[SCTP]: Implement the receive and verification of AUTH chunk
Vlad Yasevich [Thu, 4 Oct 2007 00:51:34 +0000 (17:51 -0700)]
This patch implements the receive path needed to process authenticated
chunks.  Add ability to process the AUTH chunk and handle edge cases
for authenticated COOKIE-ECHO as well.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

include/net/sctp/constants.h
include/net/sctp/sm.h
include/net/sctp/structs.h
net/sctp/associola.c
net/sctp/endpointola.c
net/sctp/input.c
net/sctp/inqueue.c
net/sctp/sm_statefuns.c
net/sctp/sm_statetable.c

index 777118f..da8354e 100644 (file)
@@ -183,7 +183,9 @@ typedef enum {
        SCTP_IERROR_NO_DATA,
        SCTP_IERROR_BAD_STREAM,
        SCTP_IERROR_BAD_PORTS,
-
+       SCTP_IERROR_AUTH_BAD_HMAC,
+       SCTP_IERROR_AUTH_BAD_KEYID,
+       SCTP_IERROR_PROTO_VIOLATION,
 } sctp_ierror_t;
 
 
index 148cdb4..bf2f5ed 100644 (file)
@@ -143,6 +143,7 @@ sctp_state_fn_t sctp_sf_do_asconf_ack;
 sctp_state_fn_t sctp_sf_do_9_2_reshutack;
 sctp_state_fn_t sctp_sf_eat_fwd_tsn;
 sctp_state_fn_t sctp_sf_eat_fwd_tsn_fast;
+sctp_state_fn_t sctp_sf_eat_auth;
 
 /* Prototypes for primitive event state functions.  */
 sctp_state_fn_t sctp_sf_do_prm_asoc;
index 31841c3..47e54f8 100644 (file)
@@ -724,6 +724,13 @@ struct sctp_chunk {
         */
        struct sctp_transport *transport;
 
+       /* SCTP-AUTH:  For the special case inbound processing of COOKIE-ECHO
+        * we need save a pointer to the AUTH chunk, since the SCTP-AUTH
+        * spec violates the principle premis that all chunks are processed
+        * in order.
+        */
+       struct sk_buff *auth_chunk;
+
        __u8 rtt_in_progress;   /* Is this chunk used for RTT calculation? */
        __u8 resent;            /* Has this chunk ever been retransmitted. */
        __u8 has_tsn;           /* Does this chunk have a TSN yet? */
@@ -1067,6 +1074,7 @@ void sctp_inq_init(struct sctp_inq *);
 void sctp_inq_free(struct sctp_inq *);
 void sctp_inq_push(struct sctp_inq *, struct sctp_chunk *packet);
 struct sctp_chunk *sctp_inq_pop(struct sctp_inq *);
+struct sctp_chunkhdr *sctp_inq_peek(struct sctp_inq *);
 void sctp_inq_set_th_handler(struct sctp_inq *, work_func_t);
 
 /* This is the structure we use to hold outbound chunks.  You push
index 3bdd8dc..03158e3 100644 (file)
@@ -1011,6 +1011,16 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
                state = asoc->state;
                subtype = SCTP_ST_CHUNK(chunk->chunk_hdr->type);
 
+               /* SCTP-AUTH, Section 6.3:
+                *    The receiver has a list of chunk types which it expects
+                *    to be received only after an AUTH-chunk.  This list has
+                *    been sent to the peer during the association setup.  It
+                *    MUST silently discard these chunks if they are not placed
+                *    after an AUTH chunk in the packet.
+                */
+               if (sctp_auth_recv_cid(subtype.chunk, asoc) && !chunk->auth)
+                       continue;
+
                /* Remember where the last DATA chunk came from so we
                 * know where to send the SACK.
                 */
index c8d5023..2d2d81e 100644 (file)
@@ -400,6 +400,7 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
        sctp_subtype_t subtype;
        sctp_state_t state;
        int error = 0;
+       int first_time = 1;     /* is this the first time through the looop */
 
        if (ep->base.dead)
                return;
@@ -411,6 +412,29 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
        while (NULL != (chunk = sctp_inq_pop(inqueue))) {
                subtype = SCTP_ST_CHUNK(chunk->chunk_hdr->type);
 
+               /* If the first chunk in the packet is AUTH, do special
+                * processing specified in Section 6.3 of SCTP-AUTH spec
+                */
+               if (first_time && (subtype.chunk == SCTP_CID_AUTH)) {
+                       struct sctp_chunkhdr *next_hdr;
+
+                       next_hdr = sctp_inq_peek(inqueue);
+                       if (!next_hdr)
+                               goto normal;
+
+                       /* If the next chunk is COOKIE-ECHO, skip the AUTH
+                        * chunk while saving a pointer to it so we can do
+                        * Authentication later (during cookie-echo
+                        * processing).
+                        */
+                       if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
+                               chunk->auth_chunk = skb_clone(chunk->skb,
+                                                               GFP_ATOMIC);
+                               chunk->auth = 1;
+                               continue;
+                       }
+               }
+normal:
                /* We might have grown an association since last we
                 * looked, so try again.
                 *
@@ -426,6 +450,8 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
                }
 
                state = asoc ? asoc->state : SCTP_STATE_CLOSED;
+               if (sctp_auth_recv_cid(subtype.chunk, asoc) && !chunk->auth)
+                       continue;
 
                /* Remember where the last DATA chunk came from so we
                 * know where to send the SACK.
@@ -449,5 +475,8 @@ static void sctp_endpoint_bh_rcv(struct work_struct *work)
                 */
                if (!sctp_sk(sk)->ep)
                        break;
+
+               if (first_time)
+                       first_time = 0;
        }
 }
index f9a0c92..86503e7 100644 (file)
@@ -911,15 +911,6 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct sk_buff *skb,
 
        ch = (sctp_chunkhdr_t *) skb->data;
 
-       /* If this is INIT/INIT-ACK look inside the chunk too. */
-       switch (ch->type) {
-       case SCTP_CID_INIT:
-       case SCTP_CID_INIT_ACK:
-               break;
-       default:
-               return NULL;
-       }
-
        /* The code below will attempt to walk the chunk and extract
         * parameter information.  Before we do that, we need to verify
         * that the chunk length doesn't cause overflow.  Otherwise, we'll
@@ -964,6 +955,60 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct sk_buff *skb,
        return NULL;
 }
 
+/* SCTP-AUTH, Section 6.3:
+*    If the receiver does not find a STCB for a packet containing an AUTH
+*    chunk as the first chunk and not a COOKIE-ECHO chunk as the second
+*    chunk, it MUST use the chunks after the AUTH chunk to look up an existing
+*    association.
+*
+* This means that any chunks that can help us identify the association need
+* to be looked at to find this assocation.
+*
+* TODO: The only chunk currently defined that can do that is ASCONF, but we
+* don't support that functionality yet.
+*/
+static struct sctp_association *__sctp_rcv_auth_lookup(struct sk_buff *skb,
+                                     const union sctp_addr *paddr,
+                                     const union sctp_addr *laddr,
+                                     struct sctp_transport **transportp)
+{
+       /* XXX - walk through the chunks looking for something that can
+        * help us find the association.  INIT, and INIT-ACK are not permitted.
+        * That leaves ASCONF, but we don't support that yet.
+        */
+       return NULL;
+}
+
+/*
+ * There are circumstances when we need to look inside the SCTP packet
+ * for information to help us find the association.   Examples
+ * include looking inside of INIT/INIT-ACK chunks or after the AUTH
+ * chunks.
+ */
+static struct sctp_association *__sctp_rcv_lookup_harder(struct sk_buff *skb,
+                                     const union sctp_addr *paddr,
+                                     const union sctp_addr *laddr,
+                                     struct sctp_transport **transportp)
+{
+       sctp_chunkhdr_t *ch;
+
+       ch = (sctp_chunkhdr_t *) skb->data;
+
+       /* If this is INIT/INIT-ACK look inside the chunk too. */
+       switch (ch->type) {
+       case SCTP_CID_INIT:
+       case SCTP_CID_INIT_ACK:
+               return __sctp_rcv_init_lookup(skb, laddr, transportp);
+               break;
+
+       case SCTP_CID_AUTH:
+               return __sctp_rcv_auth_lookup(skb, paddr, laddr, transportp);
+               break;
+       }
+
+       return NULL;
+}
+
 /* Lookup an association for an inbound skb. */
 static struct sctp_association *__sctp_rcv_lookup(struct sk_buff *skb,
                                      const union sctp_addr *paddr,
@@ -979,7 +1024,7 @@ static struct sctp_association *__sctp_rcv_lookup(struct sk_buff *skb,
         * parameters within the INIT or INIT-ACK.
         */
        if (!asoc)
-               asoc = __sctp_rcv_init_lookup(skb, laddr, transportp);
+               asoc = __sctp_rcv_lookup_harder(skb, paddr, laddr, transportp);
 
        return asoc;
 }
index e4ea7fd..f10fe7f 100644 (file)
@@ -100,6 +100,25 @@ void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *chunk)
        q->immediate.func(&q->immediate);
 }
 
+/* Peek at the next chunk on the inqeue. */
+struct sctp_chunkhdr *sctp_inq_peek(struct sctp_inq *queue)
+{
+       struct sctp_chunk *chunk;
+       sctp_chunkhdr_t *ch = NULL;
+
+       chunk = queue->in_progress;
+       /* If there is no more chunks in this packet, say so */
+       if (chunk->singleton ||
+           chunk->end_of_packet ||
+           chunk->pdiscard)
+                   return NULL;
+
+       ch = (sctp_chunkhdr_t *)chunk->chunk_end;
+
+       return ch;
+}
+
+
 /* Extract a chunk from an SCTP inqueue.
  *
  * WARNING:  If you need to put the chunk on another queue, you need to
index 3854863..5aef4aa 100644 (file)
@@ -138,6 +138,11 @@ static sctp_disposition_t sctp_sf_violation_chunk(
                                     void *arg,
                                     sctp_cmd_seq_t *commands);
 
+static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
+                                   const struct sctp_association *asoc,
+                                   const sctp_subtype_t type,
+                                   struct sctp_chunk *chunk);
+
 /* Small helper function that checks if the chunk length
  * is of the appropriate length.  The 'required_length' argument
  * is set to be the size of a specific chunk we are testing.
@@ -495,8 +500,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                              (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
                              &err_chunk)) {
 
-               SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
-
                /* This chunk contains fatal error. It is to be discarded.
                 * Send an ABORT, with causes if there is any.
                 */
@@ -521,6 +524,22 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
                        sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
                        error = SCTP_ERROR_INV_PARAM;
                }
+
+               /* SCTP-AUTH, Section 6.3:
+                *    It should be noted that if the receiver wants to tear
+                *    down an association in an authenticated way only, the
+                *    handling of malformed packets should not result in
+                *    tearing down the association.
+                *
+                * This means that if we only want to abort associations
+                * in an authenticated way (i.e AUTH+ABORT), then we
+                * can't destory this association just becuase the packet
+                * was malformed.
+                */
+               if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
+                       return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+
+               SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
                return sctp_stop_t1_and_abort(commands, error, ECONNREFUSED,
                                                asoc, chunk->transport);
        }
@@ -699,6 +718,36 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
        if (error)
                goto nomem_init;
 
+       /* SCTP-AUTH:  auth_chunk pointer is only set when the cookie-echo
+        * is supposed to be authenticated and we have to do delayed
+        * authentication.  We've just recreated the association using
+        * the information in the cookie and now it's much easier to
+        * do the authentication.
+        */
+       if (chunk->auth_chunk) {
+               struct sctp_chunk auth;
+               sctp_ierror_t ret;
+
+               /* set-up our fake chunk so that we can process it */
+               auth.skb = chunk->auth_chunk;
+               auth.asoc = chunk->asoc;
+               auth.sctp_hdr = chunk->sctp_hdr;
+               auth.chunk_hdr = (sctp_chunkhdr_t *)skb_push(chunk->auth_chunk,
+                                           sizeof(sctp_chunkhdr_t));
+               skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
+               auth.transport = chunk->transport;
+
+               ret = sctp_sf_authenticate(ep, new_asoc, type, &auth);
+
+               /* We can now safely free the auth_chunk clone */
+               kfree_skb(chunk->auth_chunk);
+
+               if (ret != SCTP_IERROR_NO_ERROR) {
+                       sctp_association_free(new_asoc);
+                       return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+               }
+       }
+
        repl = sctp_make_cookie_ack(new_asoc, chunk);
        if (!repl)
                goto nomem_init;
@@ -3653,6 +3702,156 @@ gen_shutdown:
 }
 
 /*
+ * SCTP-AUTH Section 6.3 Receving authenticated chukns
+ *
+ *    The receiver MUST use the HMAC algorithm indicated in the HMAC
+ *    Identifier field.  If this algorithm was not specified by the
+ *    receiver in the HMAC-ALGO parameter in the INIT or INIT-ACK chunk
+ *    during association setup, the AUTH chunk and all chunks after it MUST
+ *    be discarded and an ERROR chunk SHOULD be sent with the error cause
+ *    defined in Section 4.1.
+ *
+ *    If an endpoint with no shared key receives a Shared Key Identifier
+ *    other than 0, it MUST silently discard all authenticated chunks.  If
+ *    the endpoint has at least one endpoint pair shared key for the peer,
+ *    it MUST use the key specified by the Shared Key Identifier if a
+ *    key has been configured for that Shared Key Identifier.  If no
+ *    endpoint pair shared key has been configured for that Shared Key
+ *    Identifier, all authenticated chunks MUST be silently discarded.
+ *
+ * Verification Tag:  8.5 Verification Tag [Normal verification]
+ *
+ * The return value is the disposition of the chunk.
+ */
+static sctp_ierror_t sctp_sf_authenticate(const struct sctp_endpoint *ep,
+                                   const struct sctp_association *asoc,
+                                   const sctp_subtype_t type,
+                                   struct sctp_chunk *chunk)
+{
+       struct sctp_authhdr *auth_hdr;
+       struct sctp_hmac *hmac;
+       unsigned int sig_len;
+       __u16 key_id;
+       __u8 *save_digest;
+       __u8 *digest;
+
+       /* Pull in the auth header, so we can do some more verification */
+       auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
+       chunk->subh.auth_hdr = auth_hdr;
+       skb_pull(chunk->skb, sizeof(struct sctp_authhdr));
+
+       /* Make sure that we suport the HMAC algorithm from the auth
+        * chunk.
+        */
+       if (!sctp_auth_asoc_verify_hmac_id(asoc, auth_hdr->hmac_id))
+               return SCTP_IERROR_AUTH_BAD_HMAC;
+
+       /* Make sure that the provided shared key identifier has been
+        * configured
+        */
+       key_id = ntohs(auth_hdr->shkey_id);
+       if (key_id != asoc->active_key_id && !sctp_auth_get_shkey(asoc, key_id))
+               return SCTP_IERROR_AUTH_BAD_KEYID;
+
+
+       /* Make sure that the length of the signature matches what
+        * we expect.
+        */
+       sig_len = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_auth_chunk_t);
+       hmac = sctp_auth_get_hmac(ntohs(auth_hdr->hmac_id));
+       if (sig_len != hmac->hmac_len)
+               return SCTP_IERROR_PROTO_VIOLATION;
+
+       /* Now that we've done validation checks, we can compute and
+        * verify the hmac.  The steps involved are:
+        *  1. Save the digest from the chunk.
+        *  2. Zero out the digest in the chunk.
+        *  3. Compute the new digest
+        *  4. Compare saved and new digests.
+        */
+       digest = auth_hdr->hmac;
+       skb_pull(chunk->skb, sig_len);
+
+       save_digest = kmemdup(digest, sig_len, GFP_ATOMIC);
+       if (!save_digest)
+               goto nomem;
+
+       memset(digest, 0, sig_len);
+
+       sctp_auth_calculate_hmac(asoc, chunk->skb,
+                               (struct sctp_auth_chunk *)chunk->chunk_hdr,
+                               GFP_ATOMIC);
+
+       /* Discard the packet if the digests do not match */
+       if (memcmp(save_digest, digest, sig_len)) {
+               kfree(save_digest);
+               return SCTP_IERROR_BAD_SIG;
+       }
+
+       kfree(save_digest);
+       chunk->auth = 1;
+
+       return SCTP_IERROR_NO_ERROR;
+nomem:
+       return SCTP_IERROR_NOMEM;
+}
+
+sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
+                                   const struct sctp_association *asoc,
+                                   const sctp_subtype_t type,
+                                   void *arg,
+                                   sctp_cmd_seq_t *commands)
+{
+       struct sctp_authhdr *auth_hdr;
+       struct sctp_chunk *chunk = arg;
+       struct sctp_chunk *err_chunk;
+       sctp_ierror_t error;
+
+       if (!sctp_vtag_verify(chunk, asoc)) {
+               sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
+                               SCTP_NULL());
+               return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+       }
+
+       /* Make sure that the AUTH chunk has valid length.  */
+       if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_auth_chunk)))
+               return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                                                 commands);
+
+       auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
+       error = sctp_sf_authenticate(ep, asoc, type, chunk);
+       switch (error) {
+               case SCTP_IERROR_AUTH_BAD_HMAC:
+                       /* Generate the ERROR chunk and discard the rest
+                        * of the packet
+                        */
+                       err_chunk = sctp_make_op_error(asoc, chunk,
+                                                       SCTP_ERROR_UNSUP_HMAC,
+                                                       &auth_hdr->hmac_id,
+                                                       sizeof(__u16));
+                       if (err_chunk) {
+                               sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
+                                               SCTP_CHUNK(err_chunk));
+                       }
+                       /* Fall Through */
+               case SCTP_IERROR_AUTH_BAD_KEYID:
+               case SCTP_IERROR_BAD_SIG:
+                       return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+                       break;
+               case SCTP_IERROR_PROTO_VIOLATION:
+                       return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                                                         commands);
+                       break;
+               case SCTP_IERROR_NOMEM:
+                       return SCTP_DISPOSITION_NOMEM;
+               default:
+                       break;
+       }
+
+       return SCTP_DISPOSITION_CONSUME;
+}
+
+/*
  * Process an unknown chunk.
  *
  * Section: 3.2. Also, 2.1 in the implementor's guide.
@@ -3857,6 +4056,20 @@ static sctp_disposition_t sctp_sf_abort_violation(
        if (!abort)
                goto nomem;
 
+       /* SCTP-AUTH, Section 6.3:
+        *    It should be noted that if the receiver wants to tear
+        *    down an association in an authenticated way only, the
+        *    handling of malformed packets should not result in
+        *    tearing down the association.
+        *
+        * This means that if we only want to abort associations
+        * in an authenticated way (i.e AUTH+ABORT), then we
+        * can't destory this association just becuase the packet
+        * was malformed.
+        */
+       if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
+               goto discard;
+
        if (asoc) {
                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
@@ -3894,6 +4107,7 @@ static sctp_disposition_t sctp_sf_abort_violation(
                SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
        }
 
+discard:
        sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
 
        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
index ddb0ba3..a93a4bc 100644 (file)
@@ -523,6 +523,34 @@ static const sctp_sm_table_entry_t prsctp_chunk_event_table[SCTP_NUM_PRSCTP_CHUN
        TYPE_SCTP_FWD_TSN,
 }; /*state_fn_t prsctp_chunk_event_table[][] */
 
+#define TYPE_SCTP_AUTH { \
+       /* SCTP_STATE_EMPTY */ \
+       TYPE_SCTP_FUNC(sctp_sf_ootb), \
+       /* SCTP_STATE_CLOSED */ \
+       TYPE_SCTP_FUNC(sctp_sf_ootb), \
+       /* SCTP_STATE_COOKIE_WAIT */ \
+       TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
+       /* SCTP_STATE_COOKIE_ECHOED */ \
+       TYPE_SCTP_FUNC(sctp_sf_eat_auth), \
+       /* SCTP_STATE_ESTABLISHED */ \
+       TYPE_SCTP_FUNC(sctp_sf_eat_auth), \
+       /* SCTP_STATE_SHUTDOWN_PENDING */ \
+       TYPE_SCTP_FUNC(sctp_sf_eat_auth), \
+       /* SCTP_STATE_SHUTDOWN_SENT */ \
+       TYPE_SCTP_FUNC(sctp_sf_eat_auth), \
+       /* SCTP_STATE_SHUTDOWN_RECEIVED */ \
+       TYPE_SCTP_FUNC(sctp_sf_eat_auth), \
+       /* SCTP_STATE_SHUTDOWN_ACK_SENT */ \
+       TYPE_SCTP_FUNC(sctp_sf_eat_auth), \
+} /* TYPE_SCTP_AUTH */
+
+/* The primary index for this table is the chunk type.
+ * The secondary index for this table is the state.
+ */
+static const sctp_sm_table_entry_t auth_chunk_event_table[SCTP_NUM_AUTH_CHUNK_TYPES][SCTP_STATE_NUM_STATES] = {
+       TYPE_SCTP_AUTH,
+}; /*state_fn_t auth_chunk_event_table[][] */
+
 static const sctp_sm_table_entry_t
 chunk_event_table_unknown[SCTP_STATE_NUM_STATES] = {
        /* SCTP_STATE_EMPTY */
@@ -976,5 +1004,10 @@ static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(sctp_cid_t cid,
                        return &addip_chunk_event_table[1][state];
        }
 
+       if (sctp_auth_enable) {
+               if (cid == SCTP_CID_AUTH)
+                       return &auth_chunk_event_table[0][state];
+       }
+
        return &chunk_event_table_unknown[state];
 }