| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 14 Mar 2018 10:53:13 -0300
From: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
To: Xin Long <lucien.xin@...il.com>
Cc: network dev <netdev@...r.kernel.org>, linux-sctp@...r.kernel.org,
Neil Horman <nhorman@...driver.com>, davem@...emloft.net
Subject: Re: [PATCH net-next 3/5] sctp: add sockopt SCTP_AUTH_DEACTIVATE_KEY
On Wed, Mar 14, 2018 at 07:05:32PM +0800, Xin Long wrote:
> This patch is to add sockopt SCTP_AUTH_DEACTIVATE_KEY, as described in
> section 8.3.4 of RFC6458.
>
> This set option indicates that the application will no longer send user
> messages using the indicated key identifier.
>
> Note that RFC requires that only deactivated keys that are no longer used
> by an association can be deleted, but for the backward compatibility, it
> is not to check deactivated when deleting or replacing one sh_key.
>
> Signed-off-by: Xin Long <lucien.xin@...il.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
> ---
> include/net/sctp/auth.h | 12 ++++++------
> include/uapi/linux/sctp.h | 1 +
> net/sctp/auth.c | 46 +++++++++++++++++++++++++++++++++++++++++++---
> net/sctp/socket.c | 31 +++++++++++++++++++++++++++++++
> 4 files changed, 81 insertions(+), 9 deletions(-)
>
> diff --git a/include/net/sctp/auth.h b/include/net/sctp/auth.h
> index 017c1aa..687e7f8 100644
> --- a/include/net/sctp/auth.h
> +++ b/include/net/sctp/auth.h
> @@ -65,6 +65,7 @@ struct sctp_shared_key {
> struct sctp_auth_bytes *key;
> refcount_t refcnt;
> __u16 key_id;
> + __u8 deactivated;
> };
>
> #define key_for_each(__key, __list_head) \
> @@ -113,14 +114,13 @@ void sctp_auth_shkey_hold(struct sctp_shared_key *sh_key);
> int sctp_auth_ep_add_chunkid(struct sctp_endpoint *ep, __u8 chunk_id);
> int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
> struct sctp_hmacalgo *hmacs);
> -int sctp_auth_set_key(struct sctp_endpoint *ep,
> - struct sctp_association *asoc,
> +int sctp_auth_set_key(struct sctp_endpoint *ep, struct sctp_association *asoc,
> struct sctp_authkey *auth_key);
> int sctp_auth_set_active_key(struct sctp_endpoint *ep,
> - struct sctp_association *asoc,
> - __u16 key_id);
> + struct sctp_association *asoc, __u16 key_id);
> int sctp_auth_del_key_id(struct sctp_endpoint *ep,
> - struct sctp_association *asoc,
> - __u16 key_id);
> + struct sctp_association *asoc, __u16 key_id);
> +int sctp_auth_deact_key_id(struct sctp_endpoint *ep,
> + struct sctp_association *asoc, __u16 key_id);
>
> #endif
> diff --git a/include/uapi/linux/sctp.h b/include/uapi/linux/sctp.h
> index 47e781e..08fc313 100644
> --- a/include/uapi/linux/sctp.h
> +++ b/include/uapi/linux/sctp.h
> @@ -99,6 +99,7 @@ typedef __s32 sctp_assoc_t;
> #define SCTP_RECVRCVINFO 32
> #define SCTP_RECVNXTINFO 33
> #define SCTP_DEFAULT_SNDINFO 34
> +#define SCTP_AUTH_DEACTIVATE_KEY 35
>
> /* Internal Socket Options. Some of the sctp library functions are
> * implemented using these socket options.
> diff --git a/net/sctp/auth.c b/net/sctp/auth.c
> index e5214fd..a073123 100644
> --- a/net/sctp/auth.c
> +++ b/net/sctp/auth.c
> @@ -449,8 +449,11 @@ struct sctp_shared_key *sctp_auth_get_shkey(
>
> /* First search associations set of endpoint pair shared keys */
> key_for_each(key, &asoc->endpoint_shared_keys) {
> - if (key->key_id == key_id)
> - return key;
> + if (key->key_id == key_id) {
> + if (!key->deactivated)
> + return key;
> + break;
> + }
> }
>
> return NULL;
> @@ -905,7 +908,7 @@ int sctp_auth_set_active_key(struct sctp_endpoint *ep,
> }
> }
>
> - if (!found)
> + if (!found || key->deactivated)
> return -EINVAL;
>
> if (asoc) {
> @@ -956,3 +959,40 @@ int sctp_auth_del_key_id(struct sctp_endpoint *ep,
>
> return 0;
> }
> +
> +int sctp_auth_deact_key_id(struct sctp_endpoint *ep,
> + struct sctp_association *asoc, __u16 key_id)
> +{
> + struct sctp_shared_key *key;
> + struct list_head *sh_keys;
> + int found = 0;
> +
> + /* The key identifier MUST NOT be the current active key
> + * The key identifier MUST correst to an existing key
> + */
> + if (asoc) {
> + if (asoc->active_key_id == key_id)
> + return -EINVAL;
> +
> + sh_keys = &asoc->endpoint_shared_keys;
> + } else {
> + if (ep->active_key_id == key_id)
> + return -EINVAL;
> +
> + sh_keys = &ep->endpoint_shared_keys;
> + }
> +
> + key_for_each(key, sh_keys) {
> + if (key->key_id == key_id) {
> + found = 1;
> + break;
> + }
> + }
> +
> + if (!found)
> + return -EINVAL;
> +
> + key->deactivated = 1;
> +
> + return 0;
> +}
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index 9ffdecb..65cc354 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -3647,6 +3647,33 @@ static int sctp_setsockopt_del_key(struct sock *sk,
> }
>
> /*
> + * 8.3.4 Deactivate a Shared Key (SCTP_AUTH_DEACTIVATE_KEY)
> + *
> + * This set option will deactivate a shared secret key.
> + */
> +static int sctp_setsockopt_deactivate_key(struct sock *sk, char __user *optval,
> + unsigned int optlen)
> +{
> + struct sctp_endpoint *ep = sctp_sk(sk)->ep;
> + struct sctp_authkeyid val;
> + struct sctp_association *asoc;
> +
> + if (!ep->auth_enable)
> + return -EACCES;
> +
> + if (optlen != sizeof(struct sctp_authkeyid))
> + return -EINVAL;
> + if (copy_from_user(&val, optval, optlen))
> + return -EFAULT;
> +
> + asoc = sctp_id2assoc(sk, val.scact_assoc_id);
> + if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
> + return -EINVAL;
> +
> + return sctp_auth_deact_key_id(ep, asoc, val.scact_keynumber);
> +}
> +
> +/*
> * 8.1.23 SCTP_AUTO_ASCONF
> *
> * This option will enable or disable the use of the automatic generation of
> @@ -4238,6 +4265,9 @@ static int sctp_setsockopt(struct sock *sk, int level, int optname,
> case SCTP_AUTH_DELETE_KEY:
> retval = sctp_setsockopt_del_key(sk, optval, optlen);
> break;
> + case SCTP_AUTH_DEACTIVATE_KEY:
> + retval = sctp_setsockopt_deactivate_key(sk, optval, optlen);
> + break;
> case SCTP_AUTO_ASCONF:
> retval = sctp_setsockopt_auto_asconf(sk, optval, optlen);
> break;
> @@ -7212,6 +7242,7 @@ static int sctp_getsockopt(struct sock *sk, int level, int optname,
> case SCTP_AUTH_KEY:
> case SCTP_AUTH_CHUNK:
> case SCTP_AUTH_DELETE_KEY:
> + case SCTP_AUTH_DEACTIVATE_KEY:
> retval = -EOPNOTSUPP;
> break;
> case SCTP_HMAC_IDENT:
> --
> 2.1.0
>
Powered by blists - more mailing lists