net/xfrm/xfrm_algo.c

   1 /*
   2  * xfrm algorithm interface
   3  *
   4  * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the Free
   8  * Software Foundation; either version 2 of the License, or (at your option)
   9  * any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/pfkeyv2.h>
  15 #include <linux/crypto.h>
  16 #include <linux/scatterlist.h>
  17 #include <net/xfrm.h>
  18 #if defined(CONFIG_INET_AH) || defined(CONFIG_INET_AH_MODULE) || defined(CONFIG_INET6_AH) || defined(CONFIG_INET6_AH_MODULE)
  19 #include <net/ah.h>
  20 #endif
  21 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
  22 #include <net/esp.h>
  23 #endif
  24 #include <asm/scatterlist.h>
  25
  26 /*
  27  * Algorithms supported by IPsec.  These entries contain properties which
  28  * are used in key negotiation and xfrm processing, and are used to verify
  29  * that instantiated crypto transforms have correct parameters for IPsec
  30  * purposes.
  31  */
  32 static struct xfrm_algo_desc aalg_list[] = {
  33 {
  34         .name = "hmac(digest_null)",
  35         .compat = "digest_null",
  36
  37         .uinfo = {
  38                 .auth = {
  39                         .icv_truncbits = 0,
  40                         .icv_fullbits = 0,
  41                 }
  42         },
  43
  44         .desc = {
  45                 .sadb_alg_id = SADB_X_AALG_NULL,
  46                 .sadb_alg_ivlen = 0,
  47                 .sadb_alg_minbits = 0,
  48                 .sadb_alg_maxbits = 0
  49         }
  50 },
  51 {
  52         .name = "hmac(md5)",
  53         .compat = "md5",
  54
  55         .uinfo = {
  56                 .auth = {
  57                         .icv_truncbits = 96,
  58                         .icv_fullbits = 128,
  59                 }
  60         },
  61
  62         .desc = {
  63                 .sadb_alg_id = SADB_AALG_MD5HMAC,
  64                 .sadb_alg_ivlen = 0,
  65                 .sadb_alg_minbits = 128,
  66                 .sadb_alg_maxbits = 128
  67         }
  68 },
  69 {
  70         .name = "hmac(sha1)",
  71         .compat = "sha1",
  72
  73         .uinfo = {
  74                 .auth = {
  75                         .icv_truncbits = 96,
  76                         .icv_fullbits = 160,
  77                 }
  78         },
  79
  80         .desc = {
  81                 .sadb_alg_id = SADB_AALG_SHA1HMAC,
  82                 .sadb_alg_ivlen = 0,
  83                 .sadb_alg_minbits = 160,
  84                 .sadb_alg_maxbits = 160
  85         }
  86 },
  87 {
  88         .name = "hmac(sha256)",
  89         .compat = "sha256",
  90
  91         .uinfo = {
  92                 .auth = {
  93                         .icv_truncbits = 96,
  94                         .icv_fullbits = 256,
  95                 }
  96         },
  97
  98         .desc = {
  99                 .sadb_alg_id = SADB_X_AALG_SHA2_256HMAC,
 100                 .sadb_alg_ivlen = 0,
 101                 .sadb_alg_minbits = 256,
 102                 .sadb_alg_maxbits = 256
 103         }
 104 },
 105 {
 106         .name = "hmac(ripemd160)",
 107         .compat = "ripemd160",
 108
 109         .uinfo = {
 110                 .auth = {
 111                         .icv_truncbits = 96,
 112                         .icv_fullbits = 160,
 113                 }
 114         },
 115
 116         .desc = {
 117                 .sadb_alg_id = SADB_X_AALG_RIPEMD160HMAC,
 118                 .sadb_alg_ivlen = 0,
 119                 .sadb_alg_minbits = 160,
 120                 .sadb_alg_maxbits = 160
 121         }
 122 },
 123 {
 124         .name = "xcbc(aes)",
 125
 126         .uinfo = {
 127                 .auth = {
 128                         .icv_truncbits = 96,
 129                         .icv_fullbits = 128,
 130                 }
 131         },
 132
 133         .desc = {
 134                 .sadb_alg_id = SADB_X_AALG_AES_XCBC_MAC,
 135                 .sadb_alg_ivlen = 0,
 136                 .sadb_alg_minbits = 128,
 137                 .sadb_alg_maxbits = 128
 138         }
 139 },
 140 };
 141
 142 static struct xfrm_algo_desc ealg_list[] = {
 143 {
 144         .name = "ecb(cipher_null)",
 145         .compat = "cipher_null",
 146
 147         .uinfo = {
 148                 .encr = {
 149                         .blockbits = 8,
 150                         .defkeybits = 0,
 151                 }
 152         },
 153
 154         .desc = {
 155                 .sadb_alg_id =  SADB_EALG_NULL,
 156                 .sadb_alg_ivlen = 0,
 157                 .sadb_alg_minbits = 0,
 158                 .sadb_alg_maxbits = 0
 159         }
 160 },
 161 {
 162         .name = "cbc(des)",
 163         .compat = "des",
 164
 165         .uinfo = {
 166                 .encr = {
 167                         .blockbits = 64,
 168                         .defkeybits = 64,
 169                 }
 170         },
 171
 172         .desc = {
 173                 .sadb_alg_id = SADB_EALG_DESCBC,
 174                 .sadb_alg_ivlen = 8,
 175                 .sadb_alg_minbits = 64,
 176                 .sadb_alg_maxbits = 64
 177         }
 178 },
 179 {
 180         .name = "cbc(des3_ede)",
 181         .compat = "des3_ede",
 182
 183         .uinfo = {
 184                 .encr = {
 185                         .blockbits = 64,
 186                         .defkeybits = 192,
 187                 }
 188         },
 189
 190         .desc = {
 191                 .sadb_alg_id = SADB_EALG_3DESCBC,
 192                 .sadb_alg_ivlen = 8,
 193                 .sadb_alg_minbits = 192,
 194                 .sadb_alg_maxbits = 192
 195         }
 196 },
 197 {
 198         .name = "cbc(cast128)",
 199         .compat = "cast128",
 200
 201         .uinfo = {
 202                 .encr = {
 203                         .blockbits = 64,
 204                         .defkeybits = 128,
 205                 }
 206         },
 207
 208         .desc = {
 209                 .sadb_alg_id = SADB_X_EALG_CASTCBC,
 210                 .sadb_alg_ivlen = 8,
 211                 .sadb_alg_minbits = 40,
 212                 .sadb_alg_maxbits = 128
 213         }
 214 },
 215 {
 216         .name = "cbc(blowfish)",
 217         .compat = "blowfish",
 218
 219         .uinfo = {
 220                 .encr = {
 221                         .blockbits = 64,
 222                         .defkeybits = 128,
 223                 }
 224         },
 225
 226         .desc = {
 227                 .sadb_alg_id = SADB_X_EALG_BLOWFISHCBC,
 228                 .sadb_alg_ivlen = 8,
 229                 .sadb_alg_minbits = 40,
 230                 .sadb_alg_maxbits = 448
 231         }
 232 },
 233 {
 234         .name = "cbc(aes)",
 235         .compat = "aes",
 236
 237         .uinfo = {
 238                 .encr = {
 239                         .blockbits = 128,
 240                         .defkeybits = 128,
 241                 }
 242         },
 243
 244         .desc = {
 245                 .sadb_alg_id = SADB_X_EALG_AESCBC,
 246                 .sadb_alg_ivlen = 8,
 247                 .sadb_alg_minbits = 128,
 248                 .sadb_alg_maxbits = 256
 249         }
 250 },
 251 {
 252         .name = "cbc(serpent)",
 253         .compat = "serpent",
 254
 255         .uinfo = {
 256                 .encr = {
 257                         .blockbits = 128,
 258                         .defkeybits = 128,
 259                 }
 260         },
 261
 262         .desc = {
 263                 .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
 264                 .sadb_alg_ivlen = 8,
 265                 .sadb_alg_minbits = 128,
 266                 .sadb_alg_maxbits = 256,
 267         }
 268 },
 269 {
 270         .name = "cbc(camellia)",
 271
 272         .uinfo = {
 273                 .encr = {
 274                         .blockbits = 128,
 275                         .defkeybits = 128,
 276                 }
 277         },
 278
 279         .desc = {
 280                 .sadb_alg_id = SADB_X_EALG_CAMELLIACBC,
 281                 .sadb_alg_ivlen = 8,
 282                 .sadb_alg_minbits = 128,
 283                 .sadb_alg_maxbits = 256
 284         }
 285 },
 286 {
 287         .name = "cbc(twofish)",
 288         .compat = "twofish",
 289
 290         .uinfo = {
 291                 .encr = {
 292                         .blockbits = 128,
 293                         .defkeybits = 128,
 294                 }
 295         },
 296
 297         .desc = {
 298                 .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
 299                 .sadb_alg_ivlen = 8,
 300                 .sadb_alg_minbits = 128,
 301                 .sadb_alg_maxbits = 256
 302         }
 303 },
 304 };
 305
 306 static struct xfrm_algo_desc calg_list[] = {
 307 {
 308         .name = "deflate",
 309         .uinfo = {
 310                 .comp = {
 311                         .threshold = 90,
 312                 }
 313         },
 314         .desc = { .sadb_alg_id = SADB_X_CALG_DEFLATE }
 315 },
 316 {
 317         .name = "lzs",
 318         .uinfo = {
 319                 .comp = {
 320                         .threshold = 90,
 321                 }
 322         },
 323         .desc = { .sadb_alg_id = SADB_X_CALG_LZS }
 324 },
 325 {
 326         .name = "lzjh",
 327         .uinfo = {
 328                 .comp = {
 329                         .threshold = 50,
 330                 }
 331         },
 332         .desc = { .sadb_alg_id = SADB_X_CALG_LZJH }
 333 },
 334 };
 335
 336 static inline int aalg_entries(void)
 337 {
 338         return ARRAY_SIZE(aalg_list);
 339 }
 340
 341 static inline int ealg_entries(void)
 342 {
 343         return ARRAY_SIZE(ealg_list);
 344 }
 345
 346 static inline int calg_entries(void)
 347 {
 348         return ARRAY_SIZE(calg_list);
 349 }
 350
 351 struct xfrm_algo_list {
 352         struct xfrm_algo_desc *algs;
 353         int entries;
 354         u32 type;
 355         u32 mask;
 356 };
 357
 358 static const struct xfrm_algo_list xfrm_aalg_list = {
 359         .algs = aalg_list,
 360         .entries = ARRAY_SIZE(aalg_list),
 361         .type = CRYPTO_ALG_TYPE_HASH,
 362         .mask = CRYPTO_ALG_TYPE_HASH_MASK | CRYPTO_ALG_ASYNC,
 363 };
 364
 365 static const struct xfrm_algo_list xfrm_ealg_list = {
 366         .algs = ealg_list,
 367         .entries = ARRAY_SIZE(ealg_list),
 368         .type = CRYPTO_ALG_TYPE_BLKCIPHER,
 369         .mask = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_ASYNC,
 370 };
 371
 372 static const struct xfrm_algo_list xfrm_calg_list = {
 373         .algs = calg_list,
 374         .entries = ARRAY_SIZE(calg_list),
 375         .type = CRYPTO_ALG_TYPE_COMPRESS,
 376         .mask = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_ASYNC,
 377 };
 378
 379 static struct xfrm_algo_desc *xfrm_find_algo(
 380         const struct xfrm_algo_list *algo_list,
 381         int match(const struct xfrm_algo_desc *entry, const void *data),
 382         const void *data, int probe)
 383 {
 384         struct xfrm_algo_desc *list = algo_list->algs;
 385         int i, status;
 386
 387         for (i = 0; i < algo_list->entries; i++) {
 388                 if (!match(list + i, data))
 389                         continue;
 390
 391                 if (list[i].available)
 392                         return &list[i];
 393
 394                 if (!probe)
 395                         break;
 396
 397                 status = crypto_has_alg(list[i].name, algo_list->type,
 398                                         algo_list->mask);
 399                 if (!status)
 400                         break;
 401
 402                 list[i].available = status;
 403                 return &list[i];
 404         }
 405         return NULL;
 406 }
 407
 408 static int xfrm_alg_id_match(const struct xfrm_algo_desc *entry,
 409                              const void *data)
 410 {
 411         return entry->desc.sadb_alg_id == (unsigned long)data;
 412 }
 413
 414 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
 415 {
 416         return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_id_match,
 417                               (void *)(unsigned long)alg_id, 1);
 418 }
 419 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
 420
 421 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
 422 {
 423         return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_id_match,
 424                               (void *)(unsigned long)alg_id, 1);
 425 }
 426 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
 427
 428 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
 429 {
 430         return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_id_match,
 431                               (void *)(unsigned long)alg_id, 1);
 432 }
 433 EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
 434
 435 static int xfrm_alg_name_match(const struct xfrm_algo_desc *entry,
 436                                const void *data)
 437 {
 438         const char *name = data;
 439
 440         return name && (!strcmp(name, entry->name) ||
 441                         (entry->compat && !strcmp(name, entry->compat)));
 442 }
 443
 444 struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe)
 445 {
 446         return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_name_match, name,
 447                               probe);
 448 }
 449 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname);
 450
 451 struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe)
 452 {
 453         return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_name_match, name,
 454                               probe);
 455 }
 456 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname);
 457
 458 struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe)
 459 {
 460         return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_name_match, name,
 461                               probe);
 462 }
 463 EXPORT_SYMBOL_GPL(xfrm_calg_get_byname);
 464
 465 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx)
 466 {
 467         if (idx >= aalg_entries())
 468                 return NULL;
 469
 470         return &aalg_list[idx];
 471 }
 472 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byidx);
 473
 474 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx)
 475 {
 476         if (idx >= ealg_entries())
 477                 return NULL;
 478
 479         return &ealg_list[idx];
 480 }
 481 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byidx);
 482
 483 /*
 484  * Probe for the availability of crypto algorithms, and set the available
 485  * flag for any algorithms found on the system.  This is typically called by
 486  * pfkey during userspace SA add, update or register.
 487  */
 488 void xfrm_probe_algs(void)
 489 {
 490 #ifdef CONFIG_CRYPTO
 491         int i, status;
 492
 493         BUG_ON(in_softirq());
 494
 495         for (i = 0; i < aalg_entries(); i++) {
 496                 status = crypto_has_hash(aalg_list[i].name, 0,
 497                                          CRYPTO_ALG_ASYNC);
 498                 if (aalg_list[i].available != status)
 499                         aalg_list[i].available = status;
 500         }
 501
 502         for (i = 0; i < ealg_entries(); i++) {
 503                 status = crypto_has_blkcipher(ealg_list[i].name, 0,
 504                                               CRYPTO_ALG_ASYNC);
 505                 if (ealg_list[i].available != status)
 506                         ealg_list[i].available = status;
 507         }
 508
 509         for (i = 0; i < calg_entries(); i++) {
 510                 status = crypto_has_comp(calg_list[i].name, 0,
 511                                          CRYPTO_ALG_ASYNC);
 512                 if (calg_list[i].available != status)
 513                         calg_list[i].available = status;
 514         }
 515 #endif
 516 }
 517 EXPORT_SYMBOL_GPL(xfrm_probe_algs);
 518
 519 int xfrm_count_auth_supported(void)
 520 {
 521         int i, n;
 522
 523         for (i = 0, n = 0; i < aalg_entries(); i++)
 524                 if (aalg_list[i].available)
 525                         n++;
 526         return n;
 527 }
 528 EXPORT_SYMBOL_GPL(xfrm_count_auth_supported);
 529
 530 int xfrm_count_enc_supported(void)
 531 {
 532         int i, n;
 533
 534         for (i = 0, n = 0; i < ealg_entries(); i++)
 535                 if (ealg_list[i].available)
 536                         n++;
 537         return n;
 538 }
 539 EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
 540
 541 /* Move to common area: it is shared with AH. */
 542
 543 int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
 544                  int offset, int len, icv_update_fn_t icv_update)
 545 {
 546         int start = skb_headlen(skb);
 547         int i, copy = start - offset;
 548         int err;
 549         struct scatterlist sg;
 550
 551         /* Checksum header. */
 552         if (copy > 0) {
 553                 if (copy > len)
 554                         copy = len;
 555
 556                 sg_set_page(&sg, virt_to_page(skb->data + offset));
 557                 sg.offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
 558                 sg.length = copy;
 559
 560                 err = icv_update(desc, &sg, copy);
 561                 if (unlikely(err))
 562                         return err;
 563
 564                 if ((len -= copy) == 0)
 565                         return 0;
 566                 offset += copy;
 567         }
 568
 569         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
 570                 int end;
 571
 572                 BUG_TRAP(start <= offset + len);
 573
 574                 end = start + skb_shinfo(skb)->frags[i].size;
 575                 if ((copy = end - offset) > 0) {
 576                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 577
 578                         if (copy > len)
 579                                 copy = len;
 580
 581                         sg_set_page(&sg, frag->page);
 582                         sg.offset = frag->page_offset + offset-start;
 583                         sg.length = copy;
 584
 585                         err = icv_update(desc, &sg, copy);
 586                         if (unlikely(err))
 587                                 return err;
 588
 589                         if (!(len -= copy))
 590                                 return 0;
 591                         offset += copy;
 592                 }
 593                 start = end;
 594         }
 595
 596         if (skb_shinfo(skb)->frag_list) {
 597                 struct sk_buff *list = skb_shinfo(skb)->frag_list;
 598
 599                 for (; list; list = list->next) {
 600                         int end;
 601
 602                         BUG_TRAP(start <= offset + len);
 603
 604                         end = start + list->len;
 605                         if ((copy = end - offset) > 0) {
 606                                 if (copy > len)
 607                                         copy = len;
 608                                 err = skb_icv_walk(list, desc, offset-start,
 609                                                    copy, icv_update);
 610                                 if (unlikely(err))
 611                                         return err;
 612                                 if ((len -= copy) == 0)
 613                                         return 0;
 614                                 offset += copy;
 615                         }
 616                         start = end;
 617                 }
 618         }
 619         BUG_ON(len);
 620         return 0;
 621 }
 622 EXPORT_SYMBOL_GPL(skb_icv_walk);
 623
 624 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 625
 626 void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)
 627 {
 628         if (tail != skb) {
 629                 skb->data_len += len;
 630                 skb->len += len;
 631         }
 632         return skb_put(tail, len);
 633 }
 634 EXPORT_SYMBOL_GPL(pskb_put);
 635 #endif