1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16#include <linux/config.h>
17#include <linux/module.h>
18#include <asm/scatterlist.h>
19#include <linux/crypto.h>
20#include <linux/pfkeyv2.h>
21#include <net/inet_ecn.h>
22#include <net/ip.h>
23#include <net/xfrm.h>
24#include <net/icmp.h>
25#include <net/ipcomp.h>
26
27static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb)
28{
29 int err, plen, dlen;
30 struct iphdr *iph;
31 struct ipcomp_data *ipcd = x->data;
32 u8 *start, *scratch = ipcd->scratch;
33
34 plen = skb->len;
35 dlen = IPCOMP_SCRATCH_SIZE;
36 start = skb->data;
37
38 err = crypto_comp_decompress(ipcd->tfm, start, plen, scratch, &dlen);
39 if (err)
40 goto out;
41
42 if (dlen < (plen + sizeof(struct ip_comp_hdr))) {
43 err = -EINVAL;
44 goto out;
45 }
46
47 err = pskb_expand_head(skb, 0, dlen - plen, GFP_ATOMIC);
48 if (err)
49 goto out;
50
51 skb_put(skb, dlen - plen);
52 memcpy(skb->data, scratch, dlen);
53 iph = skb->nh.iph;
54 iph->tot_len = htons(dlen + iph->ihl * 4);
55out:
56 return err;
57}
58
59static int ipcomp_input(struct xfrm_state *x,
60 struct xfrm_decap_state *decap, struct sk_buff *skb)
61{
62 u8 nexthdr;
63 int err = 0;
64 struct iphdr *iph;
65 union {
66 struct iphdr iph;
67 char buf[60];
68 } tmp_iph;
69
70
71 if ((skb_is_nonlinear(skb) || skb_cloned(skb)) &&
72 skb_linearize(skb, GFP_ATOMIC) != 0) {
73 err = -ENOMEM;
74 goto out;
75 }
76
77 skb->ip_summed = CHECKSUM_NONE;
78
79
80 iph = skb->nh.iph;
81 memcpy(&tmp_iph, iph, iph->ihl * 4);
82 nexthdr = *(u8 *)skb->data;
83 skb_pull(skb, sizeof(struct ip_comp_hdr));
84 skb->nh.raw += sizeof(struct ip_comp_hdr);
85 memcpy(skb->nh.raw, &tmp_iph, tmp_iph.iph.ihl * 4);
86 iph = skb->nh.iph;
87 iph->tot_len = htons(ntohs(iph->tot_len) - sizeof(struct ip_comp_hdr));
88 iph->protocol = nexthdr;
89 skb->h.raw = skb->data;
90 err = ipcomp_decompress(x, skb);
91
92out:
93 return err;
94}
95
96static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
97{
98 int err, plen, dlen, ihlen;
99 struct iphdr *iph = skb->nh.iph;
100 struct ipcomp_data *ipcd = x->data;
101 u8 *start, *scratch = ipcd->scratch;
102
103 ihlen = iph->ihl * 4;
104 plen = skb->len - ihlen;
105 dlen = IPCOMP_SCRATCH_SIZE;
106 start = skb->data + ihlen;
107
108 err = crypto_comp_compress(ipcd->tfm, start, plen, scratch, &dlen);
109 if (err)
110 goto out;
111
112 if ((dlen + sizeof(struct ip_comp_hdr)) >= plen) {
113 err = -EMSGSIZE;
114 goto out;
115 }
116
117 memcpy(start, scratch, dlen);
118 pskb_trim(skb, ihlen + dlen);
119
120out:
121 return err;
122}
123
124static void ipcomp_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb)
125{
126 struct dst_entry *dst = skb->dst;
127 struct iphdr *iph, *top_iph;
128
129 iph = skb->nh.iph;
130 top_iph = (struct iphdr *)skb_push(skb, sizeof(struct iphdr));
131 top_iph->ihl = 5;
132 top_iph->version = 4;
133 top_iph->tos = iph->tos;
134 top_iph->tot_len = htons(skb->len);
135 if (!(iph->frag_off&htons(IP_DF)))
136 __ip_select_ident(top_iph, dst, 0);
137 top_iph->ttl = iph->ttl;
138 top_iph->check = 0;
139 top_iph->saddr = x->props.saddr.a4;
140 top_iph->daddr = x->id.daddr.a4;
141 top_iph->frag_off = iph->frag_off&~htons(IP_MF|IP_OFFSET);
142 memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
143 skb->nh.raw = skb->data;
144}
145
146static int ipcomp_output(struct sk_buff *skb)
147{
148 int err;
149 struct dst_entry *dst = skb->dst;
150 struct xfrm_state *x = dst->xfrm;
151 struct iphdr *iph, *top_iph;
152 struct ip_comp_hdr *ipch;
153 struct ipcomp_data *ipcd = x->data;
154 union {
155 struct iphdr iph;
156 char buf[60];
157 } tmp_iph;
158 int hdr_len = 0;
159
160 if (skb->ip_summed == CHECKSUM_HW && skb_checksum_help(skb) == NULL) {
161 err = -EINVAL;
162 goto error_nolock;
163 }
164
165 spin_lock_bh(&x->lock);
166 err = xfrm_check_output(x, skb, AF_INET);
167 if (err)
168 goto error;
169
170
171 if (!x->props.mode) {
172 iph = skb->nh.iph;
173 hdr_len = iph->ihl * 4;
174 }
175 if ((skb->len - hdr_len) < ipcd->threshold) {
176 if (x->props.mode) {
177 ipcomp_tunnel_encap(x, skb);
178 iph = skb->nh.iph;
179 iph->protocol = IPPROTO_IPIP;
180 ip_send_check(iph);
181 }
182 goto out_ok;
183 }
184
185 if (x->props.mode)
186 ipcomp_tunnel_encap(x, skb);
187
188 if ((skb_is_nonlinear(skb) || skb_cloned(skb)) &&
189 skb_linearize(skb, GFP_ATOMIC) != 0) {
190 err = -ENOMEM;
191 goto error;
192 }
193
194 err = ipcomp_compress(x, skb);
195 if (err) {
196 if (err == -EMSGSIZE) {
197 if (x->props.mode) {
198 iph = skb->nh.iph;
199 iph->protocol = IPPROTO_IPIP;
200 ip_send_check(iph);
201 }
202 goto out_ok;
203 }
204 goto error;
205 }
206
207
208 iph = skb->nh.iph;
209 memcpy(&tmp_iph, iph, iph->ihl * 4);
210 top_iph = (struct iphdr *)skb_push(skb, sizeof(struct ip_comp_hdr));
211 memcpy(top_iph, &tmp_iph, iph->ihl * 4);
212 iph = top_iph;
213 if (x->props.mode && (x->props.flags & XFRM_STATE_NOECN))
214 IP_ECN_clear(iph);
215 iph->tot_len = htons(skb->len);
216 iph->protocol = IPPROTO_COMP;
217 iph->check = 0;
218 ipch = (struct ip_comp_hdr *)((char *)iph + iph->ihl * 4);
219 ipch->nexthdr = x->props.mode ? IPPROTO_IPIP : tmp_iph.iph.protocol;
220 ipch->flags = 0;
221 ipch->cpi = htons((u16 )ntohl(x->id.spi));
222 ip_send_check(iph);
223 skb->nh.raw = skb->data;
224
225out_ok:
226 x->curlft.bytes += skb->len;
227 x->curlft.packets++;
228 spin_unlock_bh(&x->lock);
229
230 if ((skb->dst = dst_pop(dst)) == NULL) {
231 err = -EHOSTUNREACH;
232 goto error_nolock;
233 }
234 err = NET_XMIT_BYPASS;
235
236out_exit:
237 return err;
238error:
239 spin_unlock_bh(&x->lock);
240error_nolock:
241 kfree_skb(skb);
242 goto out_exit;
243}
244
245static void ipcomp4_err(struct sk_buff *skb, u32 info)
246{
247 u32 spi;
248 struct iphdr *iph = (struct iphdr *)skb->data;
249 struct ip_comp_hdr *ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
250 struct xfrm_state *x;
251
252 if (skb->h.icmph->type != ICMP_DEST_UNREACH ||
253 skb->h.icmph->code != ICMP_FRAG_NEEDED)
254 return;
255
256 spi = ntohl(ntohs(ipch->cpi));
257 x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr,
258 spi, IPPROTO_COMP, AF_INET);
259 if (!x)
260 return;
261 printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%u.%u.%u.%u\n",
262 spi, NIPQUAD(iph->daddr));
263 xfrm_state_put(x);
264}
265
266
267static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
268{
269 struct xfrm_state *t;
270
271 t = xfrm_state_alloc();
272 if (t == NULL)
273 goto out;
274
275 t->id.proto = IPPROTO_IPIP;
276 t->id.spi = x->props.saddr.a4;
277 t->id.daddr.a4 = x->id.daddr.a4;
278 memcpy(&t->sel, &x->sel, sizeof(t->sel));
279 t->props.family = AF_INET;
280 t->props.mode = 1;
281 t->props.saddr.a4 = x->props.saddr.a4;
282 t->props.flags = x->props.flags;
283
284 t->type = xfrm_get_type(IPPROTO_IPIP, t->props.family);
285 if (t->type == NULL)
286 goto error;
287
288 if (t->type->init_state(t, NULL))
289 goto error;
290
291 t->km.state = XFRM_STATE_VALID;
292 atomic_set(&t->tunnel_users, 1);
293out:
294 return t;
295
296error:
297 xfrm_state_put(t);
298 t = NULL;
299 goto out;
300}
301
302
303
304
305
306static int ipcomp_tunnel_attach(struct xfrm_state *x)
307{
308 int err = 0;
309 struct xfrm_state *t;
310
311 t = xfrm_state_lookup((xfrm_address_t *)&x->id.daddr.a4,
312 x->props.saddr.a4, IPPROTO_IPIP, AF_INET);
313 if (!t) {
314 t = ipcomp_tunnel_create(x);
315 if (!t) {
316 err = -EINVAL;
317 goto out;
318 }
319 xfrm_state_insert(t);
320 xfrm_state_hold(t);
321 }
322 x->tunnel = t;
323 atomic_inc(&t->tunnel_users);
324out:
325 return err;
326}
327
328static void ipcomp_free_data(struct ipcomp_data *ipcd)
329{
330 if (ipcd->tfm)
331 crypto_free_tfm(ipcd->tfm);
332 if (ipcd->scratch)
333 kfree(ipcd->scratch);
334}
335
336static void ipcomp_destroy(struct xfrm_state *x)
337{
338 struct ipcomp_data *ipcd = x->data;
339 if (!ipcd)
340 return;
341 ipcomp_free_data(ipcd);
342 kfree(ipcd);
343}
344
345static int ipcomp_init_state(struct xfrm_state *x, void *args)
346{
347 int err;
348 struct ipcomp_data *ipcd;
349 struct xfrm_algo_desc *calg_desc;
350
351 err = -EINVAL;
352 if (!x->calg)
353 goto out;
354
355 err = -ENOMEM;
356 ipcd = kmalloc(sizeof(*ipcd), GFP_KERNEL);
357 if (!ipcd)
358 goto error;
359
360 memset(ipcd, 0, sizeof(*ipcd));
361 x->props.header_len = sizeof(struct ip_comp_hdr);
362 if (x->props.mode)
363 x->props.header_len += sizeof(struct iphdr);
364
365 ipcd->scratch = kmalloc(IPCOMP_SCRATCH_SIZE, GFP_KERNEL);
366 if (!ipcd->scratch)
367 goto error;
368
369 ipcd->tfm = crypto_alloc_tfm(x->calg->alg_name, 0);
370 if (!ipcd->tfm)
371 goto error;
372
373 if (x->props.mode) {
374 err = ipcomp_tunnel_attach(x);
375 if (err)
376 goto error;
377 }
378
379 calg_desc = xfrm_calg_get_byname(x->calg->alg_name);
380 BUG_ON(!calg_desc);
381 ipcd->threshold = calg_desc->uinfo.comp.threshold;
382 x->data = ipcd;
383 err = 0;
384out:
385 return err;
386
387error:
388 if (ipcd) {
389 ipcomp_free_data(ipcd);
390 kfree(ipcd);
391 }
392 goto out;
393}
394
395static struct xfrm_type ipcomp_type = {
396 .description = "IPCOMP4",
397 .owner = THIS_MODULE,
398 .proto = IPPROTO_COMP,
399 .init_state = ipcomp_init_state,
400 .destructor = ipcomp_destroy,
401 .input = ipcomp_input,
402 .output = ipcomp_output
403};
404
405static struct inet_protocol ipcomp4_protocol = {
406 .handler = xfrm4_rcv,
407 .err_handler = ipcomp4_err,
408 .no_policy = 1,
409};
410
411static int __init ipcomp4_init(void)
412{
413 if (xfrm_register_type(&ipcomp_type, AF_INET) < 0) {
414 printk(KERN_INFO "ipcomp init: can't add xfrm type\n");
415 return -EAGAIN;
416 }
417 if (inet_add_protocol(&ipcomp4_protocol, IPPROTO_COMP) < 0) {
418 printk(KERN_INFO "ipcomp init: can't add protocol\n");
419 xfrm_unregister_type(&ipcomp_type, AF_INET);
420 return -EAGAIN;
421 }
422 return 0;
423}
424
425static void __exit ipcomp4_fini(void)
426{
427 if (inet_del_protocol(&ipcomp4_protocol, IPPROTO_COMP) < 0)
428 printk(KERN_INFO "ip ipcomp close: can't remove protocol\n");
429 if (xfrm_unregister_type(&ipcomp_type, AF_INET) < 0)
430 printk(KERN_INFO "ip ipcomp close: can't remove xfrm type\n");
431}
432
433module_init(ipcomp4_init);
434module_exit(ipcomp4_fini);
435
436MODULE_LICENSE("GPL");
437MODULE_DESCRIPTION("IP Payload Compression Protocol (IPComp) - RFC3173");
438MODULE_AUTHOR("James Morris <jmorris@intercode.com.au>");
439
440
