diff options
Diffstat (limited to 'net/ipv4')
-rw-r--r-- | net/ipv4/Kconfig | 9 | ||||
-rw-r--r-- | net/ipv4/Makefile | 1 | ||||
-rw-r--r-- | net/ipv4/esp4.c | 26 | ||||
-rw-r--r-- | net/ipv4/ipcomp.c | 5 | ||||
-rw-r--r-- | net/ipv4/xfrm4_mode_beet.c | 139 |
5 files changed, 172 insertions, 8 deletions
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig index d172a9804448..5572071af735 100644 --- a/net/ipv4/Kconfig +++ b/net/ipv4/Kconfig | |||
@@ -434,6 +434,15 @@ config INET_XFRM_MODE_TUNNEL | |||
434 | 434 | ||
435 | If unsure, say Y. | 435 | If unsure, say Y. |
436 | 436 | ||
437 | config INET_XFRM_MODE_BEET | ||
438 | tristate "IP: IPsec BEET mode" | ||
439 | default y | ||
440 | select XFRM | ||
441 | ---help--- | ||
442 | Support for IPsec BEET mode. | ||
443 | |||
444 | If unsure, say Y. | ||
445 | |||
437 | config INET_DIAG | 446 | config INET_DIAG |
438 | tristate "INET: socket monitoring interface" | 447 | tristate "INET: socket monitoring interface" |
439 | default y | 448 | default y |
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile index f66049e28aeb..15645c51520c 100644 --- a/net/ipv4/Makefile +++ b/net/ipv4/Makefile | |||
@@ -23,6 +23,7 @@ obj-$(CONFIG_INET_AH) += ah4.o | |||
23 | obj-$(CONFIG_INET_ESP) += esp4.o | 23 | obj-$(CONFIG_INET_ESP) += esp4.o |
24 | obj-$(CONFIG_INET_IPCOMP) += ipcomp.o | 24 | obj-$(CONFIG_INET_IPCOMP) += ipcomp.o |
25 | obj-$(CONFIG_INET_XFRM_TUNNEL) += xfrm4_tunnel.o | 25 | obj-$(CONFIG_INET_XFRM_TUNNEL) += xfrm4_tunnel.o |
26 | obj-$(CONFIG_INET_XFRM_MODE_BEET) += xfrm4_mode_beet.o | ||
26 | obj-$(CONFIG_INET_TUNNEL) += tunnel4.o | 27 | obj-$(CONFIG_INET_TUNNEL) += tunnel4.o |
27 | obj-$(CONFIG_INET_XFRM_MODE_TRANSPORT) += xfrm4_mode_transport.o | 28 | obj-$(CONFIG_INET_XFRM_MODE_TRANSPORT) += xfrm4_mode_transport.o |
28 | obj-$(CONFIG_INET_XFRM_MODE_TUNNEL) += xfrm4_mode_tunnel.o | 29 | obj-$(CONFIG_INET_XFRM_MODE_TUNNEL) += xfrm4_mode_tunnel.o |
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c index 13b29360d102..b5c205b57669 100644 --- a/net/ipv4/esp4.c +++ b/net/ipv4/esp4.c | |||
@@ -253,7 +253,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) | |||
253 | * as per draft-ietf-ipsec-udp-encaps-06, | 253 | * as per draft-ietf-ipsec-udp-encaps-06, |
254 | * section 3.1.2 | 254 | * section 3.1.2 |
255 | */ | 255 | */ |
256 | if (x->props.mode == XFRM_MODE_TRANSPORT) | 256 | if (x->props.mode == XFRM_MODE_TRANSPORT || |
257 | x->props.mode == XFRM_MODE_BEET) | ||
257 | skb->ip_summed = CHECKSUM_UNNECESSARY; | 258 | skb->ip_summed = CHECKSUM_UNNECESSARY; |
258 | } | 259 | } |
259 | 260 | ||
@@ -271,17 +272,28 @@ static u32 esp4_get_max_size(struct xfrm_state *x, int mtu) | |||
271 | { | 272 | { |
272 | struct esp_data *esp = x->data; | 273 | struct esp_data *esp = x->data; |
273 | u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4); | 274 | u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4); |
274 | 275 | int enclen = 0; | |
275 | if (x->props.mode == XFRM_MODE_TUNNEL) { | 276 | |
276 | mtu = ALIGN(mtu + 2, blksize); | 277 | switch (x->props.mode) { |
277 | } else { | 278 | case XFRM_MODE_TUNNEL: |
278 | /* The worst case. */ | 279 | mtu = ALIGN(mtu +2, blksize); |
280 | break; | ||
281 | default: | ||
282 | case XFRM_MODE_TRANSPORT: | ||
283 | /* The worst case */ | ||
279 | mtu = ALIGN(mtu + 2, 4) + blksize - 4; | 284 | mtu = ALIGN(mtu + 2, 4) + blksize - 4; |
285 | break; | ||
286 | case XFRM_MODE_BEET: | ||
287 | /* The worst case. */ | ||
288 | enclen = IPV4_BEET_PHMAXLEN; | ||
289 | mtu = ALIGN(mtu + enclen + 2, blksize); | ||
290 | break; | ||
280 | } | 291 | } |
292 | |||
281 | if (esp->conf.padlen) | 293 | if (esp->conf.padlen) |
282 | mtu = ALIGN(mtu, esp->conf.padlen); | 294 | mtu = ALIGN(mtu, esp->conf.padlen); |
283 | 295 | ||
284 | return mtu + x->props.header_len + esp->auth.icv_trunc_len; | 296 | return mtu + x->props.header_len + esp->auth.icv_trunc_len - enclen; |
285 | } | 297 | } |
286 | 298 | ||
287 | static void esp4_err(struct sk_buff *skb, u32 info) | 299 | static void esp4_err(struct sk_buff *skb, u32 info) |
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c index 2017d36024d4..3839b706142e 100644 --- a/net/ipv4/ipcomp.c +++ b/net/ipv4/ipcomp.c | |||
@@ -206,6 +206,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info) | |||
206 | static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x) | 206 | static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x) |
207 | { | 207 | { |
208 | struct xfrm_state *t; | 208 | struct xfrm_state *t; |
209 | u8 mode = XFRM_MODE_TUNNEL; | ||
209 | 210 | ||
210 | t = xfrm_state_alloc(); | 211 | t = xfrm_state_alloc(); |
211 | if (t == NULL) | 212 | if (t == NULL) |
@@ -216,7 +217,9 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x) | |||
216 | t->id.daddr.a4 = x->id.daddr.a4; | 217 | t->id.daddr.a4 = x->id.daddr.a4; |
217 | memcpy(&t->sel, &x->sel, sizeof(t->sel)); | 218 | memcpy(&t->sel, &x->sel, sizeof(t->sel)); |
218 | t->props.family = AF_INET; | 219 | t->props.family = AF_INET; |
219 | t->props.mode = XFRM_MODE_TUNNEL; | 220 | if (x->props.mode == XFRM_MODE_BEET) |
221 | mode = x->props.mode; | ||
222 | t->props.mode = mode; | ||
220 | t->props.saddr.a4 = x->props.saddr.a4; | 223 | t->props.saddr.a4 = x->props.saddr.a4; |
221 | t->props.flags = x->props.flags; | 224 | t->props.flags = x->props.flags; |
222 | 225 | ||
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c new file mode 100644 index 000000000000..89cf59ea7bbe --- /dev/null +++ b/net/ipv4/xfrm4_mode_beet.c | |||
@@ -0,0 +1,139 @@ | |||
1 | /* | ||
2 | * xfrm4_mode_beet.c - BEET mode encapsulation for IPv4. | ||
3 | * | ||
4 | * Copyright (c) 2006 Diego Beltrami <diego.beltrami@gmail.com> | ||
5 | * Miika Komu <miika@iki.fi> | ||
6 | * Herbert Xu <herbert@gondor.apana.org.au> | ||
7 | * Abhinav Pathak <abhinav.pathak@hiit.fi> | ||
8 | * Jeff Ahrenholz <ahrenholz@gmail.com> | ||
9 | */ | ||
10 | |||
11 | #include <linux/init.h> | ||
12 | #include <linux/kernel.h> | ||
13 | #include <linux/module.h> | ||
14 | #include <linux/skbuff.h> | ||
15 | #include <linux/stringify.h> | ||
16 | #include <net/dst.h> | ||
17 | #include <net/ip.h> | ||
18 | #include <net/xfrm.h> | ||
19 | |||
20 | /* Add encapsulation header. | ||
21 | * | ||
22 | * The top IP header will be constructed per draft-nikander-esp-beet-mode-06.txt. | ||
23 | * The following fields in it shall be filled in by x->type->output: | ||
24 | * tot_len | ||
25 | * check | ||
26 | * | ||
27 | * On exit, skb->h will be set to the start of the payload to be processed | ||
28 | * by x->type->output and skb->nh will be set to the top IP header. | ||
29 | */ | ||
30 | static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb) | ||
31 | { | ||
32 | struct iphdr *iph, *top_iph = NULL; | ||
33 | int hdrlen, optlen; | ||
34 | |||
35 | iph = skb->nh.iph; | ||
36 | skb->h.ipiph = iph; | ||
37 | |||
38 | hdrlen = 0; | ||
39 | optlen = iph->ihl * 4 - sizeof(*iph); | ||
40 | if (unlikely(optlen)) | ||
41 | hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4); | ||
42 | |||
43 | skb->nh.raw = skb_push(skb, x->props.header_len + hdrlen); | ||
44 | top_iph = skb->nh.iph; | ||
45 | hdrlen = iph->ihl * 4 - optlen; | ||
46 | skb->h.raw += hdrlen; | ||
47 | |||
48 | memmove(top_iph, iph, hdrlen); | ||
49 | if (unlikely(optlen)) { | ||
50 | struct ip_beet_phdr *ph; | ||
51 | |||
52 | BUG_ON(optlen < 0); | ||
53 | |||
54 | ph = (struct ip_beet_phdr *)skb->h.raw; | ||
55 | ph->padlen = 4 - (optlen & 4); | ||
56 | ph->hdrlen = (optlen + ph->padlen + sizeof(*ph)) / 8; | ||
57 | ph->nexthdr = top_iph->protocol; | ||
58 | |||
59 | top_iph->protocol = IPPROTO_BEETPH; | ||
60 | top_iph->ihl = sizeof(struct iphdr) / 4; | ||
61 | } | ||
62 | |||
63 | top_iph->saddr = x->props.saddr.a4; | ||
64 | top_iph->daddr = x->id.daddr.a4; | ||
65 | |||
66 | return 0; | ||
67 | } | ||
68 | |||
69 | static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb) | ||
70 | { | ||
71 | struct iphdr *iph = skb->nh.iph; | ||
72 | int phlen = 0; | ||
73 | int optlen = 0; | ||
74 | __u8 ph_nexthdr = 0, protocol = 0; | ||
75 | int err = -EINVAL; | ||
76 | |||
77 | protocol = iph->protocol; | ||
78 | |||
79 | if (unlikely(iph->protocol == IPPROTO_BEETPH)) { | ||
80 | struct ip_beet_phdr *ph = (struct ip_beet_phdr*)(iph + 1); | ||
81 | |||
82 | if (!pskb_may_pull(skb, sizeof(*ph))) | ||
83 | goto out; | ||
84 | |||
85 | phlen = ph->hdrlen * 8; | ||
86 | optlen = phlen - ph->padlen - sizeof(*ph); | ||
87 | if (optlen < 0 || optlen & 3 || optlen > 250) | ||
88 | goto out; | ||
89 | |||
90 | if (!pskb_may_pull(skb, phlen)) | ||
91 | goto out; | ||
92 | |||
93 | ph_nexthdr = ph->nexthdr; | ||
94 | } | ||
95 | |||
96 | skb_push(skb, sizeof(*iph) - phlen + optlen); | ||
97 | memmove(skb->data, skb->nh.raw, sizeof(*iph)); | ||
98 | skb->nh.raw = skb->data; | ||
99 | |||
100 | iph = skb->nh.iph; | ||
101 | iph->ihl = (sizeof(*iph) + optlen) / 4; | ||
102 | iph->tot_len = htons(skb->len); | ||
103 | iph->daddr = x->sel.daddr.a4; | ||
104 | iph->saddr = x->sel.saddr.a4; | ||
105 | if (ph_nexthdr) | ||
106 | iph->protocol = ph_nexthdr; | ||
107 | else | ||
108 | iph->protocol = protocol; | ||
109 | iph->check = 0; | ||
110 | iph->check = ip_fast_csum(skb->nh.raw, iph->ihl); | ||
111 | err = 0; | ||
112 | out: | ||
113 | return err; | ||
114 | } | ||
115 | |||
116 | static struct xfrm_mode xfrm4_beet_mode = { | ||
117 | .input = xfrm4_beet_input, | ||
118 | .output = xfrm4_beet_output, | ||
119 | .owner = THIS_MODULE, | ||
120 | .encap = XFRM_MODE_BEET, | ||
121 | }; | ||
122 | |||
123 | static int __init xfrm4_beet_init(void) | ||
124 | { | ||
125 | return xfrm_register_mode(&xfrm4_beet_mode, AF_INET); | ||
126 | } | ||
127 | |||
128 | static void __exit xfrm4_beet_exit(void) | ||
129 | { | ||
130 | int err; | ||
131 | |||
132 | err = xfrm_unregister_mode(&xfrm4_beet_mode, AF_INET); | ||
133 | BUG_ON(err); | ||
134 | } | ||
135 | |||
136 | module_init(xfrm4_beet_init); | ||
137 | module_exit(xfrm4_beet_exit); | ||
138 | MODULE_LICENSE("GPL"); | ||
139 | MODULE_ALIAS_XFRM_MODE(AF_INET, XFRM_MODE_BEET); | ||