1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * Copyright (C)2002 USAGI/WIDE Project |
4 | * |
5 | * Authors |
6 | * |
7 | * Mitsuru KANDA @USAGI : IPv6 Support |
8 | * Kazunori MIYAZAWA @USAGI : |
9 | * Kunihiro Ishiguro <kunihiro@ipinfusion.com> |
10 | * |
11 | * This file is derived from net/ipv4/ah.c. |
12 | */ |
13 | |
14 | #define pr_fmt(fmt) "IPv6: " fmt |
15 | |
16 | #include <crypto/hash.h> |
17 | #include <crypto/utils.h> |
18 | #include <linux/module.h> |
19 | #include <linux/slab.h> |
20 | #include <net/ip.h> |
21 | #include <net/ah.h> |
22 | #include <linux/crypto.h> |
23 | #include <linux/pfkeyv2.h> |
24 | #include <linux/string.h> |
25 | #include <linux/scatterlist.h> |
26 | #include <net/ip6_route.h> |
27 | #include <net/icmp.h> |
28 | #include <net/ipv6.h> |
29 | #include <net/protocol.h> |
30 | #include <net/xfrm.h> |
31 | |
32 | #define IPV6HDR_BASELEN 8 |
33 | |
34 | struct tmp_ext { |
35 | #if IS_ENABLED(CONFIG_IPV6_MIP6) |
36 | struct in6_addr saddr; |
37 | #endif |
38 | struct in6_addr daddr; |
39 | char hdrs[]; |
40 | }; |
41 | |
42 | struct ah_skb_cb { |
43 | struct xfrm_skb_cb xfrm; |
44 | void *tmp; |
45 | }; |
46 | |
47 | #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0])) |
48 | |
49 | static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags, |
50 | unsigned int size) |
51 | { |
52 | unsigned int len; |
53 | |
54 | len = size + crypto_ahash_digestsize(tfm: ahash); |
55 | |
56 | len = ALIGN(len, crypto_tfm_ctx_alignment()); |
57 | |
58 | len += sizeof(struct ahash_request) + crypto_ahash_reqsize(tfm: ahash); |
59 | len = ALIGN(len, __alignof__(struct scatterlist)); |
60 | |
61 | len += sizeof(struct scatterlist) * nfrags; |
62 | |
63 | return kmalloc(size: len, GFP_ATOMIC); |
64 | } |
65 | |
66 | static inline struct tmp_ext *ah_tmp_ext(void *base) |
67 | { |
68 | return base + IPV6HDR_BASELEN; |
69 | } |
70 | |
71 | static inline u8 *ah_tmp_auth(u8 *tmp, unsigned int offset) |
72 | { |
73 | return tmp + offset; |
74 | } |
75 | |
76 | static inline u8 *ah_tmp_icv(void *tmp, unsigned int offset) |
77 | { |
78 | return tmp + offset; |
79 | } |
80 | |
81 | static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash, |
82 | u8 *icv) |
83 | { |
84 | struct ahash_request *req; |
85 | |
86 | req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash), |
87 | crypto_tfm_ctx_alignment()); |
88 | |
89 | ahash_request_set_tfm(req, tfm: ahash); |
90 | |
91 | return req; |
92 | } |
93 | |
94 | static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash, |
95 | struct ahash_request *req) |
96 | { |
97 | return (void *)ALIGN((unsigned long)(req + 1) + |
98 | crypto_ahash_reqsize(ahash), |
99 | __alignof__(struct scatterlist)); |
100 | } |
101 | |
102 | static bool zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr) |
103 | { |
104 | u8 *opt = (u8 *)opthdr; |
105 | int len = ipv6_optlen(opthdr); |
106 | int off = 0; |
107 | int optlen = 0; |
108 | |
109 | off += 2; |
110 | len -= 2; |
111 | |
112 | while (len > 0) { |
113 | |
114 | switch (opt[off]) { |
115 | |
116 | case IPV6_TLV_PAD1: |
117 | optlen = 1; |
118 | break; |
119 | default: |
120 | if (len < 2) |
121 | goto bad; |
122 | optlen = opt[off+1]+2; |
123 | if (len < optlen) |
124 | goto bad; |
125 | if (opt[off] & 0x20) |
126 | memset(&opt[off+2], 0, opt[off+1]); |
127 | break; |
128 | } |
129 | |
130 | off += optlen; |
131 | len -= optlen; |
132 | } |
133 | if (len == 0) |
134 | return true; |
135 | |
136 | bad: |
137 | return false; |
138 | } |
139 | |
140 | #if IS_ENABLED(CONFIG_IPV6_MIP6) |
141 | /** |
142 | * ipv6_rearrange_destopt - rearrange IPv6 destination options header |
143 | * @iph: IPv6 header |
144 | * @destopt: destionation options header |
145 | */ |
146 | static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *destopt) |
147 | { |
148 | u8 *opt = (u8 *)destopt; |
149 | int len = ipv6_optlen(destopt); |
150 | int off = 0; |
151 | int optlen = 0; |
152 | |
153 | off += 2; |
154 | len -= 2; |
155 | |
156 | while (len > 0) { |
157 | |
158 | switch (opt[off]) { |
159 | |
160 | case IPV6_TLV_PAD1: |
161 | optlen = 1; |
162 | break; |
163 | default: |
164 | if (len < 2) |
165 | goto bad; |
166 | optlen = opt[off+1]+2; |
167 | if (len < optlen) |
168 | goto bad; |
169 | |
170 | /* Rearrange the source address in @iph and the |
171 | * addresses in home address option for final source. |
172 | * See 11.3.2 of RFC 3775 for details. |
173 | */ |
174 | if (opt[off] == IPV6_TLV_HAO) { |
175 | struct ipv6_destopt_hao *hao; |
176 | |
177 | hao = (struct ipv6_destopt_hao *)&opt[off]; |
178 | if (hao->length != sizeof(hao->addr)) { |
179 | net_warn_ratelimited("destopt hao: invalid header length: %u\n" , |
180 | hao->length); |
181 | goto bad; |
182 | } |
183 | swap(hao->addr, iph->saddr); |
184 | } |
185 | break; |
186 | } |
187 | |
188 | off += optlen; |
189 | len -= optlen; |
190 | } |
191 | /* Note: ok if len == 0 */ |
192 | bad: |
193 | return; |
194 | } |
195 | #else |
196 | static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *destopt) {} |
197 | #endif |
198 | |
199 | /** |
200 | * ipv6_rearrange_rthdr - rearrange IPv6 routing header |
201 | * @iph: IPv6 header |
202 | * @rthdr: routing header |
203 | * |
204 | * Rearrange the destination address in @iph and the addresses in @rthdr |
205 | * so that they appear in the order they will at the final destination. |
206 | * See Appendix A2 of RFC 2402 for details. |
207 | */ |
208 | static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr) |
209 | { |
210 | int segments, segments_left; |
211 | struct in6_addr *addrs; |
212 | struct in6_addr final_addr; |
213 | |
214 | segments_left = rthdr->segments_left; |
215 | if (segments_left == 0) |
216 | return; |
217 | rthdr->segments_left = 0; |
218 | |
219 | /* The value of rthdr->hdrlen has been verified either by the system |
220 | * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming |
221 | * packets. So we can assume that it is even and that segments is |
222 | * greater than or equal to segments_left. |
223 | * |
224 | * For the same reason we can assume that this option is of type 0. |
225 | */ |
226 | segments = rthdr->hdrlen >> 1; |
227 | |
228 | addrs = ((struct rt0_hdr *)rthdr)->addr; |
229 | final_addr = addrs[segments - 1]; |
230 | |
231 | addrs += segments - segments_left; |
232 | memmove(addrs + 1, addrs, (segments_left - 1) * sizeof(*addrs)); |
233 | |
234 | addrs[0] = iph->daddr; |
235 | iph->daddr = final_addr; |
236 | } |
237 | |
238 | static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir) |
239 | { |
240 | union { |
241 | struct ipv6hdr *iph; |
242 | struct ipv6_opt_hdr *opth; |
243 | struct ipv6_rt_hdr *rth; |
244 | char *raw; |
245 | } exthdr = { .iph = iph }; |
246 | char *end = exthdr.raw + len; |
247 | int nexthdr = iph->nexthdr; |
248 | |
249 | exthdr.iph++; |
250 | |
251 | while (exthdr.raw < end) { |
252 | switch (nexthdr) { |
253 | case NEXTHDR_DEST: |
254 | if (dir == XFRM_POLICY_OUT) |
255 | ipv6_rearrange_destopt(iph, destopt: exthdr.opth); |
256 | fallthrough; |
257 | case NEXTHDR_HOP: |
258 | if (!zero_out_mutable_opts(opthdr: exthdr.opth)) { |
259 | net_dbg_ratelimited("overrun %sopts\n" , |
260 | nexthdr == NEXTHDR_HOP ? |
261 | "hop" : "dest" ); |
262 | return -EINVAL; |
263 | } |
264 | break; |
265 | |
266 | case NEXTHDR_ROUTING: |
267 | ipv6_rearrange_rthdr(iph, rthdr: exthdr.rth); |
268 | break; |
269 | |
270 | default: |
271 | return 0; |
272 | } |
273 | |
274 | nexthdr = exthdr.opth->nexthdr; |
275 | exthdr.raw += ipv6_optlen(exthdr.opth); |
276 | } |
277 | |
278 | return 0; |
279 | } |
280 | |
281 | static void ah6_output_done(void *data, int err) |
282 | { |
283 | int extlen; |
284 | u8 *iph_base; |
285 | u8 *icv; |
286 | struct sk_buff *skb = data; |
287 | struct xfrm_state *x = skb_dst(skb)->xfrm; |
288 | struct ah_data *ahp = x->data; |
289 | struct ipv6hdr *top_iph = ipv6_hdr(skb); |
290 | struct ip_auth_hdr *ah = ip_auth_hdr(skb); |
291 | struct tmp_ext *iph_ext; |
292 | |
293 | extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr); |
294 | if (extlen) |
295 | extlen += sizeof(*iph_ext); |
296 | |
297 | iph_base = AH_SKB_CB(skb)->tmp; |
298 | iph_ext = ah_tmp_ext(base: iph_base); |
299 | icv = ah_tmp_icv(tmp: iph_ext, offset: extlen); |
300 | |
301 | memcpy(ah->auth_data, icv, ahp->icv_trunc_len); |
302 | memcpy(top_iph, iph_base, IPV6HDR_BASELEN); |
303 | |
304 | if (extlen) { |
305 | #if IS_ENABLED(CONFIG_IPV6_MIP6) |
306 | memcpy(&top_iph->saddr, iph_ext, extlen); |
307 | #else |
308 | memcpy(&top_iph->daddr, iph_ext, extlen); |
309 | #endif |
310 | } |
311 | |
312 | kfree(AH_SKB_CB(skb)->tmp); |
313 | xfrm_output_resume(sk: skb->sk, skb, err); |
314 | } |
315 | |
316 | static int ah6_output(struct xfrm_state *x, struct sk_buff *skb) |
317 | { |
318 | int err; |
319 | int nfrags; |
320 | int extlen; |
321 | u8 *iph_base; |
322 | u8 *icv; |
323 | u8 nexthdr; |
324 | struct sk_buff *trailer; |
325 | struct crypto_ahash *ahash; |
326 | struct ahash_request *req; |
327 | struct scatterlist *sg; |
328 | struct ipv6hdr *top_iph; |
329 | struct ip_auth_hdr *ah; |
330 | struct ah_data *ahp; |
331 | struct tmp_ext *iph_ext; |
332 | int seqhi_len = 0; |
333 | __be32 *seqhi; |
334 | int sglists = 0; |
335 | struct scatterlist *seqhisg; |
336 | |
337 | ahp = x->data; |
338 | ahash = ahp->ahash; |
339 | |
340 | err = skb_cow_data(skb, tailbits: 0, trailer: &trailer); |
341 | if (err < 0) |
342 | goto out; |
343 | nfrags = err; |
344 | |
345 | skb_push(skb, len: -skb_network_offset(skb)); |
346 | extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr); |
347 | if (extlen) |
348 | extlen += sizeof(*iph_ext); |
349 | |
350 | if (x->props.flags & XFRM_STATE_ESN) { |
351 | sglists = 1; |
352 | seqhi_len = sizeof(*seqhi); |
353 | } |
354 | err = -ENOMEM; |
355 | iph_base = ah_alloc_tmp(ahash, nfrags: nfrags + sglists, IPV6HDR_BASELEN + |
356 | extlen + seqhi_len); |
357 | if (!iph_base) |
358 | goto out; |
359 | |
360 | iph_ext = ah_tmp_ext(base: iph_base); |
361 | seqhi = (__be32 *)((char *)iph_ext + extlen); |
362 | icv = ah_tmp_icv(tmp: seqhi, offset: seqhi_len); |
363 | req = ah_tmp_req(ahash, icv); |
364 | sg = ah_req_sg(ahash, req); |
365 | seqhisg = sg + nfrags; |
366 | |
367 | ah = ip_auth_hdr(skb); |
368 | memset(ah->auth_data, 0, ahp->icv_trunc_len); |
369 | |
370 | top_iph = ipv6_hdr(skb); |
371 | top_iph->payload_len = htons(skb->len - sizeof(*top_iph)); |
372 | |
373 | nexthdr = *skb_mac_header(skb); |
374 | *skb_mac_header(skb) = IPPROTO_AH; |
375 | |
376 | /* When there are no extension headers, we only need to save the first |
377 | * 8 bytes of the base IP header. |
378 | */ |
379 | memcpy(iph_base, top_iph, IPV6HDR_BASELEN); |
380 | |
381 | if (extlen) { |
382 | #if IS_ENABLED(CONFIG_IPV6_MIP6) |
383 | memcpy(iph_ext, &top_iph->saddr, extlen); |
384 | #else |
385 | memcpy(iph_ext, &top_iph->daddr, extlen); |
386 | #endif |
387 | err = ipv6_clear_mutable_options(iph: top_iph, |
388 | len: extlen - sizeof(*iph_ext) + |
389 | sizeof(*top_iph), |
390 | dir: XFRM_POLICY_OUT); |
391 | if (err) |
392 | goto out_free; |
393 | } |
394 | |
395 | ah->nexthdr = nexthdr; |
396 | |
397 | top_iph->priority = 0; |
398 | top_iph->flow_lbl[0] = 0; |
399 | top_iph->flow_lbl[1] = 0; |
400 | top_iph->flow_lbl[2] = 0; |
401 | top_iph->hop_limit = 0; |
402 | |
403 | ah->hdrlen = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2; |
404 | |
405 | ah->reserved = 0; |
406 | ah->spi = x->id.spi; |
407 | ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low); |
408 | |
409 | sg_init_table(sg, nfrags + sglists); |
410 | err = skb_to_sgvec_nomark(skb, sg, offset: 0, len: skb->len); |
411 | if (unlikely(err < 0)) |
412 | goto out_free; |
413 | |
414 | if (x->props.flags & XFRM_STATE_ESN) { |
415 | /* Attach seqhi sg right after packet payload */ |
416 | *seqhi = htonl(XFRM_SKB_CB(skb)->seq.output.hi); |
417 | sg_set_buf(sg: seqhisg, buf: seqhi, buflen: seqhi_len); |
418 | } |
419 | ahash_request_set_crypt(req, src: sg, result: icv, nbytes: skb->len + seqhi_len); |
420 | ahash_request_set_callback(req, flags: 0, compl: ah6_output_done, data: skb); |
421 | |
422 | AH_SKB_CB(skb)->tmp = iph_base; |
423 | |
424 | err = crypto_ahash_digest(req); |
425 | if (err) { |
426 | if (err == -EINPROGRESS) |
427 | goto out; |
428 | |
429 | if (err == -ENOSPC) |
430 | err = NET_XMIT_DROP; |
431 | goto out_free; |
432 | } |
433 | |
434 | memcpy(ah->auth_data, icv, ahp->icv_trunc_len); |
435 | memcpy(top_iph, iph_base, IPV6HDR_BASELEN); |
436 | |
437 | if (extlen) { |
438 | #if IS_ENABLED(CONFIG_IPV6_MIP6) |
439 | memcpy(&top_iph->saddr, iph_ext, extlen); |
440 | #else |
441 | memcpy(&top_iph->daddr, iph_ext, extlen); |
442 | #endif |
443 | } |
444 | |
445 | out_free: |
446 | kfree(objp: iph_base); |
447 | out: |
448 | return err; |
449 | } |
450 | |
451 | static void ah6_input_done(void *data, int err) |
452 | { |
453 | u8 *auth_data; |
454 | u8 *icv; |
455 | u8 *work_iph; |
456 | struct sk_buff *skb = data; |
457 | struct xfrm_state *x = xfrm_input_state(skb); |
458 | struct ah_data *ahp = x->data; |
459 | struct ip_auth_hdr *ah = ip_auth_hdr(skb); |
460 | int hdr_len = skb_network_header_len(skb); |
461 | int ah_hlen = ipv6_authlen(ah); |
462 | |
463 | if (err) |
464 | goto out; |
465 | |
466 | work_iph = AH_SKB_CB(skb)->tmp; |
467 | auth_data = ah_tmp_auth(tmp: work_iph, offset: hdr_len); |
468 | icv = ah_tmp_icv(tmp: auth_data, offset: ahp->icv_trunc_len); |
469 | |
470 | err = crypto_memneq(a: icv, b: auth_data, size: ahp->icv_trunc_len) ? -EBADMSG : 0; |
471 | if (err) |
472 | goto out; |
473 | |
474 | err = ah->nexthdr; |
475 | |
476 | skb->network_header += ah_hlen; |
477 | memcpy(skb_network_header(skb), work_iph, hdr_len); |
478 | __skb_pull(skb, len: ah_hlen + hdr_len); |
479 | if (x->props.mode == XFRM_MODE_TUNNEL) |
480 | skb_reset_transport_header(skb); |
481 | else |
482 | skb_set_transport_header(skb, offset: -hdr_len); |
483 | out: |
484 | kfree(AH_SKB_CB(skb)->tmp); |
485 | xfrm_input_resume(skb, nexthdr: err); |
486 | } |
487 | |
488 | |
489 | |
490 | static int ah6_input(struct xfrm_state *x, struct sk_buff *skb) |
491 | { |
492 | /* |
493 | * Before process AH |
494 | * [IPv6][Ext1][Ext2][AH][Dest][Payload] |
495 | * |<-------------->| hdr_len |
496 | * |
497 | * To erase AH: |
498 | * Keeping copy of cleared headers. After AH processing, |
499 | * Moving the pointer of skb->network_header by using skb_pull as long |
500 | * as AH header length. Then copy back the copy as long as hdr_len |
501 | * If destination header following AH exists, copy it into after [Ext2]. |
502 | * |
503 | * |<>|[IPv6][Ext1][Ext2][Dest][Payload] |
504 | * There is offset of AH before IPv6 header after the process. |
505 | */ |
506 | |
507 | u8 *auth_data; |
508 | u8 *icv; |
509 | u8 *work_iph; |
510 | struct sk_buff *trailer; |
511 | struct crypto_ahash *ahash; |
512 | struct ahash_request *req; |
513 | struct scatterlist *sg; |
514 | struct ip_auth_hdr *ah; |
515 | struct ipv6hdr *ip6h; |
516 | struct ah_data *ahp; |
517 | u16 hdr_len; |
518 | u16 ah_hlen; |
519 | int nexthdr; |
520 | int nfrags; |
521 | int err = -ENOMEM; |
522 | int seqhi_len = 0; |
523 | __be32 *seqhi; |
524 | int sglists = 0; |
525 | struct scatterlist *seqhisg; |
526 | |
527 | if (!pskb_may_pull(skb, len: sizeof(struct ip_auth_hdr))) |
528 | goto out; |
529 | |
530 | /* We are going to _remove_ AH header to keep sockets happy, |
531 | * so... Later this can change. */ |
532 | if (skb_unclone(skb, GFP_ATOMIC)) |
533 | goto out; |
534 | |
535 | skb->ip_summed = CHECKSUM_NONE; |
536 | |
537 | hdr_len = skb_network_header_len(skb); |
538 | ah = (struct ip_auth_hdr *)skb->data; |
539 | ahp = x->data; |
540 | ahash = ahp->ahash; |
541 | |
542 | nexthdr = ah->nexthdr; |
543 | ah_hlen = ipv6_authlen(ah); |
544 | |
545 | if (ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_full_len) && |
546 | ah_hlen != XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len)) |
547 | goto out; |
548 | |
549 | if (!pskb_may_pull(skb, len: ah_hlen)) |
550 | goto out; |
551 | |
552 | err = skb_cow_data(skb, tailbits: 0, trailer: &trailer); |
553 | if (err < 0) |
554 | goto out; |
555 | nfrags = err; |
556 | |
557 | ah = (struct ip_auth_hdr *)skb->data; |
558 | ip6h = ipv6_hdr(skb); |
559 | |
560 | skb_push(skb, len: hdr_len); |
561 | |
562 | if (x->props.flags & XFRM_STATE_ESN) { |
563 | sglists = 1; |
564 | seqhi_len = sizeof(*seqhi); |
565 | } |
566 | |
567 | work_iph = ah_alloc_tmp(ahash, nfrags: nfrags + sglists, size: hdr_len + |
568 | ahp->icv_trunc_len + seqhi_len); |
569 | if (!work_iph) { |
570 | err = -ENOMEM; |
571 | goto out; |
572 | } |
573 | |
574 | auth_data = ah_tmp_auth(tmp: (u8 *)work_iph, offset: hdr_len); |
575 | seqhi = (__be32 *)(auth_data + ahp->icv_trunc_len); |
576 | icv = ah_tmp_icv(tmp: seqhi, offset: seqhi_len); |
577 | req = ah_tmp_req(ahash, icv); |
578 | sg = ah_req_sg(ahash, req); |
579 | seqhisg = sg + nfrags; |
580 | |
581 | memcpy(work_iph, ip6h, hdr_len); |
582 | memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len); |
583 | memset(ah->auth_data, 0, ahp->icv_trunc_len); |
584 | |
585 | err = ipv6_clear_mutable_options(iph: ip6h, len: hdr_len, dir: XFRM_POLICY_IN); |
586 | if (err) |
587 | goto out_free; |
588 | |
589 | ip6h->priority = 0; |
590 | ip6h->flow_lbl[0] = 0; |
591 | ip6h->flow_lbl[1] = 0; |
592 | ip6h->flow_lbl[2] = 0; |
593 | ip6h->hop_limit = 0; |
594 | |
595 | sg_init_table(sg, nfrags + sglists); |
596 | err = skb_to_sgvec_nomark(skb, sg, offset: 0, len: skb->len); |
597 | if (unlikely(err < 0)) |
598 | goto out_free; |
599 | |
600 | if (x->props.flags & XFRM_STATE_ESN) { |
601 | /* Attach seqhi sg right after packet payload */ |
602 | *seqhi = XFRM_SKB_CB(skb)->seq.input.hi; |
603 | sg_set_buf(sg: seqhisg, buf: seqhi, buflen: seqhi_len); |
604 | } |
605 | |
606 | ahash_request_set_crypt(req, src: sg, result: icv, nbytes: skb->len + seqhi_len); |
607 | ahash_request_set_callback(req, flags: 0, compl: ah6_input_done, data: skb); |
608 | |
609 | AH_SKB_CB(skb)->tmp = work_iph; |
610 | |
611 | err = crypto_ahash_digest(req); |
612 | if (err) { |
613 | if (err == -EINPROGRESS) |
614 | goto out; |
615 | |
616 | goto out_free; |
617 | } |
618 | |
619 | err = crypto_memneq(a: icv, b: auth_data, size: ahp->icv_trunc_len) ? -EBADMSG : 0; |
620 | if (err) |
621 | goto out_free; |
622 | |
623 | skb->network_header += ah_hlen; |
624 | memcpy(skb_network_header(skb), work_iph, hdr_len); |
625 | __skb_pull(skb, len: ah_hlen + hdr_len); |
626 | |
627 | if (x->props.mode == XFRM_MODE_TUNNEL) |
628 | skb_reset_transport_header(skb); |
629 | else |
630 | skb_set_transport_header(skb, offset: -hdr_len); |
631 | |
632 | err = nexthdr; |
633 | |
634 | out_free: |
635 | kfree(objp: work_iph); |
636 | out: |
637 | return err; |
638 | } |
639 | |
640 | static int ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, |
641 | u8 type, u8 code, int offset, __be32 info) |
642 | { |
643 | struct net *net = dev_net(dev: skb->dev); |
644 | struct ipv6hdr *iph = (struct ipv6hdr *)skb->data; |
645 | struct ip_auth_hdr *ah = (struct ip_auth_hdr *)(skb->data+offset); |
646 | struct xfrm_state *x; |
647 | |
648 | if (type != ICMPV6_PKT_TOOBIG && |
649 | type != NDISC_REDIRECT) |
650 | return 0; |
651 | |
652 | x = xfrm_state_lookup(net, mark: skb->mark, daddr: (xfrm_address_t *)&iph->daddr, spi: ah->spi, IPPROTO_AH, AF_INET6); |
653 | if (!x) |
654 | return 0; |
655 | |
656 | if (type == NDISC_REDIRECT) |
657 | ip6_redirect(skb, net, oif: skb->dev->ifindex, mark: 0, |
658 | uid: sock_net_uid(net, NULL)); |
659 | else |
660 | ip6_update_pmtu(skb, net, mtu: info, oif: 0, mark: 0, uid: sock_net_uid(net, NULL)); |
661 | xfrm_state_put(x); |
662 | |
663 | return 0; |
664 | } |
665 | |
666 | static int ah6_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack) |
667 | { |
668 | struct ah_data *ahp = NULL; |
669 | struct xfrm_algo_desc *aalg_desc; |
670 | struct crypto_ahash *ahash; |
671 | |
672 | if (!x->aalg) { |
673 | NL_SET_ERR_MSG(extack, "AH requires a state with an AUTH algorithm" ); |
674 | goto error; |
675 | } |
676 | |
677 | if (x->encap) { |
678 | NL_SET_ERR_MSG(extack, "AH is not compatible with encapsulation" ); |
679 | goto error; |
680 | } |
681 | |
682 | ahp = kzalloc(size: sizeof(*ahp), GFP_KERNEL); |
683 | if (!ahp) |
684 | return -ENOMEM; |
685 | |
686 | ahash = crypto_alloc_ahash(alg_name: x->aalg->alg_name, type: 0, mask: 0); |
687 | if (IS_ERR(ptr: ahash)) { |
688 | NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations" ); |
689 | goto error; |
690 | } |
691 | |
692 | ahp->ahash = ahash; |
693 | if (crypto_ahash_setkey(tfm: ahash, key: x->aalg->alg_key, |
694 | keylen: (x->aalg->alg_key_len + 7) / 8)) { |
695 | NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations" ); |
696 | goto error; |
697 | } |
698 | |
699 | /* |
700 | * Lookup the algorithm description maintained by xfrm_algo, |
701 | * verify crypto transform properties, and store information |
702 | * we need for AH processing. This lookup cannot fail here |
703 | * after a successful crypto_alloc_hash(). |
704 | */ |
705 | aalg_desc = xfrm_aalg_get_byname(name: x->aalg->alg_name, probe: 0); |
706 | BUG_ON(!aalg_desc); |
707 | |
708 | if (aalg_desc->uinfo.auth.icv_fullbits/8 != |
709 | crypto_ahash_digestsize(tfm: ahash)) { |
710 | NL_SET_ERR_MSG(extack, "Kernel was unable to initialize cryptographic operations" ); |
711 | goto error; |
712 | } |
713 | |
714 | ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8; |
715 | ahp->icv_trunc_len = x->aalg->alg_trunc_len/8; |
716 | |
717 | x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) + |
718 | ahp->icv_trunc_len); |
719 | switch (x->props.mode) { |
720 | case XFRM_MODE_BEET: |
721 | case XFRM_MODE_TRANSPORT: |
722 | break; |
723 | case XFRM_MODE_TUNNEL: |
724 | x->props.header_len += sizeof(struct ipv6hdr); |
725 | break; |
726 | default: |
727 | NL_SET_ERR_MSG(extack, "Invalid mode requested for AH, must be one of TRANSPORT, TUNNEL, BEET" ); |
728 | goto error; |
729 | } |
730 | x->data = ahp; |
731 | |
732 | return 0; |
733 | |
734 | error: |
735 | if (ahp) { |
736 | crypto_free_ahash(tfm: ahp->ahash); |
737 | kfree(objp: ahp); |
738 | } |
739 | return -EINVAL; |
740 | } |
741 | |
742 | static void ah6_destroy(struct xfrm_state *x) |
743 | { |
744 | struct ah_data *ahp = x->data; |
745 | |
746 | if (!ahp) |
747 | return; |
748 | |
749 | crypto_free_ahash(tfm: ahp->ahash); |
750 | kfree(objp: ahp); |
751 | } |
752 | |
753 | static int ah6_rcv_cb(struct sk_buff *skb, int err) |
754 | { |
755 | return 0; |
756 | } |
757 | |
758 | static const struct xfrm_type ah6_type = { |
759 | .owner = THIS_MODULE, |
760 | .proto = IPPROTO_AH, |
761 | .flags = XFRM_TYPE_REPLAY_PROT, |
762 | .init_state = ah6_init_state, |
763 | .destructor = ah6_destroy, |
764 | .input = ah6_input, |
765 | .output = ah6_output, |
766 | }; |
767 | |
768 | static struct xfrm6_protocol ah6_protocol = { |
769 | .handler = xfrm6_rcv, |
770 | .input_handler = xfrm_input, |
771 | .cb_handler = ah6_rcv_cb, |
772 | .err_handler = ah6_err, |
773 | .priority = 0, |
774 | }; |
775 | |
776 | static int __init ah6_init(void) |
777 | { |
778 | if (xfrm_register_type(type: &ah6_type, AF_INET6) < 0) { |
779 | pr_info("%s: can't add xfrm type\n" , __func__); |
780 | return -EAGAIN; |
781 | } |
782 | |
783 | if (xfrm6_protocol_register(handler: &ah6_protocol, IPPROTO_AH) < 0) { |
784 | pr_info("%s: can't add protocol\n" , __func__); |
785 | xfrm_unregister_type(type: &ah6_type, AF_INET6); |
786 | return -EAGAIN; |
787 | } |
788 | |
789 | return 0; |
790 | } |
791 | |
792 | static void __exit ah6_fini(void) |
793 | { |
794 | if (xfrm6_protocol_deregister(handler: &ah6_protocol, IPPROTO_AH) < 0) |
795 | pr_info("%s: can't remove protocol\n" , __func__); |
796 | |
797 | xfrm_unregister_type(type: &ah6_type, AF_INET6); |
798 | } |
799 | |
800 | module_init(ah6_init); |
801 | module_exit(ah6_fini); |
802 | |
803 | MODULE_LICENSE("GPL" ); |
804 | MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_AH); |
805 | |