11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * Copyright (C)2002 USAGI/WIDE Project 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * This program is free software; you can redistribute it and/or modify 51da177e4SLinus Torvalds * it under the terms of the GNU General Public License as published by 61da177e4SLinus Torvalds * the Free Software Foundation; either version 2 of the License, or 71da177e4SLinus Torvalds * (at your option) any later version. 81da177e4SLinus Torvalds * 91da177e4SLinus Torvalds * This program is distributed in the hope that it will be useful, 101da177e4SLinus Torvalds * but WITHOUT ANY WARRANTY; without even the implied warranty of 111da177e4SLinus Torvalds * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 121da177e4SLinus Torvalds * GNU General Public License for more details. 131da177e4SLinus Torvalds * 141da177e4SLinus Torvalds * You should have received a copy of the GNU General Public License 151da177e4SLinus Torvalds * along with this program; if not, write to the Free Software 161da177e4SLinus Torvalds * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 171da177e4SLinus Torvalds * 181da177e4SLinus Torvalds * Authors 191da177e4SLinus Torvalds * 201da177e4SLinus Torvalds * Mitsuru KANDA @USAGI : IPv6 Support 211da177e4SLinus Torvalds * Kazunori MIYAZAWA @USAGI : 221da177e4SLinus Torvalds * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 231da177e4SLinus Torvalds * 241da177e4SLinus Torvalds * This file is derived from net/ipv4/ah.c. 251da177e4SLinus Torvalds */ 261da177e4SLinus Torvalds 271da177e4SLinus Torvalds #include <linux/module.h> 281da177e4SLinus Torvalds #include <net/ip.h> 291da177e4SLinus Torvalds #include <net/ah.h> 301da177e4SLinus Torvalds #include <linux/crypto.h> 311da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 321da177e4SLinus Torvalds #include <linux/string.h> 331da177e4SLinus Torvalds #include <net/icmp.h> 341da177e4SLinus Torvalds #include <net/ipv6.h> 3514c85021SArnaldo Carvalho de Melo #include <net/protocol.h> 361da177e4SLinus Torvalds #include <net/xfrm.h> 371da177e4SLinus Torvalds #include <asm/scatterlist.h> 381da177e4SLinus Torvalds 391da177e4SLinus Torvalds static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr) 401da177e4SLinus Torvalds { 411da177e4SLinus Torvalds u8 *opt = (u8 *)opthdr; 421da177e4SLinus Torvalds int len = ipv6_optlen(opthdr); 431da177e4SLinus Torvalds int off = 0; 441da177e4SLinus Torvalds int optlen = 0; 451da177e4SLinus Torvalds 461da177e4SLinus Torvalds off += 2; 471da177e4SLinus Torvalds len -= 2; 481da177e4SLinus Torvalds 491da177e4SLinus Torvalds while (len > 0) { 501da177e4SLinus Torvalds 511da177e4SLinus Torvalds switch (opt[off]) { 521da177e4SLinus Torvalds 531da177e4SLinus Torvalds case IPV6_TLV_PAD0: 541da177e4SLinus Torvalds optlen = 1; 551da177e4SLinus Torvalds break; 561da177e4SLinus Torvalds default: 571da177e4SLinus Torvalds if (len < 2) 581da177e4SLinus Torvalds goto bad; 591da177e4SLinus Torvalds optlen = opt[off+1]+2; 601da177e4SLinus Torvalds if (len < optlen) 611da177e4SLinus Torvalds goto bad; 621da177e4SLinus Torvalds if (opt[off] & 0x20) 631da177e4SLinus Torvalds memset(&opt[off+2], 0, opt[off+1]); 641da177e4SLinus Torvalds break; 651da177e4SLinus Torvalds } 661da177e4SLinus Torvalds 671da177e4SLinus Torvalds off += optlen; 681da177e4SLinus Torvalds len -= optlen; 691da177e4SLinus Torvalds } 701da177e4SLinus Torvalds if (len == 0) 711da177e4SLinus Torvalds return 1; 721da177e4SLinus Torvalds 731da177e4SLinus Torvalds bad: 741da177e4SLinus Torvalds return 0; 751da177e4SLinus Torvalds } 761da177e4SLinus Torvalds 7727637df9SMasahide NAKAMURA #ifdef CONFIG_IPV6_MIP6 7827637df9SMasahide NAKAMURA /** 7927637df9SMasahide NAKAMURA * ipv6_rearrange_destopt - rearrange IPv6 destination options header 8027637df9SMasahide NAKAMURA * @iph: IPv6 header 8127637df9SMasahide NAKAMURA * @destopt: destionation options header 8227637df9SMasahide NAKAMURA */ 8327637df9SMasahide NAKAMURA static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *destopt) 8427637df9SMasahide NAKAMURA { 8527637df9SMasahide NAKAMURA u8 *opt = (u8 *)destopt; 8627637df9SMasahide NAKAMURA int len = ipv6_optlen(destopt); 8727637df9SMasahide NAKAMURA int off = 0; 8827637df9SMasahide NAKAMURA int optlen = 0; 8927637df9SMasahide NAKAMURA 9027637df9SMasahide NAKAMURA off += 2; 9127637df9SMasahide NAKAMURA len -= 2; 9227637df9SMasahide NAKAMURA 9327637df9SMasahide NAKAMURA while (len > 0) { 9427637df9SMasahide NAKAMURA 9527637df9SMasahide NAKAMURA switch (opt[off]) { 9627637df9SMasahide NAKAMURA 9727637df9SMasahide NAKAMURA case IPV6_TLV_PAD0: 9827637df9SMasahide NAKAMURA optlen = 1; 9927637df9SMasahide NAKAMURA break; 10027637df9SMasahide NAKAMURA default: 10127637df9SMasahide NAKAMURA if (len < 2) 10227637df9SMasahide NAKAMURA goto bad; 10327637df9SMasahide NAKAMURA optlen = opt[off+1]+2; 10427637df9SMasahide NAKAMURA if (len < optlen) 10527637df9SMasahide NAKAMURA goto bad; 10627637df9SMasahide NAKAMURA 10727637df9SMasahide NAKAMURA /* Rearrange the source address in @iph and the 10827637df9SMasahide NAKAMURA * addresses in home address option for final source. 10927637df9SMasahide NAKAMURA * See 11.3.2 of RFC 3775 for details. 11027637df9SMasahide NAKAMURA */ 11127637df9SMasahide NAKAMURA if (opt[off] == IPV6_TLV_HAO) { 11227637df9SMasahide NAKAMURA struct in6_addr final_addr; 11327637df9SMasahide NAKAMURA struct ipv6_destopt_hao *hao; 11427637df9SMasahide NAKAMURA 11527637df9SMasahide NAKAMURA hao = (struct ipv6_destopt_hao *)&opt[off]; 11627637df9SMasahide NAKAMURA if (hao->length != sizeof(hao->addr)) { 11727637df9SMasahide NAKAMURA if (net_ratelimit()) 11827637df9SMasahide NAKAMURA printk(KERN_WARNING "destopt hao: invalid header length: %u\n", hao->length); 11927637df9SMasahide NAKAMURA goto bad; 12027637df9SMasahide NAKAMURA } 12127637df9SMasahide NAKAMURA ipv6_addr_copy(&final_addr, &hao->addr); 12227637df9SMasahide NAKAMURA ipv6_addr_copy(&hao->addr, &iph->saddr); 12327637df9SMasahide NAKAMURA ipv6_addr_copy(&iph->saddr, &final_addr); 12427637df9SMasahide NAKAMURA } 12527637df9SMasahide NAKAMURA break; 12627637df9SMasahide NAKAMURA } 12727637df9SMasahide NAKAMURA 12827637df9SMasahide NAKAMURA off += optlen; 12927637df9SMasahide NAKAMURA len -= optlen; 13027637df9SMasahide NAKAMURA } 131e731c248SYOSHIFUJI Hideaki /* Note: ok if len == 0 */ 13227637df9SMasahide NAKAMURA bad: 13327637df9SMasahide NAKAMURA return; 13427637df9SMasahide NAKAMURA } 13527637df9SMasahide NAKAMURA #endif 13627637df9SMasahide NAKAMURA 1371da177e4SLinus Torvalds /** 1381da177e4SLinus Torvalds * ipv6_rearrange_rthdr - rearrange IPv6 routing header 1391da177e4SLinus Torvalds * @iph: IPv6 header 1401da177e4SLinus Torvalds * @rthdr: routing header 1411da177e4SLinus Torvalds * 1421da177e4SLinus Torvalds * Rearrange the destination address in @iph and the addresses in @rthdr 1431da177e4SLinus Torvalds * so that they appear in the order they will at the final destination. 1441da177e4SLinus Torvalds * See Appendix A2 of RFC 2402 for details. 1451da177e4SLinus Torvalds */ 1461da177e4SLinus Torvalds static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr) 1471da177e4SLinus Torvalds { 1481da177e4SLinus Torvalds int segments, segments_left; 1491da177e4SLinus Torvalds struct in6_addr *addrs; 1501da177e4SLinus Torvalds struct in6_addr final_addr; 1511da177e4SLinus Torvalds 1521da177e4SLinus Torvalds segments_left = rthdr->segments_left; 1531da177e4SLinus Torvalds if (segments_left == 0) 1541da177e4SLinus Torvalds return; 1551da177e4SLinus Torvalds rthdr->segments_left = 0; 1561da177e4SLinus Torvalds 1571da177e4SLinus Torvalds /* The value of rthdr->hdrlen has been verified either by the system 1581da177e4SLinus Torvalds * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming 1591da177e4SLinus Torvalds * packets. So we can assume that it is even and that segments is 1601da177e4SLinus Torvalds * greater than or equal to segments_left. 1611da177e4SLinus Torvalds * 1621da177e4SLinus Torvalds * For the same reason we can assume that this option is of type 0. 1631da177e4SLinus Torvalds */ 1641da177e4SLinus Torvalds segments = rthdr->hdrlen >> 1; 1651da177e4SLinus Torvalds 1661da177e4SLinus Torvalds addrs = ((struct rt0_hdr *)rthdr)->addr; 1671da177e4SLinus Torvalds ipv6_addr_copy(&final_addr, addrs + segments - 1); 1681da177e4SLinus Torvalds 1691da177e4SLinus Torvalds addrs += segments - segments_left; 1701da177e4SLinus Torvalds memmove(addrs + 1, addrs, (segments_left - 1) * sizeof(*addrs)); 1711da177e4SLinus Torvalds 1721da177e4SLinus Torvalds ipv6_addr_copy(addrs, &iph->daddr); 1731da177e4SLinus Torvalds ipv6_addr_copy(&iph->daddr, &final_addr); 1741da177e4SLinus Torvalds } 1751da177e4SLinus Torvalds 17627637df9SMasahide NAKAMURA static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir) 1771da177e4SLinus Torvalds { 1781da177e4SLinus Torvalds union { 1791da177e4SLinus Torvalds struct ipv6hdr *iph; 1801da177e4SLinus Torvalds struct ipv6_opt_hdr *opth; 1811da177e4SLinus Torvalds struct ipv6_rt_hdr *rth; 1821da177e4SLinus Torvalds char *raw; 1831da177e4SLinus Torvalds } exthdr = { .iph = iph }; 1841da177e4SLinus Torvalds char *end = exthdr.raw + len; 1851da177e4SLinus Torvalds int nexthdr = iph->nexthdr; 1861da177e4SLinus Torvalds 1871da177e4SLinus Torvalds exthdr.iph++; 1881da177e4SLinus Torvalds 1891da177e4SLinus Torvalds while (exthdr.raw < end) { 1901da177e4SLinus Torvalds switch (nexthdr) { 19127637df9SMasahide NAKAMURA case NEXTHDR_DEST: 192e731c248SYOSHIFUJI Hideaki #ifdef CONFIG_IPV6_MIP6 19327637df9SMasahide NAKAMURA if (dir == XFRM_POLICY_OUT) 19427637df9SMasahide NAKAMURA ipv6_rearrange_destopt(iph, exthdr.opth); 19527637df9SMasahide NAKAMURA #endif 196e731c248SYOSHIFUJI Hideaki case NEXTHDR_HOP: 197e731c248SYOSHIFUJI Hideaki if (!zero_out_mutable_opts(exthdr.opth)) { 198e731c248SYOSHIFUJI Hideaki LIMIT_NETDEBUG( 199e731c248SYOSHIFUJI Hideaki KERN_WARNING "overrun %sopts\n", 200e731c248SYOSHIFUJI Hideaki nexthdr == NEXTHDR_HOP ? 201e731c248SYOSHIFUJI Hideaki "hop" : "dest"); 202e731c248SYOSHIFUJI Hideaki return -EINVAL; 203e731c248SYOSHIFUJI Hideaki } 204e731c248SYOSHIFUJI Hideaki break; 2051da177e4SLinus Torvalds 2061da177e4SLinus Torvalds case NEXTHDR_ROUTING: 2071da177e4SLinus Torvalds ipv6_rearrange_rthdr(iph, exthdr.rth); 2081da177e4SLinus Torvalds break; 2091da177e4SLinus Torvalds 2101da177e4SLinus Torvalds default : 2111da177e4SLinus Torvalds return 0; 2121da177e4SLinus Torvalds } 2131da177e4SLinus Torvalds 2141da177e4SLinus Torvalds nexthdr = exthdr.opth->nexthdr; 2151da177e4SLinus Torvalds exthdr.raw += ipv6_optlen(exthdr.opth); 2161da177e4SLinus Torvalds } 2171da177e4SLinus Torvalds 2181da177e4SLinus Torvalds return 0; 2191da177e4SLinus Torvalds } 2201da177e4SLinus Torvalds 2211da177e4SLinus Torvalds static int ah6_output(struct xfrm_state *x, struct sk_buff *skb) 2221da177e4SLinus Torvalds { 2231da177e4SLinus Torvalds int err; 2241da177e4SLinus Torvalds int extlen; 2251da177e4SLinus Torvalds struct ipv6hdr *top_iph; 2261da177e4SLinus Torvalds struct ip_auth_hdr *ah; 2271da177e4SLinus Torvalds struct ah_data *ahp; 2281da177e4SLinus Torvalds u8 nexthdr; 2291da177e4SLinus Torvalds char tmp_base[8]; 2301da177e4SLinus Torvalds struct { 23127637df9SMasahide NAKAMURA #ifdef CONFIG_IPV6_MIP6 23227637df9SMasahide NAKAMURA struct in6_addr saddr; 23327637df9SMasahide NAKAMURA #endif 2341da177e4SLinus Torvalds struct in6_addr daddr; 2351da177e4SLinus Torvalds char hdrs[0]; 2361da177e4SLinus Torvalds } *tmp_ext; 2371da177e4SLinus Torvalds 2381da177e4SLinus Torvalds top_iph = (struct ipv6hdr *)skb->data; 2391da177e4SLinus Torvalds top_iph->payload_len = htons(skb->len - sizeof(*top_iph)); 2401da177e4SLinus Torvalds 241d56f90a7SArnaldo Carvalho de Melo nexthdr = *skb_network_header(skb); 242d56f90a7SArnaldo Carvalho de Melo *skb_network_header(skb) = IPPROTO_AH; 2431da177e4SLinus Torvalds 2441da177e4SLinus Torvalds /* When there are no extension headers, we only need to save the first 2451da177e4SLinus Torvalds * 8 bytes of the base IP header. 2461da177e4SLinus Torvalds */ 2471da177e4SLinus Torvalds memcpy(tmp_base, top_iph, sizeof(tmp_base)); 2481da177e4SLinus Torvalds 2491da177e4SLinus Torvalds tmp_ext = NULL; 2501da177e4SLinus Torvalds extlen = skb->h.raw - (unsigned char *)(top_iph + 1); 2511da177e4SLinus Torvalds if (extlen) { 2521da177e4SLinus Torvalds extlen += sizeof(*tmp_ext); 2531da177e4SLinus Torvalds tmp_ext = kmalloc(extlen, GFP_ATOMIC); 2541da177e4SLinus Torvalds if (!tmp_ext) { 2551da177e4SLinus Torvalds err = -ENOMEM; 2561da177e4SLinus Torvalds goto error; 2571da177e4SLinus Torvalds } 25827637df9SMasahide NAKAMURA #ifdef CONFIG_IPV6_MIP6 25927637df9SMasahide NAKAMURA memcpy(tmp_ext, &top_iph->saddr, extlen); 260e731c248SYOSHIFUJI Hideaki #else 261e731c248SYOSHIFUJI Hideaki memcpy(tmp_ext, &top_iph->daddr, extlen); 262e731c248SYOSHIFUJI Hideaki #endif 26327637df9SMasahide NAKAMURA err = ipv6_clear_mutable_options(top_iph, 26427637df9SMasahide NAKAMURA extlen - sizeof(*tmp_ext) + 26527637df9SMasahide NAKAMURA sizeof(*top_iph), 26627637df9SMasahide NAKAMURA XFRM_POLICY_OUT); 2671da177e4SLinus Torvalds if (err) 2681da177e4SLinus Torvalds goto error_free_iph; 2691da177e4SLinus Torvalds } 2701da177e4SLinus Torvalds 2711da177e4SLinus Torvalds ah = (struct ip_auth_hdr *)skb->h.raw; 2721da177e4SLinus Torvalds ah->nexthdr = nexthdr; 2731da177e4SLinus Torvalds 2741da177e4SLinus Torvalds top_iph->priority = 0; 2751da177e4SLinus Torvalds top_iph->flow_lbl[0] = 0; 2761da177e4SLinus Torvalds top_iph->flow_lbl[1] = 0; 2771da177e4SLinus Torvalds top_iph->flow_lbl[2] = 0; 2781da177e4SLinus Torvalds top_iph->hop_limit = 0; 2791da177e4SLinus Torvalds 2801da177e4SLinus Torvalds ahp = x->data; 2811da177e4SLinus Torvalds ah->hdrlen = (XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + 2821da177e4SLinus Torvalds ahp->icv_trunc_len) >> 2) - 2; 2831da177e4SLinus Torvalds 2841da177e4SLinus Torvalds ah->reserved = 0; 2851da177e4SLinus Torvalds ah->spi = x->id.spi; 2861da177e4SLinus Torvalds ah->seq_no = htonl(++x->replay.oseq); 2879500e8a8SJamal Hadi Salim xfrm_aevent_doreplay(x); 28807d4ee58SHerbert Xu err = ah_mac_digest(ahp, skb, ah->auth_data); 28907d4ee58SHerbert Xu if (err) 29007d4ee58SHerbert Xu goto error_free_iph; 29107d4ee58SHerbert Xu memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len); 2921da177e4SLinus Torvalds 2931da177e4SLinus Torvalds err = 0; 2941da177e4SLinus Torvalds 2951da177e4SLinus Torvalds memcpy(top_iph, tmp_base, sizeof(tmp_base)); 2961da177e4SLinus Torvalds if (tmp_ext) { 29727637df9SMasahide NAKAMURA #ifdef CONFIG_IPV6_MIP6 29827637df9SMasahide NAKAMURA memcpy(&top_iph->saddr, tmp_ext, extlen); 29927637df9SMasahide NAKAMURA #else 3001da177e4SLinus Torvalds memcpy(&top_iph->daddr, tmp_ext, extlen); 30127637df9SMasahide NAKAMURA #endif 3021da177e4SLinus Torvalds error_free_iph: 3031da177e4SLinus Torvalds kfree(tmp_ext); 3041da177e4SLinus Torvalds } 3051da177e4SLinus Torvalds 3061da177e4SLinus Torvalds error: 3071da177e4SLinus Torvalds return err; 3081da177e4SLinus Torvalds } 3091da177e4SLinus Torvalds 310e695633eSHerbert Xu static int ah6_input(struct xfrm_state *x, struct sk_buff *skb) 3111da177e4SLinus Torvalds { 3121da177e4SLinus Torvalds /* 3131da177e4SLinus Torvalds * Before process AH 3141da177e4SLinus Torvalds * [IPv6][Ext1][Ext2][AH][Dest][Payload] 3151da177e4SLinus Torvalds * |<-------------->| hdr_len 3161da177e4SLinus Torvalds * 3171da177e4SLinus Torvalds * To erase AH: 3181da177e4SLinus Torvalds * Keeping copy of cleared headers. After AH processing, 3191da177e4SLinus Torvalds * Moving the pointer of skb->nh.raw by using skb_pull as long as AH 3201da177e4SLinus Torvalds * header length. Then copy back the copy as long as hdr_len 3211da177e4SLinus Torvalds * If destination header following AH exists, copy it into after [Ext2]. 3221da177e4SLinus Torvalds * 3231da177e4SLinus Torvalds * |<>|[IPv6][Ext1][Ext2][Dest][Payload] 3241da177e4SLinus Torvalds * There is offset of AH before IPv6 header after the process. 3251da177e4SLinus Torvalds */ 3261da177e4SLinus Torvalds 3271da177e4SLinus Torvalds struct ipv6_auth_hdr *ah; 3281da177e4SLinus Torvalds struct ah_data *ahp; 3291da177e4SLinus Torvalds unsigned char *tmp_hdr = NULL; 3301da177e4SLinus Torvalds u16 hdr_len; 3311da177e4SLinus Torvalds u16 ah_hlen; 3321da177e4SLinus Torvalds int nexthdr; 33307d4ee58SHerbert Xu int err = -EINVAL; 3341da177e4SLinus Torvalds 3351da177e4SLinus Torvalds if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr))) 3361da177e4SLinus Torvalds goto out; 3371da177e4SLinus Torvalds 3381da177e4SLinus Torvalds /* We are going to _remove_ AH header to keep sockets happy, 3391da177e4SLinus Torvalds * so... Later this can change. */ 3401da177e4SLinus Torvalds if (skb_cloned(skb) && 3411da177e4SLinus Torvalds pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) 3421da177e4SLinus Torvalds goto out; 3431da177e4SLinus Torvalds 344d56f90a7SArnaldo Carvalho de Melo hdr_len = skb->data - skb_network_header(skb); 3451da177e4SLinus Torvalds ah = (struct ipv6_auth_hdr*)skb->data; 3461da177e4SLinus Torvalds ahp = x->data; 3471da177e4SLinus Torvalds nexthdr = ah->nexthdr; 3481da177e4SLinus Torvalds ah_hlen = (ah->hdrlen + 2) << 2; 3491da177e4SLinus Torvalds 3501da177e4SLinus Torvalds if (ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_full_len) && 3511da177e4SLinus Torvalds ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len)) 3521da177e4SLinus Torvalds goto out; 3531da177e4SLinus Torvalds 3541da177e4SLinus Torvalds if (!pskb_may_pull(skb, ah_hlen)) 3551da177e4SLinus Torvalds goto out; 3561da177e4SLinus Torvalds 357d56f90a7SArnaldo Carvalho de Melo tmp_hdr = kmemdup(skb_network_header(skb), hdr_len, GFP_ATOMIC); 3581da177e4SLinus Torvalds if (!tmp_hdr) 3591da177e4SLinus Torvalds goto out; 36027637df9SMasahide NAKAMURA if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len, XFRM_POLICY_IN)) 36127637df9SMasahide NAKAMURA goto free_out; 3621da177e4SLinus Torvalds skb->nh.ipv6h->priority = 0; 3631da177e4SLinus Torvalds skb->nh.ipv6h->flow_lbl[0] = 0; 3641da177e4SLinus Torvalds skb->nh.ipv6h->flow_lbl[1] = 0; 3651da177e4SLinus Torvalds skb->nh.ipv6h->flow_lbl[2] = 0; 3661da177e4SLinus Torvalds skb->nh.ipv6h->hop_limit = 0; 3671da177e4SLinus Torvalds 3681da177e4SLinus Torvalds { 3691da177e4SLinus Torvalds u8 auth_data[MAX_AH_AUTH_LEN]; 3701da177e4SLinus Torvalds 3711da177e4SLinus Torvalds memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len); 3721da177e4SLinus Torvalds memset(ah->auth_data, 0, ahp->icv_trunc_len); 37331a4ab93SHerbert Xu skb_push(skb, hdr_len); 37407d4ee58SHerbert Xu err = ah_mac_digest(ahp, skb, ah->auth_data); 37507d4ee58SHerbert Xu if (err) 37607d4ee58SHerbert Xu goto free_out; 37707d4ee58SHerbert Xu err = -EINVAL; 37807d4ee58SHerbert Xu if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len)) { 37964ce2073SPatrick McHardy LIMIT_NETDEBUG(KERN_WARNING "ipsec ah authentication error\n"); 3801da177e4SLinus Torvalds x->stats.integrity_failed++; 3811da177e4SLinus Torvalds goto free_out; 3821da177e4SLinus Torvalds } 3831da177e4SLinus Torvalds } 3841da177e4SLinus Torvalds 385d56f90a7SArnaldo Carvalho de Melo skb->nh.raw += ah_hlen; 386d56f90a7SArnaldo Carvalho de Melo memcpy(skb_network_header(skb), tmp_hdr, hdr_len); 387d56f90a7SArnaldo Carvalho de Melo skb->h.raw = skb->nh.raw; 38831a4ab93SHerbert Xu __skb_pull(skb, ah_hlen + hdr_len); 3891da177e4SLinus Torvalds 3901da177e4SLinus Torvalds kfree(tmp_hdr); 3911da177e4SLinus Torvalds 3921da177e4SLinus Torvalds return nexthdr; 3931da177e4SLinus Torvalds 3941da177e4SLinus Torvalds free_out: 3951da177e4SLinus Torvalds kfree(tmp_hdr); 3961da177e4SLinus Torvalds out: 39707d4ee58SHerbert Xu return err; 3981da177e4SLinus Torvalds } 3991da177e4SLinus Torvalds 4001da177e4SLinus Torvalds static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, 40104ce6909SAl Viro int type, int code, int offset, __be32 info) 4021da177e4SLinus Torvalds { 4031da177e4SLinus Torvalds struct ipv6hdr *iph = (struct ipv6hdr*)skb->data; 4041da177e4SLinus Torvalds struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset); 4051da177e4SLinus Torvalds struct xfrm_state *x; 4061da177e4SLinus Torvalds 4071da177e4SLinus Torvalds if (type != ICMPV6_DEST_UNREACH && 4081da177e4SLinus Torvalds type != ICMPV6_PKT_TOOBIG) 4091da177e4SLinus Torvalds return; 4101da177e4SLinus Torvalds 4111da177e4SLinus Torvalds x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6); 4121da177e4SLinus Torvalds if (!x) 4131da177e4SLinus Torvalds return; 4141da177e4SLinus Torvalds 41546b86a2dSJoe Perches NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/" NIP6_FMT "\n", 41664ce2073SPatrick McHardy ntohl(ah->spi), NIP6(iph->daddr)); 4171da177e4SLinus Torvalds 4181da177e4SLinus Torvalds xfrm_state_put(x); 4191da177e4SLinus Torvalds } 4201da177e4SLinus Torvalds 42172cb6962SHerbert Xu static int ah6_init_state(struct xfrm_state *x) 4221da177e4SLinus Torvalds { 4231da177e4SLinus Torvalds struct ah_data *ahp = NULL; 4241da177e4SLinus Torvalds struct xfrm_algo_desc *aalg_desc; 42507d4ee58SHerbert Xu struct crypto_hash *tfm; 4261da177e4SLinus Torvalds 4271da177e4SLinus Torvalds if (!x->aalg) 4281da177e4SLinus Torvalds goto error; 4291da177e4SLinus Torvalds 4301da177e4SLinus Torvalds /* null auth can use a zero length key */ 4311da177e4SLinus Torvalds if (x->aalg->alg_key_len > 512) 4321da177e4SLinus Torvalds goto error; 4331da177e4SLinus Torvalds 4341da177e4SLinus Torvalds if (x->encap) 4351da177e4SLinus Torvalds goto error; 4361da177e4SLinus Torvalds 4370c600edaSIngo Oeser ahp = kzalloc(sizeof(*ahp), GFP_KERNEL); 4381da177e4SLinus Torvalds if (ahp == NULL) 4391da177e4SLinus Torvalds return -ENOMEM; 4401da177e4SLinus Torvalds 4411da177e4SLinus Torvalds ahp->key = x->aalg->alg_key; 4421da177e4SLinus Torvalds ahp->key_len = (x->aalg->alg_key_len+7)/8; 44307d4ee58SHerbert Xu tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC); 44407d4ee58SHerbert Xu if (IS_ERR(tfm)) 4451da177e4SLinus Torvalds goto error; 44607d4ee58SHerbert Xu 44707d4ee58SHerbert Xu ahp->tfm = tfm; 44807d4ee58SHerbert Xu if (crypto_hash_setkey(tfm, ahp->key, ahp->key_len)) 44907d4ee58SHerbert Xu goto error; 4501da177e4SLinus Torvalds 4511da177e4SLinus Torvalds /* 4521da177e4SLinus Torvalds * Lookup the algorithm description maintained by xfrm_algo, 4531da177e4SLinus Torvalds * verify crypto transform properties, and store information 4541da177e4SLinus Torvalds * we need for AH processing. This lookup cannot fail here 45507d4ee58SHerbert Xu * after a successful crypto_alloc_hash(). 4561da177e4SLinus Torvalds */ 4571da177e4SLinus Torvalds aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0); 4581da177e4SLinus Torvalds BUG_ON(!aalg_desc); 4591da177e4SLinus Torvalds 4601da177e4SLinus Torvalds if (aalg_desc->uinfo.auth.icv_fullbits/8 != 46107d4ee58SHerbert Xu crypto_hash_digestsize(tfm)) { 4621da177e4SLinus Torvalds printk(KERN_INFO "AH: %s digestsize %u != %hu\n", 46307d4ee58SHerbert Xu x->aalg->alg_name, crypto_hash_digestsize(tfm), 4641da177e4SLinus Torvalds aalg_desc->uinfo.auth.icv_fullbits/8); 4651da177e4SLinus Torvalds goto error; 4661da177e4SLinus Torvalds } 4671da177e4SLinus Torvalds 4681da177e4SLinus Torvalds ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8; 4691da177e4SLinus Torvalds ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8; 4701da177e4SLinus Torvalds 4711da177e4SLinus Torvalds BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN); 4721da177e4SLinus Torvalds 4731da177e4SLinus Torvalds ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL); 4741da177e4SLinus Torvalds if (!ahp->work_icv) 4751da177e4SLinus Torvalds goto error; 4761da177e4SLinus Torvalds 4771da177e4SLinus Torvalds x->props.header_len = XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len); 4787e49e6deSMasahide NAKAMURA if (x->props.mode == XFRM_MODE_TUNNEL) 4791da177e4SLinus Torvalds x->props.header_len += sizeof(struct ipv6hdr); 4801da177e4SLinus Torvalds x->data = ahp; 4811da177e4SLinus Torvalds 4821da177e4SLinus Torvalds return 0; 4831da177e4SLinus Torvalds 4841da177e4SLinus Torvalds error: 4851da177e4SLinus Torvalds if (ahp) { 4861da177e4SLinus Torvalds kfree(ahp->work_icv); 48707d4ee58SHerbert Xu crypto_free_hash(ahp->tfm); 4881da177e4SLinus Torvalds kfree(ahp); 4891da177e4SLinus Torvalds } 4901da177e4SLinus Torvalds return -EINVAL; 4911da177e4SLinus Torvalds } 4921da177e4SLinus Torvalds 4931da177e4SLinus Torvalds static void ah6_destroy(struct xfrm_state *x) 4941da177e4SLinus Torvalds { 4951da177e4SLinus Torvalds struct ah_data *ahp = x->data; 4961da177e4SLinus Torvalds 4971da177e4SLinus Torvalds if (!ahp) 4981da177e4SLinus Torvalds return; 4991da177e4SLinus Torvalds 5001da177e4SLinus Torvalds kfree(ahp->work_icv); 5011da177e4SLinus Torvalds ahp->work_icv = NULL; 50207d4ee58SHerbert Xu crypto_free_hash(ahp->tfm); 5031da177e4SLinus Torvalds ahp->tfm = NULL; 5041da177e4SLinus Torvalds kfree(ahp); 5051da177e4SLinus Torvalds } 5061da177e4SLinus Torvalds 5071da177e4SLinus Torvalds static struct xfrm_type ah6_type = 5081da177e4SLinus Torvalds { 5091da177e4SLinus Torvalds .description = "AH6", 5101da177e4SLinus Torvalds .owner = THIS_MODULE, 5111da177e4SLinus Torvalds .proto = IPPROTO_AH, 5121da177e4SLinus Torvalds .init_state = ah6_init_state, 5131da177e4SLinus Torvalds .destructor = ah6_destroy, 5141da177e4SLinus Torvalds .input = ah6_input, 515aee5adb4SMasahide NAKAMURA .output = ah6_output, 516aee5adb4SMasahide NAKAMURA .hdr_offset = xfrm6_find_1stfragopt, 5171da177e4SLinus Torvalds }; 5181da177e4SLinus Torvalds 5191da177e4SLinus Torvalds static struct inet6_protocol ah6_protocol = { 5201da177e4SLinus Torvalds .handler = xfrm6_rcv, 5211da177e4SLinus Torvalds .err_handler = ah6_err, 5221da177e4SLinus Torvalds .flags = INET6_PROTO_NOPOLICY, 5231da177e4SLinus Torvalds }; 5241da177e4SLinus Torvalds 5251da177e4SLinus Torvalds static int __init ah6_init(void) 5261da177e4SLinus Torvalds { 5271da177e4SLinus Torvalds if (xfrm_register_type(&ah6_type, AF_INET6) < 0) { 5281da177e4SLinus Torvalds printk(KERN_INFO "ipv6 ah init: can't add xfrm type\n"); 5291da177e4SLinus Torvalds return -EAGAIN; 5301da177e4SLinus Torvalds } 5311da177e4SLinus Torvalds 5321da177e4SLinus Torvalds if (inet6_add_protocol(&ah6_protocol, IPPROTO_AH) < 0) { 5331da177e4SLinus Torvalds printk(KERN_INFO "ipv6 ah init: can't add protocol\n"); 5341da177e4SLinus Torvalds xfrm_unregister_type(&ah6_type, AF_INET6); 5351da177e4SLinus Torvalds return -EAGAIN; 5361da177e4SLinus Torvalds } 5371da177e4SLinus Torvalds 5381da177e4SLinus Torvalds return 0; 5391da177e4SLinus Torvalds } 5401da177e4SLinus Torvalds 5411da177e4SLinus Torvalds static void __exit ah6_fini(void) 5421da177e4SLinus Torvalds { 5431da177e4SLinus Torvalds if (inet6_del_protocol(&ah6_protocol, IPPROTO_AH) < 0) 5441da177e4SLinus Torvalds printk(KERN_INFO "ipv6 ah close: can't remove protocol\n"); 5451da177e4SLinus Torvalds 5461da177e4SLinus Torvalds if (xfrm_unregister_type(&ah6_type, AF_INET6) < 0) 5471da177e4SLinus Torvalds printk(KERN_INFO "ipv6 ah close: can't remove xfrm type\n"); 5481da177e4SLinus Torvalds 5491da177e4SLinus Torvalds } 5501da177e4SLinus Torvalds 5511da177e4SLinus Torvalds module_init(ah6_init); 5521da177e4SLinus Torvalds module_exit(ah6_fini); 5531da177e4SLinus Torvalds 5541da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 555