1 #define pr_fmt(fmt) "IPsec: " fmt
3 #include <crypto/aead.h>
4 #include <crypto/authenc.h>
6 #include <linux/module.h>
10 #include <linux/scatterlist.h>
11 #include <linux/kernel.h>
12 #include <linux/pfkeyv2.h>
13 #include <linux/rtnetlink.h>
14 #include <linux/slab.h>
15 #include <linux/spinlock.h>
16 #include <linux/in6.h>
18 #include <net/protocol.h>
22 struct xfrm_skb_cb xfrm
;
26 #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
28 static u32
esp4_get_mtu(struct xfrm_state
*x
, int mtu
);
31 * Allocate an AEAD request structure with extra space for SG and IV.
33 * For alignment considerations the IV is placed at the front, followed
34 * by the request and finally the SG list.
36 * TODO: Use spare space in skb for this where possible.
38 static void *esp_alloc_tmp(struct crypto_aead
*aead
, int nfrags
, int seqhilen
)
44 len
+= crypto_aead_ivsize(aead
);
47 len
+= crypto_aead_alignmask(aead
) &
48 ~(crypto_tfm_ctx_alignment() - 1);
49 len
= ALIGN(len
, crypto_tfm_ctx_alignment());
52 len
+= sizeof(struct aead_givcrypt_request
) + crypto_aead_reqsize(aead
);
53 len
= ALIGN(len
, __alignof__(struct scatterlist
));
55 len
+= sizeof(struct scatterlist
) * nfrags
;
57 return kmalloc(len
, GFP_ATOMIC
);
60 static inline __be32
*esp_tmp_seqhi(void *tmp
)
62 return PTR_ALIGN((__be32
*)tmp
, __alignof__(__be32
));
64 static inline u8
*esp_tmp_iv(struct crypto_aead
*aead
, void *tmp
, int seqhilen
)
66 return crypto_aead_ivsize(aead
) ?
67 PTR_ALIGN((u8
*)tmp
+ seqhilen
,
68 crypto_aead_alignmask(aead
) + 1) : tmp
+ seqhilen
;
71 static inline struct aead_givcrypt_request
*esp_tmp_givreq(
72 struct crypto_aead
*aead
, u8
*iv
)
74 struct aead_givcrypt_request
*req
;
76 req
= (void *)PTR_ALIGN(iv
+ crypto_aead_ivsize(aead
),
77 crypto_tfm_ctx_alignment());
78 aead_givcrypt_set_tfm(req
, aead
);
82 static inline struct aead_request
*esp_tmp_req(struct crypto_aead
*aead
, u8
*iv
)
84 struct aead_request
*req
;
86 req
= (void *)PTR_ALIGN(iv
+ crypto_aead_ivsize(aead
),
87 crypto_tfm_ctx_alignment());
88 aead_request_set_tfm(req
, aead
);
92 static inline struct scatterlist
*esp_req_sg(struct crypto_aead
*aead
,
93 struct aead_request
*req
)
95 return (void *)ALIGN((unsigned long)(req
+ 1) +
96 crypto_aead_reqsize(aead
),
97 __alignof__(struct scatterlist
));
100 static inline struct scatterlist
*esp_givreq_sg(
101 struct crypto_aead
*aead
, struct aead_givcrypt_request
*req
)
103 return (void *)ALIGN((unsigned long)(req
+ 1) +
104 crypto_aead_reqsize(aead
),
105 __alignof__(struct scatterlist
));
108 static void esp_output_done(struct crypto_async_request
*base
, int err
)
110 struct sk_buff
*skb
= base
->data
;
112 kfree(ESP_SKB_CB(skb
)->tmp
);
113 xfrm_output_resume(skb
, err
);
116 static int esp_output(struct xfrm_state
*x
, struct sk_buff
*skb
)
119 struct ip_esp_hdr
*esph
;
120 struct crypto_aead
*aead
;
121 struct aead_givcrypt_request
*req
;
122 struct scatterlist
*sg
;
123 struct scatterlist
*asg
;
124 struct sk_buff
*trailer
;
139 /* skb is pure payload to encrypt */
142 alen
= crypto_aead_authsize(aead
);
146 struct xfrm_dst
*dst
= (struct xfrm_dst
*)skb_dst(skb
);
149 padto
= min(x
->tfcpad
, esp4_get_mtu(x
, dst
->child_mtu_cached
));
150 if (skb
->len
< padto
)
151 tfclen
= padto
- skb
->len
;
153 blksize
= ALIGN(crypto_aead_blocksize(aead
), 4);
154 clen
= ALIGN(skb
->len
+ 2 + tfclen
, blksize
);
155 plen
= clen
- skb
->len
- tfclen
;
157 err
= skb_cow_data(skb
, tfclen
+ plen
+ alen
, &trailer
);
162 assoclen
= sizeof(*esph
);
166 if (x
->props
.flags
& XFRM_STATE_ESN
) {
168 seqhilen
+= sizeof(__be32
);
169 assoclen
+= seqhilen
;
172 tmp
= esp_alloc_tmp(aead
, nfrags
+ sglists
, seqhilen
);
178 seqhi
= esp_tmp_seqhi(tmp
);
179 iv
= esp_tmp_iv(aead
, tmp
, seqhilen
);
180 req
= esp_tmp_givreq(aead
, iv
);
181 asg
= esp_givreq_sg(aead
, req
);
184 /* Fill padding... */
185 tail
= skb_tail_pointer(trailer
);
187 memset(tail
, 0, tfclen
);
192 for (i
= 0; i
< plen
- 2; i
++)
195 tail
[plen
- 2] = plen
- 2;
196 tail
[plen
- 1] = *skb_mac_header(skb
);
197 pskb_put(skb
, trailer
, clen
- skb
->len
+ alen
);
199 skb_push(skb
, -skb_network_offset(skb
));
200 esph
= ip_esp_hdr(skb
);
201 *skb_mac_header(skb
) = IPPROTO_ESP
;
203 /* this is non-NULL only with UDP Encapsulation */
205 struct xfrm_encap_tmpl
*encap
= x
->encap
;
211 spin_lock_bh(&x
->lock
);
212 sport
= encap
->encap_sport
;
213 dport
= encap
->encap_dport
;
214 encap_type
= encap
->encap_type
;
215 spin_unlock_bh(&x
->lock
);
217 uh
= (struct udphdr
*)esph
;
220 uh
->len
= htons(skb
->len
- skb_transport_offset(skb
));
223 switch (encap_type
) {
225 case UDP_ENCAP_ESPINUDP
:
226 esph
= (struct ip_esp_hdr
*)(uh
+ 1);
228 case UDP_ENCAP_ESPINUDP_NON_IKE
:
229 udpdata32
= (__be32
*)(uh
+ 1);
230 udpdata32
[0] = udpdata32
[1] = 0;
231 esph
= (struct ip_esp_hdr
*)(udpdata32
+ 2);
235 *skb_mac_header(skb
) = IPPROTO_UDP
;
238 esph
->spi
= x
->id
.spi
;
239 esph
->seq_no
= htonl(XFRM_SKB_CB(skb
)->seq
.output
.low
);
241 sg_init_table(sg
, nfrags
);
242 skb_to_sgvec(skb
, sg
,
243 esph
->enc_data
+ crypto_aead_ivsize(aead
) - skb
->data
,
246 if ((x
->props
.flags
& XFRM_STATE_ESN
)) {
247 sg_init_table(asg
, 3);
248 sg_set_buf(asg
, &esph
->spi
, sizeof(__be32
));
249 *seqhi
= htonl(XFRM_SKB_CB(skb
)->seq
.output
.hi
);
250 sg_set_buf(asg
+ 1, seqhi
, seqhilen
);
251 sg_set_buf(asg
+ 2, &esph
->seq_no
, sizeof(__be32
));
253 sg_init_one(asg
, esph
, sizeof(*esph
));
255 aead_givcrypt_set_callback(req
, 0, esp_output_done
, skb
);
256 aead_givcrypt_set_crypt(req
, sg
, sg
, clen
, iv
);
257 aead_givcrypt_set_assoc(req
, asg
, assoclen
);
258 aead_givcrypt_set_giv(req
, esph
->enc_data
,
259 XFRM_SKB_CB(skb
)->seq
.output
.low
);
261 ESP_SKB_CB(skb
)->tmp
= tmp
;
262 err
= crypto_aead_givencrypt(req
);
263 if (err
== -EINPROGRESS
)
275 static int esp_input_done2(struct sk_buff
*skb
, int err
)
277 const struct iphdr
*iph
;
278 struct xfrm_state
*x
= xfrm_input_state(skb
);
279 struct crypto_aead
*aead
= x
->data
;
280 int alen
= crypto_aead_authsize(aead
);
281 int hlen
= sizeof(struct ip_esp_hdr
) + crypto_aead_ivsize(aead
);
282 int elen
= skb
->len
- hlen
;
287 kfree(ESP_SKB_CB(skb
)->tmp
);
292 if (skb_copy_bits(skb
, skb
->len
-alen
-2, nexthdr
, 2))
297 if (padlen
+ 2 + alen
>= elen
)
300 /* ... check padding bits here. Silly. :-) */
306 struct xfrm_encap_tmpl
*encap
= x
->encap
;
307 struct udphdr
*uh
= (void *)(skb_network_header(skb
) + ihl
);
310 * 1) if the NAT-T peer's IP or port changed then
311 * advertize the change to the keying daemon.
312 * This is an inbound SA, so just compare
315 if (iph
->saddr
!= x
->props
.saddr
.a4
||
316 uh
->source
!= encap
->encap_sport
) {
317 xfrm_address_t ipaddr
;
319 ipaddr
.a4
= iph
->saddr
;
320 km_new_mapping(x
, &ipaddr
, uh
->source
);
322 /* XXX: perhaps add an extra
323 * policy check here, to see
324 * if we should allow or
325 * reject a packet from a
332 * 2) ignore UDP/TCP checksums in case
333 * of NAT-T in Transport Mode, or
334 * perform other post-processing fixes
335 * as per draft-ietf-ipsec-udp-encaps-06,
338 if (x
->props
.mode
== XFRM_MODE_TRANSPORT
)
339 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
342 pskb_trim(skb
, skb
->len
- alen
- padlen
- 2);
343 __skb_pull(skb
, hlen
);
344 if (x
->props
.mode
== XFRM_MODE_TUNNEL
)
345 skb_reset_transport_header(skb
);
347 skb_set_transport_header(skb
, -ihl
);
351 /* RFC4303: Drop dummy packets without any error */
352 if (err
== IPPROTO_NONE
)
359 static void esp_input_done(struct crypto_async_request
*base
, int err
)
361 struct sk_buff
*skb
= base
->data
;
363 xfrm_input_resume(skb
, esp_input_done2(skb
, err
));
367 * Note: detecting truncated vs. non-truncated authentication data is very
368 * expensive, so we only support truncated data, which is the recommended
371 static int esp_input(struct xfrm_state
*x
, struct sk_buff
*skb
)
373 struct ip_esp_hdr
*esph
;
374 struct crypto_aead
*aead
= x
->data
;
375 struct aead_request
*req
;
376 struct sk_buff
*trailer
;
377 int elen
= skb
->len
- sizeof(*esph
) - crypto_aead_ivsize(aead
);
385 struct scatterlist
*sg
;
386 struct scatterlist
*asg
;
389 if (!pskb_may_pull(skb
, sizeof(*esph
) + crypto_aead_ivsize(aead
)))
395 if ((err
= skb_cow_data(skb
, 0, &trailer
)) < 0)
399 assoclen
= sizeof(*esph
);
403 if (x
->props
.flags
& XFRM_STATE_ESN
) {
405 seqhilen
+= sizeof(__be32
);
406 assoclen
+= seqhilen
;
410 tmp
= esp_alloc_tmp(aead
, nfrags
+ sglists
, seqhilen
);
414 ESP_SKB_CB(skb
)->tmp
= tmp
;
415 seqhi
= esp_tmp_seqhi(tmp
);
416 iv
= esp_tmp_iv(aead
, tmp
, seqhilen
);
417 req
= esp_tmp_req(aead
, iv
);
418 asg
= esp_req_sg(aead
, req
);
421 skb
->ip_summed
= CHECKSUM_NONE
;
423 esph
= (struct ip_esp_hdr
*)skb
->data
;
425 /* Get ivec. This can be wrong, check against another impls. */
428 sg_init_table(sg
, nfrags
);
429 skb_to_sgvec(skb
, sg
, sizeof(*esph
) + crypto_aead_ivsize(aead
), elen
);
431 if ((x
->props
.flags
& XFRM_STATE_ESN
)) {
432 sg_init_table(asg
, 3);
433 sg_set_buf(asg
, &esph
->spi
, sizeof(__be32
));
434 *seqhi
= XFRM_SKB_CB(skb
)->seq
.input
.hi
;
435 sg_set_buf(asg
+ 1, seqhi
, seqhilen
);
436 sg_set_buf(asg
+ 2, &esph
->seq_no
, sizeof(__be32
));
438 sg_init_one(asg
, esph
, sizeof(*esph
));
440 aead_request_set_callback(req
, 0, esp_input_done
, skb
);
441 aead_request_set_crypt(req
, sg
, sg
, elen
, iv
);
442 aead_request_set_assoc(req
, asg
, assoclen
);
444 err
= crypto_aead_decrypt(req
);
445 if (err
== -EINPROGRESS
)
448 err
= esp_input_done2(skb
, err
);
454 static u32
esp4_get_mtu(struct xfrm_state
*x
, int mtu
)
456 struct crypto_aead
*aead
= x
->data
;
457 u32 blksize
= ALIGN(crypto_aead_blocksize(aead
), 4);
458 unsigned int net_adj
;
460 switch (x
->props
.mode
) {
461 case XFRM_MODE_TRANSPORT
:
463 net_adj
= sizeof(struct iphdr
);
465 case XFRM_MODE_TUNNEL
:
472 return ((mtu
- x
->props
.header_len
- crypto_aead_authsize(aead
) -
473 net_adj
) & ~(blksize
- 1)) + net_adj
- 2;
476 static void esp4_err(struct sk_buff
*skb
, u32 info
)
478 struct net
*net
= dev_net(skb
->dev
);
479 const struct iphdr
*iph
= (const struct iphdr
*)skb
->data
;
480 struct ip_esp_hdr
*esph
= (struct ip_esp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
481 struct xfrm_state
*x
;
483 switch (icmp_hdr(skb
)->type
) {
484 case ICMP_DEST_UNREACH
:
485 if (icmp_hdr(skb
)->code
!= ICMP_FRAG_NEEDED
)
493 x
= xfrm_state_lookup(net
, skb
->mark
, (const xfrm_address_t
*)&iph
->daddr
,
494 esph
->spi
, IPPROTO_ESP
, AF_INET
);
498 if (icmp_hdr(skb
)->type
== ICMP_DEST_UNREACH
)
499 ipv4_update_pmtu(skb
, net
, info
, 0, 0, IPPROTO_ESP
, 0);
501 ipv4_redirect(skb
, net
, 0, 0, IPPROTO_ESP
, 0);
505 static void esp_destroy(struct xfrm_state
*x
)
507 struct crypto_aead
*aead
= x
->data
;
512 crypto_free_aead(aead
);
515 static int esp_init_aead(struct xfrm_state
*x
)
517 struct crypto_aead
*aead
;
520 aead
= crypto_alloc_aead(x
->aead
->alg_name
, 0, 0);
527 err
= crypto_aead_setkey(aead
, x
->aead
->alg_key
,
528 (x
->aead
->alg_key_len
+ 7) / 8);
532 err
= crypto_aead_setauthsize(aead
, x
->aead
->alg_icv_len
/ 8);
540 static int esp_init_authenc(struct xfrm_state
*x
)
542 struct crypto_aead
*aead
;
543 struct crypto_authenc_key_param
*param
;
547 char authenc_name
[CRYPTO_MAX_ALG_NAME
];
557 if ((x
->props
.flags
& XFRM_STATE_ESN
)) {
558 if (snprintf(authenc_name
, CRYPTO_MAX_ALG_NAME
,
560 x
->aalg
? x
->aalg
->alg_name
: "digest_null",
561 x
->ealg
->alg_name
) >= CRYPTO_MAX_ALG_NAME
)
564 if (snprintf(authenc_name
, CRYPTO_MAX_ALG_NAME
,
566 x
->aalg
? x
->aalg
->alg_name
: "digest_null",
567 x
->ealg
->alg_name
) >= CRYPTO_MAX_ALG_NAME
)
571 aead
= crypto_alloc_aead(authenc_name
, 0, 0);
578 keylen
= (x
->aalg
? (x
->aalg
->alg_key_len
+ 7) / 8 : 0) +
579 (x
->ealg
->alg_key_len
+ 7) / 8 + RTA_SPACE(sizeof(*param
));
581 key
= kmalloc(keylen
, GFP_KERNEL
);
587 rta
->rta_type
= CRYPTO_AUTHENC_KEYA_PARAM
;
588 rta
->rta_len
= RTA_LENGTH(sizeof(*param
));
589 param
= RTA_DATA(rta
);
590 p
+= RTA_SPACE(sizeof(*param
));
593 struct xfrm_algo_desc
*aalg_desc
;
595 memcpy(p
, x
->aalg
->alg_key
, (x
->aalg
->alg_key_len
+ 7) / 8);
596 p
+= (x
->aalg
->alg_key_len
+ 7) / 8;
598 aalg_desc
= xfrm_aalg_get_byname(x
->aalg
->alg_name
, 0);
602 if (aalg_desc
->uinfo
.auth
.icv_fullbits
/8 !=
603 crypto_aead_authsize(aead
)) {
604 NETDEBUG(KERN_INFO
"ESP: %s digestsize %u != %hu\n",
606 crypto_aead_authsize(aead
),
607 aalg_desc
->uinfo
.auth
.icv_fullbits
/8);
611 err
= crypto_aead_setauthsize(
612 aead
, x
->aalg
->alg_trunc_len
/ 8);
617 param
->enckeylen
= cpu_to_be32((x
->ealg
->alg_key_len
+ 7) / 8);
618 memcpy(p
, x
->ealg
->alg_key
, (x
->ealg
->alg_key_len
+ 7) / 8);
620 err
= crypto_aead_setkey(aead
, key
, keylen
);
629 static int esp_init_state(struct xfrm_state
*x
)
631 struct crypto_aead
*aead
;
638 err
= esp_init_aead(x
);
640 err
= esp_init_authenc(x
);
647 x
->props
.header_len
= sizeof(struct ip_esp_hdr
) +
648 crypto_aead_ivsize(aead
);
649 if (x
->props
.mode
== XFRM_MODE_TUNNEL
)
650 x
->props
.header_len
+= sizeof(struct iphdr
);
651 else if (x
->props
.mode
== XFRM_MODE_BEET
&& x
->sel
.family
!= AF_INET6
)
652 x
->props
.header_len
+= IPV4_BEET_PHMAXLEN
;
654 struct xfrm_encap_tmpl
*encap
= x
->encap
;
656 switch (encap
->encap_type
) {
659 case UDP_ENCAP_ESPINUDP
:
660 x
->props
.header_len
+= sizeof(struct udphdr
);
662 case UDP_ENCAP_ESPINUDP_NON_IKE
:
663 x
->props
.header_len
+= sizeof(struct udphdr
) + 2 * sizeof(u32
);
668 align
= ALIGN(crypto_aead_blocksize(aead
), 4);
669 x
->props
.trailer_len
= align
+ 1 + crypto_aead_authsize(aead
);
675 static const struct xfrm_type esp_type
=
677 .description
= "ESP4",
678 .owner
= THIS_MODULE
,
679 .proto
= IPPROTO_ESP
,
680 .flags
= XFRM_TYPE_REPLAY_PROT
,
681 .init_state
= esp_init_state
,
682 .destructor
= esp_destroy
,
683 .get_mtu
= esp4_get_mtu
,
688 static const struct net_protocol esp4_protocol
= {
689 .handler
= xfrm4_rcv
,
690 .err_handler
= esp4_err
,
695 static int __init
esp4_init(void)
697 if (xfrm_register_type(&esp_type
, AF_INET
) < 0) {
698 pr_info("%s: can't add xfrm type\n", __func__
);
701 if (inet_add_protocol(&esp4_protocol
, IPPROTO_ESP
) < 0) {
702 pr_info("%s: can't add protocol\n", __func__
);
703 xfrm_unregister_type(&esp_type
, AF_INET
);
709 static void __exit
esp4_fini(void)
711 if (inet_del_protocol(&esp4_protocol
, IPPROTO_ESP
) < 0)
712 pr_info("%s: can't remove protocol\n", __func__
);
713 if (xfrm_unregister_type(&esp_type
, AF_INET
) < 0)
714 pr_info("%s: can't remove xfrm type\n", __func__
);
717 module_init(esp4_init
);
718 module_exit(esp4_fini
);
719 MODULE_LICENSE("GPL");
720 MODULE_ALIAS_XFRM_TYPE(AF_INET
, XFRM_PROTO_ESP
);