1#include <linux/config.h>
2#include <linux/module.h>
3#include <net/inet_ecn.h>
4#include <net/ip.h>
5#include <net/xfrm.h>
6#include <net/ah.h>
7#include <linux/crypto.h>
8#include <linux/pfkeyv2.h>
9#include <net/icmp.h>
10#include <asm/scatterlist.h>
11
12
13
14
15
16
17static int ip_clear_mutable_options(struct iphdr *iph, u32 *daddr)
18{
19 unsigned char * optptr = (unsigned char*)(iph+1);
20 int l = iph->ihl*4 - sizeof(struct iphdr);
21 int optlen;
22
23 while (l > 0) {
24 switch (*optptr) {
25 case IPOPT_END:
26 return 0;
27 case IPOPT_NOOP:
28 l--;
29 optptr++;
30 continue;
31 }
32 optlen = optptr[1];
33 if (optlen<2 || optlen>l)
34 return -EINVAL;
35 switch (*optptr) {
36 case IPOPT_SEC:
37 case 0x85:
38 case 0x86:
39 case IPOPT_RA:
40 case 0x80|21:
41 break;
42 case IPOPT_LSRR:
43 case IPOPT_SSRR:
44 if (optlen < 6)
45 return -EINVAL;
46 memcpy(daddr, optptr+optlen-4, 4);
47
48 default:
49 memset(optptr+2, 0, optlen-2);
50 }
51 l -= optlen;
52 optptr += optlen;
53 }
54 return 0;
55}
56
57static int ah_output(struct sk_buff *skb)
58{
59 int err;
60 struct dst_entry *dst = skb->dst;
61 struct xfrm_state *x = dst->xfrm;
62 struct iphdr *iph, *top_iph;
63 struct ip_auth_hdr *ah;
64 struct ah_data *ahp;
65 union {
66 struct iphdr iph;
67 char buf[60];
68 } tmp_iph;
69
70 if (skb->ip_summed == CHECKSUM_HW && skb_checksum_help(skb) == NULL) {
71 err = -EINVAL;
72 goto error_nolock;
73 }
74
75 spin_lock_bh(&x->lock);
76 err = xfrm_check_output(x, skb, AF_INET);
77 if (err)
78 goto error;
79
80 iph = skb->nh.iph;
81 if (x->props.mode) {
82 top_iph = (struct iphdr*)skb_push(skb, x->props.header_len);
83 top_iph->ihl = 5;
84 top_iph->version = 4;
85 top_iph->tos = 0;
86 top_iph->tot_len = htons(skb->len);
87 top_iph->frag_off = 0;
88 if (!(iph->frag_off&htons(IP_DF)))
89 __ip_select_ident(top_iph, dst, 0);
90 top_iph->ttl = 0;
91 top_iph->protocol = IPPROTO_AH;
92 top_iph->check = 0;
93 top_iph->saddr = x->props.saddr.a4;
94 top_iph->daddr = x->id.daddr.a4;
95 ah = (struct ip_auth_hdr*)(top_iph+1);
96 ah->nexthdr = IPPROTO_IPIP;
97 } else {
98 memcpy(&tmp_iph, skb->data, iph->ihl*4);
99 top_iph = (struct iphdr*)skb_push(skb, x->props.header_len);
100 memcpy(top_iph, &tmp_iph, iph->ihl*4);
101 iph = &tmp_iph.iph;
102 top_iph->tos = 0;
103 top_iph->tot_len = htons(skb->len);
104 top_iph->frag_off = 0;
105 top_iph->ttl = 0;
106 top_iph->protocol = IPPROTO_AH;
107 top_iph->check = 0;
108 if (top_iph->ihl != 5) {
109 err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
110 if (err)
111 goto error;
112 }
113 ah = (struct ip_auth_hdr*)((char*)top_iph+iph->ihl*4);
114 ah->nexthdr = iph->protocol;
115 }
116 ahp = x->data;
117 ah->hdrlen = (XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
118 ahp->icv_trunc_len) >> 2) - 2;
119
120 ah->reserved = 0;
121 ah->spi = x->id.spi;
122 ah->seq_no = htonl(++x->replay.oseq);
123 ahp->icv(ahp, skb, ah->auth_data);
124 top_iph->tos = iph->tos;
125 top_iph->ttl = iph->ttl;
126 if (x->props.mode) {
127 if (x->props.flags & XFRM_STATE_NOECN)
128 IP_ECN_clear(top_iph);
129 top_iph->frag_off = iph->frag_off&~htons(IP_MF|IP_OFFSET);
130 memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
131 } else {
132 top_iph->frag_off = iph->frag_off;
133 top_iph->daddr = iph->daddr;
134 if (iph->ihl != 5)
135 memcpy(top_iph+1, iph+1, iph->ihl*4 - sizeof(struct iphdr));
136 }
137 ip_send_check(top_iph);
138
139 skb->nh.raw = skb->data;
140
141 x->curlft.bytes += skb->len;
142 x->curlft.packets++;
143 spin_unlock_bh(&x->lock);
144 if ((skb->dst = dst_pop(dst)) == NULL) {
145 err = -EHOSTUNREACH;
146 goto error_nolock;
147 }
148 return NET_XMIT_BYPASS;
149
150error:
151 spin_unlock_bh(&x->lock);
152error_nolock:
153 kfree_skb(skb);
154 return err;
155}
156
157int ah_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
158{
159 int ah_hlen;
160 struct iphdr *iph;
161 struct ip_auth_hdr *ah;
162 struct ah_data *ahp;
163 char work_buf[60];
164
165 if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
166 goto out;
167
168 ah = (struct ip_auth_hdr*)skb->data;
169 ahp = x->data;
170 ah_hlen = (ah->hdrlen + 2) << 2;
171
172 if (ah_hlen != XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_full_len) &&
173 ah_hlen != XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len))
174 goto out;
175
176 if (!pskb_may_pull(skb, ah_hlen))
177 goto out;
178
179
180
181 if (skb_cloned(skb) &&
182 pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
183 goto out;
184
185 skb->ip_summed = CHECKSUM_NONE;
186
187 ah = (struct ip_auth_hdr*)skb->data;
188 iph = skb->nh.iph;
189
190 memcpy(work_buf, iph, iph->ihl*4);
191
192 iph->ttl = 0;
193 iph->tos = 0;
194 iph->frag_off = 0;
195 iph->check = 0;
196 if (iph->ihl != 5) {
197 u32 dummy;
198 if (ip_clear_mutable_options(iph, &dummy))
199 goto out;
200 }
201 {
202 u8 auth_data[ahp->icv_trunc_len];
203
204 memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
205 skb_push(skb, skb->data - skb->nh.raw);
206 ahp->icv(ahp, skb, ah->auth_data);
207 if (memcmp(ah->auth_data, auth_data, ahp->icv_trunc_len)) {
208 x->stats.integrity_failed++;
209 goto out;
210 }
211 }
212 ((struct iphdr*)work_buf)->protocol = ah->nexthdr;
213 skb->nh.raw = skb_pull(skb, ah_hlen);
214 memcpy(skb->nh.raw, work_buf, iph->ihl*4);
215 skb->nh.iph->tot_len = htons(skb->len);
216 skb_pull(skb, skb->nh.iph->ihl*4);
217 skb->h.raw = skb->data;
218
219 return 0;
220
221out:
222 return -EINVAL;
223}
224
225void ah4_err(struct sk_buff *skb, u32 info)
226{
227 struct iphdr *iph = (struct iphdr*)skb->data;
228 struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+(iph->ihl<<2));
229 struct xfrm_state *x;
230
231 if (skb->h.icmph->type != ICMP_DEST_UNREACH ||
232 skb->h.icmph->code != ICMP_FRAG_NEEDED)
233 return;
234
235 x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
236 if (!x)
237 return;
238 printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
239 ntohl(ah->spi), ntohl(iph->daddr));
240 xfrm_state_put(x);
241}
242
243static int ah_init_state(struct xfrm_state *x, void *args)
244{
245 struct ah_data *ahp = NULL;
246 struct xfrm_algo_desc *aalg_desc;
247
248 if (!x->aalg)
249 goto error;
250
251
252 if (x->aalg->alg_key_len > 512)
253 goto error;
254
255 ahp = kmalloc(sizeof(*ahp), GFP_KERNEL);
256 if (ahp == NULL)
257 return -ENOMEM;
258
259 memset(ahp, 0, sizeof(*ahp));
260
261 ahp->key = x->aalg->alg_key;
262 ahp->key_len = (x->aalg->alg_key_len+7)/8;
263 ahp->tfm = crypto_alloc_tfm(x->aalg->alg_name, 0);
264 if (!ahp->tfm)
265 goto error;
266 ahp->icv = ah_hmac_digest;
267
268
269
270
271
272
273
274 aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name);
275 BUG_ON(!aalg_desc);
276
277 if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
278 crypto_tfm_alg_digestsize(ahp->tfm)) {
279 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
280 x->aalg->alg_name, crypto_tfm_alg_digestsize(ahp->tfm),
281 aalg_desc->uinfo.auth.icv_fullbits/8);
282 goto error;
283 }
284
285 ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
286 ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
287
288 ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
289 if (!ahp->work_icv)
290 goto error;
291
292 x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + ahp->icv_trunc_len);
293 if (x->props.mode)
294 x->props.header_len += sizeof(struct iphdr);
295 x->data = ahp;
296
297 return 0;
298
299error:
300 if (ahp) {
301 if (ahp->work_icv)
302 kfree(ahp->work_icv);
303 if (ahp->tfm)
304 crypto_free_tfm(ahp->tfm);
305 kfree(ahp);
306 }
307 return -EINVAL;
308}
309
310static void ah_destroy(struct xfrm_state *x)
311{
312 struct ah_data *ahp = x->data;
313
314 if (!ahp)
315 return;
316
317 if (ahp->work_icv) {
318 kfree(ahp->work_icv);
319 ahp->work_icv = NULL;
320 }
321 if (ahp->tfm) {
322 crypto_free_tfm(ahp->tfm);
323 ahp->tfm = NULL;
324 }
325 kfree(ahp);
326}
327
328
329static struct xfrm_type ah_type =
330{
331 .description = "AH4",
332 .owner = THIS_MODULE,
333 .proto = IPPROTO_AH,
334 .init_state = ah_init_state,
335 .destructor = ah_destroy,
336 .input = ah_input,
337 .output = ah_output
338};
339
340static struct inet_protocol ah4_protocol = {
341 .handler = xfrm4_rcv,
342 .err_handler = ah4_err,
343 .no_policy = 1,
344};
345
346static int __init ah4_init(void)
347{
348 if (xfrm_register_type(&ah_type, AF_INET) < 0) {
349 printk(KERN_INFO "ip ah init: can't add xfrm type\n");
350 return -EAGAIN;
351 }
352 if (inet_add_protocol(&ah4_protocol, IPPROTO_AH) < 0) {
353 printk(KERN_INFO "ip ah init: can't add protocol\n");
354 xfrm_unregister_type(&ah_type, AF_INET);
355 return -EAGAIN;
356 }
357 return 0;
358}
359
360static void __exit ah4_fini(void)
361{
362 if (inet_del_protocol(&ah4_protocol, IPPROTO_AH) < 0)
363 printk(KERN_INFO "ip ah close: can't remove protocol\n");
364 if (xfrm_unregister_type(&ah_type, AF_INET) < 0)
365 printk(KERN_INFO "ip ah close: can't remove xfrm type\n");
366}
367
368module_init(ah4_init);
369module_exit(ah4_fini);
370MODULE_LICENSE("GPL");
371
