Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 1 | #include <linux/err.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2 | #include <linux/module.h> |
| 3 | #include <net/ip.h> |
| 4 | #include <net/xfrm.h> |
| 5 | #include <net/esp.h> |
Adrian Bunk | 72998d8 | 2007-10-26 22:53:58 -0700 | [diff] [blame] | 6 | #include <linux/scatterlist.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 7 | #include <linux/crypto.h> |
Herbert Xu | a02a642 | 2005-10-10 21:11:08 -0700 | [diff] [blame] | 8 | #include <linux/kernel.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 9 | #include <linux/pfkeyv2.h> |
| 10 | #include <linux/random.h> |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 11 | #include <linux/spinlock.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 12 | #include <net/icmp.h> |
Arnaldo Carvalho de Melo | 14c8502 | 2005-12-27 02:43:12 -0200 | [diff] [blame] | 13 | #include <net/protocol.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 14 | #include <net/udp.h> |
| 15 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 16 | static int esp_output(struct xfrm_state *x, struct sk_buff *skb) |
| 17 | { |
| 18 | int err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 19 | struct ip_esp_hdr *esph; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 20 | struct crypto_blkcipher *tfm; |
| 21 | struct blkcipher_desc desc; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 22 | struct esp_data *esp; |
| 23 | struct sk_buff *trailer; |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 24 | u8 *tail; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 25 | int blksize; |
| 26 | int clen; |
| 27 | int alen; |
| 28 | int nfrags; |
| 29 | |
Herbert Xu | 7b277b1 | 2007-10-10 15:44:06 -0700 | [diff] [blame] | 30 | /* skb is pure payload to encrypt */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 31 | |
| 32 | err = -ENOMEM; |
| 33 | |
| 34 | /* Round to block size */ |
| 35 | clen = skb->len; |
| 36 | |
| 37 | esp = x->data; |
| 38 | alen = esp->auth.icv_trunc_len; |
| 39 | tfm = esp->conf.tfm; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 40 | desc.tfm = tfm; |
| 41 | desc.flags = 0; |
| 42 | blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4); |
Herbert Xu | a02a642 | 2005-10-10 21:11:08 -0700 | [diff] [blame] | 43 | clen = ALIGN(clen + 2, blksize); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 44 | if (esp->conf.padlen) |
Herbert Xu | a02a642 | 2005-10-10 21:11:08 -0700 | [diff] [blame] | 45 | clen = ALIGN(clen, esp->conf.padlen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 46 | |
| 47 | if ((nfrags = skb_cow_data(skb, clen-skb->len+alen, &trailer)) < 0) |
| 48 | goto error; |
| 49 | |
| 50 | /* Fill padding... */ |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 51 | tail = skb_tail_pointer(trailer); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 52 | do { |
| 53 | int i; |
| 54 | for (i=0; i<clen-skb->len - 2; i++) |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 55 | tail[i] = i + 1; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 56 | } while (0); |
Arnaldo Carvalho de Melo | 27a884d | 2007-04-19 20:29:13 -0700 | [diff] [blame] | 57 | tail[clen - skb->len - 2] = (clen - skb->len) - 2; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 58 | pskb_put(skb, trailer, clen - skb->len); |
| 59 | |
Herbert Xu | 7b277b1 | 2007-10-10 15:44:06 -0700 | [diff] [blame] | 60 | skb_push(skb, -skb_network_offset(skb)); |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 61 | esph = ip_esp_hdr(skb); |
Herbert Xu | 37fedd3 | 2007-10-10 15:44:44 -0700 | [diff] [blame] | 62 | *(skb_tail_pointer(trailer) - 1) = *skb_mac_header(skb); |
| 63 | *skb_mac_header(skb) = IPPROTO_ESP; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 64 | |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 65 | spin_lock_bh(&x->lock); |
| 66 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 67 | /* this is non-NULL only with UDP Encapsulation */ |
| 68 | if (x->encap) { |
| 69 | struct xfrm_encap_tmpl *encap = x->encap; |
| 70 | struct udphdr *uh; |
Al Viro | d5a0a1e | 2006-11-08 00:23:14 -0800 | [diff] [blame] | 71 | __be32 *udpdata32; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 72 | |
| 73 | uh = (struct udphdr *)esph; |
| 74 | uh->source = encap->encap_sport; |
| 75 | uh->dest = encap->encap_dport; |
Herbert Xu | ceb1eec8 | 2007-10-10 15:45:52 -0700 | [diff] [blame] | 76 | uh->len = htons(skb->len + alen - skb_transport_offset(skb)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 77 | uh->check = 0; |
| 78 | |
| 79 | switch (encap->encap_type) { |
| 80 | default: |
| 81 | case UDP_ENCAP_ESPINUDP: |
| 82 | esph = (struct ip_esp_hdr *)(uh + 1); |
| 83 | break; |
| 84 | case UDP_ENCAP_ESPINUDP_NON_IKE: |
Al Viro | d5a0a1e | 2006-11-08 00:23:14 -0800 | [diff] [blame] | 85 | udpdata32 = (__be32 *)(uh + 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 86 | udpdata32[0] = udpdata32[1] = 0; |
| 87 | esph = (struct ip_esp_hdr *)(udpdata32 + 2); |
| 88 | break; |
| 89 | } |
| 90 | |
Herbert Xu | 37fedd3 | 2007-10-10 15:44:44 -0700 | [diff] [blame] | 91 | *skb_mac_header(skb) = IPPROTO_UDP; |
| 92 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 93 | |
| 94 | esph->spi = x->id.spi; |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 95 | esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 96 | |
David S. Miller | e4bec82 | 2006-09-22 15:17:35 -0700 | [diff] [blame] | 97 | if (esp->conf.ivlen) { |
| 98 | if (unlikely(!esp->conf.ivinitted)) { |
| 99 | get_random_bytes(esp->conf.ivec, esp->conf.ivlen); |
| 100 | esp->conf.ivinitted = 1; |
| 101 | } |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 102 | crypto_blkcipher_set_iv(tfm, esp->conf.ivec, esp->conf.ivlen); |
David S. Miller | e4bec82 | 2006-09-22 15:17:35 -0700 | [diff] [blame] | 103 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 104 | |
| 105 | do { |
| 106 | struct scatterlist *sg = &esp->sgbuf[0]; |
| 107 | |
| 108 | if (unlikely(nfrags > ESP_NUM_FAST_SG)) { |
| 109 | sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC); |
| 110 | if (!sg) |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 111 | goto unlock; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 112 | } |
David S. Miller | ed0e7e0 | 2007-10-26 00:38:39 -0700 | [diff] [blame] | 113 | sg_init_table(sg, nfrags); |
David S. Miller | 51c739d | 2007-10-30 21:29:29 -0700 | [diff] [blame] | 114 | skb_to_sgvec(skb, sg, |
| 115 | esph->enc_data + |
| 116 | esp->conf.ivlen - |
| 117 | skb->data, clen); |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 118 | err = crypto_blkcipher_encrypt(&desc, sg, sg, clen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 119 | if (unlikely(sg != &esp->sgbuf[0])) |
| 120 | kfree(sg); |
| 121 | } while (0); |
| 122 | |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 123 | if (unlikely(err)) |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 124 | goto unlock; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 125 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 126 | if (esp->conf.ivlen) { |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 127 | memcpy(esph->enc_data, esp->conf.ivec, esp->conf.ivlen); |
| 128 | crypto_blkcipher_get_iv(tfm, esp->conf.ivec, esp->conf.ivlen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 129 | } |
| 130 | |
| 131 | if (esp->auth.icv_full_len) { |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 132 | err = esp_mac_digest(esp, skb, (u8 *)esph - skb->data, |
| 133 | sizeof(*esph) + esp->conf.ivlen + clen); |
| 134 | memcpy(pskb_put(skb, trailer, alen), esp->auth.work_icv, alen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 135 | } |
| 136 | |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 137 | unlock: |
| 138 | spin_unlock_bh(&x->lock); |
| 139 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 140 | error: |
| 141 | return err; |
| 142 | } |
| 143 | |
| 144 | /* |
| 145 | * Note: detecting truncated vs. non-truncated authentication data is very |
| 146 | * expensive, so we only support truncated data, which is the recommended |
| 147 | * and common case. |
| 148 | */ |
Herbert Xu | e695633 | 2006-04-01 00:52:46 -0800 | [diff] [blame] | 149 | static int esp_input(struct xfrm_state *x, struct sk_buff *skb) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 150 | { |
| 151 | struct iphdr *iph; |
| 152 | struct ip_esp_hdr *esph; |
| 153 | struct esp_data *esp = x->data; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 154 | struct crypto_blkcipher *tfm = esp->conf.tfm; |
| 155 | struct blkcipher_desc desc = { .tfm = tfm }; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 156 | struct sk_buff *trailer; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 157 | int blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 158 | int alen = esp->auth.icv_trunc_len; |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 159 | int elen = skb->len - sizeof(*esph) - esp->conf.ivlen - alen; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 160 | int nfrags; |
Herbert Xu | 31a4ab9 | 2006-05-27 23:06:13 -0700 | [diff] [blame] | 161 | int ihl; |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 162 | u8 nexthdr[2]; |
| 163 | struct scatterlist *sg; |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 164 | int padlen; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 165 | int err; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 166 | |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 167 | if (!pskb_may_pull(skb, sizeof(*esph))) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 168 | goto out; |
| 169 | |
| 170 | if (elen <= 0 || (elen & (blksize-1))) |
| 171 | goto out; |
| 172 | |
| 173 | /* If integrity check is required, do this. */ |
| 174 | if (esp->auth.icv_full_len) { |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 175 | u8 sum[alen]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 176 | |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 177 | err = esp_mac_digest(esp, skb, 0, skb->len - alen); |
| 178 | if (err) |
| 179 | goto out; |
| 180 | |
| 181 | if (skb_copy_bits(skb, skb->len - alen, sum, alen)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 182 | BUG(); |
| 183 | |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 184 | if (unlikely(memcmp(esp->auth.work_icv, sum, alen))) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 185 | x->stats.integrity_failed++; |
| 186 | goto out; |
| 187 | } |
| 188 | } |
| 189 | |
| 190 | if ((nfrags = skb_cow_data(skb, 0, &trailer)) < 0) |
| 191 | goto out; |
| 192 | |
| 193 | skb->ip_summed = CHECKSUM_NONE; |
| 194 | |
Herbert Xu | 87bdc48 | 2007-10-10 15:45:25 -0700 | [diff] [blame] | 195 | esph = (struct ip_esp_hdr *)skb->data; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 196 | |
| 197 | /* Get ivec. This can be wrong, check against another impls. */ |
| 198 | if (esp->conf.ivlen) |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 199 | crypto_blkcipher_set_iv(tfm, esph->enc_data, esp->conf.ivlen); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 200 | |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 201 | sg = &esp->sgbuf[0]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 202 | |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 203 | if (unlikely(nfrags > ESP_NUM_FAST_SG)) { |
| 204 | sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC); |
| 205 | if (!sg) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 206 | goto out; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 207 | } |
David S. Miller | ed0e7e0 | 2007-10-26 00:38:39 -0700 | [diff] [blame] | 208 | sg_init_table(sg, nfrags); |
David S. Miller | 51c739d | 2007-10-30 21:29:29 -0700 | [diff] [blame] | 209 | skb_to_sgvec(skb, sg, |
| 210 | sizeof(*esph) + esp->conf.ivlen, |
| 211 | elen); |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 212 | err = crypto_blkcipher_decrypt(&desc, sg, sg, elen); |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 213 | if (unlikely(sg != &esp->sgbuf[0])) |
| 214 | kfree(sg); |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 215 | if (unlikely(err)) |
| 216 | return err; |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 217 | |
| 218 | if (skb_copy_bits(skb, skb->len-alen-2, nexthdr, 2)) |
| 219 | BUG(); |
| 220 | |
| 221 | padlen = nexthdr[0]; |
| 222 | if (padlen+2 >= elen) |
| 223 | goto out; |
| 224 | |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 225 | /* ... check padding bits here. Silly. :-) */ |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 226 | |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 227 | iph = ip_hdr(skb); |
Herbert Xu | 31a4ab9 | 2006-05-27 23:06:13 -0700 | [diff] [blame] | 228 | ihl = iph->ihl * 4; |
| 229 | |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 230 | if (x->encap) { |
| 231 | struct xfrm_encap_tmpl *encap = x->encap; |
Arnaldo Carvalho de Melo | d56f90a | 2007-04-10 20:50:43 -0700 | [diff] [blame] | 232 | struct udphdr *uh = (void *)(skb_network_header(skb) + ihl); |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 233 | |
| 234 | /* |
| 235 | * 1) if the NAT-T peer's IP or port changed then |
| 236 | * advertize the change to the keying daemon. |
| 237 | * This is an inbound SA, so just compare |
| 238 | * SRC ports. |
| 239 | */ |
| 240 | if (iph->saddr != x->props.saddr.a4 || |
| 241 | uh->source != encap->encap_sport) { |
| 242 | xfrm_address_t ipaddr; |
| 243 | |
| 244 | ipaddr.a4 = iph->saddr; |
| 245 | km_new_mapping(x, &ipaddr, uh->source); |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 246 | |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 247 | /* XXX: perhaps add an extra |
| 248 | * policy check here, to see |
| 249 | * if we should allow or |
| 250 | * reject a packet from a |
| 251 | * different source |
| 252 | * address/port. |
| 253 | */ |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 254 | } |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 255 | |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 256 | /* |
| 257 | * 2) ignore UDP/TCP checksums in case |
| 258 | * of NAT-T in Transport Mode, or |
| 259 | * perform other post-processing fixes |
| 260 | * as per draft-ietf-ipsec-udp-encaps-06, |
| 261 | * section 3.1.2 |
| 262 | */ |
Herbert Xu | 8bd1707 | 2007-10-10 15:41:41 -0700 | [diff] [blame] | 263 | if (x->props.mode == XFRM_MODE_TRANSPORT) |
Herbert Xu | 752c1f4 | 2006-02-27 13:00:40 -0800 | [diff] [blame] | 264 | skb->ip_summed = CHECKSUM_UNNECESSARY; |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 265 | } |
| 266 | |
Herbert Xu | 4bf05ec | 2006-02-27 13:00:01 -0800 | [diff] [blame] | 267 | pskb_trim(skb, skb->len - alen - padlen - 2); |
Arnaldo Carvalho de Melo | 967b05f | 2007-03-13 13:51:52 -0300 | [diff] [blame] | 268 | __skb_pull(skb, sizeof(*esph) + esp->conf.ivlen); |
| 269 | skb_set_transport_header(skb, -ihl); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 270 | |
Herbert Xu | 631a6698 | 2007-10-10 15:46:21 -0700 | [diff] [blame] | 271 | return nexthdr[1]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 272 | |
| 273 | out: |
| 274 | return -EINVAL; |
| 275 | } |
| 276 | |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 277 | static u32 esp4_get_mtu(struct xfrm_state *x, int mtu) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 278 | { |
| 279 | struct esp_data *esp = x->data; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 280 | u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4); |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 281 | u32 align = max_t(u32, blksize, esp->conf.padlen); |
| 282 | u32 rem; |
| 283 | |
| 284 | mtu -= x->props.header_len + esp->auth.icv_trunc_len; |
| 285 | rem = mtu & (align - 1); |
| 286 | mtu &= ~(align - 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 287 | |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 288 | switch (x->props.mode) { |
| 289 | case XFRM_MODE_TUNNEL: |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 290 | break; |
| 291 | default: |
| 292 | case XFRM_MODE_TRANSPORT: |
| 293 | /* The worst case */ |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 294 | mtu -= blksize - 4; |
| 295 | mtu += min_t(u32, blksize - 4, rem); |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 296 | break; |
| 297 | case XFRM_MODE_BEET: |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 298 | /* The worst case. */ |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 299 | mtu += min_t(u32, IPV4_BEET_PHMAXLEN, rem); |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 300 | break; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 301 | } |
Diego Beltrami | 0a69452 | 2006-10-03 23:47:05 -0700 | [diff] [blame] | 302 | |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 303 | return mtu - 2; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 304 | } |
| 305 | |
| 306 | static void esp4_err(struct sk_buff *skb, u32 info) |
| 307 | { |
| 308 | struct iphdr *iph = (struct iphdr*)skb->data; |
| 309 | struct ip_esp_hdr *esph = (struct ip_esp_hdr*)(skb->data+(iph->ihl<<2)); |
| 310 | struct xfrm_state *x; |
| 311 | |
Arnaldo Carvalho de Melo | 88c7664 | 2007-03-13 14:43:18 -0300 | [diff] [blame] | 312 | if (icmp_hdr(skb)->type != ICMP_DEST_UNREACH || |
| 313 | icmp_hdr(skb)->code != ICMP_FRAG_NEEDED) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 314 | return; |
| 315 | |
| 316 | x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET); |
| 317 | if (!x) |
| 318 | return; |
Patrick McHardy | 64ce207 | 2005-08-09 20:50:53 -0700 | [diff] [blame] | 319 | NETDEBUG(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n", |
| 320 | ntohl(esph->spi), ntohl(iph->daddr)); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 321 | xfrm_state_put(x); |
| 322 | } |
| 323 | |
| 324 | static void esp_destroy(struct xfrm_state *x) |
| 325 | { |
| 326 | struct esp_data *esp = x->data; |
| 327 | |
| 328 | if (!esp) |
| 329 | return; |
| 330 | |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 331 | crypto_free_blkcipher(esp->conf.tfm); |
Jesper Juhl | 573dbd9 | 2005-09-01 17:44:29 -0700 | [diff] [blame] | 332 | esp->conf.tfm = NULL; |
| 333 | kfree(esp->conf.ivec); |
| 334 | esp->conf.ivec = NULL; |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 335 | crypto_free_hash(esp->auth.tfm); |
Jesper Juhl | 573dbd9 | 2005-09-01 17:44:29 -0700 | [diff] [blame] | 336 | esp->auth.tfm = NULL; |
| 337 | kfree(esp->auth.work_icv); |
| 338 | esp->auth.work_icv = NULL; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 339 | kfree(esp); |
| 340 | } |
| 341 | |
Herbert Xu | 72cb696 | 2005-06-20 13:18:08 -0700 | [diff] [blame] | 342 | static int esp_init_state(struct xfrm_state *x) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 343 | { |
| 344 | struct esp_data *esp = NULL; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 345 | struct crypto_blkcipher *tfm; |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 346 | u32 align; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 347 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 348 | if (x->ealg == NULL) |
| 349 | goto error; |
| 350 | |
Panagiotis Issaris | 0da974f | 2006-07-21 14:51:30 -0700 | [diff] [blame] | 351 | esp = kzalloc(sizeof(*esp), GFP_KERNEL); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 352 | if (esp == NULL) |
| 353 | return -ENOMEM; |
| 354 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 355 | if (x->aalg) { |
| 356 | struct xfrm_algo_desc *aalg_desc; |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 357 | struct crypto_hash *hash; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 358 | |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 359 | hash = crypto_alloc_hash(x->aalg->alg_name, 0, |
| 360 | CRYPTO_ALG_ASYNC); |
| 361 | if (IS_ERR(hash)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 362 | goto error; |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 363 | |
| 364 | esp->auth.tfm = hash; |
Herbert Xu | 4b7137f | 2007-10-08 17:13:44 -0700 | [diff] [blame] | 365 | if (crypto_hash_setkey(hash, x->aalg->alg_key, |
| 366 | (x->aalg->alg_key_len + 7) / 8)) |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 367 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 368 | |
| 369 | aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0); |
| 370 | BUG_ON(!aalg_desc); |
| 371 | |
| 372 | if (aalg_desc->uinfo.auth.icv_fullbits/8 != |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 373 | crypto_hash_digestsize(hash)) { |
Patrick McHardy | 64ce207 | 2005-08-09 20:50:53 -0700 | [diff] [blame] | 374 | NETDEBUG(KERN_INFO "ESP: %s digestsize %u != %hu\n", |
| 375 | x->aalg->alg_name, |
Herbert Xu | 07d4ee5 | 2006-08-20 14:24:50 +1000 | [diff] [blame] | 376 | crypto_hash_digestsize(hash), |
Patrick McHardy | 64ce207 | 2005-08-09 20:50:53 -0700 | [diff] [blame] | 377 | aalg_desc->uinfo.auth.icv_fullbits/8); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 378 | goto error; |
| 379 | } |
| 380 | |
| 381 | esp->auth.icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8; |
| 382 | esp->auth.icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8; |
| 383 | |
| 384 | esp->auth.work_icv = kmalloc(esp->auth.icv_full_len, GFP_KERNEL); |
| 385 | if (!esp->auth.work_icv) |
| 386 | goto error; |
| 387 | } |
Herbert Xu | 4b7137f | 2007-10-08 17:13:44 -0700 | [diff] [blame] | 388 | |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 389 | tfm = crypto_alloc_blkcipher(x->ealg->alg_name, 0, CRYPTO_ALG_ASYNC); |
| 390 | if (IS_ERR(tfm)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 391 | goto error; |
Herbert Xu | 6b7326c | 2006-07-30 15:41:01 +1000 | [diff] [blame] | 392 | esp->conf.tfm = tfm; |
| 393 | esp->conf.ivlen = crypto_blkcipher_ivsize(tfm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 394 | esp->conf.padlen = 0; |
| 395 | if (esp->conf.ivlen) { |
| 396 | esp->conf.ivec = kmalloc(esp->conf.ivlen, GFP_KERNEL); |
| 397 | if (unlikely(esp->conf.ivec == NULL)) |
| 398 | goto error; |
David S. Miller | e4bec82 | 2006-09-22 15:17:35 -0700 | [diff] [blame] | 399 | esp->conf.ivinitted = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 400 | } |
Herbert Xu | 4b7137f | 2007-10-08 17:13:44 -0700 | [diff] [blame] | 401 | if (crypto_blkcipher_setkey(tfm, x->ealg->alg_key, |
| 402 | (x->ealg->alg_key_len + 7) / 8)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 403 | goto error; |
| 404 | x->props.header_len = sizeof(struct ip_esp_hdr) + esp->conf.ivlen; |
Masahide NAKAMURA | 7e49e6d | 2006-09-22 15:05:15 -0700 | [diff] [blame] | 405 | if (x->props.mode == XFRM_MODE_TUNNEL) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 406 | x->props.header_len += sizeof(struct iphdr); |
Patrick McHardy | ac758e3 | 2007-04-09 11:47:58 -0700 | [diff] [blame] | 407 | else if (x->props.mode == XFRM_MODE_BEET) |
| 408 | x->props.header_len += IPV4_BEET_PHMAXLEN; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 409 | if (x->encap) { |
| 410 | struct xfrm_encap_tmpl *encap = x->encap; |
| 411 | |
| 412 | switch (encap->encap_type) { |
| 413 | default: |
| 414 | goto error; |
| 415 | case UDP_ENCAP_ESPINUDP: |
| 416 | x->props.header_len += sizeof(struct udphdr); |
| 417 | break; |
| 418 | case UDP_ENCAP_ESPINUDP_NON_IKE: |
| 419 | x->props.header_len += sizeof(struct udphdr) + 2 * sizeof(u32); |
| 420 | break; |
| 421 | } |
| 422 | } |
| 423 | x->data = esp; |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 424 | align = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4); |
| 425 | if (esp->conf.padlen) |
| 426 | align = max_t(u32, align, esp->conf.padlen); |
| 427 | x->props.trailer_len = align + 1 + esp->auth.icv_trunc_len; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 428 | return 0; |
| 429 | |
| 430 | error: |
| 431 | x->data = esp; |
| 432 | esp_destroy(x); |
| 433 | x->data = NULL; |
| 434 | return -EINVAL; |
| 435 | } |
| 436 | |
| 437 | static struct xfrm_type esp_type = |
| 438 | { |
| 439 | .description = "ESP4", |
| 440 | .owner = THIS_MODULE, |
| 441 | .proto = IPPROTO_ESP, |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 442 | .flags = XFRM_TYPE_REPLAY_PROT, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 443 | .init_state = esp_init_state, |
| 444 | .destructor = esp_destroy, |
Patrick McHardy | c5c2523 | 2007-04-09 11:47:18 -0700 | [diff] [blame] | 445 | .get_mtu = esp4_get_mtu, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 446 | .input = esp_input, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 447 | .output = esp_output |
| 448 | }; |
| 449 | |
| 450 | static struct net_protocol esp4_protocol = { |
| 451 | .handler = xfrm4_rcv, |
| 452 | .err_handler = esp4_err, |
| 453 | .no_policy = 1, |
| 454 | }; |
| 455 | |
| 456 | static int __init esp4_init(void) |
| 457 | { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 458 | if (xfrm_register_type(&esp_type, AF_INET) < 0) { |
| 459 | printk(KERN_INFO "ip esp init: can't add xfrm type\n"); |
| 460 | return -EAGAIN; |
| 461 | } |
| 462 | if (inet_add_protocol(&esp4_protocol, IPPROTO_ESP) < 0) { |
| 463 | printk(KERN_INFO "ip esp init: can't add protocol\n"); |
| 464 | xfrm_unregister_type(&esp_type, AF_INET); |
| 465 | return -EAGAIN; |
| 466 | } |
| 467 | return 0; |
| 468 | } |
| 469 | |
| 470 | static void __exit esp4_fini(void) |
| 471 | { |
| 472 | if (inet_del_protocol(&esp4_protocol, IPPROTO_ESP) < 0) |
| 473 | printk(KERN_INFO "ip esp close: can't remove protocol\n"); |
| 474 | if (xfrm_unregister_type(&esp_type, AF_INET) < 0) |
| 475 | printk(KERN_INFO "ip esp close: can't remove xfrm type\n"); |
| 476 | } |
| 477 | |
| 478 | module_init(esp4_init); |
| 479 | module_exit(esp4_fini); |
| 480 | MODULE_LICENSE("GPL"); |
Masahide NAKAMURA | d3d6dd3 | 2007-06-26 23:57:49 -0700 | [diff] [blame] | 481 | MODULE_ALIAS_XFRM_TYPE(AF_INET, XFRM_PROTO_ESP); |