net/xfrm/xfrm_algo.c

   1 /*
   2  * xfrm algorithm interface
   3  *
   4  * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the Free
   8  * Software Foundation; either version 2 of the License, or (at your option)
   9  * any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/pfkeyv2.h>
  15 #include <linux/crypto.h>
  16 #include <net/xfrm.h>
  17 #if defined(CONFIG_INET_AH) || defined(CONFIG_INET_AH_MODULE) || defined(CONFIG_INET6_AH) || defined(CONFIG_INET6_AH_MODULE)
  18 #include <net/ah.h>
  19 #endif
  20 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
  21 #include <net/esp.h>
  22 #endif
  23 #include <asm/scatterlist.h>
  24
  25 /*
  26  * Algorithms supported by IPsec.  These entries contain properties which
  27  * are used in key negotiation and xfrm processing, and are used to verify
  28  * that instantiated crypto transforms have correct parameters for IPsec
  29  * purposes.
  30  */
  31 static struct xfrm_algo_desc aalg_list[] = {
  32 {
  33         .name = "hmac(digest_null)",
  34         .compat = "digest_null",
  35
  36         .uinfo = {
  37                 .auth = {
  38                         .icv_truncbits = 0,
  39                         .icv_fullbits = 0,
  40                 }
  41         },
  42
  43         .desc = {
  44                 .sadb_alg_id = SADB_X_AALG_NULL,
  45                 .sadb_alg_ivlen = 0,
  46                 .sadb_alg_minbits = 0,
  47                 .sadb_alg_maxbits = 0
  48         }
  49 },
  50 {
  51         .name = "hmac(md5)",
  52         .compat = "md5",
  53
  54         .uinfo = {
  55                 .auth = {
  56                         .icv_truncbits = 96,
  57                         .icv_fullbits = 128,
  58                 }
  59         },
  60
  61         .desc = {
  62                 .sadb_alg_id = SADB_AALG_MD5HMAC,
  63                 .sadb_alg_ivlen = 0,
  64                 .sadb_alg_minbits = 128,
  65                 .sadb_alg_maxbits = 128
  66         }
  67 },
  68 {
  69         .name = "hmac(sha1)",
  70         .compat = "sha1",
  71
  72         .uinfo = {
  73                 .auth = {
  74                         .icv_truncbits = 96,
  75                         .icv_fullbits = 160,
  76                 }
  77         },
  78
  79         .desc = {
  80                 .sadb_alg_id = SADB_AALG_SHA1HMAC,
  81                 .sadb_alg_ivlen = 0,
  82                 .sadb_alg_minbits = 160,
  83                 .sadb_alg_maxbits = 160
  84         }
  85 },
  86 {
  87         .name = "hmac(sha256)",
  88         .compat = "sha256",
  89
  90         .uinfo = {
  91                 .auth = {
  92                         .icv_truncbits = 96,
  93                         .icv_fullbits = 256,
  94                 }
  95         },
  96
  97         .desc = {
  98                 .sadb_alg_id = SADB_X_AALG_SHA2_256HMAC,
  99                 .sadb_alg_ivlen = 0,
 100                 .sadb_alg_minbits = 256,
 101                 .sadb_alg_maxbits = 256
 102         }
 103 },
 104 {
 105         .name = "hmac(ripemd160)",
 106         .compat = "ripemd160",
 107
 108         .uinfo = {
 109                 .auth = {
 110                         .icv_truncbits = 96,
 111                         .icv_fullbits = 160,
 112                 }
 113         },
 114
 115         .desc = {
 116                 .sadb_alg_id = SADB_X_AALG_RIPEMD160HMAC,
 117                 .sadb_alg_ivlen = 0,
 118                 .sadb_alg_minbits = 160,
 119                 .sadb_alg_maxbits = 160
 120         }
 121 },
 122 };
 123
 124 static struct xfrm_algo_desc ealg_list[] = {
 125 {
 126         .name = "ecb(cipher_null)",
 127         .compat = "cipher_null",
 128
 129         .uinfo = {
 130                 .encr = {
 131                         .blockbits = 8,
 132                         .defkeybits = 0,
 133                 }
 134         },
 135
 136         .desc = {
 137                 .sadb_alg_id =  SADB_EALG_NULL,
 138                 .sadb_alg_ivlen = 0,
 139                 .sadb_alg_minbits = 0,
 140                 .sadb_alg_maxbits = 0
 141         }
 142 },
 143 {
 144         .name = "cbc(des)",
 145         .compat = "des",
 146
 147         .uinfo = {
 148                 .encr = {
 149                         .blockbits = 64,
 150                         .defkeybits = 64,
 151                 }
 152         },
 153
 154         .desc = {
 155                 .sadb_alg_id = SADB_EALG_DESCBC,
 156                 .sadb_alg_ivlen = 8,
 157                 .sadb_alg_minbits = 64,
 158                 .sadb_alg_maxbits = 64
 159         }
 160 },
 161 {
 162         .name = "cbc(des3_ede)",
 163         .compat = "des3_ede",
 164
 165         .uinfo = {
 166                 .encr = {
 167                         .blockbits = 64,
 168                         .defkeybits = 192,
 169                 }
 170         },
 171
 172         .desc = {
 173                 .sadb_alg_id = SADB_EALG_3DESCBC,
 174                 .sadb_alg_ivlen = 8,
 175                 .sadb_alg_minbits = 192,
 176                 .sadb_alg_maxbits = 192
 177         }
 178 },
 179 {
 180         .name = "cbc(cast128)",
 181         .compat = "cast128",
 182
 183         .uinfo = {
 184                 .encr = {
 185                         .blockbits = 64,
 186                         .defkeybits = 128,
 187                 }
 188         },
 189
 190         .desc = {
 191                 .sadb_alg_id = SADB_X_EALG_CASTCBC,
 192                 .sadb_alg_ivlen = 8,
 193                 .sadb_alg_minbits = 40,
 194                 .sadb_alg_maxbits = 128
 195         }
 196 },
 197 {
 198         .name = "cbc(blowfish)",
 199         .compat = "blowfish",
 200
 201         .uinfo = {
 202                 .encr = {
 203                         .blockbits = 64,
 204                         .defkeybits = 128,
 205                 }
 206         },
 207
 208         .desc = {
 209                 .sadb_alg_id = SADB_X_EALG_BLOWFISHCBC,
 210                 .sadb_alg_ivlen = 8,
 211                 .sadb_alg_minbits = 40,
 212                 .sadb_alg_maxbits = 448
 213         }
 214 },
 215 {
 216         .name = "cbc(aes)",
 217         .compat = "aes",
 218
 219         .uinfo = {
 220                 .encr = {
 221                         .blockbits = 128,
 222                         .defkeybits = 128,
 223                 }
 224         },
 225
 226         .desc = {
 227                 .sadb_alg_id = SADB_X_EALG_AESCBC,
 228                 .sadb_alg_ivlen = 8,
 229                 .sadb_alg_minbits = 128,
 230                 .sadb_alg_maxbits = 256
 231         }
 232 },
 233 {
 234         .name = "cbc(serpent)",
 235         .compat = "serpent",
 236
 237         .uinfo = {
 238                 .encr = {
 239                         .blockbits = 128,
 240                         .defkeybits = 128,
 241                 }
 242         },
 243
 244         .desc = {
 245                 .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
 246                 .sadb_alg_ivlen = 8,
 247                 .sadb_alg_minbits = 128,
 248                 .sadb_alg_maxbits = 256,
 249         }
 250 },
 251 {
 252         .name = "cbc(twofish)",
 253         .compat = "twofish",
 254
 255         .uinfo = {
 256                 .encr = {
 257                         .blockbits = 128,
 258                         .defkeybits = 128,
 259                 }
 260         },
 261
 262         .desc = {
 263                 .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
 264                 .sadb_alg_ivlen = 8,
 265                 .sadb_alg_minbits = 128,
 266                 .sadb_alg_maxbits = 256
 267         }
 268 },
 269 };
 270
 271 static struct xfrm_algo_desc calg_list[] = {
 272 {
 273         .name = "deflate",
 274         .uinfo = {
 275                 .comp = {
 276                         .threshold = 90,
 277                 }
 278         },
 279         .desc = { .sadb_alg_id = SADB_X_CALG_DEFLATE }
 280 },
 281 {
 282         .name = "lzs",
 283         .uinfo = {
 284                 .comp = {
 285                         .threshold = 90,
 286                 }
 287         },
 288         .desc = { .sadb_alg_id = SADB_X_CALG_LZS }
 289 },
 290 {
 291         .name = "lzjh",
 292         .uinfo = {
 293                 .comp = {
 294                         .threshold = 50,
 295                 }
 296         },
 297         .desc = { .sadb_alg_id = SADB_X_CALG_LZJH }
 298 },
 299 };
 300
 301 static inline int aalg_entries(void)
 302 {
 303         return ARRAY_SIZE(aalg_list);
 304 }
 305
 306 static inline int ealg_entries(void)
 307 {
 308         return ARRAY_SIZE(ealg_list);
 309 }
 310
 311 static inline int calg_entries(void)
 312 {
 313         return ARRAY_SIZE(calg_list);
 314 }
 315
 316 /* Todo: generic iterators */
 317 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
 318 {
 319         int i;
 320
 321         for (i = 0; i < aalg_entries(); i++) {
 322                 if (aalg_list[i].desc.sadb_alg_id == alg_id) {
 323                         if (aalg_list[i].available)
 324                                 return &aalg_list[i];
 325                         else
 326                                 break;
 327                 }
 328         }
 329         return NULL;
 330 }
 331 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
 332
 333 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
 334 {
 335         int i;
 336
 337         for (i = 0; i < ealg_entries(); i++) {
 338                 if (ealg_list[i].desc.sadb_alg_id == alg_id) {
 339                         if (ealg_list[i].available)
 340                                 return &ealg_list[i];
 341                         else
 342                                 break;
 343                 }
 344         }
 345         return NULL;
 346 }
 347 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
 348
 349 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
 350 {
 351         int i;
 352
 353         for (i = 0; i < calg_entries(); i++) {
 354                 if (calg_list[i].desc.sadb_alg_id == alg_id) {
 355                         if (calg_list[i].available)
 356                                 return &calg_list[i];
 357                         else
 358                                 break;
 359                 }
 360         }
 361         return NULL;
 362 }
 363 EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
 364
 365 static struct xfrm_algo_desc *xfrm_get_byname(struct xfrm_algo_desc *list,
 366                                               int entries, char *name,
 367                                               int probe)
 368 {
 369         int i, status;
 370
 371         if (!name)
 372                 return NULL;
 373
 374         for (i = 0; i < entries; i++) {
 375                 if (strcmp(name, list[i].name) &&
 376                     (!list[i].compat || strcmp(name, list[i].compat)))
 377                         continue;
 378
 379                 if (list[i].available)
 380                         return &list[i];
 381
 382                 if (!probe)
 383                         break;
 384
 385                 status = crypto_alg_available(name, 0);
 386                 if (!status)
 387                         break;
 388
 389                 list[i].available = status;
 390                 return &list[i];
 391         }
 392         return NULL;
 393 }
 394
 395 struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe)
 396 {
 397         return xfrm_get_byname(aalg_list, aalg_entries(), name, probe);
 398 }
 399 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname);
 400
 401 struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe)
 402 {
 403         return xfrm_get_byname(ealg_list, ealg_entries(), name, probe);
 404 }
 405 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname);
 406
 407 struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe)
 408 {
 409         return xfrm_get_byname(calg_list, calg_entries(), name, probe);
 410 }
 411 EXPORT_SYMBOL_GPL(xfrm_calg_get_byname);
 412
 413 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx)
 414 {
 415         if (idx >= aalg_entries())
 416                 return NULL;
 417
 418         return &aalg_list[idx];
 419 }
 420 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byidx);
 421
 422 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx)
 423 {
 424         if (idx >= ealg_entries())
 425                 return NULL;
 426
 427         return &ealg_list[idx];
 428 }
 429 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byidx);
 430
 431 /*
 432  * Probe for the availability of crypto algorithms, and set the available
 433  * flag for any algorithms found on the system.  This is typically called by
 434  * pfkey during userspace SA add, update or register.
 435  */
 436 void xfrm_probe_algs(void)
 437 {
 438 #ifdef CONFIG_CRYPTO
 439         int i, status;
 440
 441         BUG_ON(in_softirq());
 442
 443         for (i = 0; i < aalg_entries(); i++) {
 444                 status = crypto_alg_available(aalg_list[i].name, 0);
 445                 if (aalg_list[i].available != status)
 446                         aalg_list[i].available = status;
 447         }
 448
 449         for (i = 0; i < ealg_entries(); i++) {
 450                 status = crypto_alg_available(ealg_list[i].name, 0);
 451                 if (ealg_list[i].available != status)
 452                         ealg_list[i].available = status;
 453         }
 454
 455         for (i = 0; i < calg_entries(); i++) {
 456                 status = crypto_alg_available(calg_list[i].name, 0);
 457                 if (calg_list[i].available != status)
 458                         calg_list[i].available = status;
 459         }
 460 #endif
 461 }
 462 EXPORT_SYMBOL_GPL(xfrm_probe_algs);
 463
 464 int xfrm_count_auth_supported(void)
 465 {
 466         int i, n;
 467
 468         for (i = 0, n = 0; i < aalg_entries(); i++)
 469                 if (aalg_list[i].available)
 470                         n++;
 471         return n;
 472 }
 473 EXPORT_SYMBOL_GPL(xfrm_count_auth_supported);
 474
 475 int xfrm_count_enc_supported(void)
 476 {
 477         int i, n;
 478
 479         for (i = 0, n = 0; i < ealg_entries(); i++)
 480                 if (ealg_list[i].available)
 481                         n++;
 482         return n;
 483 }
 484 EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
 485
 486 /* Move to common area: it is shared with AH. */
 487
 488 int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
 489                  int offset, int len, icv_update_fn_t icv_update)
 490 {
 491         int start = skb_headlen(skb);
 492         int i, copy = start - offset;
 493         int err;
 494         struct scatterlist sg;
 495
 496         /* Checksum header. */
 497         if (copy > 0) {
 498                 if (copy > len)
 499                         copy = len;
 500
 501                 sg.page = virt_to_page(skb->data + offset);
 502                 sg.offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
 503                 sg.length = copy;
 504
 505                 err = icv_update(desc, &sg, copy);
 506                 if (unlikely(err))
 507                         return err;
 508
 509                 if ((len -= copy) == 0)
 510                         return 0;
 511                 offset += copy;
 512         }
 513
 514         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
 515                 int end;
 516
 517                 BUG_TRAP(start <= offset + len);
 518
 519                 end = start + skb_shinfo(skb)->frags[i].size;
 520                 if ((copy = end - offset) > 0) {
 521                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 522
 523                         if (copy > len)
 524                                 copy = len;
 525
 526                         sg.page = frag->page;
 527                         sg.offset = frag->page_offset + offset-start;
 528                         sg.length = copy;
 529
 530                         err = icv_update(desc, &sg, copy);
 531                         if (unlikely(err))
 532                                 return err;
 533
 534                         if (!(len -= copy))
 535                                 return 0;
 536                         offset += copy;
 537                 }
 538                 start = end;
 539         }
 540
 541         if (skb_shinfo(skb)->frag_list) {
 542                 struct sk_buff *list = skb_shinfo(skb)->frag_list;
 543
 544                 for (; list; list = list->next) {
 545                         int end;
 546
 547                         BUG_TRAP(start <= offset + len);
 548
 549                         end = start + list->len;
 550                         if ((copy = end - offset) > 0) {
 551                                 if (copy > len)
 552                                         copy = len;
 553                                 err = skb_icv_walk(list, desc, offset-start,
 554                                                    copy, icv_update);
 555                                 if (unlikely(err))
 556                                         return err;
 557                                 if ((len -= copy) == 0)
 558                                         return 0;
 559                                 offset += copy;
 560                         }
 561                         start = end;
 562                 }
 563         }
 564         BUG_ON(len);
 565         return 0;
 566 }
 567 EXPORT_SYMBOL_GPL(skb_icv_walk);
 568
 569 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 570
 571 /* Looking generic it is not used in another places. */
 572
 573 int
 574 skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
 575 {
 576         int start = skb_headlen(skb);
 577         int i, copy = start - offset;
 578         int elt = 0;
 579
 580         if (copy > 0) {
 581                 if (copy > len)
 582                         copy = len;
 583                 sg[elt].page = virt_to_page(skb->data + offset);
 584                 sg[elt].offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
 585                 sg[elt].length = copy;
 586                 elt++;
 587                 if ((len -= copy) == 0)
 588                         return elt;
 589                 offset += copy;
 590         }
 591
 592         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
 593                 int end;
 594
 595                 BUG_TRAP(start <= offset + len);
 596
 597                 end = start + skb_shinfo(skb)->frags[i].size;
 598                 if ((copy = end - offset) > 0) {
 599                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 600
 601                         if (copy > len)
 602                                 copy = len;
 603                         sg[elt].page = frag->page;
 604                         sg[elt].offset = frag->page_offset+offset-start;
 605                         sg[elt].length = copy;
 606                         elt++;
 607                         if (!(len -= copy))
 608                                 return elt;
 609                         offset += copy;
 610                 }
 611                 start = end;
 612         }
 613
 614         if (skb_shinfo(skb)->frag_list) {
 615                 struct sk_buff *list = skb_shinfo(skb)->frag_list;
 616
 617                 for (; list; list = list->next) {
 618                         int end;
 619
 620                         BUG_TRAP(start <= offset + len);
 621
 622                         end = start + list->len;
 623                         if ((copy = end - offset) > 0) {
 624                                 if (copy > len)
 625                                         copy = len;
 626                                 elt += skb_to_sgvec(list, sg+elt, offset - start, copy);
 627                                 if ((len -= copy) == 0)
 628                                         return elt;
 629                                 offset += copy;
 630                         }
 631                         start = end;
 632                 }
 633         }
 634         BUG_ON(len);
 635         return elt;
 636 }
 637 EXPORT_SYMBOL_GPL(skb_to_sgvec);
 638
 639 /* Check that skb data bits are writable. If they are not, copy data
 640  * to newly created private area. If "tailbits" is given, make sure that
 641  * tailbits bytes beyond current end of skb are writable.
 642  *
 643  * Returns amount of elements of scatterlist to load for subsequent
 644  * transformations and pointer to writable trailer skb.
 645  */
 646
 647 int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
 648 {
 649         int copyflag;
 650         int elt;
 651         struct sk_buff *skb1, **skb_p;
 652
 653         /* If skb is cloned or its head is paged, reallocate
 654          * head pulling out all the pages (pages are considered not writable
 655          * at the moment even if they are anonymous).
 656          */
 657         if ((skb_cloned(skb) || skb_shinfo(skb)->nr_frags) &&
 658             __pskb_pull_tail(skb, skb_pagelen(skb)-skb_headlen(skb)) == NULL)
 659                 return -ENOMEM;
 660
 661         /* Easy case. Most of packets will go this way. */
 662         if (!skb_shinfo(skb)->frag_list) {
 663                 /* A little of trouble, not enough of space for trailer.
 664                  * This should not happen, when stack is tuned to generate
 665                  * good frames. OK, on miss we reallocate and reserve even more
 666                  * space, 128 bytes is fair. */
 667
 668                 if (skb_tailroom(skb) < tailbits &&
 669                     pskb_expand_head(skb, 0, tailbits-skb_tailroom(skb)+128, GFP_ATOMIC))
 670                         return -ENOMEM;
 671
 672                 /* Voila! */
 673                 *trailer = skb;
 674                 return 1;
 675         }
 676
 677         /* Misery. We are in troubles, going to mincer fragments... */
 678
 679         elt = 1;
 680         skb_p = &skb_shinfo(skb)->frag_list;
 681         copyflag = 0;
 682
 683         while ((skb1 = *skb_p) != NULL) {
 684                 int ntail = 0;
 685
 686                 /* The fragment is partially pulled by someone,
 687                  * this can happen on input. Copy it and everything
 688                  * after it. */
 689
 690                 if (skb_shared(skb1))
 691                         copyflag = 1;
 692
 693                 /* If the skb is the last, worry about trailer. */
 694
 695                 if (skb1->next == NULL && tailbits) {
 696                         if (skb_shinfo(skb1)->nr_frags ||
 697                             skb_shinfo(skb1)->frag_list ||
 698                             skb_tailroom(skb1) < tailbits)
 699                                 ntail = tailbits + 128;
 700                 }
 701
 702                 if (copyflag ||
 703                     skb_cloned(skb1) ||
 704                     ntail ||
 705                     skb_shinfo(skb1)->nr_frags ||
 706                     skb_shinfo(skb1)->frag_list) {
 707                         struct sk_buff *skb2;
 708
 709                         /* Fuck, we are miserable poor guys... */
 710                         if (ntail == 0)
 711                                 skb2 = skb_copy(skb1, GFP_ATOMIC);
 712                         else
 713                                 skb2 = skb_copy_expand(skb1,
 714                                                        skb_headroom(skb1),
 715                                                        ntail,
 716                                                        GFP_ATOMIC);
 717                         if (unlikely(skb2 == NULL))
 718                                 return -ENOMEM;
 719
 720                         if (skb1->sk)
 721                                 skb_set_owner_w(skb2, skb1->sk);
 722
 723                         /* Looking around. Are we still alive?
 724                          * OK, link new skb, drop old one */
 725
 726                         skb2->next = skb1->next;
 727                         *skb_p = skb2;
 728                         kfree_skb(skb1);
 729                         skb1 = skb2;
 730                 }
 731                 elt++;
 732                 *trailer = skb1;
 733                 skb_p = &skb1->next;
 734         }
 735
 736         return elt;
 737 }
 738 EXPORT_SYMBOL_GPL(skb_cow_data);
 739
 740 void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)
 741 {
 742         if (tail != skb) {
 743                 skb->data_len += len;
 744                 skb->len += len;
 745         }
 746         return skb_put(tail, len);
 747 }
 748 EXPORT_SYMBOL_GPL(pskb_put);
 749 #endif