11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * Copyright (C)2002 USAGI/WIDE Project 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * This program is free software; you can redistribute it and/or modify 51da177e4SLinus Torvalds * it under the terms of the GNU General Public License as published by 61da177e4SLinus Torvalds * the Free Software Foundation; either version 2 of the License, or 71da177e4SLinus Torvalds * (at your option) any later version. 81da177e4SLinus Torvalds * 91da177e4SLinus Torvalds * This program is distributed in the hope that it will be useful, 101da177e4SLinus Torvalds * but WITHOUT ANY WARRANTY; without even the implied warranty of 111da177e4SLinus Torvalds * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 121da177e4SLinus Torvalds * GNU General Public License for more details. 131da177e4SLinus Torvalds * 141da177e4SLinus Torvalds * You should have received a copy of the GNU General Public License 151da177e4SLinus Torvalds * along with this program; if not, write to the Free Software 161da177e4SLinus Torvalds * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 171da177e4SLinus Torvalds * 181da177e4SLinus Torvalds * Authors 191da177e4SLinus Torvalds * 201da177e4SLinus Torvalds * Mitsuru KANDA @USAGI : IPv6 Support 211da177e4SLinus Torvalds * Kazunori MIYAZAWA @USAGI : 221da177e4SLinus Torvalds * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 231da177e4SLinus Torvalds * 241da177e4SLinus Torvalds * This file is derived from net/ipv4/ah.c. 251da177e4SLinus Torvalds */ 261da177e4SLinus Torvalds 271da177e4SLinus Torvalds #include <linux/module.h> 281da177e4SLinus Torvalds #include <net/ip.h> 291da177e4SLinus Torvalds #include <net/ah.h> 301da177e4SLinus Torvalds #include <linux/crypto.h> 311da177e4SLinus Torvalds #include <linux/pfkeyv2.h> 32b7c6538cSHerbert Xu #include <linux/spinlock.h> 331da177e4SLinus Torvalds #include <linux/string.h> 341da177e4SLinus Torvalds #include <net/icmp.h> 351da177e4SLinus Torvalds #include <net/ipv6.h> 3614c85021SArnaldo Carvalho de Melo #include <net/protocol.h> 371da177e4SLinus Torvalds #include <net/xfrm.h> 381da177e4SLinus Torvalds #include <asm/scatterlist.h> 391da177e4SLinus Torvalds 401da177e4SLinus Torvalds static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr) 411da177e4SLinus Torvalds { 421da177e4SLinus Torvalds u8 *opt = (u8 *)opthdr; 431da177e4SLinus Torvalds int len = ipv6_optlen(opthdr); 441da177e4SLinus Torvalds int off = 0; 451da177e4SLinus Torvalds int optlen = 0; 461da177e4SLinus Torvalds 471da177e4SLinus Torvalds off += 2; 481da177e4SLinus Torvalds len -= 2; 491da177e4SLinus Torvalds 501da177e4SLinus Torvalds while (len > 0) { 511da177e4SLinus Torvalds 521da177e4SLinus Torvalds switch (opt[off]) { 531da177e4SLinus Torvalds 541da177e4SLinus Torvalds case IPV6_TLV_PAD0: 551da177e4SLinus Torvalds optlen = 1; 561da177e4SLinus Torvalds break; 571da177e4SLinus Torvalds default: 581da177e4SLinus Torvalds if (len < 2) 591da177e4SLinus Torvalds goto bad; 601da177e4SLinus Torvalds optlen = opt[off+1]+2; 611da177e4SLinus Torvalds if (len < optlen) 621da177e4SLinus Torvalds goto bad; 631da177e4SLinus Torvalds if (opt[off] & 0x20) 641da177e4SLinus Torvalds memset(&opt[off+2], 0, opt[off+1]); 651da177e4SLinus Torvalds break; 661da177e4SLinus Torvalds } 671da177e4SLinus Torvalds 681da177e4SLinus Torvalds off += optlen; 691da177e4SLinus Torvalds len -= optlen; 701da177e4SLinus Torvalds } 711da177e4SLinus Torvalds if (len == 0) 721da177e4SLinus Torvalds return 1; 731da177e4SLinus Torvalds 741da177e4SLinus Torvalds bad: 751da177e4SLinus Torvalds return 0; 761da177e4SLinus Torvalds } 771da177e4SLinus Torvalds 7859fbb3a6SMasahide NAKAMURA #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 7927637df9SMasahide NAKAMURA /** 8027637df9SMasahide NAKAMURA * ipv6_rearrange_destopt - rearrange IPv6 destination options header 8127637df9SMasahide NAKAMURA * @iph: IPv6 header 8227637df9SMasahide NAKAMURA * @destopt: destionation options header 8327637df9SMasahide NAKAMURA */ 8427637df9SMasahide NAKAMURA static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *destopt) 8527637df9SMasahide NAKAMURA { 8627637df9SMasahide NAKAMURA u8 *opt = (u8 *)destopt; 8727637df9SMasahide NAKAMURA int len = ipv6_optlen(destopt); 8827637df9SMasahide NAKAMURA int off = 0; 8927637df9SMasahide NAKAMURA int optlen = 0; 9027637df9SMasahide NAKAMURA 9127637df9SMasahide NAKAMURA off += 2; 9227637df9SMasahide NAKAMURA len -= 2; 9327637df9SMasahide NAKAMURA 9427637df9SMasahide NAKAMURA while (len > 0) { 9527637df9SMasahide NAKAMURA 9627637df9SMasahide NAKAMURA switch (opt[off]) { 9727637df9SMasahide NAKAMURA 9827637df9SMasahide NAKAMURA case IPV6_TLV_PAD0: 9927637df9SMasahide NAKAMURA optlen = 1; 10027637df9SMasahide NAKAMURA break; 10127637df9SMasahide NAKAMURA default: 10227637df9SMasahide NAKAMURA if (len < 2) 10327637df9SMasahide NAKAMURA goto bad; 10427637df9SMasahide NAKAMURA optlen = opt[off+1]+2; 10527637df9SMasahide NAKAMURA if (len < optlen) 10627637df9SMasahide NAKAMURA goto bad; 10727637df9SMasahide NAKAMURA 10827637df9SMasahide NAKAMURA /* Rearrange the source address in @iph and the 10927637df9SMasahide NAKAMURA * addresses in home address option for final source. 11027637df9SMasahide NAKAMURA * See 11.3.2 of RFC 3775 for details. 11127637df9SMasahide NAKAMURA */ 11227637df9SMasahide NAKAMURA if (opt[off] == IPV6_TLV_HAO) { 11327637df9SMasahide NAKAMURA struct in6_addr final_addr; 11427637df9SMasahide NAKAMURA struct ipv6_destopt_hao *hao; 11527637df9SMasahide NAKAMURA 11627637df9SMasahide NAKAMURA hao = (struct ipv6_destopt_hao *)&opt[off]; 11727637df9SMasahide NAKAMURA if (hao->length != sizeof(hao->addr)) { 11827637df9SMasahide NAKAMURA if (net_ratelimit()) 11927637df9SMasahide NAKAMURA printk(KERN_WARNING "destopt hao: invalid header length: %u\n", hao->length); 12027637df9SMasahide NAKAMURA goto bad; 12127637df9SMasahide NAKAMURA } 12227637df9SMasahide NAKAMURA ipv6_addr_copy(&final_addr, &hao->addr); 12327637df9SMasahide NAKAMURA ipv6_addr_copy(&hao->addr, &iph->saddr); 12427637df9SMasahide NAKAMURA ipv6_addr_copy(&iph->saddr, &final_addr); 12527637df9SMasahide NAKAMURA } 12627637df9SMasahide NAKAMURA break; 12727637df9SMasahide NAKAMURA } 12827637df9SMasahide NAKAMURA 12927637df9SMasahide NAKAMURA off += optlen; 13027637df9SMasahide NAKAMURA len -= optlen; 13127637df9SMasahide NAKAMURA } 132e731c248SYOSHIFUJI Hideaki /* Note: ok if len == 0 */ 13327637df9SMasahide NAKAMURA bad: 13427637df9SMasahide NAKAMURA return; 13527637df9SMasahide NAKAMURA } 136136ebf08SMasahide NAKAMURA #else 137136ebf08SMasahide NAKAMURA static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *destopt) {} 13827637df9SMasahide NAKAMURA #endif 13927637df9SMasahide NAKAMURA 1401da177e4SLinus Torvalds /** 1411da177e4SLinus Torvalds * ipv6_rearrange_rthdr - rearrange IPv6 routing header 1421da177e4SLinus Torvalds * @iph: IPv6 header 1431da177e4SLinus Torvalds * @rthdr: routing header 1441da177e4SLinus Torvalds * 1451da177e4SLinus Torvalds * Rearrange the destination address in @iph and the addresses in @rthdr 1461da177e4SLinus Torvalds * so that they appear in the order they will at the final destination. 1471da177e4SLinus Torvalds * See Appendix A2 of RFC 2402 for details. 1481da177e4SLinus Torvalds */ 1491da177e4SLinus Torvalds static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr) 1501da177e4SLinus Torvalds { 1511da177e4SLinus Torvalds int segments, segments_left; 1521da177e4SLinus Torvalds struct in6_addr *addrs; 1531da177e4SLinus Torvalds struct in6_addr final_addr; 1541da177e4SLinus Torvalds 1551da177e4SLinus Torvalds segments_left = rthdr->segments_left; 1561da177e4SLinus Torvalds if (segments_left == 0) 1571da177e4SLinus Torvalds return; 1581da177e4SLinus Torvalds rthdr->segments_left = 0; 1591da177e4SLinus Torvalds 1601da177e4SLinus Torvalds /* The value of rthdr->hdrlen has been verified either by the system 1611da177e4SLinus Torvalds * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming 1621da177e4SLinus Torvalds * packets. So we can assume that it is even and that segments is 1631da177e4SLinus Torvalds * greater than or equal to segments_left. 1641da177e4SLinus Torvalds * 1651da177e4SLinus Torvalds * For the same reason we can assume that this option is of type 0. 1661da177e4SLinus Torvalds */ 1671da177e4SLinus Torvalds segments = rthdr->hdrlen >> 1; 1681da177e4SLinus Torvalds 1691da177e4SLinus Torvalds addrs = ((struct rt0_hdr *)rthdr)->addr; 1701da177e4SLinus Torvalds ipv6_addr_copy(&final_addr, addrs + segments - 1); 1711da177e4SLinus Torvalds 1721da177e4SLinus Torvalds addrs += segments - segments_left; 1731da177e4SLinus Torvalds memmove(addrs + 1, addrs, (segments_left - 1) * sizeof(*addrs)); 1741da177e4SLinus Torvalds 1751da177e4SLinus Torvalds ipv6_addr_copy(addrs, &iph->daddr); 1761da177e4SLinus Torvalds ipv6_addr_copy(&iph->daddr, &final_addr); 1771da177e4SLinus Torvalds } 1781da177e4SLinus Torvalds 17927637df9SMasahide NAKAMURA static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir) 1801da177e4SLinus Torvalds { 1811da177e4SLinus Torvalds union { 1821da177e4SLinus Torvalds struct ipv6hdr *iph; 1831da177e4SLinus Torvalds struct ipv6_opt_hdr *opth; 1841da177e4SLinus Torvalds struct ipv6_rt_hdr *rth; 1851da177e4SLinus Torvalds char *raw; 1861da177e4SLinus Torvalds } exthdr = { .iph = iph }; 1871da177e4SLinus Torvalds char *end = exthdr.raw + len; 1881da177e4SLinus Torvalds int nexthdr = iph->nexthdr; 1891da177e4SLinus Torvalds 1901da177e4SLinus Torvalds exthdr.iph++; 1911da177e4SLinus Torvalds 1921da177e4SLinus Torvalds while (exthdr.raw < end) { 1931da177e4SLinus Torvalds switch (nexthdr) { 19427637df9SMasahide NAKAMURA case NEXTHDR_DEST: 19527637df9SMasahide NAKAMURA if (dir == XFRM_POLICY_OUT) 19627637df9SMasahide NAKAMURA ipv6_rearrange_destopt(iph, exthdr.opth); 197e731c248SYOSHIFUJI Hideaki case NEXTHDR_HOP: 198e731c248SYOSHIFUJI Hideaki if (!zero_out_mutable_opts(exthdr.opth)) { 199e731c248SYOSHIFUJI Hideaki LIMIT_NETDEBUG( 200e731c248SYOSHIFUJI Hideaki KERN_WARNING "overrun %sopts\n", 201e731c248SYOSHIFUJI Hideaki nexthdr == NEXTHDR_HOP ? 202e731c248SYOSHIFUJI Hideaki "hop" : "dest"); 203e731c248SYOSHIFUJI Hideaki return -EINVAL; 204e731c248SYOSHIFUJI Hideaki } 205e731c248SYOSHIFUJI Hideaki break; 2061da177e4SLinus Torvalds 2071da177e4SLinus Torvalds case NEXTHDR_ROUTING: 2081da177e4SLinus Torvalds ipv6_rearrange_rthdr(iph, exthdr.rth); 2091da177e4SLinus Torvalds break; 2101da177e4SLinus Torvalds 2111da177e4SLinus Torvalds default : 2121da177e4SLinus Torvalds return 0; 2131da177e4SLinus Torvalds } 2141da177e4SLinus Torvalds 2151da177e4SLinus Torvalds nexthdr = exthdr.opth->nexthdr; 2161da177e4SLinus Torvalds exthdr.raw += ipv6_optlen(exthdr.opth); 2171da177e4SLinus Torvalds } 2181da177e4SLinus Torvalds 2191da177e4SLinus Torvalds return 0; 2201da177e4SLinus Torvalds } 2211da177e4SLinus Torvalds 2221da177e4SLinus Torvalds static int ah6_output(struct xfrm_state *x, struct sk_buff *skb) 2231da177e4SLinus Torvalds { 2241da177e4SLinus Torvalds int err; 2251da177e4SLinus Torvalds int extlen; 2261da177e4SLinus Torvalds struct ipv6hdr *top_iph; 2271da177e4SLinus Torvalds struct ip_auth_hdr *ah; 2281da177e4SLinus Torvalds struct ah_data *ahp; 2291da177e4SLinus Torvalds u8 nexthdr; 2301da177e4SLinus Torvalds char tmp_base[8]; 2311da177e4SLinus Torvalds struct { 23259fbb3a6SMasahide NAKAMURA #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 23327637df9SMasahide NAKAMURA struct in6_addr saddr; 23427637df9SMasahide NAKAMURA #endif 2351da177e4SLinus Torvalds struct in6_addr daddr; 2361da177e4SLinus Torvalds char hdrs[0]; 2371da177e4SLinus Torvalds } *tmp_ext; 2381da177e4SLinus Torvalds 2397b277b1aSHerbert Xu skb_push(skb, -skb_network_offset(skb)); 240007f0211SHerbert Xu top_iph = ipv6_hdr(skb); 2411da177e4SLinus Torvalds top_iph->payload_len = htons(skb->len - sizeof(*top_iph)); 2421da177e4SLinus Torvalds 243007f0211SHerbert Xu nexthdr = *skb_mac_header(skb); 244007f0211SHerbert Xu *skb_mac_header(skb) = IPPROTO_AH; 2451da177e4SLinus Torvalds 2461da177e4SLinus Torvalds /* When there are no extension headers, we only need to save the first 2471da177e4SLinus Torvalds * 8 bytes of the base IP header. 2481da177e4SLinus Torvalds */ 2491da177e4SLinus Torvalds memcpy(tmp_base, top_iph, sizeof(tmp_base)); 2501da177e4SLinus Torvalds 2511da177e4SLinus Torvalds tmp_ext = NULL; 252144466bdSKazunori MIYAZAWA extlen = skb_transport_offset(skb) - sizeof(struct ipv6hdr); 2531da177e4SLinus Torvalds if (extlen) { 2541da177e4SLinus Torvalds extlen += sizeof(*tmp_ext); 2551da177e4SLinus Torvalds tmp_ext = kmalloc(extlen, GFP_ATOMIC); 2561da177e4SLinus Torvalds if (!tmp_ext) { 2571da177e4SLinus Torvalds err = -ENOMEM; 2581da177e4SLinus Torvalds goto error; 2591da177e4SLinus Torvalds } 26059fbb3a6SMasahide NAKAMURA #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 26127637df9SMasahide NAKAMURA memcpy(tmp_ext, &top_iph->saddr, extlen); 262e731c248SYOSHIFUJI Hideaki #else 263e731c248SYOSHIFUJI Hideaki memcpy(tmp_ext, &top_iph->daddr, extlen); 264e731c248SYOSHIFUJI Hideaki #endif 26527637df9SMasahide NAKAMURA err = ipv6_clear_mutable_options(top_iph, 26627637df9SMasahide NAKAMURA extlen - sizeof(*tmp_ext) + 26727637df9SMasahide NAKAMURA sizeof(*top_iph), 26827637df9SMasahide NAKAMURA XFRM_POLICY_OUT); 2691da177e4SLinus Torvalds if (err) 2701da177e4SLinus Torvalds goto error_free_iph; 2711da177e4SLinus Torvalds } 2721da177e4SLinus Torvalds 27387bdc48dSHerbert Xu ah = ip_auth_hdr(skb); 2741da177e4SLinus Torvalds ah->nexthdr = nexthdr; 2751da177e4SLinus Torvalds 2761da177e4SLinus Torvalds top_iph->priority = 0; 2771da177e4SLinus Torvalds top_iph->flow_lbl[0] = 0; 2781da177e4SLinus Torvalds top_iph->flow_lbl[1] = 0; 2791da177e4SLinus Torvalds top_iph->flow_lbl[2] = 0; 2801da177e4SLinus Torvalds top_iph->hop_limit = 0; 2811da177e4SLinus Torvalds 2821da177e4SLinus Torvalds ahp = x->data; 28387bdc48dSHerbert Xu ah->hdrlen = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2; 2841da177e4SLinus Torvalds 2851da177e4SLinus Torvalds ah->reserved = 0; 2861da177e4SLinus Torvalds ah->spi = x->id.spi; 287436a0a40SHerbert Xu ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq); 288b7c6538cSHerbert Xu 289b7c6538cSHerbert Xu spin_lock_bh(&x->lock); 29007d4ee58SHerbert Xu err = ah_mac_digest(ahp, skb, ah->auth_data); 291b7c6538cSHerbert Xu memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len); 292b7c6538cSHerbert Xu spin_unlock_bh(&x->lock); 293b7c6538cSHerbert Xu 29407d4ee58SHerbert Xu if (err) 29507d4ee58SHerbert Xu goto error_free_iph; 2961da177e4SLinus Torvalds 2971da177e4SLinus Torvalds memcpy(top_iph, tmp_base, sizeof(tmp_base)); 2981da177e4SLinus Torvalds if (tmp_ext) { 29959fbb3a6SMasahide NAKAMURA #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 30027637df9SMasahide NAKAMURA memcpy(&top_iph->saddr, tmp_ext, extlen); 30127637df9SMasahide NAKAMURA #else 3021da177e4SLinus Torvalds memcpy(&top_iph->daddr, tmp_ext, extlen); 30327637df9SMasahide NAKAMURA #endif 3041da177e4SLinus Torvalds error_free_iph: 3051da177e4SLinus Torvalds kfree(tmp_ext); 3061da177e4SLinus Torvalds } 3071da177e4SLinus Torvalds 3081da177e4SLinus Torvalds error: 3091da177e4SLinus Torvalds return err; 3101da177e4SLinus Torvalds } 3111da177e4SLinus Torvalds 312e695633eSHerbert Xu static int ah6_input(struct xfrm_state *x, struct sk_buff *skb) 3131da177e4SLinus Torvalds { 3141da177e4SLinus Torvalds /* 3151da177e4SLinus Torvalds * Before process AH 3161da177e4SLinus Torvalds * [IPv6][Ext1][Ext2][AH][Dest][Payload] 3171da177e4SLinus Torvalds * |<-------------->| hdr_len 3181da177e4SLinus Torvalds * 3191da177e4SLinus Torvalds * To erase AH: 3201da177e4SLinus Torvalds * Keeping copy of cleared headers. After AH processing, 321b0e380b1SArnaldo Carvalho de Melo * Moving the pointer of skb->network_header by using skb_pull as long 322b0e380b1SArnaldo Carvalho de Melo * as AH header length. Then copy back the copy as long as hdr_len 3231da177e4SLinus Torvalds * If destination header following AH exists, copy it into after [Ext2]. 3241da177e4SLinus Torvalds * 3251da177e4SLinus Torvalds * |<>|[IPv6][Ext1][Ext2][Dest][Payload] 3261da177e4SLinus Torvalds * There is offset of AH before IPv6 header after the process. 3271da177e4SLinus Torvalds */ 3281da177e4SLinus Torvalds 32987bdc48dSHerbert Xu struct ip_auth_hdr *ah; 3300660e03fSArnaldo Carvalho de Melo struct ipv6hdr *ip6h; 3311da177e4SLinus Torvalds struct ah_data *ahp; 3321da177e4SLinus Torvalds unsigned char *tmp_hdr = NULL; 3331da177e4SLinus Torvalds u16 hdr_len; 3341da177e4SLinus Torvalds u16 ah_hlen; 3351da177e4SLinus Torvalds int nexthdr; 33607d4ee58SHerbert Xu int err = -EINVAL; 3371da177e4SLinus Torvalds 3381da177e4SLinus Torvalds if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr))) 3391da177e4SLinus Torvalds goto out; 3401da177e4SLinus Torvalds 3411da177e4SLinus Torvalds /* We are going to _remove_ AH header to keep sockets happy, 3421da177e4SLinus Torvalds * so... Later this can change. */ 3431da177e4SLinus Torvalds if (skb_cloned(skb) && 3441da177e4SLinus Torvalds pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) 3451da177e4SLinus Torvalds goto out; 3461da177e4SLinus Torvalds 3477aa68cb9SHerbert Xu skb->ip_summed = CHECKSUM_NONE; 3487aa68cb9SHerbert Xu 349d56f90a7SArnaldo Carvalho de Melo hdr_len = skb->data - skb_network_header(skb); 35087bdc48dSHerbert Xu ah = (struct ip_auth_hdr *)skb->data; 3511da177e4SLinus Torvalds ahp = x->data; 3521da177e4SLinus Torvalds nexthdr = ah->nexthdr; 3531da177e4SLinus Torvalds ah_hlen = (ah->hdrlen + 2) << 2; 3541da177e4SLinus Torvalds 35587bdc48dSHerbert Xu if (ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_full_len) && 35687bdc48dSHerbert Xu ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len)) 3571da177e4SLinus Torvalds goto out; 3581da177e4SLinus Torvalds 3591da177e4SLinus Torvalds if (!pskb_may_pull(skb, ah_hlen)) 3601da177e4SLinus Torvalds goto out; 3611da177e4SLinus Torvalds 362d56f90a7SArnaldo Carvalho de Melo tmp_hdr = kmemdup(skb_network_header(skb), hdr_len, GFP_ATOMIC); 3631da177e4SLinus Torvalds if (!tmp_hdr) 3641da177e4SLinus Torvalds goto out; 3650660e03fSArnaldo Carvalho de Melo ip6h = ipv6_hdr(skb); 3660660e03fSArnaldo Carvalho de Melo if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN)) 36727637df9SMasahide NAKAMURA goto free_out; 3680660e03fSArnaldo Carvalho de Melo ip6h->priority = 0; 3690660e03fSArnaldo Carvalho de Melo ip6h->flow_lbl[0] = 0; 3700660e03fSArnaldo Carvalho de Melo ip6h->flow_lbl[1] = 0; 3710660e03fSArnaldo Carvalho de Melo ip6h->flow_lbl[2] = 0; 3720660e03fSArnaldo Carvalho de Melo ip6h->hop_limit = 0; 3731da177e4SLinus Torvalds 3741da177e4SLinus Torvalds { 3751da177e4SLinus Torvalds u8 auth_data[MAX_AH_AUTH_LEN]; 3761da177e4SLinus Torvalds 3771da177e4SLinus Torvalds memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len); 3781da177e4SLinus Torvalds memset(ah->auth_data, 0, ahp->icv_trunc_len); 37931a4ab93SHerbert Xu skb_push(skb, hdr_len); 38007d4ee58SHerbert Xu err = ah_mac_digest(ahp, skb, ah->auth_data); 38107d4ee58SHerbert Xu if (err) 38207d4ee58SHerbert Xu goto free_out; 38307d4ee58SHerbert Xu err = -EINVAL; 38407d4ee58SHerbert Xu if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len)) { 38564ce2073SPatrick McHardy LIMIT_NETDEBUG(KERN_WARNING "ipsec ah authentication error\n"); 3861da177e4SLinus Torvalds x->stats.integrity_failed++; 3871da177e4SLinus Torvalds goto free_out; 3881da177e4SLinus Torvalds } 3891da177e4SLinus Torvalds } 3901da177e4SLinus Torvalds 391b0e380b1SArnaldo Carvalho de Melo skb->network_header += ah_hlen; 392d56f90a7SArnaldo Carvalho de Melo memcpy(skb_network_header(skb), tmp_hdr, hdr_len); 393b0e380b1SArnaldo Carvalho de Melo skb->transport_header = skb->network_header; 39431a4ab93SHerbert Xu __skb_pull(skb, ah_hlen + hdr_len); 3951da177e4SLinus Torvalds 3961da177e4SLinus Torvalds kfree(tmp_hdr); 3971da177e4SLinus Torvalds 3981da177e4SLinus Torvalds return nexthdr; 3991da177e4SLinus Torvalds 4001da177e4SLinus Torvalds free_out: 4011da177e4SLinus Torvalds kfree(tmp_hdr); 4021da177e4SLinus Torvalds out: 40307d4ee58SHerbert Xu return err; 4041da177e4SLinus Torvalds } 4051da177e4SLinus Torvalds 4061da177e4SLinus Torvalds static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, 40704ce6909SAl Viro int type, int code, int offset, __be32 info) 4081da177e4SLinus Torvalds { 4091da177e4SLinus Torvalds struct ipv6hdr *iph = (struct ipv6hdr*)skb->data; 4101da177e4SLinus Torvalds struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset); 4111da177e4SLinus Torvalds struct xfrm_state *x; 4121da177e4SLinus Torvalds 4131da177e4SLinus Torvalds if (type != ICMPV6_DEST_UNREACH && 4141da177e4SLinus Torvalds type != ICMPV6_PKT_TOOBIG) 4151da177e4SLinus Torvalds return; 4161da177e4SLinus Torvalds 4171da177e4SLinus Torvalds x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6); 4181da177e4SLinus Torvalds if (!x) 4191da177e4SLinus Torvalds return; 4201da177e4SLinus Torvalds 42146b86a2dSJoe Perches NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/" NIP6_FMT "\n", 42264ce2073SPatrick McHardy ntohl(ah->spi), NIP6(iph->daddr)); 4231da177e4SLinus Torvalds 4241da177e4SLinus Torvalds xfrm_state_put(x); 4251da177e4SLinus Torvalds } 4261da177e4SLinus Torvalds 42772cb6962SHerbert Xu static int ah6_init_state(struct xfrm_state *x) 4281da177e4SLinus Torvalds { 4291da177e4SLinus Torvalds struct ah_data *ahp = NULL; 4301da177e4SLinus Torvalds struct xfrm_algo_desc *aalg_desc; 43107d4ee58SHerbert Xu struct crypto_hash *tfm; 4321da177e4SLinus Torvalds 4331da177e4SLinus Torvalds if (!x->aalg) 4341da177e4SLinus Torvalds goto error; 4351da177e4SLinus Torvalds 4361da177e4SLinus Torvalds if (x->encap) 4371da177e4SLinus Torvalds goto error; 4381da177e4SLinus Torvalds 4390c600edaSIngo Oeser ahp = kzalloc(sizeof(*ahp), GFP_KERNEL); 4401da177e4SLinus Torvalds if (ahp == NULL) 4411da177e4SLinus Torvalds return -ENOMEM; 4421da177e4SLinus Torvalds 44307d4ee58SHerbert Xu tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC); 44407d4ee58SHerbert Xu if (IS_ERR(tfm)) 4451da177e4SLinus Torvalds goto error; 44607d4ee58SHerbert Xu 44707d4ee58SHerbert Xu ahp->tfm = tfm; 448bc31d3b2SHerbert Xu if (crypto_hash_setkey(tfm, x->aalg->alg_key, 449bc31d3b2SHerbert Xu (x->aalg->alg_key_len + 7) / 8)) 45007d4ee58SHerbert Xu goto error; 4511da177e4SLinus Torvalds 4521da177e4SLinus Torvalds /* 4531da177e4SLinus Torvalds * Lookup the algorithm description maintained by xfrm_algo, 4541da177e4SLinus Torvalds * verify crypto transform properties, and store information 4551da177e4SLinus Torvalds * we need for AH processing. This lookup cannot fail here 45607d4ee58SHerbert Xu * after a successful crypto_alloc_hash(). 4571da177e4SLinus Torvalds */ 4581da177e4SLinus Torvalds aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0); 4591da177e4SLinus Torvalds BUG_ON(!aalg_desc); 4601da177e4SLinus Torvalds 4611da177e4SLinus Torvalds if (aalg_desc->uinfo.auth.icv_fullbits/8 != 46207d4ee58SHerbert Xu crypto_hash_digestsize(tfm)) { 4631da177e4SLinus Torvalds printk(KERN_INFO "AH: %s digestsize %u != %hu\n", 46407d4ee58SHerbert Xu x->aalg->alg_name, crypto_hash_digestsize(tfm), 4651da177e4SLinus Torvalds aalg_desc->uinfo.auth.icv_fullbits/8); 4661da177e4SLinus Torvalds goto error; 4671da177e4SLinus Torvalds } 4681da177e4SLinus Torvalds 4691da177e4SLinus Torvalds ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8; 4701da177e4SLinus Torvalds ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8; 4711da177e4SLinus Torvalds 4721da177e4SLinus Torvalds BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN); 4731da177e4SLinus Torvalds 4741da177e4SLinus Torvalds ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL); 4751da177e4SLinus Torvalds if (!ahp->work_icv) 4761da177e4SLinus Torvalds goto error; 4771da177e4SLinus Torvalds 47887bdc48dSHerbert Xu x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + 47987bdc48dSHerbert Xu ahp->icv_trunc_len); 480ca68145fSHerbert Xu switch (x->props.mode) { 481ca68145fSHerbert Xu case XFRM_MODE_BEET: 482ca68145fSHerbert Xu case XFRM_MODE_TRANSPORT: 483ca68145fSHerbert Xu break; 484ca68145fSHerbert Xu case XFRM_MODE_TUNNEL: 4851da177e4SLinus Torvalds x->props.header_len += sizeof(struct ipv6hdr); 486ea2c47b4SMasahide NAKAMURA break; 487ca68145fSHerbert Xu default: 488ca68145fSHerbert Xu goto error; 489ca68145fSHerbert Xu } 4901da177e4SLinus Torvalds x->data = ahp; 4911da177e4SLinus Torvalds 4921da177e4SLinus Torvalds return 0; 4931da177e4SLinus Torvalds 4941da177e4SLinus Torvalds error: 4951da177e4SLinus Torvalds if (ahp) { 4961da177e4SLinus Torvalds kfree(ahp->work_icv); 49707d4ee58SHerbert Xu crypto_free_hash(ahp->tfm); 4981da177e4SLinus Torvalds kfree(ahp); 4991da177e4SLinus Torvalds } 5001da177e4SLinus Torvalds return -EINVAL; 5011da177e4SLinus Torvalds } 5021da177e4SLinus Torvalds 5031da177e4SLinus Torvalds static void ah6_destroy(struct xfrm_state *x) 5041da177e4SLinus Torvalds { 5051da177e4SLinus Torvalds struct ah_data *ahp = x->data; 5061da177e4SLinus Torvalds 5071da177e4SLinus Torvalds if (!ahp) 5081da177e4SLinus Torvalds return; 5091da177e4SLinus Torvalds 5101da177e4SLinus Torvalds kfree(ahp->work_icv); 5111da177e4SLinus Torvalds ahp->work_icv = NULL; 51207d4ee58SHerbert Xu crypto_free_hash(ahp->tfm); 5131da177e4SLinus Torvalds ahp->tfm = NULL; 5141da177e4SLinus Torvalds kfree(ahp); 5151da177e4SLinus Torvalds } 5161da177e4SLinus Torvalds 5171da177e4SLinus Torvalds static struct xfrm_type ah6_type = 5181da177e4SLinus Torvalds { 5191da177e4SLinus Torvalds .description = "AH6", 5201da177e4SLinus Torvalds .owner = THIS_MODULE, 5211da177e4SLinus Torvalds .proto = IPPROTO_AH, 522436a0a40SHerbert Xu .flags = XFRM_TYPE_REPLAY_PROT, 5231da177e4SLinus Torvalds .init_state = ah6_init_state, 5241da177e4SLinus Torvalds .destructor = ah6_destroy, 5251da177e4SLinus Torvalds .input = ah6_input, 526aee5adb4SMasahide NAKAMURA .output = ah6_output, 527aee5adb4SMasahide NAKAMURA .hdr_offset = xfrm6_find_1stfragopt, 5281da177e4SLinus Torvalds }; 5291da177e4SLinus Torvalds 5301da177e4SLinus Torvalds static struct inet6_protocol ah6_protocol = { 5311da177e4SLinus Torvalds .handler = xfrm6_rcv, 5321da177e4SLinus Torvalds .err_handler = ah6_err, 5331da177e4SLinus Torvalds .flags = INET6_PROTO_NOPOLICY, 5341da177e4SLinus Torvalds }; 5351da177e4SLinus Torvalds 5361da177e4SLinus Torvalds static int __init ah6_init(void) 5371da177e4SLinus Torvalds { 5381da177e4SLinus Torvalds if (xfrm_register_type(&ah6_type, AF_INET6) < 0) { 5391da177e4SLinus Torvalds printk(KERN_INFO "ipv6 ah init: can't add xfrm type\n"); 5401da177e4SLinus Torvalds return -EAGAIN; 5411da177e4SLinus Torvalds } 5421da177e4SLinus Torvalds 5431da177e4SLinus Torvalds if (inet6_add_protocol(&ah6_protocol, IPPROTO_AH) < 0) { 5441da177e4SLinus Torvalds printk(KERN_INFO "ipv6 ah init: can't add protocol\n"); 5451da177e4SLinus Torvalds xfrm_unregister_type(&ah6_type, AF_INET6); 5461da177e4SLinus Torvalds return -EAGAIN; 5471da177e4SLinus Torvalds } 5481da177e4SLinus Torvalds 5491da177e4SLinus Torvalds return 0; 5501da177e4SLinus Torvalds } 5511da177e4SLinus Torvalds 5521da177e4SLinus Torvalds static void __exit ah6_fini(void) 5531da177e4SLinus Torvalds { 5541da177e4SLinus Torvalds if (inet6_del_protocol(&ah6_protocol, IPPROTO_AH) < 0) 5551da177e4SLinus Torvalds printk(KERN_INFO "ipv6 ah close: can't remove protocol\n"); 5561da177e4SLinus Torvalds 5571da177e4SLinus Torvalds if (xfrm_unregister_type(&ah6_type, AF_INET6) < 0) 5581da177e4SLinus Torvalds printk(KERN_INFO "ipv6 ah close: can't remove xfrm type\n"); 5591da177e4SLinus Torvalds 5601da177e4SLinus Torvalds } 5611da177e4SLinus Torvalds 5621da177e4SLinus Torvalds module_init(ah6_init); 5631da177e4SLinus Torvalds module_exit(ah6_fini); 5641da177e4SLinus Torvalds 5651da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 566d3d6dd3aSMasahide NAKAMURA MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_AH); 567