blob: 2f4531fcaca23d43e8b49702b84dd5288acedf1e [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm algorithm interface
3 *
4 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the Free
8 * Software Foundation; either version 2 of the License, or (at your option)
9 * any later version.
10 */
11
12#include <linux/config.h>
13#include <linux/module.h>
14#include <linux/kernel.h>
15#include <linux/pfkeyv2.h>
16#include <linux/crypto.h>
17#include <net/xfrm.h>
18#if defined(CONFIG_INET_AH) || defined(CONFIG_INET_AH_MODULE) || defined(CONFIG_INET6_AH) || defined(CONFIG_INET6_AH_MODULE)
19#include <net/ah.h>
20#endif
21#if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
22#include <net/esp.h>
23#endif
24#include <asm/scatterlist.h>
25
26/*
27 * Algorithms supported by IPsec. These entries contain properties which
28 * are used in key negotiation and xfrm processing, and are used to verify
29 * that instantiated crypto transforms have correct parameters for IPsec
30 * purposes.
31 */
32static struct xfrm_algo_desc aalg_list[] = {
33{
34 .name = "digest_null",
35
36 .uinfo = {
37 .auth = {
38 .icv_truncbits = 0,
39 .icv_fullbits = 0,
40 }
41 },
42
43 .desc = {
44 .sadb_alg_id = SADB_X_AALG_NULL,
45 .sadb_alg_ivlen = 0,
46 .sadb_alg_minbits = 0,
47 .sadb_alg_maxbits = 0
48 }
49},
50{
51 .name = "md5",
52
53 .uinfo = {
54 .auth = {
55 .icv_truncbits = 96,
56 .icv_fullbits = 128,
57 }
58 },
59
60 .desc = {
61 .sadb_alg_id = SADB_AALG_MD5HMAC,
62 .sadb_alg_ivlen = 0,
63 .sadb_alg_minbits = 128,
64 .sadb_alg_maxbits = 128
65 }
66},
67{
68 .name = "sha1",
69
70 .uinfo = {
71 .auth = {
72 .icv_truncbits = 96,
73 .icv_fullbits = 160,
74 }
75 },
76
77 .desc = {
78 .sadb_alg_id = SADB_AALG_SHA1HMAC,
79 .sadb_alg_ivlen = 0,
80 .sadb_alg_minbits = 160,
81 .sadb_alg_maxbits = 160
82 }
83},
84{
85 .name = "sha256",
86
87 .uinfo = {
88 .auth = {
89 .icv_truncbits = 96,
90 .icv_fullbits = 256,
91 }
92 },
93
94 .desc = {
95 .sadb_alg_id = SADB_X_AALG_SHA2_256HMAC,
96 .sadb_alg_ivlen = 0,
97 .sadb_alg_minbits = 256,
98 .sadb_alg_maxbits = 256
99 }
100},
101{
102 .name = "ripemd160",
103
104 .uinfo = {
105 .auth = {
106 .icv_truncbits = 96,
107 .icv_fullbits = 160,
108 }
109 },
110
111 .desc = {
112 .sadb_alg_id = SADB_X_AALG_RIPEMD160HMAC,
113 .sadb_alg_ivlen = 0,
114 .sadb_alg_minbits = 160,
115 .sadb_alg_maxbits = 160
116 }
117},
118};
119
120static struct xfrm_algo_desc ealg_list[] = {
121{
122 .name = "cipher_null",
123
124 .uinfo = {
125 .encr = {
126 .blockbits = 8,
127 .defkeybits = 0,
128 }
129 },
130
131 .desc = {
132 .sadb_alg_id = SADB_EALG_NULL,
133 .sadb_alg_ivlen = 0,
134 .sadb_alg_minbits = 0,
135 .sadb_alg_maxbits = 0
136 }
137},
138{
139 .name = "des",
140
141 .uinfo = {
142 .encr = {
143 .blockbits = 64,
144 .defkeybits = 64,
145 }
146 },
147
148 .desc = {
149 .sadb_alg_id = SADB_EALG_DESCBC,
150 .sadb_alg_ivlen = 8,
151 .sadb_alg_minbits = 64,
152 .sadb_alg_maxbits = 64
153 }
154},
155{
156 .name = "des3_ede",
157
158 .uinfo = {
159 .encr = {
160 .blockbits = 64,
161 .defkeybits = 192,
162 }
163 },
164
165 .desc = {
166 .sadb_alg_id = SADB_EALG_3DESCBC,
167 .sadb_alg_ivlen = 8,
168 .sadb_alg_minbits = 192,
169 .sadb_alg_maxbits = 192
170 }
171},
172{
173 .name = "cast128",
174
175 .uinfo = {
176 .encr = {
177 .blockbits = 64,
178 .defkeybits = 128,
179 }
180 },
181
182 .desc = {
183 .sadb_alg_id = SADB_X_EALG_CASTCBC,
184 .sadb_alg_ivlen = 8,
185 .sadb_alg_minbits = 40,
186 .sadb_alg_maxbits = 128
187 }
188},
189{
190 .name = "blowfish",
191
192 .uinfo = {
193 .encr = {
194 .blockbits = 64,
195 .defkeybits = 128,
196 }
197 },
198
199 .desc = {
200 .sadb_alg_id = SADB_X_EALG_BLOWFISHCBC,
201 .sadb_alg_ivlen = 8,
202 .sadb_alg_minbits = 40,
203 .sadb_alg_maxbits = 448
204 }
205},
206{
207 .name = "aes",
208
209 .uinfo = {
210 .encr = {
211 .blockbits = 128,
212 .defkeybits = 128,
213 }
214 },
215
216 .desc = {
217 .sadb_alg_id = SADB_X_EALG_AESCBC,
218 .sadb_alg_ivlen = 8,
219 .sadb_alg_minbits = 128,
220 .sadb_alg_maxbits = 256
221 }
222},
223{
224 .name = "serpent",
225
226 .uinfo = {
227 .encr = {
228 .blockbits = 128,
229 .defkeybits = 128,
230 }
231 },
232
233 .desc = {
234 .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
235 .sadb_alg_ivlen = 8,
236 .sadb_alg_minbits = 128,
237 .sadb_alg_maxbits = 256,
238 }
239},
240{
241 .name = "twofish",
242
243 .uinfo = {
244 .encr = {
245 .blockbits = 128,
246 .defkeybits = 128,
247 }
248 },
249
250 .desc = {
251 .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
252 .sadb_alg_ivlen = 8,
253 .sadb_alg_minbits = 128,
254 .sadb_alg_maxbits = 256
255 }
256},
257};
258
259static struct xfrm_algo_desc calg_list[] = {
260{
261 .name = "deflate",
262 .uinfo = {
263 .comp = {
264 .threshold = 90,
265 }
266 },
267 .desc = { .sadb_alg_id = SADB_X_CALG_DEFLATE }
268},
269{
270 .name = "lzs",
271 .uinfo = {
272 .comp = {
273 .threshold = 90,
274 }
275 },
276 .desc = { .sadb_alg_id = SADB_X_CALG_LZS }
277},
278{
279 .name = "lzjh",
280 .uinfo = {
281 .comp = {
282 .threshold = 50,
283 }
284 },
285 .desc = { .sadb_alg_id = SADB_X_CALG_LZJH }
286},
287};
288
289static inline int aalg_entries(void)
290{
291 return ARRAY_SIZE(aalg_list);
292}
293
294static inline int ealg_entries(void)
295{
296 return ARRAY_SIZE(ealg_list);
297}
298
299static inline int calg_entries(void)
300{
301 return ARRAY_SIZE(calg_list);
302}
303
304/* Todo: generic iterators */
305struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
306{
307 int i;
308
309 for (i = 0; i < aalg_entries(); i++) {
310 if (aalg_list[i].desc.sadb_alg_id == alg_id) {
311 if (aalg_list[i].available)
312 return &aalg_list[i];
313 else
314 break;
315 }
316 }
317 return NULL;
318}
319EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
320
321struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
322{
323 int i;
324
325 for (i = 0; i < ealg_entries(); i++) {
326 if (ealg_list[i].desc.sadb_alg_id == alg_id) {
327 if (ealg_list[i].available)
328 return &ealg_list[i];
329 else
330 break;
331 }
332 }
333 return NULL;
334}
335EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
336
337struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
338{
339 int i;
340
341 for (i = 0; i < calg_entries(); i++) {
342 if (calg_list[i].desc.sadb_alg_id == alg_id) {
343 if (calg_list[i].available)
344 return &calg_list[i];
345 else
346 break;
347 }
348 }
349 return NULL;
350}
351EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
352
353static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
354 int entries, char *name,
355 int probe)
356{
357 int i, status;
358
359 if (!name)
360 return NULL;
361
362 for (i = 0; i < entries; i++) {
363 if (strcmp(name, list[i].name))
364 continue;
365
366 if (list[i].available)
367 return &list[i];
368
369 if (!probe)
370 break;
371
372 status = crypto_alg_available(name, 0);
373 if (!status)
374 break;
375
376 list[i].available = status;
377 return &list[i];
378 }
379 return NULL;
380}
381
382struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe)
383{
384 return xfrm_get_byname(aalg_list, aalg_entries(), name, probe);
385}
386EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname);
387
388struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe)
389{
390 return xfrm_get_byname(ealg_list, ealg_entries(), name, probe);
391}
392EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname);
393
394struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe)
395{
396 return xfrm_get_byname(calg_list, calg_entries(), name, probe);
397}
398EXPORT_SYMBOL_GPL(xfrm_calg_get_byname);
399
400struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx)
401{
402 if (idx >= aalg_entries())
403 return NULL;
404
405 return &aalg_list[idx];
406}
407EXPORT_SYMBOL_GPL(xfrm_aalg_get_byidx);
408
409struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx)
410{
411 if (idx >= ealg_entries())
412 return NULL;
413
414 return &ealg_list[idx];
415}
416EXPORT_SYMBOL_GPL(xfrm_ealg_get_byidx);
417
418/*
419 * Probe for the availability of crypto algorithms, and set the available
420 * flag for any algorithms found on the system. This is typically called by
421 * pfkey during userspace SA add, update or register.
422 */
423void xfrm_probe_algs(void)
424{
425#ifdef CONFIG_CRYPTO
426 int i, status;
427
428 BUG_ON(in_softirq());
429
430 for (i = 0; i < aalg_entries(); i++) {
431 status = crypto_alg_available(aalg_list[i].name, 0);
432 if (aalg_list[i].available != status)
433 aalg_list[i].available = status;
434 }
435
436 for (i = 0; i < ealg_entries(); i++) {
437 status = crypto_alg_available(ealg_list[i].name, 0);
438 if (ealg_list[i].available != status)
439 ealg_list[i].available = status;
440 }
441
442 for (i = 0; i < calg_entries(); i++) {
443 status = crypto_alg_available(calg_list[i].name, 0);
444 if (calg_list[i].available != status)
445 calg_list[i].available = status;
446 }
447#endif
448}
449EXPORT_SYMBOL_GPL(xfrm_probe_algs);
450
451int xfrm_count_auth_supported(void)
452{
453 int i, n;
454
455 for (i = 0, n = 0; i < aalg_entries(); i++)
456 if (aalg_list[i].available)
457 n++;
458 return n;
459}
460EXPORT_SYMBOL_GPL(xfrm_count_auth_supported);
461
462int xfrm_count_enc_supported(void)
463{
464 int i, n;
465
466 for (i = 0, n = 0; i < ealg_entries(); i++)
467 if (ealg_list[i].available)
468 n++;
469 return n;
470}
471EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
472
473/* Move to common area: it is shared with AH. */
474
475void skb_icv_walk(const struct sk_buff *skb, struct crypto_tfm *tfm,
476 int offset, int len, icv_update_fn_t icv_update)
477{
478 int start = skb_headlen(skb);
479 int i, copy = start - offset;
480 struct scatterlist sg;
481
482 /* Checksum header. */
483 if (copy > 0) {
484 if (copy > len)
485 copy = len;
486
487 sg.page = virt_to_page(skb->data + offset);
488 sg.offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
489 sg.length = copy;
490
491 icv_update(tfm, &sg, 1);
492
493 if ((len -= copy) == 0)
494 return;
495 offset += copy;
496 }
497
498 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
499 int end;
500
501 BUG_TRAP(start <= offset + len);
502
503 end = start + skb_shinfo(skb)->frags[i].size;
504 if ((copy = end - offset) > 0) {
505 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
506
507 if (copy > len)
508 copy = len;
509
510 sg.page = frag->page;
511 sg.offset = frag->page_offset + offset-start;
512 sg.length = copy;
513
514 icv_update(tfm, &sg, 1);
515
516 if (!(len -= copy))
517 return;
518 offset += copy;
519 }
520 start = end;
521 }
522
523 if (skb_shinfo(skb)->frag_list) {
524 struct sk_buff *list = skb_shinfo(skb)->frag_list;
525
526 for (; list; list = list->next) {
527 int end;
528
529 BUG_TRAP(start <= offset + len);
530
531 end = start + list->len;
532 if ((copy = end - offset) > 0) {
533 if (copy > len)
534 copy = len;
535 skb_icv_walk(list, tfm, offset-start, copy, icv_update);
536 if ((len -= copy) == 0)
537 return;
538 offset += copy;
539 }
540 start = end;
541 }
542 }
543 if (len)
544 BUG();
545}
546EXPORT_SYMBOL_GPL(skb_icv_walk);
547
548#if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
549
550/* Looking generic it is not used in another places. */
551
552int
553skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
554{
555 int start = skb_headlen(skb);
556 int i, copy = start - offset;
557 int elt = 0;
558
559 if (copy > 0) {
560 if (copy > len)
561 copy = len;
562 sg[elt].page = virt_to_page(skb->data + offset);
563 sg[elt].offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
564 sg[elt].length = copy;
565 elt++;
566 if ((len -= copy) == 0)
567 return elt;
568 offset += copy;
569 }
570
571 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
572 int end;
573
574 BUG_TRAP(start <= offset + len);
575
576 end = start + skb_shinfo(skb)->frags[i].size;
577 if ((copy = end - offset) > 0) {
578 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
579
580 if (copy > len)
581 copy = len;
582 sg[elt].page = frag->page;
583 sg[elt].offset = frag->page_offset+offset-start;
584 sg[elt].length = copy;
585 elt++;
586 if (!(len -= copy))
587 return elt;
588 offset += copy;
589 }
590 start = end;
591 }
592
593 if (skb_shinfo(skb)->frag_list) {
594 struct sk_buff *list = skb_shinfo(skb)->frag_list;
595
596 for (; list; list = list->next) {
597 int end;
598
599 BUG_TRAP(start <= offset + len);
600
601 end = start + list->len;
602 if ((copy = end - offset) > 0) {
603 if (copy > len)
604 copy = len;
605 elt += skb_to_sgvec(list, sg+elt, offset - start, copy);
606 if ((len -= copy) == 0)
607 return elt;
608 offset += copy;
609 }
610 start = end;
611 }
612 }
613 if (len)
614 BUG();
615 return elt;
616}
617EXPORT_SYMBOL_GPL(skb_to_sgvec);
618
619/* Check that skb data bits are writable. If they are not, copy data
620 * to newly created private area. If "tailbits" is given, make sure that
621 * tailbits bytes beyond current end of skb are writable.
622 *
623 * Returns amount of elements of scatterlist to load for subsequent
624 * transformations and pointer to writable trailer skb.
625 */
626
627int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
628{
629 int copyflag;
630 int elt;
631 struct sk_buff *skb1, **skb_p;
632
633 /* If skb is cloned or its head is paged, reallocate
634 * head pulling out all the pages (pages are considered not writable
635 * at the moment even if they are anonymous).
636 */
637 if ((skb_cloned(skb) || skb_shinfo(skb)->nr_frags) &&
638 __pskb_pull_tail(skb, skb_pagelen(skb)-skb_headlen(skb)) == NULL)
639 return -ENOMEM;
640
641 /* Easy case. Most of packets will go this way. */
642 if (!skb_shinfo(skb)->frag_list) {
643 /* A little of trouble, not enough of space for trailer.
644 * This should not happen, when stack is tuned to generate
645 * good frames. OK, on miss we reallocate and reserve even more
646 * space, 128 bytes is fair. */
647
648 if (skb_tailroom(skb) < tailbits &&
649 pskb_expand_head(skb, 0, tailbits-skb_tailroom(skb)+128, GFP_ATOMIC))
650 return -ENOMEM;
651
652 /* Voila! */
653 *trailer = skb;
654 return 1;
655 }
656
657 /* Misery. We are in troubles, going to mincer fragments... */
658
659 elt = 1;
660 skb_p = &skb_shinfo(skb)->frag_list;
661 copyflag = 0;
662
663 while ((skb1 = *skb_p) != NULL) {
664 int ntail = 0;
665
666 /* The fragment is partially pulled by someone,
667 * this can happen on input. Copy it and everything
668 * after it. */
669
670 if (skb_shared(skb1))
671 copyflag = 1;
672
673 /* If the skb is the last, worry about trailer. */
674
675 if (skb1->next == NULL && tailbits) {
676 if (skb_shinfo(skb1)->nr_frags ||
677 skb_shinfo(skb1)->frag_list ||
678 skb_tailroom(skb1) < tailbits)
679 ntail = tailbits + 128;
680 }
681
682 if (copyflag ||
683 skb_cloned(skb1) ||
684 ntail ||
685 skb_shinfo(skb1)->nr_frags ||
686 skb_shinfo(skb1)->frag_list) {
687 struct sk_buff *skb2;
688
689 /* Fuck, we are miserable poor guys... */
690 if (ntail == 0)
691 skb2 = skb_copy(skb1, GFP_ATOMIC);
692 else
693 skb2 = skb_copy_expand(skb1,
694 skb_headroom(skb1),
695 ntail,
696 GFP_ATOMIC);
697 if (unlikely(skb2 == NULL))
698 return -ENOMEM;
699
700 if (skb1->sk)
Evgeniy Polyakovd4810202005-05-18 22:51:45 -0700701 skb_set_owner_w(skb2, skb1->sk);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700702
703 /* Looking around. Are we still alive?
704 * OK, link new skb, drop old one */
705
706 skb2->next = skb1->next;
707 *skb_p = skb2;
708 kfree_skb(skb1);
709 skb1 = skb2;
710 }
711 elt++;
712 *trailer = skb1;
713 skb_p = &skb1->next;
714 }
715
716 return elt;
717}
718EXPORT_SYMBOL_GPL(skb_cow_data);
719
720void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)
721{
722 if (tail != skb) {
723 skb->data_len += len;
724 skb->len += len;
725 }
726 return skb_put(tail, len);
727}
728EXPORT_SYMBOL_GPL(pskb_put);
729#endif