2 * xfrm algorithm interface
4 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the Free
8 * Software Foundation; either version 2 of the License, or (at your option)
12 #include <linux/module.h>
13 #include <linux/kernel.h>
14 #include <linux/pfkeyv2.h>
15 #include <linux/crypto.h>
16 #include <linux/scatterlist.h>
18 #if defined(CONFIG_INET_AH) || defined(CONFIG_INET_AH_MODULE) || defined(CONFIG_INET6_AH) || defined(CONFIG_INET6_AH_MODULE)
21 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
26 * Algorithms supported by IPsec. These entries contain properties which
27 * are used in key negotiation and xfrm processing, and are used to verify
28 * that instantiated crypto transforms have correct parameters for IPsec
31 static struct xfrm_algo_desc aead_list[] = {
33 .name = "rfc4106(gcm(aes))",
42 .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV8,
44 .sadb_alg_minbits = 128,
45 .sadb_alg_maxbits = 256
49 .name = "rfc4106(gcm(aes))",
58 .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV12,
60 .sadb_alg_minbits = 128,
61 .sadb_alg_maxbits = 256
65 .name = "rfc4106(gcm(aes))",
74 .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV16,
76 .sadb_alg_minbits = 128,
77 .sadb_alg_maxbits = 256
81 .name = "rfc4309(ccm(aes))",
90 .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV8,
92 .sadb_alg_minbits = 128,
93 .sadb_alg_maxbits = 256
97 .name = "rfc4309(ccm(aes))",
106 .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV12,
108 .sadb_alg_minbits = 128,
109 .sadb_alg_maxbits = 256
113 .name = "rfc4309(ccm(aes))",
117 .icv_truncbits = 128,
122 .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV16,
124 .sadb_alg_minbits = 128,
125 .sadb_alg_maxbits = 256
130 static struct xfrm_algo_desc aalg_list[] = {
132 .name = "hmac(digest_null)",
133 .compat = "digest_null",
143 .sadb_alg_id = SADB_X_AALG_NULL,
145 .sadb_alg_minbits = 0,
146 .sadb_alg_maxbits = 0
161 .sadb_alg_id = SADB_AALG_MD5HMAC,
163 .sadb_alg_minbits = 128,
164 .sadb_alg_maxbits = 128
168 .name = "hmac(sha1)",
179 .sadb_alg_id = SADB_AALG_SHA1HMAC,
181 .sadb_alg_minbits = 160,
182 .sadb_alg_maxbits = 160
186 .name = "hmac(sha256)",
197 .sadb_alg_id = SADB_X_AALG_SHA2_256HMAC,
199 .sadb_alg_minbits = 256,
200 .sadb_alg_maxbits = 256
204 .name = "hmac(ripemd160)",
205 .compat = "ripemd160",
215 .sadb_alg_id = SADB_X_AALG_RIPEMD160HMAC,
217 .sadb_alg_minbits = 160,
218 .sadb_alg_maxbits = 160
232 .sadb_alg_id = SADB_X_AALG_AES_XCBC_MAC,
234 .sadb_alg_minbits = 128,
235 .sadb_alg_maxbits = 128
240 static struct xfrm_algo_desc ealg_list[] = {
242 .name = "ecb(cipher_null)",
243 .compat = "cipher_null",
253 .sadb_alg_id = SADB_EALG_NULL,
255 .sadb_alg_minbits = 0,
256 .sadb_alg_maxbits = 0
271 .sadb_alg_id = SADB_EALG_DESCBC,
273 .sadb_alg_minbits = 64,
274 .sadb_alg_maxbits = 64
278 .name = "cbc(des3_ede)",
279 .compat = "des3_ede",
289 .sadb_alg_id = SADB_EALG_3DESCBC,
291 .sadb_alg_minbits = 192,
292 .sadb_alg_maxbits = 192
296 .name = "cbc(cast128)",
307 .sadb_alg_id = SADB_X_EALG_CASTCBC,
309 .sadb_alg_minbits = 40,
310 .sadb_alg_maxbits = 128
314 .name = "cbc(blowfish)",
315 .compat = "blowfish",
325 .sadb_alg_id = SADB_X_EALG_BLOWFISHCBC,
327 .sadb_alg_minbits = 40,
328 .sadb_alg_maxbits = 448
343 .sadb_alg_id = SADB_X_EALG_AESCBC,
345 .sadb_alg_minbits = 128,
346 .sadb_alg_maxbits = 256
350 .name = "cbc(serpent)",
361 .sadb_alg_id = SADB_X_EALG_SERPENTCBC,
363 .sadb_alg_minbits = 128,
364 .sadb_alg_maxbits = 256,
368 .name = "cbc(camellia)",
378 .sadb_alg_id = SADB_X_EALG_CAMELLIACBC,
380 .sadb_alg_minbits = 128,
381 .sadb_alg_maxbits = 256
385 .name = "cbc(twofish)",
396 .sadb_alg_id = SADB_X_EALG_TWOFISHCBC,
398 .sadb_alg_minbits = 128,
399 .sadb_alg_maxbits = 256
404 static struct xfrm_algo_desc calg_list[] = {
412 .desc = { .sadb_alg_id = SADB_X_CALG_DEFLATE }
421 .desc = { .sadb_alg_id = SADB_X_CALG_LZS }
430 .desc = { .sadb_alg_id = SADB_X_CALG_LZJH }
434 static inline int aead_entries(void)
436 return ARRAY_SIZE(aead_list);
439 static inline int aalg_entries(void)
441 return ARRAY_SIZE(aalg_list);
444 static inline int ealg_entries(void)
446 return ARRAY_SIZE(ealg_list);
449 static inline int calg_entries(void)
451 return ARRAY_SIZE(calg_list);
454 struct xfrm_algo_list {
455 struct xfrm_algo_desc *algs;
461 static const struct xfrm_algo_list xfrm_aead_list = {
463 .entries = ARRAY_SIZE(aead_list),
464 .type = CRYPTO_ALG_TYPE_AEAD,
465 .mask = CRYPTO_ALG_TYPE_MASK,
468 static const struct xfrm_algo_list xfrm_aalg_list = {
470 .entries = ARRAY_SIZE(aalg_list),
471 .type = CRYPTO_ALG_TYPE_HASH,
472 .mask = CRYPTO_ALG_TYPE_HASH_MASK,
475 static const struct xfrm_algo_list xfrm_ealg_list = {
477 .entries = ARRAY_SIZE(ealg_list),
478 .type = CRYPTO_ALG_TYPE_BLKCIPHER,
479 .mask = CRYPTO_ALG_TYPE_BLKCIPHER_MASK,
482 static const struct xfrm_algo_list xfrm_calg_list = {
484 .entries = ARRAY_SIZE(calg_list),
485 .type = CRYPTO_ALG_TYPE_COMPRESS,
486 .mask = CRYPTO_ALG_TYPE_MASK,
489 static struct xfrm_algo_desc *xfrm_find_algo(
490 const struct xfrm_algo_list *algo_list,
491 int match(const struct xfrm_algo_desc *entry, const void *data),
492 const void *data, int probe)
494 struct xfrm_algo_desc *list = algo_list->algs;
497 for (i = 0; i < algo_list->entries; i++) {
498 if (!match(list + i, data))
501 if (list[i].available)
507 status = crypto_has_alg(list[i].name, algo_list->type,
512 list[i].available = status;
518 static int xfrm_alg_id_match(const struct xfrm_algo_desc *entry,
521 return entry->desc.sadb_alg_id == (unsigned long)data;
524 struct xfrm_algo_desc *xfrm_aalg_get_byid(int alg_id)
526 return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_id_match,
527 (void *)(unsigned long)alg_id, 1);
529 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byid);
531 struct xfrm_algo_desc *xfrm_ealg_get_byid(int alg_id)
533 return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_id_match,
534 (void *)(unsigned long)alg_id, 1);
536 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byid);
538 struct xfrm_algo_desc *xfrm_calg_get_byid(int alg_id)
540 return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_id_match,
541 (void *)(unsigned long)alg_id, 1);
543 EXPORT_SYMBOL_GPL(xfrm_calg_get_byid);
545 static int xfrm_alg_name_match(const struct xfrm_algo_desc *entry,
548 const char *name = data;
550 return name && (!strcmp(name, entry->name) ||
551 (entry->compat && !strcmp(name, entry->compat)));
554 struct xfrm_algo_desc *xfrm_aalg_get_byname(char *name, int probe)
556 return xfrm_find_algo(&xfrm_aalg_list, xfrm_alg_name_match, name,
559 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byname);
561 struct xfrm_algo_desc *xfrm_ealg_get_byname(char *name, int probe)
563 return xfrm_find_algo(&xfrm_ealg_list, xfrm_alg_name_match, name,
566 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byname);
568 struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe)
570 return xfrm_find_algo(&xfrm_calg_list, xfrm_alg_name_match, name,
573 EXPORT_SYMBOL_GPL(xfrm_calg_get_byname);
575 struct xfrm_aead_name {
580 static int xfrm_aead_name_match(const struct xfrm_algo_desc *entry,
583 const struct xfrm_aead_name *aead = data;
584 const char *name = aead->name;
586 return aead->icvbits == entry->uinfo.aead.icv_truncbits && name &&
587 !strcmp(name, entry->name);
590 struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len, int probe)
592 struct xfrm_aead_name data = {
597 return xfrm_find_algo(&xfrm_aead_list, xfrm_aead_name_match, &data,
600 EXPORT_SYMBOL_GPL(xfrm_aead_get_byname);
602 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx)
604 if (idx >= aalg_entries())
607 return &aalg_list[idx];
609 EXPORT_SYMBOL_GPL(xfrm_aalg_get_byidx);
611 struct xfrm_algo_desc *xfrm_ealg_get_byidx(unsigned int idx)
613 if (idx >= ealg_entries())
616 return &ealg_list[idx];
618 EXPORT_SYMBOL_GPL(xfrm_ealg_get_byidx);
621 * Probe for the availability of crypto algorithms, and set the available
622 * flag for any algorithms found on the system. This is typically called by
623 * pfkey during userspace SA add, update or register.
625 void xfrm_probe_algs(void)
629 BUG_ON(in_softirq());
631 for (i = 0; i < aalg_entries(); i++) {
632 status = crypto_has_hash(aalg_list[i].name, 0,
634 if (aalg_list[i].available != status)
635 aalg_list[i].available = status;
638 for (i = 0; i < ealg_entries(); i++) {
639 status = crypto_has_blkcipher(ealg_list[i].name, 0,
641 if (ealg_list[i].available != status)
642 ealg_list[i].available = status;
645 for (i = 0; i < calg_entries(); i++) {
646 status = crypto_has_comp(calg_list[i].name, 0,
648 if (calg_list[i].available != status)
649 calg_list[i].available = status;
652 EXPORT_SYMBOL_GPL(xfrm_probe_algs);
654 int xfrm_count_auth_supported(void)
658 for (i = 0, n = 0; i < aalg_entries(); i++)
659 if (aalg_list[i].available)
663 EXPORT_SYMBOL_GPL(xfrm_count_auth_supported);
665 int xfrm_count_enc_supported(void)
669 for (i = 0, n = 0; i < ealg_entries(); i++)
670 if (ealg_list[i].available)
674 EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
676 /* Move to common area: it is shared with AH. */
678 int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
679 int offset, int len, icv_update_fn_t icv_update)
681 int start = skb_headlen(skb);
682 int i, copy = start - offset;
684 struct scatterlist sg;
686 /* Checksum header. */
691 sg_init_one(&sg, skb->data + offset, copy);
693 err = icv_update(desc, &sg, copy);
697 if ((len -= copy) == 0)
702 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
705 BUG_TRAP(start <= offset + len);
707 end = start + skb_shinfo(skb)->frags[i].size;
708 if ((copy = end - offset) > 0) {
709 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
714 sg_init_table(&sg, 1);
715 sg_set_page(&sg, frag->page, copy,
716 frag->page_offset + offset-start);
718 err = icv_update(desc, &sg, copy);
729 if (skb_shinfo(skb)->frag_list) {
730 struct sk_buff *list = skb_shinfo(skb)->frag_list;
732 for (; list; list = list->next) {
735 BUG_TRAP(start <= offset + len);
737 end = start + list->len;
738 if ((copy = end - offset) > 0) {
741 err = skb_icv_walk(list, desc, offset-start,
745 if ((len -= copy) == 0)
755 EXPORT_SYMBOL_GPL(skb_icv_walk);
757 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
759 void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)
762 skb->data_len += len;
765 return skb_put(tail, len);
767 EXPORT_SYMBOL_GPL(pskb_put);