07a9371271
https://source.android.com/security/bulletin/2021-05-01 CVE-2020-29661 * tag 'ASB-2021-05-05_4.19-stable' of https://github.com/aosp-mirror/kernel_common: ANDROID: Add allowed symbols requried from Qualcomm drivers ANDROID: GKI: QoS: Prevent usage of dev_pm_qos_request as pm_qos_request Linux 4.19.189 USB: CDC-ACM: fix poison/unpoison imbalance net: hso: fix NULL-deref on disconnect regression x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access ia64: tools: remove duplicate definition of ia64_mf() on ia64 ia64: fix discontig.c section mismatches cavium/liquidio: Fix duplicate argument xen-netback: Check for hotplug-status existence before watching s390/entry: save the caller of psw_idle net: geneve: check skb is large enough for IPv4/IPv6 header ARM: dts: Fix swapped mmc order for omap3 HID: wacom: Assign boolean values to a bool variable HID: alps: fix error return code in alps_input_configured() HID: google: add don USB id perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3 locking/qrwlock: Fix ordering in queued_write_lock_slowpath() pinctrl: lewisburg: Update number of pins in community gup: document and work around "COW can break either way" issue net: phy: marvell: fix detection of PHY on Topaz switches ARM: 9071/1: uprobes: Don't hook on thumb instructions ARM: footbridge: fix PCI interrupt mapping ibmvnic: remove duplicate napi_schedule call in open function ibmvnic: remove duplicate napi_schedule call in do_reset function ibmvnic: avoid calling napi_disable() twice i40e: fix the panic when running bpf in xdpdrv mode net: ip6_tunnel: Unregister catch-all devices net: sit: Unregister catch-all devices net: davicom: Fix regulator not turned off on failed probe netfilter: nft_limit: avoid possible divide error in nft_limit_init netfilter: conntrack: do not print icmpv6 as unknown via /proc scsi: libsas: Reset num_scatter if libata marks qc as NODATA arm64: alternatives: Move length validation in alternative_{insn, endif} arm64: fix inline asm in load_unaligned_zeropad() readdir: make sure to verify directory entry for legacy interfaces too dm verity fec: fix misaligned RS roots IO HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices Input: i8042 - fix Pegatron C15B ID entry Input: s6sy761 - fix coordinate read bit shift mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN pcnet32: Use pci_resource_len to validate PCI resource net: ieee802154: forbid monitor for add llsec seclevel net: ieee802154: stop dump llsec seclevels for monitors net: ieee802154: forbid monitor for add llsec devkey net: ieee802154: stop dump llsec devkeys for monitors net: ieee802154: forbid monitor for add llsec dev net: ieee802154: stop dump llsec devs for monitors net: ieee802154: stop dump llsec keys for monitors scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state ASoC: fsl_esai: Fix TDM slot setup for I2S mode drm/msm: Fix a5xx/a6xx timestamps ARM: keystone: fix integer overflow warning neighbour: Disregard DEAD dst in neigh_update arc: kernel: Return -EFAULT if copy_to_user() fails lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message ARM: dts: Fix moving mmc devices with aliases for omap4 & 5 ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race dmaengine: dw: Make it dependent to HAS_IOMEM gpio: sysfs: Obey valid_mask Input: nspire-keypad - enable interrupts only when opened net/sctp: fix race condition in sctp_destroy_sock ANDROID: GKI: update allowed list for incrementalfs.ko ANDROID: fs-verity: Export function to check signatures UPSTREAM: fs-verity: move structs needed for file signing to UAPI header UPSTREAM: fs-verity: rename "file measurement" to "file digest" UPSTREAM: fs-verity: rename fsverity_signed_digest to fsverity_formatted_digest UPSTREAM: fs-verity: remove filenames from file comments ANDROID: clang: update to 12.0.5 Linux 4.19.188 xen/events: fix setting irq affinity perf map: Tighten snprintf() string precision to pass gcc check on some 32-bit arches driver core: Fix locking bug in deferred_probe_timeout_work_func() netfilter: x_tables: fix compat match/target pad out-of-bound write staging: m57621-mmc: delete driver from the tree. net: phy: broadcom: Only advertise EEE for supported modes riscv,entry: fix misaligned base for excp_vect_table block: only update parent bi_status when bio fail drm/tegra: dc: Don't set PLL clock to 0Hz gfs2: report "already frozen/thawed" errors drm/imx: imx-ldb: fix out of bounds array access warning KVM: arm64: Disable guest access to trace filter controls KVM: arm64: Hide system instruction access to Trace registers Revert "net: xfrm: Localize sequence counter per network namespace" ANDROID: Incremental fs: Set credentials before reading/writing Linux 4.19.187 Revert "cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath." net: ieee802154: stop dump llsec params for monitors net: ieee802154: forbid monitor for del llsec seclevel net: ieee802154: forbid monitor for set llsec params net: ieee802154: fix nl802154 del llsec devkey net: ieee802154: fix nl802154 add llsec key net: ieee802154: fix nl802154 del llsec dev net: ieee802154: fix nl802154 del llsec key net: ieee802154: nl-mac: fix check on panid net: mac802154: Fix general protection fault drivers: net: fix memory leak in peak_usb_create_dev drivers: net: fix memory leak in atusb_probe net: tun: set tun->dev->addr_len during TUNSETLINK processing cfg80211: remove WARN_ON() in cfg80211_sme_connect net: sched: bump refcount for new action in ACT replace mode clk: socfpga: fix iomem pointer cast on 64-bit RDMA/cxgb4: check for ipv6 address properly while destroying listener net/mlx5: Fix PBMC register mapping net/mlx5: Fix placement of log_max_flow_counter s390/cpcmd: fix inline assembly register clobbering workqueue: Move the position of debug_work_activate() in __queue_work() clk: fix invalid usage of list cursor in unregister clk: fix invalid usage of list cursor in register soc/fsl: qbman: fix conflicting alignment attributes ASoC: sunxi: sun4i-codec: fill ASoC card owner net/ncsi: Avoid channel_monitor hrtimer deadlock ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces net:tipc: Fix a double free in tipc_sk_mcast_rcv cxgb4: avoid collecting SGE_QBASE regs during traffic gianfar: Handle error code at MAC address change sch_red: fix off-by-one checks in red_check_params() amd-xgbe: Update DMA coherency values i40e: Fix kernel oops when i40e driver removes VF's i40e: Added Asym_Pause to supported link modes ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips net: xfrm: Localize sequence counter per network namespace regulator: bd9571mwv: Fix AVS and DVFS voltage range xfrm: interface: fix ipv4 pmtu check to honor ip header df virtio_net: Add XDP meta data support i2c: turn recovery error on init to debug usbip: synchronize event handler with sysfs code paths usbip: vudc synchronize sysfs code paths usbip: stub-dev synchronize sysfs code paths usbip: add sysfs_lock to synchronize sysfs code paths net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind() net: sched: sch_teql: fix null-pointer dereference net: ensure mac header is set in virtio_net_hdr_to_skb() net: hso: fix null-ptr-deref during tty device unregistration ice: Increase control queue timeout batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field ARM: dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers parisc: parisc-agp requires SBA IOMMU driver fs: direct-io: fix missing sdio->boundary ocfs2: fix deadlock between setattr and dio_end_io_write nds32: flush_dcache_page: use page_mapping_file to avoid races with swapoff ia64: fix user_stack_pointer() for ptrace() net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh xen/evtchn: Change irq_info lock to raw_spinlock_t nfc: Avoid endless loops caused by repeated llcp_sock_connect() nfc: fix memory leak in llcp_sock_connect() nfc: fix refcount leak in llcp_sock_connect() nfc: fix refcount leak in llcp_sock_bind() ASoC: intel: atom: Stop advertising non working S24LE support ALSA: aloop: Fix initialization of controls Linux 4.19.186 init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM init/Kconfig: make COMPILE_TEST depend on !S390 bpf, x86: Validate computation of branch displacements for x86-32 bpf, x86: Validate computation of branch displacements for x86-64 cifs: Silently ignore unknown oplock break handle cifs: revalidate mapping when we open files for SMB1 POSIX ia64: fix format strings for err_inject ia64: mca: allocate early mca with GFP_ATOMIC scsi: target: pscsi: Clean up after failure in pscsi_map_sg() x86/build: Turn off -fcf-protection for realmode targets platform/x86: thinkpad_acpi: Allow the FnLock LED to change state drm/msm: Ratelimit invalid-fence message mac80211: choose first enabled channel for monitor mISDN: fix crash in fritzpci net: pxa168_eth: Fix a potential data race in pxa168_eth_remove platform/x86: intel-hid: Support Lenovo ThinkPad X1 Tablet Gen 2 bus: ti-sysc: Fix warning on unbind if reset is not deasserted ARM: dts: am33xx: add aliases for mmc interfaces Linux 4.19.185 drivers: video: fbcon: fix NULL dereference in fbcon_cursor() staging: rtl8192e: Change state information from u16 to u8 staging: rtl8192e: Fix incorrect source in memcpy() usb: dwc2: Fix HPRT0.PrtSusp bit setting for HiKey 960 board. usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference USB: cdc-acm: fix use-after-free after probe failure USB: cdc-acm: fix double free on probe failure USB: cdc-acm: downgrade message to debug USB: cdc-acm: untangle a circular dependency between callback and softint cdc-acm: fix BREAK rx code path adding necessary calls usb: xhci-mtk: fix broken streams issue on 0.96 xHCI usb: musb: Fix suspend with devices connected for a64 USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control() firewire: nosy: Fix a use-after-free bug in nosy_ioctl() extcon: Fix error handling in extcon_dev_register extcon: Add stubs for extcon_register_notifier_all() functions pinctrl: rockchip: fix restore error in resume reiserfs: update reiserfs_xattrs_initialized() condition drm/amdgpu: check alignment on CPU page for bo map drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings() mm: fix race by making init_zero_pfn() early_initcall tracing: Fix stack trace event size PM: runtime: Fix ordering in pm_runtime_get_suppliers() PM: runtime: Fix race getting/putting suppliers at probe ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO ALSA: usb-audio: Apply sample rate quirk to Logitech Connect bpf: Remove MTU check in __bpf_skb_max_len net: wan/lmc: unregister device when no matching device is found appletalk: Fix skb allocation size in loopback case net: ethernet: aquantia: Handle error cleanup of start on open ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr() brcmfmac: clear EAP/association status bits on linkdown events ext4: do not iput inode under running transaction in ext4_rename() locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling thermal/core: Add NULL pointer check before using cooling device stats ASoC: rt5659: Update MCLK rate in set_sysclk() staging: comedi: cb_pcidas64: fix request_irq() warn staging: comedi: cb_pcidas: fix request_irq() warn scsi: qla2xxx: Fix broken #endif placement scsi: st: Fix a use after free in st_open() vhost: Fix vhost_vq_reset() ASoC: cs42l42: Always wait at least 3ms after reset ASoC: cs42l42: Fix mixer volume control ASoC: cs42l42: Fix channel width support ASoC: cs42l42: Fix Bitclock polarity inversion ASoC: es8316: Simplify adc_pga_gain_tlv table ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor of 10 ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10 rpc: fix NULL dereference on kmalloc failure ext4: fix bh ref count on error paths ipv6: weaken the v4mapped source check tcp: relookup sock for RST+ACK packets handled by obsolete req sock selinux: vsock: Set SID for socket returned by accept() Revert "can: dev: Move device back to init netns on owning netns delete" Linux 4.19.184 xen-blkback: don't leak persistent grants from xen_blkbk_map() can: peak_usb: Revert "can: peak_usb: add forgotten supported devices" ext4: add reclaim checks to xattr code mac80211: fix double free in ibss_leave net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() net: sched: validate stab values can: dev: Move device back to init netns on owning netns delete x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc() locking/mutex: Fix non debug version of mutex_lock_io_nested() scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() scsi: qedi: Fix error return code of qedi_alloc_global_queues() perf auxtrace: Fix auxtrace queue conflict dm verity: add root hash pkcs#7 signature verification ACPI: scan: Use unique number for instance_no ACPI: scan: Rearrange memory allocation in acpi_device_add() Revert "netfilter: x_tables: Update remaining dereference to RCU" netfilter: x_tables: Use correct memory barriers. Revert "netfilter: x_tables: Switch synchronization to RCU" bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server net/mlx5e: Fix error path for ethtool set-priv-flag arm64: kdump: update ppos when reading elfcorehdr drm/msm: fix shutdown hook in case GPU components failed to bind net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes net: cdc-phonet: fix data-interface release on probe failure mac80211: fix rate mask reset can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning can: c_can: move runtime PM enable/disable to c_can_platform can: c_can_pci: c_can_pci_remove(): fix use-after-free can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate can: peak_usb: add forgotten supported devices netfilter: ctnetlink: fix dump of the expect mask attribute ftgmac100: Restart MAC HW once net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 e1000e: add rtnl_lock() to e1000_reset_task net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port macvlan: macvlan_count_rx() needs to be aware of preemption libbpf: Fix INSTALL flag order veth: Store queue_mapping independently of XDP prog presence bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD dm ioctl: fix out of bounds array access when no devices ARM: dts: at91-sama5d27_som1: fix phy address to 7 arm64: dts: ls1043a: mark crypto engine dma coherent arm64: dts: ls1012a: mark crypto engine dma coherent arm64: dts: ls1046a: mark crypto engine dma coherent squashfs: fix xattr id and id lookup sanity checks squashfs: fix inode lookup sanity checks platform/x86: intel-vbtn: Stop reporting SW_DOCK events netsec: restore phy power state after controller reset ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls block: Suppress uevent for hidden device when removed nfs: we don't support removing system.nfs4_acl drm/radeon: fix AGP dependency u64_stats,lockdep: Fix u64_stats_init() vs lockdep sparc64: Fix opcode filtering in handling of no fault loads atm: idt77252: fix null-ptr-dereference atm: uPD98402: fix incorrect allocation net: wan: fix error return code of uhdlc_init() net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() NFS: Correct size calculation for create reply length nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default gpiolib: acpi: Add missing IRQF_ONESHOT gianfar: fix jumbo packets+napi+rx overrun crash sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count net: tehuti: fix error return code in bdx_probe() ixgbe: Fix memleak in ixgbe_configure_clsu32 Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" atm: lanai: dont run lanai_dev_close if not open atm: eni: dont release is never initialized powerpc/4xx: Fix build errors from mfdcr() net: fec: ptp: avoid register access when ipg clock is disabled Change-Id: Iba7c8569b32ea50c97004cf182ccd907a3022d0b Signed-off-by: UtsavBalar1231 <utsavbalar1231@gmail.com> Conflicts: kernel/locking/lockdep.c kernel/power/qos.c net/qrtr/qrtr.c
1059 lines
25 KiB
C
1059 lines
25 KiB
C
/*
|
|
* Copyright (C) 2014 Fraunhofer ITWM
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2
|
|
* as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* Written by:
|
|
* Phoebe Buckheister <phoebe.buckheister@itwm.fraunhofer.de>
|
|
*/
|
|
|
|
#include <linux/err.h>
|
|
#include <linux/bug.h>
|
|
#include <linux/completion.h>
|
|
#include <linux/ieee802154.h>
|
|
#include <linux/rculist.h>
|
|
|
|
#include <crypto/aead.h>
|
|
#include <crypto/skcipher.h>
|
|
|
|
#include "ieee802154_i.h"
|
|
#include "llsec.h"
|
|
|
|
static void llsec_key_put(struct mac802154_llsec_key *key);
|
|
static bool llsec_key_id_equal(const struct ieee802154_llsec_key_id *a,
|
|
const struct ieee802154_llsec_key_id *b);
|
|
|
|
static void llsec_dev_free(struct mac802154_llsec_device *dev);
|
|
|
|
void mac802154_llsec_init(struct mac802154_llsec *sec)
|
|
{
|
|
memset(sec, 0, sizeof(*sec));
|
|
|
|
memset(&sec->params.default_key_source, 0xFF, IEEE802154_ADDR_LEN);
|
|
|
|
INIT_LIST_HEAD(&sec->table.security_levels);
|
|
INIT_LIST_HEAD(&sec->table.devices);
|
|
INIT_LIST_HEAD(&sec->table.keys);
|
|
hash_init(sec->devices_short);
|
|
hash_init(sec->devices_hw);
|
|
rwlock_init(&sec->lock);
|
|
}
|
|
|
|
void mac802154_llsec_destroy(struct mac802154_llsec *sec)
|
|
{
|
|
struct ieee802154_llsec_seclevel *sl, *sn;
|
|
struct ieee802154_llsec_device *dev, *dn;
|
|
struct ieee802154_llsec_key_entry *key, *kn;
|
|
|
|
list_for_each_entry_safe(sl, sn, &sec->table.security_levels, list) {
|
|
struct mac802154_llsec_seclevel *msl;
|
|
|
|
msl = container_of(sl, struct mac802154_llsec_seclevel, level);
|
|
list_del(&sl->list);
|
|
kzfree(msl);
|
|
}
|
|
|
|
list_for_each_entry_safe(dev, dn, &sec->table.devices, list) {
|
|
struct mac802154_llsec_device *mdev;
|
|
|
|
mdev = container_of(dev, struct mac802154_llsec_device, dev);
|
|
list_del(&dev->list);
|
|
llsec_dev_free(mdev);
|
|
}
|
|
|
|
list_for_each_entry_safe(key, kn, &sec->table.keys, list) {
|
|
struct mac802154_llsec_key *mkey;
|
|
|
|
mkey = container_of(key->key, struct mac802154_llsec_key, key);
|
|
list_del(&key->list);
|
|
llsec_key_put(mkey);
|
|
kzfree(key);
|
|
}
|
|
}
|
|
|
|
int mac802154_llsec_get_params(struct mac802154_llsec *sec,
|
|
struct ieee802154_llsec_params *params)
|
|
{
|
|
read_lock_bh(&sec->lock);
|
|
*params = sec->params;
|
|
read_unlock_bh(&sec->lock);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int mac802154_llsec_set_params(struct mac802154_llsec *sec,
|
|
const struct ieee802154_llsec_params *params,
|
|
int changed)
|
|
{
|
|
write_lock_bh(&sec->lock);
|
|
|
|
if (changed & IEEE802154_LLSEC_PARAM_ENABLED)
|
|
sec->params.enabled = params->enabled;
|
|
if (changed & IEEE802154_LLSEC_PARAM_FRAME_COUNTER)
|
|
sec->params.frame_counter = params->frame_counter;
|
|
if (changed & IEEE802154_LLSEC_PARAM_OUT_LEVEL)
|
|
sec->params.out_level = params->out_level;
|
|
if (changed & IEEE802154_LLSEC_PARAM_OUT_KEY)
|
|
sec->params.out_key = params->out_key;
|
|
if (changed & IEEE802154_LLSEC_PARAM_KEY_SOURCE)
|
|
sec->params.default_key_source = params->default_key_source;
|
|
if (changed & IEEE802154_LLSEC_PARAM_PAN_ID)
|
|
sec->params.pan_id = params->pan_id;
|
|
if (changed & IEEE802154_LLSEC_PARAM_HWADDR)
|
|
sec->params.hwaddr = params->hwaddr;
|
|
if (changed & IEEE802154_LLSEC_PARAM_COORD_HWADDR)
|
|
sec->params.coord_hwaddr = params->coord_hwaddr;
|
|
if (changed & IEEE802154_LLSEC_PARAM_COORD_SHORTADDR)
|
|
sec->params.coord_shortaddr = params->coord_shortaddr;
|
|
|
|
write_unlock_bh(&sec->lock);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static struct mac802154_llsec_key*
|
|
llsec_key_alloc(const struct ieee802154_llsec_key *template)
|
|
{
|
|
const int authsizes[3] = { 4, 8, 16 };
|
|
struct mac802154_llsec_key *key;
|
|
int i;
|
|
|
|
key = kzalloc(sizeof(*key), GFP_KERNEL);
|
|
if (!key)
|
|
return NULL;
|
|
|
|
kref_init(&key->ref);
|
|
key->key = *template;
|
|
|
|
BUILD_BUG_ON(ARRAY_SIZE(authsizes) != ARRAY_SIZE(key->tfm));
|
|
|
|
for (i = 0; i < ARRAY_SIZE(key->tfm); i++) {
|
|
key->tfm[i] = crypto_alloc_aead("ccm(aes)", 0,
|
|
CRYPTO_ALG_ASYNC);
|
|
if (IS_ERR(key->tfm[i]))
|
|
goto err_tfm;
|
|
if (crypto_aead_setkey(key->tfm[i], template->key,
|
|
IEEE802154_LLSEC_KEY_SIZE))
|
|
goto err_tfm;
|
|
if (crypto_aead_setauthsize(key->tfm[i], authsizes[i]))
|
|
goto err_tfm;
|
|
}
|
|
|
|
key->tfm0 = crypto_alloc_sync_skcipher("ctr(aes)", 0, 0);
|
|
if (IS_ERR(key->tfm0))
|
|
goto err_tfm;
|
|
|
|
if (crypto_sync_skcipher_setkey(key->tfm0, template->key,
|
|
IEEE802154_LLSEC_KEY_SIZE))
|
|
goto err_tfm0;
|
|
|
|
return key;
|
|
|
|
err_tfm0:
|
|
crypto_free_sync_skcipher(key->tfm0);
|
|
err_tfm:
|
|
for (i = 0; i < ARRAY_SIZE(key->tfm); i++)
|
|
if (!IS_ERR_OR_NULL(key->tfm[i]))
|
|
crypto_free_aead(key->tfm[i]);
|
|
|
|
kzfree(key);
|
|
return NULL;
|
|
}
|
|
|
|
static void llsec_key_release(struct kref *ref)
|
|
{
|
|
struct mac802154_llsec_key *key;
|
|
int i;
|
|
|
|
key = container_of(ref, struct mac802154_llsec_key, ref);
|
|
|
|
for (i = 0; i < ARRAY_SIZE(key->tfm); i++)
|
|
crypto_free_aead(key->tfm[i]);
|
|
|
|
crypto_free_sync_skcipher(key->tfm0);
|
|
kzfree(key);
|
|
}
|
|
|
|
static struct mac802154_llsec_key*
|
|
llsec_key_get(struct mac802154_llsec_key *key)
|
|
{
|
|
kref_get(&key->ref);
|
|
return key;
|
|
}
|
|
|
|
static void llsec_key_put(struct mac802154_llsec_key *key)
|
|
{
|
|
kref_put(&key->ref, llsec_key_release);
|
|
}
|
|
|
|
static bool llsec_key_id_equal(const struct ieee802154_llsec_key_id *a,
|
|
const struct ieee802154_llsec_key_id *b)
|
|
{
|
|
if (a->mode != b->mode)
|
|
return false;
|
|
|
|
if (a->mode == IEEE802154_SCF_KEY_IMPLICIT)
|
|
return ieee802154_addr_equal(&a->device_addr, &b->device_addr);
|
|
|
|
if (a->id != b->id)
|
|
return false;
|
|
|
|
switch (a->mode) {
|
|
case IEEE802154_SCF_KEY_INDEX:
|
|
return true;
|
|
case IEEE802154_SCF_KEY_SHORT_INDEX:
|
|
return a->short_source == b->short_source;
|
|
case IEEE802154_SCF_KEY_HW_INDEX:
|
|
return a->extended_source == b->extended_source;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
int mac802154_llsec_key_add(struct mac802154_llsec *sec,
|
|
const struct ieee802154_llsec_key_id *id,
|
|
const struct ieee802154_llsec_key *key)
|
|
{
|
|
struct mac802154_llsec_key *mkey = NULL;
|
|
struct ieee802154_llsec_key_entry *pos, *new;
|
|
|
|
if (!(key->frame_types & (1 << IEEE802154_FC_TYPE_MAC_CMD)) &&
|
|
key->cmd_frame_ids)
|
|
return -EINVAL;
|
|
|
|
list_for_each_entry(pos, &sec->table.keys, list) {
|
|
if (llsec_key_id_equal(&pos->id, id))
|
|
return -EEXIST;
|
|
|
|
if (memcmp(pos->key->key, key->key,
|
|
IEEE802154_LLSEC_KEY_SIZE))
|
|
continue;
|
|
|
|
mkey = container_of(pos->key, struct mac802154_llsec_key, key);
|
|
|
|
/* Don't allow multiple instances of the same AES key to have
|
|
* different allowed frame types/command frame ids, as this is
|
|
* not possible in the 802.15.4 PIB.
|
|
*/
|
|
if (pos->key->frame_types != key->frame_types ||
|
|
pos->key->cmd_frame_ids != key->cmd_frame_ids)
|
|
return -EEXIST;
|
|
|
|
break;
|
|
}
|
|
|
|
new = kzalloc(sizeof(*new), GFP_KERNEL);
|
|
if (!new)
|
|
return -ENOMEM;
|
|
|
|
if (!mkey)
|
|
mkey = llsec_key_alloc(key);
|
|
else
|
|
mkey = llsec_key_get(mkey);
|
|
|
|
if (!mkey)
|
|
goto fail;
|
|
|
|
new->id = *id;
|
|
new->key = &mkey->key;
|
|
|
|
list_add_rcu(&new->list, &sec->table.keys);
|
|
|
|
return 0;
|
|
|
|
fail:
|
|
kzfree(new);
|
|
return -ENOMEM;
|
|
}
|
|
|
|
int mac802154_llsec_key_del(struct mac802154_llsec *sec,
|
|
const struct ieee802154_llsec_key_id *key)
|
|
{
|
|
struct ieee802154_llsec_key_entry *pos;
|
|
|
|
list_for_each_entry(pos, &sec->table.keys, list) {
|
|
struct mac802154_llsec_key *mkey;
|
|
|
|
mkey = container_of(pos->key, struct mac802154_llsec_key, key);
|
|
|
|
if (llsec_key_id_equal(&pos->id, key)) {
|
|
list_del_rcu(&pos->list);
|
|
llsec_key_put(mkey);
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
return -ENOENT;
|
|
}
|
|
|
|
static bool llsec_dev_use_shortaddr(__le16 short_addr)
|
|
{
|
|
return short_addr != cpu_to_le16(IEEE802154_ADDR_UNDEF) &&
|
|
short_addr != cpu_to_le16(0xffff);
|
|
}
|
|
|
|
static u32 llsec_dev_hash_short(__le16 short_addr, __le16 pan_id)
|
|
{
|
|
return ((__force u16)short_addr) << 16 | (__force u16)pan_id;
|
|
}
|
|
|
|
static u64 llsec_dev_hash_long(__le64 hwaddr)
|
|
{
|
|
return (__force u64)hwaddr;
|
|
}
|
|
|
|
static struct mac802154_llsec_device*
|
|
llsec_dev_find_short(struct mac802154_llsec *sec, __le16 short_addr,
|
|
__le16 pan_id)
|
|
{
|
|
struct mac802154_llsec_device *dev;
|
|
u32 key = llsec_dev_hash_short(short_addr, pan_id);
|
|
|
|
hash_for_each_possible_rcu(sec->devices_short, dev, bucket_s, key) {
|
|
if (dev->dev.short_addr == short_addr &&
|
|
dev->dev.pan_id == pan_id)
|
|
return dev;
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
static struct mac802154_llsec_device*
|
|
llsec_dev_find_long(struct mac802154_llsec *sec, __le64 hwaddr)
|
|
{
|
|
struct mac802154_llsec_device *dev;
|
|
u64 key = llsec_dev_hash_long(hwaddr);
|
|
|
|
hash_for_each_possible_rcu(sec->devices_hw, dev, bucket_hw, key) {
|
|
if (dev->dev.hwaddr == hwaddr)
|
|
return dev;
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
static void llsec_dev_free(struct mac802154_llsec_device *dev)
|
|
{
|
|
struct ieee802154_llsec_device_key *pos, *pn;
|
|
struct mac802154_llsec_device_key *devkey;
|
|
|
|
list_for_each_entry_safe(pos, pn, &dev->dev.keys, list) {
|
|
devkey = container_of(pos, struct mac802154_llsec_device_key,
|
|
devkey);
|
|
|
|
list_del(&pos->list);
|
|
kzfree(devkey);
|
|
}
|
|
|
|
kzfree(dev);
|
|
}
|
|
|
|
int mac802154_llsec_dev_add(struct mac802154_llsec *sec,
|
|
const struct ieee802154_llsec_device *dev)
|
|
{
|
|
struct mac802154_llsec_device *entry;
|
|
u32 skey = llsec_dev_hash_short(dev->short_addr, dev->pan_id);
|
|
u64 hwkey = llsec_dev_hash_long(dev->hwaddr);
|
|
|
|
BUILD_BUG_ON(sizeof(hwkey) != IEEE802154_ADDR_LEN);
|
|
|
|
if ((llsec_dev_use_shortaddr(dev->short_addr) &&
|
|
llsec_dev_find_short(sec, dev->short_addr, dev->pan_id)) ||
|
|
llsec_dev_find_long(sec, dev->hwaddr))
|
|
return -EEXIST;
|
|
|
|
entry = kmalloc(sizeof(*entry), GFP_KERNEL);
|
|
if (!entry)
|
|
return -ENOMEM;
|
|
|
|
entry->dev = *dev;
|
|
spin_lock_init(&entry->lock);
|
|
INIT_LIST_HEAD(&entry->dev.keys);
|
|
|
|
if (llsec_dev_use_shortaddr(dev->short_addr))
|
|
hash_add_rcu(sec->devices_short, &entry->bucket_s, skey);
|
|
else
|
|
INIT_HLIST_NODE(&entry->bucket_s);
|
|
|
|
hash_add_rcu(sec->devices_hw, &entry->bucket_hw, hwkey);
|
|
list_add_tail_rcu(&entry->dev.list, &sec->table.devices);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void llsec_dev_free_rcu(struct rcu_head *rcu)
|
|
{
|
|
llsec_dev_free(container_of(rcu, struct mac802154_llsec_device, rcu));
|
|
}
|
|
|
|
int mac802154_llsec_dev_del(struct mac802154_llsec *sec, __le64 device_addr)
|
|
{
|
|
struct mac802154_llsec_device *pos;
|
|
|
|
pos = llsec_dev_find_long(sec, device_addr);
|
|
if (!pos)
|
|
return -ENOENT;
|
|
|
|
hash_del_rcu(&pos->bucket_s);
|
|
hash_del_rcu(&pos->bucket_hw);
|
|
list_del_rcu(&pos->dev.list);
|
|
call_rcu(&pos->rcu, llsec_dev_free_rcu);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static struct mac802154_llsec_device_key*
|
|
llsec_devkey_find(struct mac802154_llsec_device *dev,
|
|
const struct ieee802154_llsec_key_id *key)
|
|
{
|
|
struct ieee802154_llsec_device_key *devkey;
|
|
|
|
list_for_each_entry_rcu(devkey, &dev->dev.keys, list) {
|
|
if (!llsec_key_id_equal(key, &devkey->key_id))
|
|
continue;
|
|
|
|
return container_of(devkey, struct mac802154_llsec_device_key,
|
|
devkey);
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
int mac802154_llsec_devkey_add(struct mac802154_llsec *sec,
|
|
__le64 dev_addr,
|
|
const struct ieee802154_llsec_device_key *key)
|
|
{
|
|
struct mac802154_llsec_device *dev;
|
|
struct mac802154_llsec_device_key *devkey;
|
|
|
|
dev = llsec_dev_find_long(sec, dev_addr);
|
|
|
|
if (!dev)
|
|
return -ENOENT;
|
|
|
|
if (llsec_devkey_find(dev, &key->key_id))
|
|
return -EEXIST;
|
|
|
|
devkey = kmalloc(sizeof(*devkey), GFP_KERNEL);
|
|
if (!devkey)
|
|
return -ENOMEM;
|
|
|
|
devkey->devkey = *key;
|
|
list_add_tail_rcu(&devkey->devkey.list, &dev->dev.keys);
|
|
return 0;
|
|
}
|
|
|
|
int mac802154_llsec_devkey_del(struct mac802154_llsec *sec,
|
|
__le64 dev_addr,
|
|
const struct ieee802154_llsec_device_key *key)
|
|
{
|
|
struct mac802154_llsec_device *dev;
|
|
struct mac802154_llsec_device_key *devkey;
|
|
|
|
dev = llsec_dev_find_long(sec, dev_addr);
|
|
|
|
if (!dev)
|
|
return -ENOENT;
|
|
|
|
devkey = llsec_devkey_find(dev, &key->key_id);
|
|
if (!devkey)
|
|
return -ENOENT;
|
|
|
|
list_del_rcu(&devkey->devkey.list);
|
|
kfree_rcu(devkey, rcu);
|
|
return 0;
|
|
}
|
|
|
|
static struct mac802154_llsec_seclevel*
|
|
llsec_find_seclevel(const struct mac802154_llsec *sec,
|
|
const struct ieee802154_llsec_seclevel *sl)
|
|
{
|
|
struct ieee802154_llsec_seclevel *pos;
|
|
|
|
list_for_each_entry(pos, &sec->table.security_levels, list) {
|
|
if (pos->frame_type != sl->frame_type ||
|
|
(pos->frame_type == IEEE802154_FC_TYPE_MAC_CMD &&
|
|
pos->cmd_frame_id != sl->cmd_frame_id) ||
|
|
pos->device_override != sl->device_override ||
|
|
pos->sec_levels != sl->sec_levels)
|
|
continue;
|
|
|
|
return container_of(pos, struct mac802154_llsec_seclevel,
|
|
level);
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
int mac802154_llsec_seclevel_add(struct mac802154_llsec *sec,
|
|
const struct ieee802154_llsec_seclevel *sl)
|
|
{
|
|
struct mac802154_llsec_seclevel *entry;
|
|
|
|
if (llsec_find_seclevel(sec, sl))
|
|
return -EEXIST;
|
|
|
|
entry = kmalloc(sizeof(*entry), GFP_KERNEL);
|
|
if (!entry)
|
|
return -ENOMEM;
|
|
|
|
entry->level = *sl;
|
|
|
|
list_add_tail_rcu(&entry->level.list, &sec->table.security_levels);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int mac802154_llsec_seclevel_del(struct mac802154_llsec *sec,
|
|
const struct ieee802154_llsec_seclevel *sl)
|
|
{
|
|
struct mac802154_llsec_seclevel *pos;
|
|
|
|
pos = llsec_find_seclevel(sec, sl);
|
|
if (!pos)
|
|
return -ENOENT;
|
|
|
|
list_del_rcu(&pos->level.list);
|
|
kfree_rcu(pos, rcu);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int llsec_recover_addr(struct mac802154_llsec *sec,
|
|
struct ieee802154_addr *addr)
|
|
{
|
|
__le16 caddr = sec->params.coord_shortaddr;
|
|
|
|
addr->pan_id = sec->params.pan_id;
|
|
|
|
if (caddr == cpu_to_le16(IEEE802154_ADDR_BROADCAST)) {
|
|
return -EINVAL;
|
|
} else if (caddr == cpu_to_le16(IEEE802154_ADDR_UNDEF)) {
|
|
addr->extended_addr = sec->params.coord_hwaddr;
|
|
addr->mode = IEEE802154_ADDR_LONG;
|
|
} else {
|
|
addr->short_addr = sec->params.coord_shortaddr;
|
|
addr->mode = IEEE802154_ADDR_SHORT;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static struct mac802154_llsec_key*
|
|
llsec_lookup_key(struct mac802154_llsec *sec,
|
|
const struct ieee802154_hdr *hdr,
|
|
const struct ieee802154_addr *addr,
|
|
struct ieee802154_llsec_key_id *key_id)
|
|
{
|
|
struct ieee802154_addr devaddr = *addr;
|
|
u8 key_id_mode = hdr->sec.key_id_mode;
|
|
struct ieee802154_llsec_key_entry *key_entry;
|
|
struct mac802154_llsec_key *key;
|
|
|
|
if (key_id_mode == IEEE802154_SCF_KEY_IMPLICIT &&
|
|
devaddr.mode == IEEE802154_ADDR_NONE) {
|
|
if (hdr->fc.type == IEEE802154_FC_TYPE_BEACON) {
|
|
devaddr.extended_addr = sec->params.coord_hwaddr;
|
|
devaddr.mode = IEEE802154_ADDR_LONG;
|
|
} else if (llsec_recover_addr(sec, &devaddr) < 0) {
|
|
return NULL;
|
|
}
|
|
}
|
|
|
|
list_for_each_entry_rcu(key_entry, &sec->table.keys, list) {
|
|
const struct ieee802154_llsec_key_id *id = &key_entry->id;
|
|
|
|
if (!(key_entry->key->frame_types & BIT(hdr->fc.type)))
|
|
continue;
|
|
|
|
if (id->mode != key_id_mode)
|
|
continue;
|
|
|
|
if (key_id_mode == IEEE802154_SCF_KEY_IMPLICIT) {
|
|
if (ieee802154_addr_equal(&devaddr, &id->device_addr))
|
|
goto found;
|
|
} else {
|
|
if (id->id != hdr->sec.key_id)
|
|
continue;
|
|
|
|
if ((key_id_mode == IEEE802154_SCF_KEY_INDEX) ||
|
|
(key_id_mode == IEEE802154_SCF_KEY_SHORT_INDEX &&
|
|
id->short_source == hdr->sec.short_src) ||
|
|
(key_id_mode == IEEE802154_SCF_KEY_HW_INDEX &&
|
|
id->extended_source == hdr->sec.extended_src))
|
|
goto found;
|
|
}
|
|
}
|
|
|
|
return NULL;
|
|
|
|
found:
|
|
key = container_of(key_entry->key, struct mac802154_llsec_key, key);
|
|
if (key_id)
|
|
*key_id = key_entry->id;
|
|
return llsec_key_get(key);
|
|
}
|
|
|
|
static void llsec_geniv(u8 iv[16], __le64 addr,
|
|
const struct ieee802154_sechdr *sec)
|
|
{
|
|
__be64 addr_bytes = (__force __be64) swab64((__force u64) addr);
|
|
__be32 frame_counter = (__force __be32) swab32((__force u32) sec->frame_counter);
|
|
|
|
iv[0] = 1; /* L' = L - 1 = 1 */
|
|
memcpy(iv + 1, &addr_bytes, sizeof(addr_bytes));
|
|
memcpy(iv + 9, &frame_counter, sizeof(frame_counter));
|
|
iv[13] = sec->level;
|
|
iv[14] = 0;
|
|
iv[15] = 1;
|
|
}
|
|
|
|
static int
|
|
llsec_do_encrypt_unauth(struct sk_buff *skb, const struct mac802154_llsec *sec,
|
|
const struct ieee802154_hdr *hdr,
|
|
struct mac802154_llsec_key *key)
|
|
{
|
|
u8 iv[16];
|
|
struct scatterlist src;
|
|
SYNC_SKCIPHER_REQUEST_ON_STACK(req, key->tfm0);
|
|
int err, datalen;
|
|
unsigned char *data;
|
|
|
|
llsec_geniv(iv, sec->params.hwaddr, &hdr->sec);
|
|
/* Compute data payload offset and data length */
|
|
data = skb_mac_header(skb) + skb->mac_len;
|
|
datalen = skb_tail_pointer(skb) - data;
|
|
sg_init_one(&src, data, datalen);
|
|
|
|
skcipher_request_set_sync_tfm(req, key->tfm0);
|
|
skcipher_request_set_callback(req, 0, NULL, NULL);
|
|
skcipher_request_set_crypt(req, &src, &src, datalen, iv);
|
|
err = crypto_skcipher_encrypt(req);
|
|
skcipher_request_zero(req);
|
|
return err;
|
|
}
|
|
|
|
static struct crypto_aead*
|
|
llsec_tfm_by_len(struct mac802154_llsec_key *key, int authlen)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(key->tfm); i++)
|
|
if (crypto_aead_authsize(key->tfm[i]) == authlen)
|
|
return key->tfm[i];
|
|
|
|
BUG();
|
|
}
|
|
|
|
static int
|
|
llsec_do_encrypt_auth(struct sk_buff *skb, const struct mac802154_llsec *sec,
|
|
const struct ieee802154_hdr *hdr,
|
|
struct mac802154_llsec_key *key)
|
|
{
|
|
u8 iv[16];
|
|
unsigned char *data;
|
|
int authlen, assoclen, datalen, rc;
|
|
struct scatterlist sg;
|
|
struct aead_request *req;
|
|
|
|
authlen = ieee802154_sechdr_authtag_len(&hdr->sec);
|
|
llsec_geniv(iv, sec->params.hwaddr, &hdr->sec);
|
|
|
|
req = aead_request_alloc(llsec_tfm_by_len(key, authlen), GFP_ATOMIC);
|
|
if (!req)
|
|
return -ENOMEM;
|
|
|
|
assoclen = skb->mac_len;
|
|
|
|
data = skb_mac_header(skb) + skb->mac_len;
|
|
datalen = skb_tail_pointer(skb) - data;
|
|
|
|
skb_put(skb, authlen);
|
|
|
|
sg_init_one(&sg, skb_mac_header(skb), assoclen + datalen + authlen);
|
|
|
|
if (!(hdr->sec.level & IEEE802154_SCF_SECLEVEL_ENC)) {
|
|
assoclen += datalen;
|
|
datalen = 0;
|
|
}
|
|
|
|
aead_request_set_callback(req, 0, NULL, NULL);
|
|
aead_request_set_crypt(req, &sg, &sg, datalen, iv);
|
|
aead_request_set_ad(req, assoclen);
|
|
|
|
rc = crypto_aead_encrypt(req);
|
|
|
|
kzfree(req);
|
|
|
|
return rc;
|
|
}
|
|
|
|
static int llsec_do_encrypt(struct sk_buff *skb,
|
|
const struct mac802154_llsec *sec,
|
|
const struct ieee802154_hdr *hdr,
|
|
struct mac802154_llsec_key *key)
|
|
{
|
|
if (hdr->sec.level == IEEE802154_SCF_SECLEVEL_ENC)
|
|
return llsec_do_encrypt_unauth(skb, sec, hdr, key);
|
|
else
|
|
return llsec_do_encrypt_auth(skb, sec, hdr, key);
|
|
}
|
|
|
|
int mac802154_llsec_encrypt(struct mac802154_llsec *sec, struct sk_buff *skb)
|
|
{
|
|
struct ieee802154_hdr hdr;
|
|
int rc, authlen, hlen;
|
|
struct mac802154_llsec_key *key;
|
|
u32 frame_ctr;
|
|
|
|
hlen = ieee802154_hdr_pull(skb, &hdr);
|
|
|
|
if (hlen < 0 || hdr.fc.type != IEEE802154_FC_TYPE_DATA)
|
|
return -EINVAL;
|
|
|
|
if (!hdr.fc.security_enabled ||
|
|
(hdr.sec.level == IEEE802154_SCF_SECLEVEL_NONE)) {
|
|
skb_push(skb, hlen);
|
|
return 0;
|
|
}
|
|
|
|
authlen = ieee802154_sechdr_authtag_len(&hdr.sec);
|
|
|
|
if (skb->len + hlen + authlen + IEEE802154_MFR_SIZE > IEEE802154_MTU)
|
|
return -EMSGSIZE;
|
|
|
|
rcu_read_lock();
|
|
|
|
read_lock_bh(&sec->lock);
|
|
|
|
if (!sec->params.enabled) {
|
|
rc = -EINVAL;
|
|
goto fail_read;
|
|
}
|
|
|
|
key = llsec_lookup_key(sec, &hdr, &hdr.dest, NULL);
|
|
if (!key) {
|
|
rc = -ENOKEY;
|
|
goto fail_read;
|
|
}
|
|
|
|
read_unlock_bh(&sec->lock);
|
|
|
|
write_lock_bh(&sec->lock);
|
|
|
|
frame_ctr = be32_to_cpu(sec->params.frame_counter);
|
|
hdr.sec.frame_counter = cpu_to_le32(frame_ctr);
|
|
if (frame_ctr == 0xFFFFFFFF) {
|
|
write_unlock_bh(&sec->lock);
|
|
llsec_key_put(key);
|
|
rc = -EOVERFLOW;
|
|
goto fail;
|
|
}
|
|
|
|
sec->params.frame_counter = cpu_to_be32(frame_ctr + 1);
|
|
|
|
write_unlock_bh(&sec->lock);
|
|
|
|
rcu_read_unlock();
|
|
|
|
skb->mac_len = ieee802154_hdr_push(skb, &hdr);
|
|
skb_reset_mac_header(skb);
|
|
|
|
rc = llsec_do_encrypt(skb, sec, &hdr, key);
|
|
llsec_key_put(key);
|
|
|
|
return rc;
|
|
|
|
fail_read:
|
|
read_unlock_bh(&sec->lock);
|
|
fail:
|
|
rcu_read_unlock();
|
|
return rc;
|
|
}
|
|
|
|
static struct mac802154_llsec_device*
|
|
llsec_lookup_dev(struct mac802154_llsec *sec,
|
|
const struct ieee802154_addr *addr)
|
|
{
|
|
struct ieee802154_addr devaddr = *addr;
|
|
struct mac802154_llsec_device *dev = NULL;
|
|
|
|
if (devaddr.mode == IEEE802154_ADDR_NONE &&
|
|
llsec_recover_addr(sec, &devaddr) < 0)
|
|
return NULL;
|
|
|
|
if (devaddr.mode == IEEE802154_ADDR_SHORT) {
|
|
u32 key = llsec_dev_hash_short(devaddr.short_addr,
|
|
devaddr.pan_id);
|
|
|
|
hash_for_each_possible_rcu(sec->devices_short, dev,
|
|
bucket_s, key) {
|
|
if (dev->dev.pan_id == devaddr.pan_id &&
|
|
dev->dev.short_addr == devaddr.short_addr)
|
|
return dev;
|
|
}
|
|
} else {
|
|
u64 key = llsec_dev_hash_long(devaddr.extended_addr);
|
|
|
|
hash_for_each_possible_rcu(sec->devices_hw, dev,
|
|
bucket_hw, key) {
|
|
if (dev->dev.hwaddr == devaddr.extended_addr)
|
|
return dev;
|
|
}
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
static int
|
|
llsec_lookup_seclevel(const struct mac802154_llsec *sec,
|
|
u8 frame_type, u8 cmd_frame_id,
|
|
struct ieee802154_llsec_seclevel *rlevel)
|
|
{
|
|
struct ieee802154_llsec_seclevel *level;
|
|
|
|
list_for_each_entry_rcu(level, &sec->table.security_levels, list) {
|
|
if (level->frame_type == frame_type &&
|
|
(frame_type != IEEE802154_FC_TYPE_MAC_CMD ||
|
|
level->cmd_frame_id == cmd_frame_id)) {
|
|
*rlevel = *level;
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
return -EINVAL;
|
|
}
|
|
|
|
static int
|
|
llsec_do_decrypt_unauth(struct sk_buff *skb, const struct mac802154_llsec *sec,
|
|
const struct ieee802154_hdr *hdr,
|
|
struct mac802154_llsec_key *key, __le64 dev_addr)
|
|
{
|
|
u8 iv[16];
|
|
unsigned char *data;
|
|
int datalen;
|
|
struct scatterlist src;
|
|
SYNC_SKCIPHER_REQUEST_ON_STACK(req, key->tfm0);
|
|
int err;
|
|
|
|
llsec_geniv(iv, dev_addr, &hdr->sec);
|
|
data = skb_mac_header(skb) + skb->mac_len;
|
|
datalen = skb_tail_pointer(skb) - data;
|
|
|
|
sg_init_one(&src, data, datalen);
|
|
|
|
skcipher_request_set_sync_tfm(req, key->tfm0);
|
|
skcipher_request_set_callback(req, 0, NULL, NULL);
|
|
skcipher_request_set_crypt(req, &src, &src, datalen, iv);
|
|
|
|
err = crypto_skcipher_decrypt(req);
|
|
skcipher_request_zero(req);
|
|
return err;
|
|
}
|
|
|
|
static int
|
|
llsec_do_decrypt_auth(struct sk_buff *skb, const struct mac802154_llsec *sec,
|
|
const struct ieee802154_hdr *hdr,
|
|
struct mac802154_llsec_key *key, __le64 dev_addr)
|
|
{
|
|
u8 iv[16];
|
|
unsigned char *data;
|
|
int authlen, datalen, assoclen, rc;
|
|
struct scatterlist sg;
|
|
struct aead_request *req;
|
|
|
|
authlen = ieee802154_sechdr_authtag_len(&hdr->sec);
|
|
llsec_geniv(iv, dev_addr, &hdr->sec);
|
|
|
|
req = aead_request_alloc(llsec_tfm_by_len(key, authlen), GFP_ATOMIC);
|
|
if (!req)
|
|
return -ENOMEM;
|
|
|
|
assoclen = skb->mac_len;
|
|
|
|
data = skb_mac_header(skb) + skb->mac_len;
|
|
datalen = skb_tail_pointer(skb) - data;
|
|
|
|
sg_init_one(&sg, skb_mac_header(skb), assoclen + datalen);
|
|
|
|
if (!(hdr->sec.level & IEEE802154_SCF_SECLEVEL_ENC)) {
|
|
assoclen += datalen - authlen;
|
|
datalen = authlen;
|
|
}
|
|
|
|
aead_request_set_callback(req, 0, NULL, NULL);
|
|
aead_request_set_crypt(req, &sg, &sg, datalen, iv);
|
|
aead_request_set_ad(req, assoclen);
|
|
|
|
rc = crypto_aead_decrypt(req);
|
|
|
|
kzfree(req);
|
|
skb_trim(skb, skb->len - authlen);
|
|
|
|
return rc;
|
|
}
|
|
|
|
static int
|
|
llsec_do_decrypt(struct sk_buff *skb, const struct mac802154_llsec *sec,
|
|
const struct ieee802154_hdr *hdr,
|
|
struct mac802154_llsec_key *key, __le64 dev_addr)
|
|
{
|
|
if (hdr->sec.level == IEEE802154_SCF_SECLEVEL_ENC)
|
|
return llsec_do_decrypt_unauth(skb, sec, hdr, key, dev_addr);
|
|
else
|
|
return llsec_do_decrypt_auth(skb, sec, hdr, key, dev_addr);
|
|
}
|
|
|
|
static int
|
|
llsec_update_devkey_record(struct mac802154_llsec_device *dev,
|
|
const struct ieee802154_llsec_key_id *in_key)
|
|
{
|
|
struct mac802154_llsec_device_key *devkey;
|
|
|
|
devkey = llsec_devkey_find(dev, in_key);
|
|
|
|
if (!devkey) {
|
|
struct mac802154_llsec_device_key *next;
|
|
|
|
next = kzalloc(sizeof(*devkey), GFP_ATOMIC);
|
|
if (!next)
|
|
return -ENOMEM;
|
|
|
|
next->devkey.key_id = *in_key;
|
|
|
|
spin_lock_bh(&dev->lock);
|
|
|
|
devkey = llsec_devkey_find(dev, in_key);
|
|
if (!devkey)
|
|
list_add_rcu(&next->devkey.list, &dev->dev.keys);
|
|
else
|
|
kzfree(next);
|
|
|
|
spin_unlock_bh(&dev->lock);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int
|
|
llsec_update_devkey_info(struct mac802154_llsec_device *dev,
|
|
const struct ieee802154_llsec_key_id *in_key,
|
|
u32 frame_counter)
|
|
{
|
|
struct mac802154_llsec_device_key *devkey = NULL;
|
|
|
|
if (dev->dev.key_mode == IEEE802154_LLSEC_DEVKEY_RESTRICT) {
|
|
devkey = llsec_devkey_find(dev, in_key);
|
|
if (!devkey)
|
|
return -ENOENT;
|
|
}
|
|
|
|
if (dev->dev.key_mode == IEEE802154_LLSEC_DEVKEY_RECORD) {
|
|
int rc = llsec_update_devkey_record(dev, in_key);
|
|
|
|
if (rc < 0)
|
|
return rc;
|
|
}
|
|
|
|
spin_lock_bh(&dev->lock);
|
|
|
|
if ((!devkey && frame_counter < dev->dev.frame_counter) ||
|
|
(devkey && frame_counter < devkey->devkey.frame_counter)) {
|
|
spin_unlock_bh(&dev->lock);
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (devkey)
|
|
devkey->devkey.frame_counter = frame_counter + 1;
|
|
else
|
|
dev->dev.frame_counter = frame_counter + 1;
|
|
|
|
spin_unlock_bh(&dev->lock);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int mac802154_llsec_decrypt(struct mac802154_llsec *sec, struct sk_buff *skb)
|
|
{
|
|
struct ieee802154_hdr hdr;
|
|
struct mac802154_llsec_key *key;
|
|
struct ieee802154_llsec_key_id key_id;
|
|
struct mac802154_llsec_device *dev;
|
|
struct ieee802154_llsec_seclevel seclevel;
|
|
int err;
|
|
__le64 dev_addr;
|
|
u32 frame_ctr;
|
|
|
|
if (ieee802154_hdr_peek(skb, &hdr) < 0)
|
|
return -EINVAL;
|
|
if (!hdr.fc.security_enabled)
|
|
return 0;
|
|
if (hdr.fc.version == 0)
|
|
return -EINVAL;
|
|
|
|
read_lock_bh(&sec->lock);
|
|
if (!sec->params.enabled) {
|
|
read_unlock_bh(&sec->lock);
|
|
return -EINVAL;
|
|
}
|
|
read_unlock_bh(&sec->lock);
|
|
|
|
rcu_read_lock();
|
|
|
|
key = llsec_lookup_key(sec, &hdr, &hdr.source, &key_id);
|
|
if (!key) {
|
|
err = -ENOKEY;
|
|
goto fail;
|
|
}
|
|
|
|
dev = llsec_lookup_dev(sec, &hdr.source);
|
|
if (!dev) {
|
|
err = -EINVAL;
|
|
goto fail_dev;
|
|
}
|
|
|
|
if (llsec_lookup_seclevel(sec, hdr.fc.type, 0, &seclevel) < 0) {
|
|
err = -EINVAL;
|
|
goto fail_dev;
|
|
}
|
|
|
|
if (!(seclevel.sec_levels & BIT(hdr.sec.level)) &&
|
|
(hdr.sec.level == 0 && seclevel.device_override &&
|
|
!dev->dev.seclevel_exempt)) {
|
|
err = -EINVAL;
|
|
goto fail_dev;
|
|
}
|
|
|
|
frame_ctr = le32_to_cpu(hdr.sec.frame_counter);
|
|
|
|
if (frame_ctr == 0xffffffff) {
|
|
err = -EOVERFLOW;
|
|
goto fail_dev;
|
|
}
|
|
|
|
err = llsec_update_devkey_info(dev, &key_id, frame_ctr);
|
|
if (err)
|
|
goto fail_dev;
|
|
|
|
dev_addr = dev->dev.hwaddr;
|
|
|
|
rcu_read_unlock();
|
|
|
|
err = llsec_do_decrypt(skb, sec, &hdr, key, dev_addr);
|
|
llsec_key_put(key);
|
|
return err;
|
|
|
|
fail_dev:
|
|
llsec_key_put(key);
|
|
fail:
|
|
rcu_read_unlock();
|
|
return err;
|
|
}
|