ah4.c 7.6 KB
Newer Older
1
#include <linux/err.h>
L
Linus Torvalds 已提交
2 3 4 5 6 7
#include <linux/module.h>
#include <net/ip.h>
#include <net/xfrm.h>
#include <net/ah.h>
#include <linux/crypto.h>
#include <linux/pfkeyv2.h>
8
#include <linux/spinlock.h>
L
Linus Torvalds 已提交
9
#include <net/icmp.h>
10
#include <net/protocol.h>
L
Linus Torvalds 已提交
11 12 13 14 15 16


/* Clear mutable options and find final destination to substitute
 * into IP header for icv calculation. Options are already checked
 * for validity, so paranoia is not required. */

A
Al Viro 已提交
17
static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
L
Linus Torvalds 已提交
18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37
{
	unsigned char * optptr = (unsigned char*)(iph+1);
	int  l = iph->ihl*4 - sizeof(struct iphdr);
	int  optlen;

	while (l > 0) {
		switch (*optptr) {
		case IPOPT_END:
			return 0;
		case IPOPT_NOOP:
			l--;
			optptr++;
			continue;
		}
		optlen = optptr[1];
		if (optlen<2 || optlen>l)
			return -EINVAL;
		switch (*optptr) {
		case IPOPT_SEC:
		case 0x85:	/* Some "Extended Security" crap. */
P
Paul Moore 已提交
38
		case IPOPT_CIPSO:
L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46 47 48
		case IPOPT_RA:
		case 0x80|21:	/* RFC1770 */
			break;
		case IPOPT_LSRR:
		case IPOPT_SSRR:
			if (optlen < 6)
				return -EINVAL;
			memcpy(daddr, optptr+optlen-4, 4);
			/* Fall through */
		default:
49
			memset(optptr, 0, optlen);
L
Linus Torvalds 已提交
50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67
		}
		l -= optlen;
		optptr += optlen;
	}
	return 0;
}

static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
{
	int err;
	struct iphdr *iph, *top_iph;
	struct ip_auth_hdr *ah;
	struct ah_data *ahp;
	union {
		struct iphdr	iph;
		char 		buf[60];
	} tmp_iph;

68
	skb_push(skb, -skb_network_offset(skb));
69
	top_iph = ip_hdr(skb);
L
Linus Torvalds 已提交
70 71 72 73 74 75 76 77 78 79 80 81 82 83
	iph = &tmp_iph.iph;

	iph->tos = top_iph->tos;
	iph->ttl = top_iph->ttl;
	iph->frag_off = top_iph->frag_off;

	if (top_iph->ihl != 5) {
		iph->daddr = top_iph->daddr;
		memcpy(iph+1, top_iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
		err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
		if (err)
			goto error;
	}

84
	ah = ip_auth_hdr(skb);
85 86
	ah->nexthdr = *skb_mac_header(skb);
	*skb_mac_header(skb) = IPPROTO_AH;
L
Linus Torvalds 已提交
87 88 89 90 91 92 93 94

	top_iph->tos = 0;
	top_iph->tot_len = htons(skb->len);
	top_iph->frag_off = 0;
	top_iph->ttl = 0;
	top_iph->check = 0;

	ahp = x->data;
95
	ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
L
Linus Torvalds 已提交
96 97 98

	ah->reserved = 0;
	ah->spi = x->id.spi;
99
	ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
100 101

	spin_lock_bh(&x->lock);
102
	err = ah_mac_digest(ahp, skb, ah->auth_data);
103 104 105
	memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
	spin_unlock_bh(&x->lock);

106 107
	if (err)
		goto error;
L
Linus Torvalds 已提交
108 109 110 111 112 113 114 115 116 117 118 119 120 121 122

	top_iph->tos = iph->tos;
	top_iph->ttl = iph->ttl;
	top_iph->frag_off = iph->frag_off;
	if (top_iph->ihl != 5) {
		top_iph->daddr = iph->daddr;
		memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
	}

	err = 0;

error:
	return err;
}

123
static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
L
Linus Torvalds 已提交
124 125
{
	int ah_hlen;
126
	int ihl;
127
	int nexthdr;
128
	int err = -EINVAL;
L
Linus Torvalds 已提交
129 130 131 132 133
	struct iphdr *iph;
	struct ip_auth_hdr *ah;
	struct ah_data *ahp;
	char work_buf[60];

134
	if (!pskb_may_pull(skb, sizeof(*ah)))
L
Linus Torvalds 已提交
135 136
		goto out;

137
	ah = (struct ip_auth_hdr *)skb->data;
L
Linus Torvalds 已提交
138
	ahp = x->data;
139
	nexthdr = ah->nexthdr;
L
Linus Torvalds 已提交
140
	ah_hlen = (ah->hdrlen + 2) << 2;
141

142 143
	if (ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_full_len) &&
	    ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len))
L
Linus Torvalds 已提交
144 145 146 147 148 149 150 151 152 153 154 155 156
		goto out;

	if (!pskb_may_pull(skb, ah_hlen))
		goto out;

	/* We are going to _remove_ AH header to keep sockets happy,
	 * so... Later this can change. */
	if (skb_cloned(skb) &&
	    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
		goto out;

	skb->ip_summed = CHECKSUM_NONE;

157
	ah = (struct ip_auth_hdr *)skb->data;
158
	iph = ip_hdr(skb);
L
Linus Torvalds 已提交
159

160
	ihl = skb->data - skb_network_header(skb);
161
	memcpy(work_buf, iph, ihl);
L
Linus Torvalds 已提交
162 163 164 165 166

	iph->ttl = 0;
	iph->tos = 0;
	iph->frag_off = 0;
	iph->check = 0;
167
	if (ihl > sizeof(*iph)) {
A
Al Viro 已提交
168
		__be32 dummy;
L
Linus Torvalds 已提交
169 170 171
		if (ip_clear_mutable_options(iph, &dummy))
			goto out;
	}
172 173

	spin_lock(&x->lock);
174
	{
L
Linus Torvalds 已提交
175
		u8 auth_data[MAX_AH_AUTH_LEN];
176

L
Linus Torvalds 已提交
177
		memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
178
		skb_push(skb, ihl);
179 180
		err = ah_mac_digest(ahp, skb, ah->auth_data);
		if (err)
181
			goto unlock;
182
		if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
183
			err = -EBADMSG;
L
Linus Torvalds 已提交
184
	}
185 186 187 188 189 190
unlock:
	spin_unlock(&x->lock);

	if (err)
		goto out;

191
	skb->network_header += ah_hlen;
192
	memcpy(skb_network_header(skb), work_buf, ihl);
193
	skb->transport_header = skb->network_header;
194
	__skb_pull(skb, ah_hlen + ihl);
L
Linus Torvalds 已提交
195

196
	return nexthdr;
L
Linus Torvalds 已提交
197 198

out:
199
	return err;
L
Linus Torvalds 已提交
200 201 202 203
}

static void ah4_err(struct sk_buff *skb, u32 info)
{
204 205
	struct iphdr *iph = (struct iphdr *)skb->data;
	struct ip_auth_hdr *ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
L
Linus Torvalds 已提交
206 207
	struct xfrm_state *x;

208 209
	if (icmp_hdr(skb)->type != ICMP_DEST_UNREACH ||
	    icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
L
Linus Torvalds 已提交
210 211 212 213 214 215 216 217 218 219
		return;

	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
	if (!x)
		return;
	printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
	       ntohl(ah->spi), ntohl(iph->daddr));
	xfrm_state_put(x);
}

H
Herbert Xu 已提交
220
static int ah_init_state(struct xfrm_state *x)
L
Linus Torvalds 已提交
221 222 223
{
	struct ah_data *ahp = NULL;
	struct xfrm_algo_desc *aalg_desc;
224
	struct crypto_hash *tfm;
L
Linus Torvalds 已提交
225 226 227 228 229 230 231

	if (!x->aalg)
		goto error;

	if (x->encap)
		goto error;

232
	ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
L
Linus Torvalds 已提交
233 234 235
	if (ahp == NULL)
		return -ENOMEM;

236 237 238 239 240
	tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
	if (IS_ERR(tfm))
		goto error;

	ahp->tfm = tfm;
241 242
	if (crypto_hash_setkey(tfm, x->aalg->alg_key,
			       (x->aalg->alg_key_len + 7) / 8))
L
Linus Torvalds 已提交
243
		goto error;
244

L
Linus Torvalds 已提交
245 246 247 248
	/*
	 * Lookup the algorithm description maintained by xfrm_algo,
	 * verify crypto transform properties, and store information
	 * we need for AH processing.  This lookup cannot fail here
249
	 * after a successful crypto_alloc_hash().
L
Linus Torvalds 已提交
250 251 252 253 254
	 */
	aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
	BUG_ON(!aalg_desc);

	if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
255
	    crypto_hash_digestsize(tfm)) {
L
Linus Torvalds 已提交
256
		printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
257
		       x->aalg->alg_name, crypto_hash_digestsize(tfm),
L
Linus Torvalds 已提交
258 259 260
		       aalg_desc->uinfo.auth.icv_fullbits/8);
		goto error;
	}
261

L
Linus Torvalds 已提交
262 263
	ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
	ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
264

L
Linus Torvalds 已提交
265
	BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
266

L
Linus Torvalds 已提交
267 268 269
	ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
	if (!ahp->work_icv)
		goto error;
270

271 272
	x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
					  ahp->icv_trunc_len);
273
	if (x->props.mode == XFRM_MODE_TUNNEL)
L
Linus Torvalds 已提交
274 275 276 277 278 279 280
		x->props.header_len += sizeof(struct iphdr);
	x->data = ahp;

	return 0;

error:
	if (ahp) {
281
		kfree(ahp->work_icv);
282
		crypto_free_hash(ahp->tfm);
L
Linus Torvalds 已提交
283 284 285 286 287 288 289 290 291 292 293 294
		kfree(ahp);
	}
	return -EINVAL;
}

static void ah_destroy(struct xfrm_state *x)
{
	struct ah_data *ahp = x->data;

	if (!ahp)
		return;

295 296
	kfree(ahp->work_icv);
	ahp->work_icv = NULL;
297
	crypto_free_hash(ahp->tfm);
298
	ahp->tfm = NULL;
L
Linus Torvalds 已提交
299 300 301 302
	kfree(ahp);
}


303
static const struct xfrm_type ah_type =
L
Linus Torvalds 已提交
304 305 306 307
{
	.description	= "AH4",
	.owner		= THIS_MODULE,
	.proto	     	= IPPROTO_AH,
308
	.flags		= XFRM_TYPE_REPLAY_PROT,
L
Linus Torvalds 已提交
309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345
	.init_state	= ah_init_state,
	.destructor	= ah_destroy,
	.input		= ah_input,
	.output		= ah_output
};

static struct net_protocol ah4_protocol = {
	.handler	=	xfrm4_rcv,
	.err_handler	=	ah4_err,
	.no_policy	=	1,
};

static int __init ah4_init(void)
{
	if (xfrm_register_type(&ah_type, AF_INET) < 0) {
		printk(KERN_INFO "ip ah init: can't add xfrm type\n");
		return -EAGAIN;
	}
	if (inet_add_protocol(&ah4_protocol, IPPROTO_AH) < 0) {
		printk(KERN_INFO "ip ah init: can't add protocol\n");
		xfrm_unregister_type(&ah_type, AF_INET);
		return -EAGAIN;
	}
	return 0;
}

static void __exit ah4_fini(void)
{
	if (inet_del_protocol(&ah4_protocol, IPPROTO_AH) < 0)
		printk(KERN_INFO "ip ah close: can't remove protocol\n");
	if (xfrm_unregister_type(&ah_type, AF_INET) < 0)
		printk(KERN_INFO "ip ah close: can't remove xfrm type\n");
}

module_init(ah4_init);
module_exit(ah4_fini);
MODULE_LICENSE("GPL");
346
MODULE_ALIAS_XFRM_TYPE(AF_INET, XFRM_PROTO_AH);