linux.git/net/sctp/auth.c, branch v4.3

sctp: allow authenticating DATA chunks that are bundled with COOKIE_ECHO

2015-06-12T21:18:20+00:00

Currently, we can ask to authenticate DATA chunks and we can send DATA
chunks on the same packet as COOKIE_ECHO, but if you try to combine
both, the DATA chunk will be sent unauthenticated and peer won't accept
it, leading to a communication failure.

This happens because even though the data was queued after it was
requested to authenticate DATA chunks, it was also queued before we
could know that remote peer can handle authenticating, so
sctp_auth_send_cid() returns false.

The fix is whenever we set up an active key, re-check send queue for
chunks that now should be authenticated. As a result, such packet will
now contain COOKIE_ECHO + AUTH + DATA chunks, in that order.

Reported-by: Liu Wei 
Signed-off-by: Marcelo Ricardo Leitner 
Acked-by: Neil Horman 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller

net: sctp: fix memory leak in auth key management

2014-11-11T20:19:11+00:00

A very minimal and simple user space application allocating an SCTP
socket, setting SCTP_AUTH_KEY setsockopt(2) on it and then closing
the socket again will leak the memory containing the authentication
key from user space:

unreferenced object 0xffff8800837047c0 (size 16):
  comm "a.out", pid 2789, jiffies 4296954322 (age 192.258s)
  hex dump (first 16 bytes):
    01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmemleak_alloc+0x4e/0xb0
    [] __kmalloc+0xe8/0x270
    [] sctp_auth_create_key+0x23/0x50 [sctp]
    [] sctp_auth_set_key+0xa1/0x140 [sctp]
    [] sctp_setsockopt+0xd03/0x1180 [sctp]
    [] sock_common_setsockopt+0x14/0x20
    [] SyS_setsockopt+0x71/0xd0
    [] system_call_fastpath+0x12/0x17
    [] 0xffffffffffffffff

This is bad because of two things, we can bring down a machine from
user space when auth_enable=1, but also we would leave security sensitive
keying material in memory without clearing it after use. The issue is
that sctp_auth_create_key() already sets the refcount to 1, but after
allocation sctp_auth_set_key() does an additional refcount on it, and
thus leaving it around when we free the socket.

Fixes: 65b07e5d0d0 ("[SCTP]: API updates to suport SCTP-AUTH extensions.")
Signed-off-by: Daniel Borkmann 
Cc: Vlad Yasevich 
Acked-by: Neil Horman 
Signed-off-by: David S. Miller

net: sctp: cache auth_enable per endpoint

2014-04-18T22:32:00+00:00

Currently, it is possible to create an SCTP socket, then switch
auth_enable via sysctl setting to 1 and crash the system on connect:

Oops[#1]:
CPU: 0 PID: 0 Comm: swapper Not tainted 3.14.1-mipsgit-20140415 #1
task: ffffffff8056ce80 ti: ffffffff8055c000 task.ti: ffffffff8055c000
[...]
Call Trace:
[] sctp_auth_asoc_set_default_hmac+0x68/0x80
[] sctp_process_init+0x5e0/0x8a4
[] sctp_sf_do_5_1B_init+0x234/0x34c
[] sctp_do_sm+0xb4/0x1e8
[] sctp_endpoint_bh_rcv+0x1c4/0x214
[] sctp_rcv+0x588/0x630
[] sctp6_rcv+0x10/0x24
[] ip6_input+0x2c0/0x440
[] __netif_receive_skb_core+0x4a8/0x564
[] process_backlog+0xb4/0x18c
[] net_rx_action+0x12c/0x210
[] __do_softirq+0x17c/0x2ac
[] irq_exit+0x54/0xb0
[] ret_from_irq+0x0/0x4
[] rm7k_wait_irqoff+0x24/0x48
[] cpu_startup_entry+0xc0/0x148
[] start_kernel+0x37c/0x398
Code: dd0900b8  000330f8  0126302d  50c0fff1  0047182a  a48306a0
03e00008  00000000
---[ end trace b530b0551467f2fd ]---
Kernel panic - not syncing: Fatal exception in interrupt

What happens while auth_enable=0 in that case is, that
ep->auth_hmacs is initialized to NULL in sctp_auth_init_hmacs()
when endpoint is being created.

After that point, if an admin switches over to auth_enable=1,
the machine can crash due to NULL pointer dereference during
reception of an INIT chunk. When we enter sctp_process_init()
via sctp_sf_do_5_1B_init() in order to respond to an INIT chunk,
the INIT verification succeeds and while we walk and process
all INIT params via sctp_process_param() we find that
net->sctp.auth_enable is set, therefore do not fall through,
but invoke sctp_auth_asoc_set_default_hmac() instead, and thus,
dereference what we have set to NULL during endpoint
initialization phase.

The fix is to make auth_enable immutable by caching its value
during endpoint initialization, so that its original value is
being carried along until destruction. The bug seems to originate
from the very first days.

Fix in joint work with Daniel Borkmann.

Reported-by: Joshua Kinard 
Signed-off-by: Vlad Yasevich 
Signed-off-by: Daniel Borkmann 
Acked-by: Neil Horman 
Tested-by: Joshua Kinard 
Signed-off-by: David S. Miller

sctp: fix checkpatch errors with open brace '{' and trailing statements

2013-12-26T18:47:48+00:00

fix checkpatch errors below:
ERROR: that open brace { should be on the previous line
ERROR: open brace '{' following function declarations go on the next line
ERROR: trailing statements should be on next line

Signed-off-by: Wang Weidong 
Signed-off-by: David S. Miller

sctp: fix checkpatch errors with indent

2013-12-26T18:47:48+00:00

fix checkpatch errors below:
ERROR: switch and case should be at the same inden
ERROR: code indent should use tabs where possible

Acked-by: Neil Horman 
Signed-off-by: Wang Weidong 
Signed-off-by: David S. Miller

sctp: fix checkpatch errors with (foo)|foo bar|foo* bar

2013-12-26T18:47:47+00:00

fix checkpatch errors below:
ERROR: "(foo*)" should be "(foo *)"
ERROR: "foo * bar" should be "foo *bar"
ERROR: "foo* bar" should be "foo *bar"

Signed-off-by: Wang Weidong 
Signed-off-by: David S. Miller

sctp: fix checkpatch errors with space required or prohibited

2013-12-26T18:47:47+00:00

fix checkpatch errors while the space is required or prohibited
to the "=,()++..."

Acked-by: Neil Horman 
Signed-off-by: Wang Weidong 
Signed-off-by: David S. Miller

sctp: Fix FSF address in file headers

2013-12-06T17:37:56+00:00

Several files refer to an old address for the Free Software Foundation
in the file header comment.  Resolve by replacing the address with
the URL  so that we do not have to keep
updating the header comments anytime the address changes.

CC: Vlad Yasevich 
CC: Neil Horman 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller

sctp: merge two if statements to one

2013-10-28T05:02:34+00:00

Two if statements do the same work, we can merge them to
one. And fix some typos. There is just code simplification,
no functional changes.

Signed-off-by: Wang Weidong 
Signed-off-by: David S. Miller

net: sctp: trivial: update bug report in header comment

2013-08-09T18:33:02+00:00

With the restructuring of the lksctp.org site, we only allow bug
reports through the SCTP mailing list linux-sctp@vger.kernel.org,
not via SF, as SF is only used for web hosting and nothing more.
While at it, also remove the obvious statement that bugs will be
fixed and incooperated into the kernel.

Signed-off-by: Daniel Borkmann 
Acked-by: Vlad Yasevich 
Signed-off-by: David S. Miller