ah6.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586
  1. /*
  2. * Copyright (C)2002 USAGI/WIDE Project
  3. *
  4. * This program is free software; you can redistribute it and/or modify
  5. * it under the terms of the GNU General Public License as published by
  6. * the Free Software Foundation; either version 2 of the License, or
  7. * (at your option) any later version.
  8. *
  9. * This program is distributed in the hope that it will be useful,
  10. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12. * GNU General Public License for more details.
  13. *
  14. * You should have received a copy of the GNU General Public License
  15. * along with this program; if not, write to the Free Software
  16. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  17. *
  18. * Authors
  19. *
  20. * Mitsuru KANDA @USAGI : IPv6 Support
  21. * Kazunori MIYAZAWA @USAGI :
  22. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  23. *
  24. * This file is derived from net/ipv4/ah.c.
  25. */
  26. #include <linux/module.h>
  27. #include <net/ip.h>
  28. #include <net/ah.h>
  29. #include <linux/crypto.h>
  30. #include <linux/pfkeyv2.h>
  31. #include <linux/string.h>
  32. #include <net/icmp.h>
  33. #include <net/ipv6.h>
  34. #include <net/protocol.h>
  35. #include <net/xfrm.h>
  36. #include <asm/scatterlist.h>
  37. static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
  38. {
  39. u8 *opt = (u8 *)opthdr;
  40. int len = ipv6_optlen(opthdr);
  41. int off = 0;
  42. int optlen = 0;
  43. off += 2;
  44. len -= 2;
  45. while (len > 0) {
  46. switch (opt[off]) {
  47. case IPV6_TLV_PAD0:
  48. optlen = 1;
  49. break;
  50. default:
  51. if (len < 2)
  52. goto bad;
  53. optlen = opt[off+1]+2;
  54. if (len < optlen)
  55. goto bad;
  56. if (opt[off] & 0x20)
  57. memset(&opt[off+2], 0, opt[off+1]);
  58. break;
  59. }
  60. off += optlen;
  61. len -= optlen;
  62. }
  63. if (len == 0)
  64. return 1;
  65. bad:
  66. return 0;
  67. }
  68. #ifdef CONFIG_IPV6_MIP6
  69. /**
  70. * ipv6_rearrange_destopt - rearrange IPv6 destination options header
  71. * @iph: IPv6 header
  72. * @destopt: destionation options header
  73. */
  74. static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *destopt)
  75. {
  76. u8 *opt = (u8 *)destopt;
  77. int len = ipv6_optlen(destopt);
  78. int off = 0;
  79. int optlen = 0;
  80. off += 2;
  81. len -= 2;
  82. while (len > 0) {
  83. switch (opt[off]) {
  84. case IPV6_TLV_PAD0:
  85. optlen = 1;
  86. break;
  87. default:
  88. if (len < 2)
  89. goto bad;
  90. optlen = opt[off+1]+2;
  91. if (len < optlen)
  92. goto bad;
  93. /* Rearrange the source address in @iph and the
  94. * addresses in home address option for final source.
  95. * See 11.3.2 of RFC 3775 for details.
  96. */
  97. if (opt[off] == IPV6_TLV_HAO) {
  98. struct in6_addr final_addr;
  99. struct ipv6_destopt_hao *hao;
  100. hao = (struct ipv6_destopt_hao *)&opt[off];
  101. if (hao->length != sizeof(hao->addr)) {
  102. if (net_ratelimit())
  103. printk(KERN_WARNING "destopt hao: invalid header length: %u\n", hao->length);
  104. goto bad;
  105. }
  106. ipv6_addr_copy(&final_addr, &hao->addr);
  107. ipv6_addr_copy(&hao->addr, &iph->saddr);
  108. ipv6_addr_copy(&iph->saddr, &final_addr);
  109. }
  110. break;
  111. }
  112. off += optlen;
  113. len -= optlen;
  114. }
  115. if (len == 0)
  116. return;
  117. bad:
  118. return;
  119. }
  120. #endif
  121. /**
  122. * ipv6_rearrange_rthdr - rearrange IPv6 routing header
  123. * @iph: IPv6 header
  124. * @rthdr: routing header
  125. *
  126. * Rearrange the destination address in @iph and the addresses in @rthdr
  127. * so that they appear in the order they will at the final destination.
  128. * See Appendix A2 of RFC 2402 for details.
  129. */
  130. static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
  131. {
  132. int segments, segments_left;
  133. struct in6_addr *addrs;
  134. struct in6_addr final_addr;
  135. segments_left = rthdr->segments_left;
  136. if (segments_left == 0)
  137. return;
  138. rthdr->segments_left = 0;
  139. /* The value of rthdr->hdrlen has been verified either by the system
  140. * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming
  141. * packets. So we can assume that it is even and that segments is
  142. * greater than or equal to segments_left.
  143. *
  144. * For the same reason we can assume that this option is of type 0.
  145. */
  146. segments = rthdr->hdrlen >> 1;
  147. addrs = ((struct rt0_hdr *)rthdr)->addr;
  148. ipv6_addr_copy(&final_addr, addrs + segments - 1);
  149. addrs += segments - segments_left;
  150. memmove(addrs + 1, addrs, (segments_left - 1) * sizeof(*addrs));
  151. ipv6_addr_copy(addrs, &iph->daddr);
  152. ipv6_addr_copy(&iph->daddr, &final_addr);
  153. }
  154. #ifdef CONFIG_IPV6_MIP6
  155. static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
  156. #else
  157. static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len)
  158. #endif
  159. {
  160. union {
  161. struct ipv6hdr *iph;
  162. struct ipv6_opt_hdr *opth;
  163. struct ipv6_rt_hdr *rth;
  164. char *raw;
  165. } exthdr = { .iph = iph };
  166. char *end = exthdr.raw + len;
  167. int nexthdr = iph->nexthdr;
  168. exthdr.iph++;
  169. while (exthdr.raw < end) {
  170. switch (nexthdr) {
  171. #ifdef CONFIG_IPV6_MIP6
  172. case NEXTHDR_HOP:
  173. if (!zero_out_mutable_opts(exthdr.opth)) {
  174. LIMIT_NETDEBUG(
  175. KERN_WARNING "overrun %sopts\n",
  176. nexthdr == NEXTHDR_HOP ?
  177. "hop" : "dest");
  178. return -EINVAL;
  179. }
  180. break;
  181. case NEXTHDR_DEST:
  182. if (dir == XFRM_POLICY_OUT)
  183. ipv6_rearrange_destopt(iph, exthdr.opth);
  184. if (!zero_out_mutable_opts(exthdr.opth)) {
  185. LIMIT_NETDEBUG(
  186. KERN_WARNING "overrun %sopts\n",
  187. nexthdr == NEXTHDR_HOP ?
  188. "hop" : "dest");
  189. return -EINVAL;
  190. }
  191. break;
  192. #else
  193. case NEXTHDR_HOP:
  194. case NEXTHDR_DEST:
  195. if (!zero_out_mutable_opts(exthdr.opth)) {
  196. LIMIT_NETDEBUG(
  197. KERN_WARNING "overrun %sopts\n",
  198. nexthdr == NEXTHDR_HOP ?
  199. "hop" : "dest");
  200. return -EINVAL;
  201. }
  202. break;
  203. #endif
  204. case NEXTHDR_ROUTING:
  205. ipv6_rearrange_rthdr(iph, exthdr.rth);
  206. break;
  207. default :
  208. return 0;
  209. }
  210. nexthdr = exthdr.opth->nexthdr;
  211. exthdr.raw += ipv6_optlen(exthdr.opth);
  212. }
  213. return 0;
  214. }
  215. static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
  216. {
  217. int err;
  218. int extlen;
  219. struct ipv6hdr *top_iph;
  220. struct ip_auth_hdr *ah;
  221. struct ah_data *ahp;
  222. u8 nexthdr;
  223. char tmp_base[8];
  224. struct {
  225. #ifdef CONFIG_IPV6_MIP6
  226. struct in6_addr saddr;
  227. #endif
  228. struct in6_addr daddr;
  229. char hdrs[0];
  230. } *tmp_ext;
  231. top_iph = (struct ipv6hdr *)skb->data;
  232. top_iph->payload_len = htons(skb->len - sizeof(*top_iph));
  233. nexthdr = *skb->nh.raw;
  234. *skb->nh.raw = IPPROTO_AH;
  235. /* When there are no extension headers, we only need to save the first
  236. * 8 bytes of the base IP header.
  237. */
  238. memcpy(tmp_base, top_iph, sizeof(tmp_base));
  239. tmp_ext = NULL;
  240. extlen = skb->h.raw - (unsigned char *)(top_iph + 1);
  241. if (extlen) {
  242. extlen += sizeof(*tmp_ext);
  243. tmp_ext = kmalloc(extlen, GFP_ATOMIC);
  244. if (!tmp_ext) {
  245. err = -ENOMEM;
  246. goto error;
  247. }
  248. #ifdef CONFIG_IPV6_MIP6
  249. memcpy(tmp_ext, &top_iph->saddr, extlen);
  250. err = ipv6_clear_mutable_options(top_iph,
  251. extlen - sizeof(*tmp_ext) +
  252. sizeof(*top_iph),
  253. XFRM_POLICY_OUT);
  254. #else
  255. memcpy(tmp_ext, &top_iph->daddr, extlen);
  256. err = ipv6_clear_mutable_options(top_iph,
  257. extlen - sizeof(*tmp_ext) +
  258. sizeof(*top_iph));
  259. #endif
  260. if (err)
  261. goto error_free_iph;
  262. }
  263. ah = (struct ip_auth_hdr *)skb->h.raw;
  264. ah->nexthdr = nexthdr;
  265. top_iph->priority = 0;
  266. top_iph->flow_lbl[0] = 0;
  267. top_iph->flow_lbl[1] = 0;
  268. top_iph->flow_lbl[2] = 0;
  269. top_iph->hop_limit = 0;
  270. ahp = x->data;
  271. ah->hdrlen = (XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) +
  272. ahp->icv_trunc_len) >> 2) - 2;
  273. ah->reserved = 0;
  274. ah->spi = x->id.spi;
  275. ah->seq_no = htonl(++x->replay.oseq);
  276. xfrm_aevent_doreplay(x);
  277. err = ah_mac_digest(ahp, skb, ah->auth_data);
  278. if (err)
  279. goto error_free_iph;
  280. memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
  281. err = 0;
  282. memcpy(top_iph, tmp_base, sizeof(tmp_base));
  283. if (tmp_ext) {
  284. #ifdef CONFIG_IPV6_MIP6
  285. memcpy(&top_iph->saddr, tmp_ext, extlen);
  286. #else
  287. memcpy(&top_iph->daddr, tmp_ext, extlen);
  288. #endif
  289. error_free_iph:
  290. kfree(tmp_ext);
  291. }
  292. error:
  293. return err;
  294. }
  295. static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
  296. {
  297. /*
  298. * Before process AH
  299. * [IPv6][Ext1][Ext2][AH][Dest][Payload]
  300. * |<-------------->| hdr_len
  301. *
  302. * To erase AH:
  303. * Keeping copy of cleared headers. After AH processing,
  304. * Moving the pointer of skb->nh.raw by using skb_pull as long as AH
  305. * header length. Then copy back the copy as long as hdr_len
  306. * If destination header following AH exists, copy it into after [Ext2].
  307. *
  308. * |<>|[IPv6][Ext1][Ext2][Dest][Payload]
  309. * There is offset of AH before IPv6 header after the process.
  310. */
  311. struct ipv6_auth_hdr *ah;
  312. struct ah_data *ahp;
  313. unsigned char *tmp_hdr = NULL;
  314. u16 hdr_len;
  315. u16 ah_hlen;
  316. int nexthdr;
  317. int err = -EINVAL;
  318. if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
  319. goto out;
  320. /* We are going to _remove_ AH header to keep sockets happy,
  321. * so... Later this can change. */
  322. if (skb_cloned(skb) &&
  323. pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
  324. goto out;
  325. hdr_len = skb->data - skb->nh.raw;
  326. ah = (struct ipv6_auth_hdr*)skb->data;
  327. ahp = x->data;
  328. nexthdr = ah->nexthdr;
  329. ah_hlen = (ah->hdrlen + 2) << 2;
  330. if (ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_full_len) &&
  331. ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len))
  332. goto out;
  333. if (!pskb_may_pull(skb, ah_hlen))
  334. goto out;
  335. tmp_hdr = kmalloc(hdr_len, GFP_ATOMIC);
  336. if (!tmp_hdr)
  337. goto out;
  338. memcpy(tmp_hdr, skb->nh.raw, hdr_len);
  339. #ifdef CONFIG_IPV6_MIP6
  340. if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len, XFRM_POLICY_IN))
  341. goto free_out;
  342. #else
  343. if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len))
  344. goto free_out;
  345. #endif
  346. skb->nh.ipv6h->priority = 0;
  347. skb->nh.ipv6h->flow_lbl[0] = 0;
  348. skb->nh.ipv6h->flow_lbl[1] = 0;
  349. skb->nh.ipv6h->flow_lbl[2] = 0;
  350. skb->nh.ipv6h->hop_limit = 0;
  351. {
  352. u8 auth_data[MAX_AH_AUTH_LEN];
  353. memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
  354. memset(ah->auth_data, 0, ahp->icv_trunc_len);
  355. skb_push(skb, hdr_len);
  356. err = ah_mac_digest(ahp, skb, ah->auth_data);
  357. if (err)
  358. goto free_out;
  359. err = -EINVAL;
  360. if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len)) {
  361. LIMIT_NETDEBUG(KERN_WARNING "ipsec ah authentication error\n");
  362. x->stats.integrity_failed++;
  363. goto free_out;
  364. }
  365. }
  366. skb->h.raw = memcpy(skb->nh.raw += ah_hlen, tmp_hdr, hdr_len);
  367. __skb_pull(skb, ah_hlen + hdr_len);
  368. kfree(tmp_hdr);
  369. return nexthdr;
  370. free_out:
  371. kfree(tmp_hdr);
  372. out:
  373. return err;
  374. }
  375. static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  376. int type, int code, int offset, __u32 info)
  377. {
  378. struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
  379. struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);
  380. struct xfrm_state *x;
  381. if (type != ICMPV6_DEST_UNREACH &&
  382. type != ICMPV6_PKT_TOOBIG)
  383. return;
  384. x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
  385. if (!x)
  386. return;
  387. NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/" NIP6_FMT "\n",
  388. ntohl(ah->spi), NIP6(iph->daddr));
  389. xfrm_state_put(x);
  390. }
  391. static int ah6_init_state(struct xfrm_state *x)
  392. {
  393. struct ah_data *ahp = NULL;
  394. struct xfrm_algo_desc *aalg_desc;
  395. struct crypto_hash *tfm;
  396. if (!x->aalg)
  397. goto error;
  398. /* null auth can use a zero length key */
  399. if (x->aalg->alg_key_len > 512)
  400. goto error;
  401. if (x->encap)
  402. goto error;
  403. ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
  404. if (ahp == NULL)
  405. return -ENOMEM;
  406. ahp->key = x->aalg->alg_key;
  407. ahp->key_len = (x->aalg->alg_key_len+7)/8;
  408. tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
  409. if (IS_ERR(tfm))
  410. goto error;
  411. ahp->tfm = tfm;
  412. if (crypto_hash_setkey(tfm, ahp->key, ahp->key_len))
  413. goto error;
  414. /*
  415. * Lookup the algorithm description maintained by xfrm_algo,
  416. * verify crypto transform properties, and store information
  417. * we need for AH processing. This lookup cannot fail here
  418. * after a successful crypto_alloc_hash().
  419. */
  420. aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
  421. BUG_ON(!aalg_desc);
  422. if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
  423. crypto_hash_digestsize(tfm)) {
  424. printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
  425. x->aalg->alg_name, crypto_hash_digestsize(tfm),
  426. aalg_desc->uinfo.auth.icv_fullbits/8);
  427. goto error;
  428. }
  429. ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
  430. ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
  431. BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
  432. ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
  433. if (!ahp->work_icv)
  434. goto error;
  435. x->props.header_len = XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len);
  436. if (x->props.mode == XFRM_MODE_TUNNEL)
  437. x->props.header_len += sizeof(struct ipv6hdr);
  438. x->data = ahp;
  439. return 0;
  440. error:
  441. if (ahp) {
  442. kfree(ahp->work_icv);
  443. crypto_free_hash(ahp->tfm);
  444. kfree(ahp);
  445. }
  446. return -EINVAL;
  447. }
  448. static void ah6_destroy(struct xfrm_state *x)
  449. {
  450. struct ah_data *ahp = x->data;
  451. if (!ahp)
  452. return;
  453. kfree(ahp->work_icv);
  454. ahp->work_icv = NULL;
  455. crypto_free_hash(ahp->tfm);
  456. ahp->tfm = NULL;
  457. kfree(ahp);
  458. }
  459. static struct xfrm_type ah6_type =
  460. {
  461. .description = "AH6",
  462. .owner = THIS_MODULE,
  463. .proto = IPPROTO_AH,
  464. .init_state = ah6_init_state,
  465. .destructor = ah6_destroy,
  466. .input = ah6_input,
  467. .output = ah6_output,
  468. .hdr_offset = xfrm6_find_1stfragopt,
  469. };
  470. static struct inet6_protocol ah6_protocol = {
  471. .handler = xfrm6_rcv,
  472. .err_handler = ah6_err,
  473. .flags = INET6_PROTO_NOPOLICY,
  474. };
  475. static int __init ah6_init(void)
  476. {
  477. if (xfrm_register_type(&ah6_type, AF_INET6) < 0) {
  478. printk(KERN_INFO "ipv6 ah init: can't add xfrm type\n");
  479. return -EAGAIN;
  480. }
  481. if (inet6_add_protocol(&ah6_protocol, IPPROTO_AH) < 0) {
  482. printk(KERN_INFO "ipv6 ah init: can't add protocol\n");
  483. xfrm_unregister_type(&ah6_type, AF_INET6);
  484. return -EAGAIN;
  485. }
  486. return 0;
  487. }
  488. static void __exit ah6_fini(void)
  489. {
  490. if (inet6_del_protocol(&ah6_protocol, IPPROTO_AH) < 0)
  491. printk(KERN_INFO "ipv6 ah close: can't remove protocol\n");
  492. if (xfrm_unregister_type(&ah6_type, AF_INET6) < 0)
  493. printk(KERN_INFO "ipv6 ah close: can't remove xfrm type\n");
  494. }
  495. module_init(ah6_init);
  496. module_exit(ah6_fini);
  497. MODULE_LICENSE("GPL");