ah6.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552
  1. /*
  2. * Copyright (C)2002 USAGI/WIDE Project
  3. *
  4. * This program is free software; you can redistribute it and/or modify
  5. * it under the terms of the GNU General Public License as published by
  6. * the Free Software Foundation; either version 2 of the License, or
  7. * (at your option) any later version.
  8. *
  9. * This program is distributed in the hope that it will be useful,
  10. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12. * GNU General Public License for more details.
  13. *
  14. * You should have received a copy of the GNU General Public License
  15. * along with this program; if not, write to the Free Software
  16. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  17. *
  18. * Authors
  19. *
  20. * Mitsuru KANDA @USAGI : IPv6 Support
  21. * Kazunori MIYAZAWA @USAGI :
  22. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  23. *
  24. * This file is derived from net/ipv4/ah.c.
  25. */
  26. #include <linux/module.h>
  27. #include <net/ip.h>
  28. #include <net/ah.h>
  29. #include <linux/crypto.h>
  30. #include <linux/pfkeyv2.h>
  31. #include <linux/string.h>
  32. #include <net/icmp.h>
  33. #include <net/ipv6.h>
  34. #include <net/protocol.h>
  35. #include <net/xfrm.h>
  36. #include <asm/scatterlist.h>
  37. static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
  38. {
  39. u8 *opt = (u8 *)opthdr;
  40. int len = ipv6_optlen(opthdr);
  41. int off = 0;
  42. int optlen = 0;
  43. off += 2;
  44. len -= 2;
  45. while (len > 0) {
  46. switch (opt[off]) {
  47. case IPV6_TLV_PAD0:
  48. optlen = 1;
  49. break;
  50. default:
  51. if (len < 2)
  52. goto bad;
  53. optlen = opt[off+1]+2;
  54. if (len < optlen)
  55. goto bad;
  56. if (opt[off] & 0x20)
  57. memset(&opt[off+2], 0, opt[off+1]);
  58. break;
  59. }
  60. off += optlen;
  61. len -= optlen;
  62. }
  63. if (len == 0)
  64. return 1;
  65. bad:
  66. return 0;
  67. }
  68. #ifdef CONFIG_IPV6_MIP6
  69. /**
  70. * ipv6_rearrange_destopt - rearrange IPv6 destination options header
  71. * @iph: IPv6 header
  72. * @destopt: destionation options header
  73. */
  74. static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *destopt)
  75. {
  76. u8 *opt = (u8 *)destopt;
  77. int len = ipv6_optlen(destopt);
  78. int off = 0;
  79. int optlen = 0;
  80. off += 2;
  81. len -= 2;
  82. while (len > 0) {
  83. switch (opt[off]) {
  84. case IPV6_TLV_PAD0:
  85. optlen = 1;
  86. break;
  87. default:
  88. if (len < 2)
  89. goto bad;
  90. optlen = opt[off+1]+2;
  91. if (len < optlen)
  92. goto bad;
  93. /* Rearrange the source address in @iph and the
  94. * addresses in home address option for final source.
  95. * See 11.3.2 of RFC 3775 for details.
  96. */
  97. if (opt[off] == IPV6_TLV_HAO) {
  98. struct in6_addr final_addr;
  99. struct ipv6_destopt_hao *hao;
  100. hao = (struct ipv6_destopt_hao *)&opt[off];
  101. if (hao->length != sizeof(hao->addr)) {
  102. if (net_ratelimit())
  103. printk(KERN_WARNING "destopt hao: invalid header length: %u\n", hao->length);
  104. goto bad;
  105. }
  106. ipv6_addr_copy(&final_addr, &hao->addr);
  107. ipv6_addr_copy(&hao->addr, &iph->saddr);
  108. ipv6_addr_copy(&iph->saddr, &final_addr);
  109. }
  110. break;
  111. }
  112. off += optlen;
  113. len -= optlen;
  114. }
  115. /* Note: ok if len == 0 */
  116. bad:
  117. return;
  118. }
  119. #endif
  120. /**
  121. * ipv6_rearrange_rthdr - rearrange IPv6 routing header
  122. * @iph: IPv6 header
  123. * @rthdr: routing header
  124. *
  125. * Rearrange the destination address in @iph and the addresses in @rthdr
  126. * so that they appear in the order they will at the final destination.
  127. * See Appendix A2 of RFC 2402 for details.
  128. */
  129. static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
  130. {
  131. int segments, segments_left;
  132. struct in6_addr *addrs;
  133. struct in6_addr final_addr;
  134. segments_left = rthdr->segments_left;
  135. if (segments_left == 0)
  136. return;
  137. rthdr->segments_left = 0;
  138. /* The value of rthdr->hdrlen has been verified either by the system
  139. * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming
  140. * packets. So we can assume that it is even and that segments is
  141. * greater than or equal to segments_left.
  142. *
  143. * For the same reason we can assume that this option is of type 0.
  144. */
  145. segments = rthdr->hdrlen >> 1;
  146. addrs = ((struct rt0_hdr *)rthdr)->addr;
  147. ipv6_addr_copy(&final_addr, addrs + segments - 1);
  148. addrs += segments - segments_left;
  149. memmove(addrs + 1, addrs, (segments_left - 1) * sizeof(*addrs));
  150. ipv6_addr_copy(addrs, &iph->daddr);
  151. ipv6_addr_copy(&iph->daddr, &final_addr);
  152. }
  153. static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
  154. {
  155. union {
  156. struct ipv6hdr *iph;
  157. struct ipv6_opt_hdr *opth;
  158. struct ipv6_rt_hdr *rth;
  159. char *raw;
  160. } exthdr = { .iph = iph };
  161. char *end = exthdr.raw + len;
  162. int nexthdr = iph->nexthdr;
  163. exthdr.iph++;
  164. while (exthdr.raw < end) {
  165. switch (nexthdr) {
  166. case NEXTHDR_DEST:
  167. #ifdef CONFIG_IPV6_MIP6
  168. if (dir == XFRM_POLICY_OUT)
  169. ipv6_rearrange_destopt(iph, exthdr.opth);
  170. #endif
  171. case NEXTHDR_HOP:
  172. if (!zero_out_mutable_opts(exthdr.opth)) {
  173. LIMIT_NETDEBUG(
  174. KERN_WARNING "overrun %sopts\n",
  175. nexthdr == NEXTHDR_HOP ?
  176. "hop" : "dest");
  177. return -EINVAL;
  178. }
  179. break;
  180. case NEXTHDR_ROUTING:
  181. ipv6_rearrange_rthdr(iph, exthdr.rth);
  182. break;
  183. default :
  184. return 0;
  185. }
  186. nexthdr = exthdr.opth->nexthdr;
  187. exthdr.raw += ipv6_optlen(exthdr.opth);
  188. }
  189. return 0;
  190. }
  191. static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
  192. {
  193. int err;
  194. int extlen;
  195. struct ipv6hdr *top_iph;
  196. struct ip_auth_hdr *ah;
  197. struct ah_data *ahp;
  198. u8 nexthdr;
  199. char tmp_base[8];
  200. struct {
  201. #ifdef CONFIG_IPV6_MIP6
  202. struct in6_addr saddr;
  203. #endif
  204. struct in6_addr daddr;
  205. char hdrs[0];
  206. } *tmp_ext;
  207. top_iph = (struct ipv6hdr *)skb->data;
  208. top_iph->payload_len = htons(skb->len - sizeof(*top_iph));
  209. nexthdr = *skb->nh.raw;
  210. *skb->nh.raw = IPPROTO_AH;
  211. /* When there are no extension headers, we only need to save the first
  212. * 8 bytes of the base IP header.
  213. */
  214. memcpy(tmp_base, top_iph, sizeof(tmp_base));
  215. tmp_ext = NULL;
  216. extlen = skb->h.raw - (unsigned char *)(top_iph + 1);
  217. if (extlen) {
  218. extlen += sizeof(*tmp_ext);
  219. tmp_ext = kmalloc(extlen, GFP_ATOMIC);
  220. if (!tmp_ext) {
  221. err = -ENOMEM;
  222. goto error;
  223. }
  224. #ifdef CONFIG_IPV6_MIP6
  225. memcpy(tmp_ext, &top_iph->saddr, extlen);
  226. #else
  227. memcpy(tmp_ext, &top_iph->daddr, extlen);
  228. #endif
  229. err = ipv6_clear_mutable_options(top_iph,
  230. extlen - sizeof(*tmp_ext) +
  231. sizeof(*top_iph),
  232. XFRM_POLICY_OUT);
  233. if (err)
  234. goto error_free_iph;
  235. }
  236. ah = (struct ip_auth_hdr *)skb->h.raw;
  237. ah->nexthdr = nexthdr;
  238. top_iph->priority = 0;
  239. top_iph->flow_lbl[0] = 0;
  240. top_iph->flow_lbl[1] = 0;
  241. top_iph->flow_lbl[2] = 0;
  242. top_iph->hop_limit = 0;
  243. ahp = x->data;
  244. ah->hdrlen = (XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) +
  245. ahp->icv_trunc_len) >> 2) - 2;
  246. ah->reserved = 0;
  247. ah->spi = x->id.spi;
  248. ah->seq_no = htonl(++x->replay.oseq);
  249. xfrm_aevent_doreplay(x);
  250. err = ah_mac_digest(ahp, skb, ah->auth_data);
  251. if (err)
  252. goto error_free_iph;
  253. memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
  254. err = 0;
  255. memcpy(top_iph, tmp_base, sizeof(tmp_base));
  256. if (tmp_ext) {
  257. #ifdef CONFIG_IPV6_MIP6
  258. memcpy(&top_iph->saddr, tmp_ext, extlen);
  259. #else
  260. memcpy(&top_iph->daddr, tmp_ext, extlen);
  261. #endif
  262. error_free_iph:
  263. kfree(tmp_ext);
  264. }
  265. error:
  266. return err;
  267. }
  268. static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
  269. {
  270. /*
  271. * Before process AH
  272. * [IPv6][Ext1][Ext2][AH][Dest][Payload]
  273. * |<-------------->| hdr_len
  274. *
  275. * To erase AH:
  276. * Keeping copy of cleared headers. After AH processing,
  277. * Moving the pointer of skb->nh.raw by using skb_pull as long as AH
  278. * header length. Then copy back the copy as long as hdr_len
  279. * If destination header following AH exists, copy it into after [Ext2].
  280. *
  281. * |<>|[IPv6][Ext1][Ext2][Dest][Payload]
  282. * There is offset of AH before IPv6 header after the process.
  283. */
  284. struct ipv6_auth_hdr *ah;
  285. struct ah_data *ahp;
  286. unsigned char *tmp_hdr = NULL;
  287. u16 hdr_len;
  288. u16 ah_hlen;
  289. int nexthdr;
  290. int err = -EINVAL;
  291. if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
  292. goto out;
  293. /* We are going to _remove_ AH header to keep sockets happy,
  294. * so... Later this can change. */
  295. if (skb_cloned(skb) &&
  296. pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
  297. goto out;
  298. hdr_len = skb->data - skb->nh.raw;
  299. ah = (struct ipv6_auth_hdr*)skb->data;
  300. ahp = x->data;
  301. nexthdr = ah->nexthdr;
  302. ah_hlen = (ah->hdrlen + 2) << 2;
  303. if (ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_full_len) &&
  304. ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len))
  305. goto out;
  306. if (!pskb_may_pull(skb, ah_hlen))
  307. goto out;
  308. tmp_hdr = kmemdup(skb->nh.raw, hdr_len, GFP_ATOMIC);
  309. if (!tmp_hdr)
  310. goto out;
  311. if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len, XFRM_POLICY_IN))
  312. goto free_out;
  313. skb->nh.ipv6h->priority = 0;
  314. skb->nh.ipv6h->flow_lbl[0] = 0;
  315. skb->nh.ipv6h->flow_lbl[1] = 0;
  316. skb->nh.ipv6h->flow_lbl[2] = 0;
  317. skb->nh.ipv6h->hop_limit = 0;
  318. {
  319. u8 auth_data[MAX_AH_AUTH_LEN];
  320. memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
  321. memset(ah->auth_data, 0, ahp->icv_trunc_len);
  322. skb_push(skb, hdr_len);
  323. err = ah_mac_digest(ahp, skb, ah->auth_data);
  324. if (err)
  325. goto free_out;
  326. err = -EINVAL;
  327. if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len)) {
  328. LIMIT_NETDEBUG(KERN_WARNING "ipsec ah authentication error\n");
  329. x->stats.integrity_failed++;
  330. goto free_out;
  331. }
  332. }
  333. skb->h.raw = memcpy(skb->nh.raw += ah_hlen, tmp_hdr, hdr_len);
  334. __skb_pull(skb, ah_hlen + hdr_len);
  335. kfree(tmp_hdr);
  336. return nexthdr;
  337. free_out:
  338. kfree(tmp_hdr);
  339. out:
  340. return err;
  341. }
  342. static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  343. int type, int code, int offset, __be32 info)
  344. {
  345. struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
  346. struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);
  347. struct xfrm_state *x;
  348. if (type != ICMPV6_DEST_UNREACH &&
  349. type != ICMPV6_PKT_TOOBIG)
  350. return;
  351. x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
  352. if (!x)
  353. return;
  354. NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/" NIP6_FMT "\n",
  355. ntohl(ah->spi), NIP6(iph->daddr));
  356. xfrm_state_put(x);
  357. }
  358. static int ah6_init_state(struct xfrm_state *x)
  359. {
  360. struct ah_data *ahp = NULL;
  361. struct xfrm_algo_desc *aalg_desc;
  362. struct crypto_hash *tfm;
  363. if (!x->aalg)
  364. goto error;
  365. /* null auth can use a zero length key */
  366. if (x->aalg->alg_key_len > 512)
  367. goto error;
  368. if (x->encap)
  369. goto error;
  370. ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
  371. if (ahp == NULL)
  372. return -ENOMEM;
  373. ahp->key = x->aalg->alg_key;
  374. ahp->key_len = (x->aalg->alg_key_len+7)/8;
  375. tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
  376. if (IS_ERR(tfm))
  377. goto error;
  378. ahp->tfm = tfm;
  379. if (crypto_hash_setkey(tfm, ahp->key, ahp->key_len))
  380. goto error;
  381. /*
  382. * Lookup the algorithm description maintained by xfrm_algo,
  383. * verify crypto transform properties, and store information
  384. * we need for AH processing. This lookup cannot fail here
  385. * after a successful crypto_alloc_hash().
  386. */
  387. aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
  388. BUG_ON(!aalg_desc);
  389. if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
  390. crypto_hash_digestsize(tfm)) {
  391. printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
  392. x->aalg->alg_name, crypto_hash_digestsize(tfm),
  393. aalg_desc->uinfo.auth.icv_fullbits/8);
  394. goto error;
  395. }
  396. ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
  397. ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
  398. BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
  399. ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
  400. if (!ahp->work_icv)
  401. goto error;
  402. x->props.header_len = XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len);
  403. if (x->props.mode == XFRM_MODE_TUNNEL)
  404. x->props.header_len += sizeof(struct ipv6hdr);
  405. x->data = ahp;
  406. return 0;
  407. error:
  408. if (ahp) {
  409. kfree(ahp->work_icv);
  410. crypto_free_hash(ahp->tfm);
  411. kfree(ahp);
  412. }
  413. return -EINVAL;
  414. }
  415. static void ah6_destroy(struct xfrm_state *x)
  416. {
  417. struct ah_data *ahp = x->data;
  418. if (!ahp)
  419. return;
  420. kfree(ahp->work_icv);
  421. ahp->work_icv = NULL;
  422. crypto_free_hash(ahp->tfm);
  423. ahp->tfm = NULL;
  424. kfree(ahp);
  425. }
  426. static struct xfrm_type ah6_type =
  427. {
  428. .description = "AH6",
  429. .owner = THIS_MODULE,
  430. .proto = IPPROTO_AH,
  431. .init_state = ah6_init_state,
  432. .destructor = ah6_destroy,
  433. .input = ah6_input,
  434. .output = ah6_output,
  435. .hdr_offset = xfrm6_find_1stfragopt,
  436. };
  437. static struct inet6_protocol ah6_protocol = {
  438. .handler = xfrm6_rcv,
  439. .err_handler = ah6_err,
  440. .flags = INET6_PROTO_NOPOLICY,
  441. };
  442. static int __init ah6_init(void)
  443. {
  444. if (xfrm_register_type(&ah6_type, AF_INET6) < 0) {
  445. printk(KERN_INFO "ipv6 ah init: can't add xfrm type\n");
  446. return -EAGAIN;
  447. }
  448. if (inet6_add_protocol(&ah6_protocol, IPPROTO_AH) < 0) {
  449. printk(KERN_INFO "ipv6 ah init: can't add protocol\n");
  450. xfrm_unregister_type(&ah6_type, AF_INET6);
  451. return -EAGAIN;
  452. }
  453. return 0;
  454. }
  455. static void __exit ah6_fini(void)
  456. {
  457. if (inet6_del_protocol(&ah6_protocol, IPPROTO_AH) < 0)
  458. printk(KERN_INFO "ipv6 ah close: can't remove protocol\n");
  459. if (xfrm_unregister_type(&ah6_type, AF_INET6) < 0)
  460. printk(KERN_INFO "ipv6 ah close: can't remove xfrm type\n");
  461. }
  462. module_init(ah6_init);
  463. module_exit(ah6_fini);
  464. MODULE_LICENSE("GPL");