1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* SCTP kernel implementation
3  * (C) Copyright 2007 Hewlett-Packard Development Company, L.P.
4  *
5  * This file is part of the SCTP kernel implementation
6  *
7  * Please send any bug reports or fixes you make to the
8  * email address(es):
9  *    lksctp developers <linux-sctp@vger.kernel.org>
10  *
11  * Written or modified by:
12  *   Vlad Yasevich     <vladislav.yasevich@hp.com>
13  */
14 
15 #include <crypto/hash.h>
16 #include <linux/slab.h>
17 #include <linux/types.h>
18 #include <linux/scatterlist.h>
19 #include <net/sctp/sctp.h>
20 #include <net/sctp/auth.h>
21 
22 static struct sctp_hmac sctp_hmac_list[SCTP_AUTH_NUM_HMACS] = {
23 	{
24 		/* id 0 is reserved.  as all 0 */
25 		.hmac_id = SCTP_AUTH_HMAC_ID_RESERVED_0,
26 	},
27 	{
28 		.hmac_id = SCTP_AUTH_HMAC_ID_SHA1,
29 		.hmac_name = "hmac(sha1)",
30 		.hmac_len = SCTP_SHA1_SIG_SIZE,
31 	},
32 	{
33 		/* id 2 is reserved as well */
34 		.hmac_id = SCTP_AUTH_HMAC_ID_RESERVED_2,
35 	},
36 #if IS_ENABLED(CONFIG_CRYPTO_SHA256)
37 	{
38 		.hmac_id = SCTP_AUTH_HMAC_ID_SHA256,
39 		.hmac_name = "hmac(sha256)",
40 		.hmac_len = SCTP_SHA256_SIG_SIZE,
41 	}
42 #endif
43 };
44 
45 
sctp_auth_key_put(struct sctp_auth_bytes * key)46 void sctp_auth_key_put(struct sctp_auth_bytes *key)
47 {
48 	if (!key)
49 		return;
50 
51 	if (refcount_dec_and_test(&key->refcnt)) {
52 		kfree_sensitive(key);
53 		SCTP_DBG_OBJCNT_DEC(keys);
54 	}
55 }
56 
57 /* Create a new key structure of a given length */
sctp_auth_create_key(__u32 key_len,gfp_t gfp)58 static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
59 {
60 	struct sctp_auth_bytes *key;
61 
62 	/* Verify that we are not going to overflow INT_MAX */
63 	if (key_len > (INT_MAX - sizeof(struct sctp_auth_bytes)))
64 		return NULL;
65 
66 	/* Allocate the shared key */
67 	key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp);
68 	if (!key)
69 		return NULL;
70 
71 	key->len = key_len;
72 	refcount_set(&key->refcnt, 1);
73 	SCTP_DBG_OBJCNT_INC(keys);
74 
75 	return key;
76 }
77 
78 /* Create a new shared key container with a give key id */
sctp_auth_shkey_create(__u16 key_id,gfp_t gfp)79 struct sctp_shared_key *sctp_auth_shkey_create(__u16 key_id, gfp_t gfp)
80 {
81 	struct sctp_shared_key *new;
82 
83 	/* Allocate the shared key container */
84 	new = kzalloc(sizeof(struct sctp_shared_key), gfp);
85 	if (!new)
86 		return NULL;
87 
88 	INIT_LIST_HEAD(&new->key_list);
89 	refcount_set(&new->refcnt, 1);
90 	new->key_id = key_id;
91 
92 	return new;
93 }
94 
95 /* Free the shared key structure */
sctp_auth_shkey_destroy(struct sctp_shared_key * sh_key)96 static void sctp_auth_shkey_destroy(struct sctp_shared_key *sh_key)
97 {
98 	BUG_ON(!list_empty(&sh_key->key_list));
99 	sctp_auth_key_put(sh_key->key);
100 	sh_key->key = NULL;
101 	kfree(sh_key);
102 }
103 
sctp_auth_shkey_release(struct sctp_shared_key * sh_key)104 void sctp_auth_shkey_release(struct sctp_shared_key *sh_key)
105 {
106 	if (refcount_dec_and_test(&sh_key->refcnt))
107 		sctp_auth_shkey_destroy(sh_key);
108 }
109 
sctp_auth_shkey_hold(struct sctp_shared_key * sh_key)110 void sctp_auth_shkey_hold(struct sctp_shared_key *sh_key)
111 {
112 	refcount_inc(&sh_key->refcnt);
113 }
114 
115 /* Destroy the entire key list.  This is done during the
116  * associon and endpoint free process.
117  */
sctp_auth_destroy_keys(struct list_head * keys)118 void sctp_auth_destroy_keys(struct list_head *keys)
119 {
120 	struct sctp_shared_key *ep_key;
121 	struct sctp_shared_key *tmp;
122 
123 	if (list_empty(keys))
124 		return;
125 
126 	key_for_each_safe(ep_key, tmp, keys) {
127 		list_del_init(&ep_key->key_list);
128 		sctp_auth_shkey_release(ep_key);
129 	}
130 }
131 
132 /* Compare two byte vectors as numbers.  Return values
133  * are:
134  * 	  0 - vectors are equal
135  * 	< 0 - vector 1 is smaller than vector2
136  * 	> 0 - vector 1 is greater than vector2
137  *
138  * Algorithm is:
139  * 	This is performed by selecting the numerically smaller key vector...
140  *	If the key vectors are equal as numbers but differ in length ...
141  *	the shorter vector is considered smaller
142  *
143  * Examples (with small values):
144  * 	000123456789 > 123456789 (first number is longer)
145  * 	000123456789 < 234567891 (second number is larger numerically)
146  * 	123456789 > 2345678 	 (first number is both larger & longer)
147  */
sctp_auth_compare_vectors(struct sctp_auth_bytes * vector1,struct sctp_auth_bytes * vector2)148 static int sctp_auth_compare_vectors(struct sctp_auth_bytes *vector1,
149 			      struct sctp_auth_bytes *vector2)
150 {
151 	int diff;
152 	int i;
153 	const __u8 *longer;
154 
155 	diff = vector1->len - vector2->len;
156 	if (diff) {
157 		longer = (diff > 0) ? vector1->data : vector2->data;
158 
159 		/* Check to see if the longer number is
160 		 * lead-zero padded.  If it is not, it
161 		 * is automatically larger numerically.
162 		 */
163 		for (i = 0; i < abs(diff); i++) {
164 			if (longer[i] != 0)
165 				return diff;
166 		}
167 	}
168 
169 	/* lengths are the same, compare numbers */
170 	return memcmp(vector1->data, vector2->data, vector1->len);
171 }
172 
173 /*
174  * Create a key vector as described in SCTP-AUTH, Section 6.1
175  *    The RANDOM parameter, the CHUNKS parameter and the HMAC-ALGO
176  *    parameter sent by each endpoint are concatenated as byte vectors.
177  *    These parameters include the parameter type, parameter length, and
178  *    the parameter value, but padding is omitted; all padding MUST be
179  *    removed from this concatenation before proceeding with further
180  *    computation of keys.  Parameters which were not sent are simply
181  *    omitted from the concatenation process.  The resulting two vectors
182  *    are called the two key vectors.
183  */
sctp_auth_make_key_vector(struct sctp_random_param * random,struct sctp_chunks_param * chunks,struct sctp_hmac_algo_param * hmacs,gfp_t gfp)184 static struct sctp_auth_bytes *sctp_auth_make_key_vector(
185 			struct sctp_random_param *random,
186 			struct sctp_chunks_param *chunks,
187 			struct sctp_hmac_algo_param *hmacs,
188 			gfp_t gfp)
189 {
190 	struct sctp_auth_bytes *new;
191 	__u32	len;
192 	__u32	offset = 0;
193 	__u16	random_len, hmacs_len, chunks_len = 0;
194 
195 	random_len = ntohs(random->param_hdr.length);
196 	hmacs_len = ntohs(hmacs->param_hdr.length);
197 	if (chunks)
198 		chunks_len = ntohs(chunks->param_hdr.length);
199 
200 	len = random_len + hmacs_len + chunks_len;
201 
202 	new = sctp_auth_create_key(len, gfp);
203 	if (!new)
204 		return NULL;
205 
206 	memcpy(new->data, random, random_len);
207 	offset += random_len;
208 
209 	if (chunks) {
210 		memcpy(new->data + offset, chunks, chunks_len);
211 		offset += chunks_len;
212 	}
213 
214 	memcpy(new->data + offset, hmacs, hmacs_len);
215 
216 	return new;
217 }
218 
219 
220 /* Make a key vector based on our local parameters */
sctp_auth_make_local_vector(const struct sctp_association * asoc,gfp_t gfp)221 static struct sctp_auth_bytes *sctp_auth_make_local_vector(
222 				    const struct sctp_association *asoc,
223 				    gfp_t gfp)
224 {
225 	return sctp_auth_make_key_vector(
226 			(struct sctp_random_param *)asoc->c.auth_random,
227 			(struct sctp_chunks_param *)asoc->c.auth_chunks,
228 			(struct sctp_hmac_algo_param *)asoc->c.auth_hmacs, gfp);
229 }
230 
231 /* Make a key vector based on peer's parameters */
sctp_auth_make_peer_vector(const struct sctp_association * asoc,gfp_t gfp)232 static struct sctp_auth_bytes *sctp_auth_make_peer_vector(
233 				    const struct sctp_association *asoc,
234 				    gfp_t gfp)
235 {
236 	return sctp_auth_make_key_vector(asoc->peer.peer_random,
237 					 asoc->peer.peer_chunks,
238 					 asoc->peer.peer_hmacs,
239 					 gfp);
240 }
241 
242 
243 /* Set the value of the association shared key base on the parameters
244  * given.  The algorithm is:
245  *    From the endpoint pair shared keys and the key vectors the
246  *    association shared keys are computed.  This is performed by selecting
247  *    the numerically smaller key vector and concatenating it to the
248  *    endpoint pair shared key, and then concatenating the numerically
249  *    larger key vector to that.  The result of the concatenation is the
250  *    association shared key.
251  */
sctp_auth_asoc_set_secret(struct sctp_shared_key * ep_key,struct sctp_auth_bytes * first_vector,struct sctp_auth_bytes * last_vector,gfp_t gfp)252 static struct sctp_auth_bytes *sctp_auth_asoc_set_secret(
253 			struct sctp_shared_key *ep_key,
254 			struct sctp_auth_bytes *first_vector,
255 			struct sctp_auth_bytes *last_vector,
256 			gfp_t gfp)
257 {
258 	struct sctp_auth_bytes *secret;
259 	__u32 offset = 0;
260 	__u32 auth_len;
261 
262 	auth_len = first_vector->len + last_vector->len;
263 	if (ep_key->key)
264 		auth_len += ep_key->key->len;
265 
266 	secret = sctp_auth_create_key(auth_len, gfp);
267 	if (!secret)
268 		return NULL;
269 
270 	if (ep_key->key) {
271 		memcpy(secret->data, ep_key->key->data, ep_key->key->len);
272 		offset += ep_key->key->len;
273 	}
274 
275 	memcpy(secret->data + offset, first_vector->data, first_vector->len);
276 	offset += first_vector->len;
277 
278 	memcpy(secret->data + offset, last_vector->data, last_vector->len);
279 
280 	return secret;
281 }
282 
283 /* Create an association shared key.  Follow the algorithm
284  * described in SCTP-AUTH, Section 6.1
285  */
sctp_auth_asoc_create_secret(const struct sctp_association * asoc,struct sctp_shared_key * ep_key,gfp_t gfp)286 static struct sctp_auth_bytes *sctp_auth_asoc_create_secret(
287 				 const struct sctp_association *asoc,
288 				 struct sctp_shared_key *ep_key,
289 				 gfp_t gfp)
290 {
291 	struct sctp_auth_bytes *local_key_vector;
292 	struct sctp_auth_bytes *peer_key_vector;
293 	struct sctp_auth_bytes	*first_vector,
294 				*last_vector;
295 	struct sctp_auth_bytes	*secret = NULL;
296 	int	cmp;
297 
298 
299 	/* Now we need to build the key vectors
300 	 * SCTP-AUTH , Section 6.1
301 	 *    The RANDOM parameter, the CHUNKS parameter and the HMAC-ALGO
302 	 *    parameter sent by each endpoint are concatenated as byte vectors.
303 	 *    These parameters include the parameter type, parameter length, and
304 	 *    the parameter value, but padding is omitted; all padding MUST be
305 	 *    removed from this concatenation before proceeding with further
306 	 *    computation of keys.  Parameters which were not sent are simply
307 	 *    omitted from the concatenation process.  The resulting two vectors
308 	 *    are called the two key vectors.
309 	 */
310 
311 	local_key_vector = sctp_auth_make_local_vector(asoc, gfp);
312 	peer_key_vector = sctp_auth_make_peer_vector(asoc, gfp);
313 
314 	if (!peer_key_vector || !local_key_vector)
315 		goto out;
316 
317 	/* Figure out the order in which the key_vectors will be
318 	 * added to the endpoint shared key.
319 	 * SCTP-AUTH, Section 6.1:
320 	 *   This is performed by selecting the numerically smaller key
321 	 *   vector and concatenating it to the endpoint pair shared
322 	 *   key, and then concatenating the numerically larger key
323 	 *   vector to that.  If the key vectors are equal as numbers
324 	 *   but differ in length, then the concatenation order is the
325 	 *   endpoint shared key, followed by the shorter key vector,
326 	 *   followed by the longer key vector.  Otherwise, the key
327 	 *   vectors are identical, and may be concatenated to the
328 	 *   endpoint pair key in any order.
329 	 */
330 	cmp = sctp_auth_compare_vectors(local_key_vector,
331 					peer_key_vector);
332 	if (cmp < 0) {
333 		first_vector = local_key_vector;
334 		last_vector = peer_key_vector;
335 	} else {
336 		first_vector = peer_key_vector;
337 		last_vector = local_key_vector;
338 	}
339 
340 	secret = sctp_auth_asoc_set_secret(ep_key, first_vector, last_vector,
341 					    gfp);
342 out:
343 	sctp_auth_key_put(local_key_vector);
344 	sctp_auth_key_put(peer_key_vector);
345 
346 	return secret;
347 }
348 
349 /*
350  * Populate the association overlay list with the list
351  * from the endpoint.
352  */
sctp_auth_asoc_copy_shkeys(const struct sctp_endpoint * ep,struct sctp_association * asoc,gfp_t gfp)353 int sctp_auth_asoc_copy_shkeys(const struct sctp_endpoint *ep,
354 				struct sctp_association *asoc,
355 				gfp_t gfp)
356 {
357 	struct sctp_shared_key *sh_key;
358 	struct sctp_shared_key *new;
359 
360 	BUG_ON(!list_empty(&asoc->endpoint_shared_keys));
361 
362 	key_for_each(sh_key, &ep->endpoint_shared_keys) {
363 		new = sctp_auth_shkey_create(sh_key->key_id, gfp);
364 		if (!new)
365 			goto nomem;
366 
367 		new->key = sh_key->key;
368 		sctp_auth_key_hold(new->key);
369 		list_add(&new->key_list, &asoc->endpoint_shared_keys);
370 	}
371 
372 	return 0;
373 
374 nomem:
375 	sctp_auth_destroy_keys(&asoc->endpoint_shared_keys);
376 	return -ENOMEM;
377 }
378 
379 
380 /* Public interface to create the association shared key.
381  * See code above for the algorithm.
382  */
sctp_auth_asoc_init_active_key(struct sctp_association * asoc,gfp_t gfp)383 int sctp_auth_asoc_init_active_key(struct sctp_association *asoc, gfp_t gfp)
384 {
385 	struct sctp_auth_bytes	*secret;
386 	struct sctp_shared_key *ep_key;
387 	struct sctp_chunk *chunk;
388 
389 	/* If we don't support AUTH, or peer is not capable
390 	 * we don't need to do anything.
391 	 */
392 	if (!asoc->peer.auth_capable)
393 		return 0;
394 
395 	/* If the key_id is non-zero and we couldn't find an
396 	 * endpoint pair shared key, we can't compute the
397 	 * secret.
398 	 * For key_id 0, endpoint pair shared key is a NULL key.
399 	 */
400 	ep_key = sctp_auth_get_shkey(asoc, asoc->active_key_id);
401 	BUG_ON(!ep_key);
402 
403 	secret = sctp_auth_asoc_create_secret(asoc, ep_key, gfp);
404 	if (!secret)
405 		return -ENOMEM;
406 
407 	sctp_auth_key_put(asoc->asoc_shared_key);
408 	asoc->asoc_shared_key = secret;
409 	asoc->shkey = ep_key;
410 
411 	/* Update send queue in case any chunk already in there now
412 	 * needs authenticating
413 	 */
414 	list_for_each_entry(chunk, &asoc->outqueue.out_chunk_list, list) {
415 		if (sctp_auth_send_cid(chunk->chunk_hdr->type, asoc)) {
416 			chunk->auth = 1;
417 			if (!chunk->shkey) {
418 				chunk->shkey = asoc->shkey;
419 				sctp_auth_shkey_hold(chunk->shkey);
420 			}
421 		}
422 	}
423 
424 	return 0;
425 }
426 
427 
428 /* Find the endpoint pair shared key based on the key_id */
sctp_auth_get_shkey(const struct sctp_association * asoc,__u16 key_id)429 struct sctp_shared_key *sctp_auth_get_shkey(
430 				const struct sctp_association *asoc,
431 				__u16 key_id)
432 {
433 	struct sctp_shared_key *key;
434 
435 	/* First search associations set of endpoint pair shared keys */
436 	key_for_each(key, &asoc->endpoint_shared_keys) {
437 		if (key->key_id == key_id) {
438 			if (!key->deactivated)
439 				return key;
440 			break;
441 		}
442 	}
443 
444 	return NULL;
445 }
446 
447 /*
448  * Initialize all the possible digest transforms that we can use.  Right
449  * now, the supported digests are SHA1 and SHA256.  We do this here once
450  * because of the restrictiong that transforms may only be allocated in
451  * user context.  This forces us to pre-allocated all possible transforms
452  * at the endpoint init time.
453  */
sctp_auth_init_hmacs(struct sctp_endpoint * ep,gfp_t gfp)454 int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
455 {
456 	struct crypto_shash *tfm = NULL;
457 	__u16   id;
458 
459 	/* If the transforms are already allocated, we are done */
460 	if (ep->auth_hmacs)
461 		return 0;
462 
463 	/* Allocated the array of pointers to transorms */
464 	ep->auth_hmacs = kcalloc(SCTP_AUTH_NUM_HMACS,
465 				 sizeof(struct crypto_shash *),
466 				 gfp);
467 	if (!ep->auth_hmacs)
468 		return -ENOMEM;
469 
470 	for (id = 0; id < SCTP_AUTH_NUM_HMACS; id++) {
471 
472 		/* See is we support the id.  Supported IDs have name and
473 		 * length fields set, so that we can allocated and use
474 		 * them.  We can safely just check for name, for without the
475 		 * name, we can't allocate the TFM.
476 		 */
477 		if (!sctp_hmac_list[id].hmac_name)
478 			continue;
479 
480 		/* If this TFM has been allocated, we are all set */
481 		if (ep->auth_hmacs[id])
482 			continue;
483 
484 		/* Allocate the ID */
485 		tfm = crypto_alloc_shash(sctp_hmac_list[id].hmac_name, 0, 0);
486 		if (IS_ERR(tfm))
487 			goto out_err;
488 
489 		ep->auth_hmacs[id] = tfm;
490 	}
491 
492 	return 0;
493 
494 out_err:
495 	/* Clean up any successful allocations */
496 	sctp_auth_destroy_hmacs(ep->auth_hmacs);
497 	ep->auth_hmacs = NULL;
498 	return -ENOMEM;
499 }
500 
501 /* Destroy the hmac tfm array */
sctp_auth_destroy_hmacs(struct crypto_shash * auth_hmacs[])502 void sctp_auth_destroy_hmacs(struct crypto_shash *auth_hmacs[])
503 {
504 	int i;
505 
506 	if (!auth_hmacs)
507 		return;
508 
509 	for (i = 0; i < SCTP_AUTH_NUM_HMACS; i++) {
510 		crypto_free_shash(auth_hmacs[i]);
511 	}
512 	kfree(auth_hmacs);
513 }
514 
515 
sctp_auth_get_hmac(__u16 hmac_id)516 struct sctp_hmac *sctp_auth_get_hmac(__u16 hmac_id)
517 {
518 	return &sctp_hmac_list[hmac_id];
519 }
520 
521 /* Get an hmac description information that we can use to build
522  * the AUTH chunk
523  */
sctp_auth_asoc_get_hmac(const struct sctp_association * asoc)524 struct sctp_hmac *sctp_auth_asoc_get_hmac(const struct sctp_association *asoc)
525 {
526 	struct sctp_hmac_algo_param *hmacs;
527 	__u16 n_elt;
528 	__u16 id = 0;
529 	int i;
530 
531 	/* If we have a default entry, use it */
532 	if (asoc->default_hmac_id)
533 		return &sctp_hmac_list[asoc->default_hmac_id];
534 
535 	/* Since we do not have a default entry, find the first entry
536 	 * we support and return that.  Do not cache that id.
537 	 */
538 	hmacs = asoc->peer.peer_hmacs;
539 	if (!hmacs)
540 		return NULL;
541 
542 	n_elt = (ntohs(hmacs->param_hdr.length) -
543 		 sizeof(struct sctp_paramhdr)) >> 1;
544 	for (i = 0; i < n_elt; i++) {
545 		id = ntohs(hmacs->hmac_ids[i]);
546 
547 		/* Check the id is in the supported range. And
548 		 * see if we support the id.  Supported IDs have name and
549 		 * length fields set, so that we can allocate and use
550 		 * them.  We can safely just check for name, for without the
551 		 * name, we can't allocate the TFM.
552 		 */
553 		if (id > SCTP_AUTH_HMAC_ID_MAX ||
554 		    !sctp_hmac_list[id].hmac_name) {
555 			id = 0;
556 			continue;
557 		}
558 
559 		break;
560 	}
561 
562 	if (id == 0)
563 		return NULL;
564 
565 	return &sctp_hmac_list[id];
566 }
567 
__sctp_auth_find_hmacid(__be16 * hmacs,int n_elts,__be16 hmac_id)568 static int __sctp_auth_find_hmacid(__be16 *hmacs, int n_elts, __be16 hmac_id)
569 {
570 	int  found = 0;
571 	int  i;
572 
573 	for (i = 0; i < n_elts; i++) {
574 		if (hmac_id == hmacs[i]) {
575 			found = 1;
576 			break;
577 		}
578 	}
579 
580 	return found;
581 }
582 
583 /* See if the HMAC_ID is one that we claim as supported */
sctp_auth_asoc_verify_hmac_id(const struct sctp_association * asoc,__be16 hmac_id)584 int sctp_auth_asoc_verify_hmac_id(const struct sctp_association *asoc,
585 				    __be16 hmac_id)
586 {
587 	struct sctp_hmac_algo_param *hmacs;
588 	__u16 n_elt;
589 
590 	if (!asoc)
591 		return 0;
592 
593 	hmacs = (struct sctp_hmac_algo_param *)asoc->c.auth_hmacs;
594 	n_elt = (ntohs(hmacs->param_hdr.length) -
595 		 sizeof(struct sctp_paramhdr)) >> 1;
596 
597 	return __sctp_auth_find_hmacid(hmacs->hmac_ids, n_elt, hmac_id);
598 }
599 
600 
601 /* Cache the default HMAC id.  This to follow this text from SCTP-AUTH:
602  * Section 6.1:
603  *   The receiver of a HMAC-ALGO parameter SHOULD use the first listed
604  *   algorithm it supports.
605  */
sctp_auth_asoc_set_default_hmac(struct sctp_association * asoc,struct sctp_hmac_algo_param * hmacs)606 void sctp_auth_asoc_set_default_hmac(struct sctp_association *asoc,
607 				     struct sctp_hmac_algo_param *hmacs)
608 {
609 	struct sctp_endpoint *ep;
610 	__u16   id;
611 	int	i;
612 	int	n_params;
613 
614 	/* if the default id is already set, use it */
615 	if (asoc->default_hmac_id)
616 		return;
617 
618 	n_params = (ntohs(hmacs->param_hdr.length) -
619 		    sizeof(struct sctp_paramhdr)) >> 1;
620 	ep = asoc->ep;
621 	for (i = 0; i < n_params; i++) {
622 		id = ntohs(hmacs->hmac_ids[i]);
623 
624 		/* Check the id is in the supported range */
625 		if (id > SCTP_AUTH_HMAC_ID_MAX)
626 			continue;
627 
628 		/* If this TFM has been allocated, use this id */
629 		if (ep->auth_hmacs[id]) {
630 			asoc->default_hmac_id = id;
631 			break;
632 		}
633 	}
634 }
635 
636 
637 /* Check to see if the given chunk is supposed to be authenticated */
__sctp_auth_cid(enum sctp_cid chunk,struct sctp_chunks_param * param)638 static int __sctp_auth_cid(enum sctp_cid chunk, struct sctp_chunks_param *param)
639 {
640 	unsigned short len;
641 	int found = 0;
642 	int i;
643 
644 	if (!param || param->param_hdr.length == 0)
645 		return 0;
646 
647 	len = ntohs(param->param_hdr.length) - sizeof(struct sctp_paramhdr);
648 
649 	/* SCTP-AUTH, Section 3.2
650 	 *    The chunk types for INIT, INIT-ACK, SHUTDOWN-COMPLETE and AUTH
651 	 *    chunks MUST NOT be listed in the CHUNKS parameter.  However, if
652 	 *    a CHUNKS parameter is received then the types for INIT, INIT-ACK,
653 	 *    SHUTDOWN-COMPLETE and AUTH chunks MUST be ignored.
654 	 */
655 	for (i = 0; !found && i < len; i++) {
656 		switch (param->chunks[i]) {
657 		case SCTP_CID_INIT:
658 		case SCTP_CID_INIT_ACK:
659 		case SCTP_CID_SHUTDOWN_COMPLETE:
660 		case SCTP_CID_AUTH:
661 			break;
662 
663 		default:
664 			if (param->chunks[i] == chunk)
665 				found = 1;
666 			break;
667 		}
668 	}
669 
670 	return found;
671 }
672 
673 /* Check if peer requested that this chunk is authenticated */
sctp_auth_send_cid(enum sctp_cid chunk,const struct sctp_association * asoc)674 int sctp_auth_send_cid(enum sctp_cid chunk, const struct sctp_association *asoc)
675 {
676 	if (!asoc)
677 		return 0;
678 
679 	if (!asoc->peer.auth_capable)
680 		return 0;
681 
682 	return __sctp_auth_cid(chunk, asoc->peer.peer_chunks);
683 }
684 
685 /* Check if we requested that peer authenticate this chunk. */
sctp_auth_recv_cid(enum sctp_cid chunk,const struct sctp_association * asoc)686 int sctp_auth_recv_cid(enum sctp_cid chunk, const struct sctp_association *asoc)
687 {
688 	if (!asoc)
689 		return 0;
690 
691 	if (!asoc->peer.auth_capable)
692 		return 0;
693 
694 	return __sctp_auth_cid(chunk,
695 			      (struct sctp_chunks_param *)asoc->c.auth_chunks);
696 }
697 
698 /* SCTP-AUTH: Section 6.2:
699  *    The sender MUST calculate the MAC as described in RFC2104 [2] using
700  *    the hash function H as described by the MAC Identifier and the shared
701  *    association key K based on the endpoint pair shared key described by
702  *    the shared key identifier.  The 'data' used for the computation of
703  *    the AUTH-chunk is given by the AUTH chunk with its HMAC field set to
704  *    zero (as shown in Figure 6) followed by all chunks that are placed
705  *    after the AUTH chunk in the SCTP packet.
706  */
sctp_auth_calculate_hmac(const struct sctp_association * asoc,struct sk_buff * skb,struct sctp_auth_chunk * auth,struct sctp_shared_key * ep_key,gfp_t gfp)707 void sctp_auth_calculate_hmac(const struct sctp_association *asoc,
708 			      struct sk_buff *skb, struct sctp_auth_chunk *auth,
709 			      struct sctp_shared_key *ep_key, gfp_t gfp)
710 {
711 	struct sctp_auth_bytes *asoc_key;
712 	struct crypto_shash *tfm;
713 	__u16 key_id, hmac_id;
714 	unsigned char *end;
715 	int free_key = 0;
716 	__u8 *digest;
717 
718 	/* Extract the info we need:
719 	 * - hmac id
720 	 * - key id
721 	 */
722 	key_id = ntohs(auth->auth_hdr.shkey_id);
723 	hmac_id = ntohs(auth->auth_hdr.hmac_id);
724 
725 	if (key_id == asoc->active_key_id)
726 		asoc_key = asoc->asoc_shared_key;
727 	else {
728 		/* ep_key can't be NULL here */
729 		asoc_key = sctp_auth_asoc_create_secret(asoc, ep_key, gfp);
730 		if (!asoc_key)
731 			return;
732 
733 		free_key = 1;
734 	}
735 
736 	/* set up scatter list */
737 	end = skb_tail_pointer(skb);
738 
739 	tfm = asoc->ep->auth_hmacs[hmac_id];
740 
741 	digest = auth->auth_hdr.hmac;
742 	if (crypto_shash_setkey(tfm, &asoc_key->data[0], asoc_key->len))
743 		goto free;
744 
745 	crypto_shash_tfm_digest(tfm, (u8 *)auth, end - (unsigned char *)auth,
746 				digest);
747 
748 free:
749 	if (free_key)
750 		sctp_auth_key_put(asoc_key);
751 }
752 
753 /* API Helpers */
754 
755 /* Add a chunk to the endpoint authenticated chunk list */
sctp_auth_ep_add_chunkid(struct sctp_endpoint * ep,__u8 chunk_id)756 int sctp_auth_ep_add_chunkid(struct sctp_endpoint *ep, __u8 chunk_id)
757 {
758 	struct sctp_chunks_param *p = ep->auth_chunk_list;
759 	__u16 nchunks;
760 	__u16 param_len;
761 
762 	/* If this chunk is already specified, we are done */
763 	if (__sctp_auth_cid(chunk_id, p))
764 		return 0;
765 
766 	/* Check if we can add this chunk to the array */
767 	param_len = ntohs(p->param_hdr.length);
768 	nchunks = param_len - sizeof(struct sctp_paramhdr);
769 	if (nchunks == SCTP_NUM_CHUNK_TYPES)
770 		return -EINVAL;
771 
772 	p->chunks[nchunks] = chunk_id;
773 	p->param_hdr.length = htons(param_len + 1);
774 	return 0;
775 }
776 
777 /* Add hmac identifires to the endpoint list of supported hmac ids */
sctp_auth_ep_set_hmacs(struct sctp_endpoint * ep,struct sctp_hmacalgo * hmacs)778 int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
779 			   struct sctp_hmacalgo *hmacs)
780 {
781 	int has_sha1 = 0;
782 	__u16 id;
783 	int i;
784 
785 	/* Scan the list looking for unsupported id.  Also make sure that
786 	 * SHA1 is specified.
787 	 */
788 	for (i = 0; i < hmacs->shmac_num_idents; i++) {
789 		id = hmacs->shmac_idents[i];
790 
791 		if (id > SCTP_AUTH_HMAC_ID_MAX)
792 			return -EOPNOTSUPP;
793 
794 		if (SCTP_AUTH_HMAC_ID_SHA1 == id)
795 			has_sha1 = 1;
796 
797 		if (!sctp_hmac_list[id].hmac_name)
798 			return -EOPNOTSUPP;
799 	}
800 
801 	if (!has_sha1)
802 		return -EINVAL;
803 
804 	for (i = 0; i < hmacs->shmac_num_idents; i++)
805 		ep->auth_hmacs_list->hmac_ids[i] =
806 				htons(hmacs->shmac_idents[i]);
807 	ep->auth_hmacs_list->param_hdr.length =
808 			htons(sizeof(struct sctp_paramhdr) +
809 			hmacs->shmac_num_idents * sizeof(__u16));
810 	return 0;
811 }
812 
813 /* Set a new shared key on either endpoint or association.  If the
814  * key with a same ID already exists, replace the key (remove the
815  * old key and add a new one).
816  */
sctp_auth_set_key(struct sctp_endpoint * ep,struct sctp_association * asoc,struct sctp_authkey * auth_key)817 int sctp_auth_set_key(struct sctp_endpoint *ep,
818 		      struct sctp_association *asoc,
819 		      struct sctp_authkey *auth_key)
820 {
821 	struct sctp_shared_key *cur_key, *shkey;
822 	struct sctp_auth_bytes *key;
823 	struct list_head *sh_keys;
824 	int replace = 0;
825 
826 	/* Try to find the given key id to see if
827 	 * we are doing a replace, or adding a new key
828 	 */
829 	if (asoc) {
830 		if (!asoc->peer.auth_capable)
831 			return -EACCES;
832 		sh_keys = &asoc->endpoint_shared_keys;
833 	} else {
834 		if (!ep->auth_enable)
835 			return -EACCES;
836 		sh_keys = &ep->endpoint_shared_keys;
837 	}
838 
839 	key_for_each(shkey, sh_keys) {
840 		if (shkey->key_id == auth_key->sca_keynumber) {
841 			replace = 1;
842 			break;
843 		}
844 	}
845 
846 	cur_key = sctp_auth_shkey_create(auth_key->sca_keynumber, GFP_KERNEL);
847 	if (!cur_key)
848 		return -ENOMEM;
849 
850 	/* Create a new key data based on the info passed in */
851 	key = sctp_auth_create_key(auth_key->sca_keylength, GFP_KERNEL);
852 	if (!key) {
853 		kfree(cur_key);
854 		return -ENOMEM;
855 	}
856 
857 	memcpy(key->data, &auth_key->sca_key[0], auth_key->sca_keylength);
858 	cur_key->key = key;
859 
860 	if (replace) {
861 		list_del_init(&shkey->key_list);
862 		sctp_auth_shkey_release(shkey);
863 	}
864 	list_add(&cur_key->key_list, sh_keys);
865 
866 	return 0;
867 }
868 
sctp_auth_set_active_key(struct sctp_endpoint * ep,struct sctp_association * asoc,__u16 key_id)869 int sctp_auth_set_active_key(struct sctp_endpoint *ep,
870 			     struct sctp_association *asoc,
871 			     __u16  key_id)
872 {
873 	struct sctp_shared_key *key;
874 	struct list_head *sh_keys;
875 	int found = 0;
876 
877 	/* The key identifier MUST correst to an existing key */
878 	if (asoc) {
879 		if (!asoc->peer.auth_capable)
880 			return -EACCES;
881 		sh_keys = &asoc->endpoint_shared_keys;
882 	} else {
883 		if (!ep->auth_enable)
884 			return -EACCES;
885 		sh_keys = &ep->endpoint_shared_keys;
886 	}
887 
888 	key_for_each(key, sh_keys) {
889 		if (key->key_id == key_id) {
890 			found = 1;
891 			break;
892 		}
893 	}
894 
895 	if (!found || key->deactivated)
896 		return -EINVAL;
897 
898 	if (asoc) {
899 		asoc->active_key_id = key_id;
900 		sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
901 	} else
902 		ep->active_key_id = key_id;
903 
904 	return 0;
905 }
906 
sctp_auth_del_key_id(struct sctp_endpoint * ep,struct sctp_association * asoc,__u16 key_id)907 int sctp_auth_del_key_id(struct sctp_endpoint *ep,
908 			 struct sctp_association *asoc,
909 			 __u16  key_id)
910 {
911 	struct sctp_shared_key *key;
912 	struct list_head *sh_keys;
913 	int found = 0;
914 
915 	/* The key identifier MUST NOT be the current active key
916 	 * The key identifier MUST correst to an existing key
917 	 */
918 	if (asoc) {
919 		if (!asoc->peer.auth_capable)
920 			return -EACCES;
921 		if (asoc->active_key_id == key_id)
922 			return -EINVAL;
923 
924 		sh_keys = &asoc->endpoint_shared_keys;
925 	} else {
926 		if (!ep->auth_enable)
927 			return -EACCES;
928 		if (ep->active_key_id == key_id)
929 			return -EINVAL;
930 
931 		sh_keys = &ep->endpoint_shared_keys;
932 	}
933 
934 	key_for_each(key, sh_keys) {
935 		if (key->key_id == key_id) {
936 			found = 1;
937 			break;
938 		}
939 	}
940 
941 	if (!found)
942 		return -EINVAL;
943 
944 	/* Delete the shared key */
945 	list_del_init(&key->key_list);
946 	sctp_auth_shkey_release(key);
947 
948 	return 0;
949 }
950 
sctp_auth_deact_key_id(struct sctp_endpoint * ep,struct sctp_association * asoc,__u16 key_id)951 int sctp_auth_deact_key_id(struct sctp_endpoint *ep,
952 			   struct sctp_association *asoc, __u16  key_id)
953 {
954 	struct sctp_shared_key *key;
955 	struct list_head *sh_keys;
956 	int found = 0;
957 
958 	/* The key identifier MUST NOT be the current active key
959 	 * The key identifier MUST correst to an existing key
960 	 */
961 	if (asoc) {
962 		if (!asoc->peer.auth_capable)
963 			return -EACCES;
964 		if (asoc->active_key_id == key_id)
965 			return -EINVAL;
966 
967 		sh_keys = &asoc->endpoint_shared_keys;
968 	} else {
969 		if (!ep->auth_enable)
970 			return -EACCES;
971 		if (ep->active_key_id == key_id)
972 			return -EINVAL;
973 
974 		sh_keys = &ep->endpoint_shared_keys;
975 	}
976 
977 	key_for_each(key, sh_keys) {
978 		if (key->key_id == key_id) {
979 			found = 1;
980 			break;
981 		}
982 	}
983 
984 	if (!found)
985 		return -EINVAL;
986 
987 	/* refcnt == 1 and !list_empty mean it's not being used anywhere
988 	 * and deactivated will be set, so it's time to notify userland
989 	 * that this shkey can be freed.
990 	 */
991 	if (asoc && !list_empty(&key->key_list) &&
992 	    refcount_read(&key->refcnt) == 1) {
993 		struct sctp_ulpevent *ev;
994 
995 		ev = sctp_ulpevent_make_authkey(asoc, key->key_id,
996 						SCTP_AUTH_FREE_KEY, GFP_KERNEL);
997 		if (ev)
998 			asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
999 	}
1000 
1001 	key->deactivated = 1;
1002 
1003 	return 0;
1004 }
1005 
sctp_auth_init(struct sctp_endpoint * ep,gfp_t gfp)1006 int sctp_auth_init(struct sctp_endpoint *ep, gfp_t gfp)
1007 {
1008 	int err = -ENOMEM;
1009 
1010 	/* Allocate space for HMACS and CHUNKS authentication
1011 	 * variables.  There are arrays that we encode directly
1012 	 * into parameters to make the rest of the operations easier.
1013 	 */
1014 	if (!ep->auth_hmacs_list) {
1015 		struct sctp_hmac_algo_param *auth_hmacs;
1016 
1017 		auth_hmacs = kzalloc(struct_size(auth_hmacs, hmac_ids,
1018 						 SCTP_AUTH_NUM_HMACS), gfp);
1019 		if (!auth_hmacs)
1020 			goto nomem;
1021 		/* Initialize the HMACS parameter.
1022 		 * SCTP-AUTH: Section 3.3
1023 		 *    Every endpoint supporting SCTP chunk authentication MUST
1024 		 *    support the HMAC based on the SHA-1 algorithm.
1025 		 */
1026 		auth_hmacs->param_hdr.type = SCTP_PARAM_HMAC_ALGO;
1027 		auth_hmacs->param_hdr.length =
1028 				htons(sizeof(struct sctp_paramhdr) + 2);
1029 		auth_hmacs->hmac_ids[0] = htons(SCTP_AUTH_HMAC_ID_SHA1);
1030 		ep->auth_hmacs_list = auth_hmacs;
1031 	}
1032 
1033 	if (!ep->auth_chunk_list) {
1034 		struct sctp_chunks_param *auth_chunks;
1035 
1036 		auth_chunks = kzalloc(sizeof(*auth_chunks) +
1037 				      SCTP_NUM_CHUNK_TYPES, gfp);
1038 		if (!auth_chunks)
1039 			goto nomem;
1040 		/* Initialize the CHUNKS parameter */
1041 		auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS;
1042 		auth_chunks->param_hdr.length =
1043 				htons(sizeof(struct sctp_paramhdr));
1044 		ep->auth_chunk_list = auth_chunks;
1045 	}
1046 
1047 	/* Allocate and initialize transorms arrays for supported
1048 	 * HMACs.
1049 	 */
1050 	err = sctp_auth_init_hmacs(ep, gfp);
1051 	if (err)
1052 		goto nomem;
1053 
1054 	return 0;
1055 
1056 nomem:
1057 	/* Free all allocations */
1058 	kfree(ep->auth_hmacs_list);
1059 	kfree(ep->auth_chunk_list);
1060 	ep->auth_hmacs_list = NULL;
1061 	ep->auth_chunk_list = NULL;
1062 	return err;
1063 }
1064 
sctp_auth_free(struct sctp_endpoint * ep)1065 void sctp_auth_free(struct sctp_endpoint *ep)
1066 {
1067 	kfree(ep->auth_hmacs_list);
1068 	kfree(ep->auth_chunk_list);
1069 	ep->auth_hmacs_list = NULL;
1070 	ep->auth_chunk_list = NULL;
1071 	sctp_auth_destroy_hmacs(ep->auth_hmacs);
1072 	ep->auth_hmacs = NULL;
1073 }
1074