590
591 if (skb_shinfo(skb)->frag_list) {
592 struct sk_buff *list = skb_shinfo(skb)->frag_list;
593
594 for (; list; list = list->next) {
595 int end;
596
597 BUG_TRAP(start <= offset + len);
598
599 end = start + list->len;
600 if ((copy = end - offset) > 0) {
601 if (copy > len)
602 copy = len;
603 elt += skb_to_sgvec(list, sg+elt, offset - start, copy);
604 if ((len -= copy) == 0)
605 return elt;
606 offset += copy;
607 }
608 start = end;
609 }
610 }
Kris Katterjohn09a62662006-01-08 22:24:28 -0800611 BUG_ON(len);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700612 return elt;
613}
614EXPORT_SYMBOL_GPL(skb_to_sgvec);
615
616/* Check that skb data bits are writable. If they are not, copy data
617 * to newly created private area. If "tailbits" is given, make sure that
618 * tailbits bytes beyond current end of skb are writable.
619 *
620 * Returns amount of elements of scatterlist to load for subsequent
621 * transformations and pointer to writable trailer skb.
622 */
623
624int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
625{
626 int copyflag;
627 int elt;
628 struct sk_buff *skb1, **skb_p;
629
630 /* If skb is cloned or its head is paged, reallocate
631 * head pulling out all the pages (pages are considered not writable
632 * at the moment even if they are anonymous).
633 */
634 if ((skb_cloned(skb) || skb_shinfo(skb)->nr_frags) &&
635 __pskb_pull_tail(skb, skb_pagelen(skb)-skb_headlen(skb)) == NULL)
636 return -ENOMEM;
637
638 /* Easy case. Most of packets will go this way. */
639 if (!skb_shinfo(skb)->frag_list) {
640 /* A little of trouble, not enough of space for trailer.
641 * This should not happen, when stack is tuned to generate
642 * good frames. OK, on miss we reallocate and reserve even more
643 * space, 128 bytes is fair. */
644
645 if (skb_tailroom(skb) < tailbits &&
646 pskb_expand_head(skb, 0, tailbits-skb_tailroom(skb)+128, GFP_ATOMIC))
647 return -ENOMEM;
648
649 /* Voila! */
650 *trailer = skb;
651 return 1;
652 }
653
654 /* Misery. We are in troubles, going to mincer fragments... */
655
656 elt = 1;
657 skb_p = &skb_shinfo(skb)->frag_list;
658 copyflag = 0;
659
660 while ((skb1 = *skb_p) != NULL) {
661 int ntail = 0;
662
663 /* The fragment is partially pulled by someone,
664 * this can happen on input. Copy it and everything
665 * after it. */
666
667 if (skb_shared(skb1))
668 copyflag = 1;
669
670 /* If the skb is the last, worry about trailer. */
671
672 if (skb1->next == NULL && tailbits) {
673 if (skb_shinfo(skb1)->nr_frags ||
674 skb_shinfo(skb1)->frag_list ||
675 skb_tailroom(skb1) < tailbits)
676 ntail = tailbits + 128;
677 }
678
679 if (copyflag ||
680 skb_cloned(skb1) ||
681 ntail ||
682 skb_shinfo(skb1)->nr_frags ||
683 skb_shinfo(skb1)->frag_list) {
684 struct sk_buff *skb2;
685
686 /* Fuck, we are miserable poor guys... */
687 if (ntail == 0)
688 skb2 = skb_copy(skb1, GFP_ATOMIC);
689 else
690 skb2 = skb_copy_expand(skb1,
691 skb_headroom(skb1),
692 ntail,
693 GFP_ATOMIC);
694 if (unlikely(skb2 == NULL))
695 return -ENOMEM;
696
697 if (skb1->sk)
Evgeniy Polyakovd4810202005-05-18 22:51:45 -0700698 skb_set_owner_w(skb2, skb1->sk);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700699
700 /* Looking around. Are we still alive?
701 * OK, link new skb, drop old one */
702
703 skb2->next = skb1->next;
704 *skb_p = skb2;
705 kfree_skb(skb1);
706 skb1 = skb2;
707 }
708 elt++;
709 *trailer = skb1;
710 skb_p = &skb1->next;
711 }
712
713 return elt;
714}
715EXPORT_SYMBOL_GPL(skb_cow_data);
716
717void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)
718{
719 if (tail != skb) {
720 skb->data_len += len;
721 skb->len += len;
722 }
723 return skb_put(tail, len);
724}
725EXPORT_SYMBOL_GPL(pskb_put);
726#endif