Commit 7b0bd881 authored by Konrad Sztyber's avatar Konrad Sztyber Committed by Tomasz Zawadzki
Browse files

nvmf/auth: verify authentication commands' fields 



The DH-HMAC-CHAP protocol requires the fields in the authentication
commands to be set in certain way (i.e. secp=0xe9, spsp{0,1}=1), so
they're now sanitized before we process them any further.

Signed-off-by: default avatarKonrad Sztyber <konrad.sztyber@intel.com>
Change-Id: I1675df21e074980439c6ca43b7c2b775eec7abe8
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/22658


Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
Community-CI: Mellanox Build Bot
Reviewed-by: default avatarBen Walker <ben@nvidia.com>
Reviewed-by: default avatarTomasz Zawadzki <tomasz.zawadzki@intel.com>
parent f74bf0d0

include/spdk/nvmf_transport.h

+2 −0
Original line number Diff line number Diff line
@@ -47,6 +47,8 @@ union nvmf_h2c_msg { 
	struct spdk_nvmf_fabric_prop_set_cmd		prop_set_cmd;

	struct spdk_nvmf_fabric_prop_get_cmd		prop_get_cmd;

	struct spdk_nvmf_fabric_connect_cmd		connect_cmd;

	struct spdk_nvmf_fabric_auth_send_cmd		auth_send_cmd;

	struct spdk_nvmf_fabric_auth_recv_cmd		auth_recv_cmd;

};

SPDK_STATIC_ASSERT(sizeof(union nvmf_h2c_msg) == 64, "Incorrect size");

lib/nvmf/auth.c

+80 −2
Original line number Diff line number Diff line
@@ -57,11 +57,89 @@ nvmf_auth_set_state(struct spdk_nvmf_qpair *qpair, enum nvmf_qpair_auth_state st 
	auth->state = state;

}



static int

nvmf_auth_check_command(struct spdk_nvmf_request *req, uint8_t secp,

			uint8_t spsp0, uint8_t spsp1, uint32_t len)

{

	struct spdk_nvmf_qpair *qpair = req->qpair;



	if (secp != SPDK_NVMF_AUTH_SECP_NVME) {

		AUTH_ERRLOG(qpair, "invalid secp=%u\n", secp);

		return -EINVAL;

	}

	if (spsp0 != 1 || spsp1 != 1) {

		AUTH_ERRLOG(qpair, "invalid spsp0=%u, spsp1=%u\n", spsp0, spsp1);

		return -EINVAL;

	}

	if (len != req->length) {

		AUTH_ERRLOG(qpair, "invalid length: %"PRIu32" != %"PRIu32"\n", len, req->length);

		return -EINVAL;

	}



	return 0;

}



static void

nvmf_auth_send_exec(struct spdk_nvmf_request *req)

{

	struct spdk_nvmf_fabric_auth_send_cmd *cmd = &req->cmd->auth_send_cmd;

	int rc;



	rc = nvmf_auth_check_command(req, cmd->secp, cmd->spsp0, cmd->spsp1, cmd->tl);

	if (rc != 0) {

		nvmf_auth_request_complete(req, SPDK_NVME_SCT_GENERIC,

					   SPDK_NVME_SC_INVALID_FIELD, 1);

		return;

	}



	nvmf_auth_request_complete(req, SPDK_NVME_SCT_GENERIC,

				   SPDK_NVME_SC_INVALID_OPCODE, 1);

}



static void

nvmf_auth_recv_exec(struct spdk_nvmf_request *req)

{

	struct spdk_nvmf_fabric_auth_recv_cmd *cmd = &req->cmd->auth_recv_cmd;

	int rc;



	rc = nvmf_auth_check_command(req, cmd->secp, cmd->spsp0, cmd->spsp1, cmd->al);

	if (rc != 0) {

		nvmf_auth_request_complete(req, SPDK_NVME_SCT_GENERIC,

					   SPDK_NVME_SC_INVALID_FIELD, 1);

		return;

	}



	nvmf_auth_request_complete(req, SPDK_NVME_SCT_GENERIC,

				   SPDK_NVME_SC_INVALID_OPCODE, 1);

}



int

nvmf_auth_request_exec(struct spdk_nvmf_request *req)

{

	struct spdk_nvmf_qpair *qpair = req->qpair;

	union nvmf_h2c_msg *cmd = req->cmd;



	/* We don't support reauthentication */

	if (qpair->state != SPDK_NVMF_QPAIR_AUTHENTICATING) {

		nvmf_auth_request_complete(req, SPDK_NVME_SCT_GENERIC,

				   SPDK_NVME_SC_INVALID_OPCODE, 1);

					   SPDK_NVME_SC_COMMAND_SEQUENCE_ERROR, 0);

		return SPDK_NVMF_REQUEST_EXEC_STATUS_ASYNCHRONOUS;

	}



	assert(cmd->nvmf_cmd.opcode == SPDK_NVME_OPC_FABRIC);

	switch (cmd->nvmf_cmd.fctype) {

	case SPDK_NVMF_FABRIC_COMMAND_AUTHENTICATION_SEND:

		nvmf_auth_send_exec(req);

		break;

	case SPDK_NVMF_FABRIC_COMMAND_AUTHENTICATION_RECV:

		nvmf_auth_recv_exec(req);

		break;

	default:

		assert(0 && "invalid fctype");

		nvmf_auth_request_complete(req, SPDK_NVME_SCT_GENERIC,

					   SPDK_NVME_SC_INTERNAL_DEVICE_ERROR, 0);

		break;

	}



	return SPDK_NVMF_REQUEST_EXEC_STATUS_ASYNCHRONOUS;

}

test/unit/lib/nvmf/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ 
SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../../..)

include $(SPDK_ROOT_DIR)/mk/spdk.common.mk



DIRS-y = tcp.c ctrlr.c subsystem.c ctrlr_discovery.c ctrlr_bdev.c nvmf.c

DIRS-y = tcp.c ctrlr.c subsystem.c ctrlr_discovery.c ctrlr_bdev.c nvmf.c auth.c



DIRS-$(CONFIG_RDMA) += rdma.c transport.c

test/unit/lib/nvmf/auth.c/Makefile

0 → 100644
+10 −0
Original line number Diff line number Diff line 
# SPDX-License-Identifier: BSD-3-Clause

# Copyright (c) 2024 Intel Corporation.

# All rights reserved.

#



SPDK_ROOT_DIR := $(abspath $(CURDIR)/../../../../..)



TEST_FILE = auth_ut.c



include $(SPDK_ROOT_DIR)/mk/spdk.unittest.mk

test/unit/lib/nvmf/auth.c/auth_ut.c

0 → 100644
+191 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: BSD-3-Clause

 * Copyright (c) 2024 Intel Corporation. All rights reserved.

 */

#include "spdk/stdinc.h"



#include "spdk_internal/cunit.h"

#include "spdk_internal/mock.h"



#include "common/lib/ut_multithread.c"

#include "nvmf/auth.c"



DEFINE_STUB(spdk_nvme_dhchap_get_digest_name, const char *, (int d), NULL);

DEFINE_STUB(spdk_nvme_dhchap_get_dhgroup_name, const char *, (int d), NULL);

DEFINE_STUB(spdk_nvmf_qpair_disconnect, int, (struct spdk_nvmf_qpair *q), 0);



static bool g_req_completed;



int

spdk_nvmf_request_complete(struct spdk_nvmf_request *req)

{

	g_req_completed = true;

	return 0;

}



static void

ut_clear_resp(struct spdk_nvmf_request *req)

{

	memset(&req->rsp->nvme_cpl, 0, sizeof(req->rsp->nvme_cpl));

}



#define ut_prep_cmd(_req, _cmd, _buf, _len, _lfield)		\

	do {							\

		(_req)->cmd = (void *)_cmd;			\

		(_req)->iov[0].iov_base = _buf;			\

		(_req)->iov[0].iov_len = _len;			\

		(_req)->iovcnt = 1;				\

		(_req)->length = _len;				\

		(_cmd)->secp = SPDK_NVMF_AUTH_SECP_NVME;	\

		(_cmd)->spsp0 = 1;				\

		(_cmd)->spsp1 = 1;				\

		(_cmd)->_lfield = _len;				\

	} while (0)



#define ut_prep_send_cmd(req, cmd, buf, len) ut_prep_cmd(req, cmd, buf, len, tl)

#define ut_prep_recv_cmd(req, cmd, buf, len) ut_prep_cmd(req, cmd, buf, len, al)



static void

test_auth_send_recv_error(void)

{

	union nvmf_c2h_msg rsp = {};

	struct spdk_nvmf_subsystem subsys = {};

	struct spdk_nvmf_ctrlr ctrlr = { .subsys = &subsys };

	struct spdk_nvmf_qpair qpair = { .ctrlr = &ctrlr };

	struct spdk_nvmf_request req = { .qpair = &qpair, .rsp = &rsp };

	struct spdk_nvme_cpl *cpl = &rsp.nvme_cpl;

	struct spdk_nvmf_fabric_auth_send_cmd send_cmd = {};

	struct spdk_nvmf_fabric_auth_recv_cmd recv_cmd = {};

	int rc;



	rc = nvmf_qpair_auth_init(&qpair);

	SPDK_CU_ASSERT_FATAL(rc == 0);

	ut_prep_send_cmd(&req, &send_cmd, NULL, 255);

	ut_prep_recv_cmd(&req, &recv_cmd, NULL, 255);



	/* Bad secp (send) */

	g_req_completed = false;

	req.cmd = (void *)&send_cmd;

	ut_clear_resp(&req);

	send_cmd.secp = SPDK_NVMF_AUTH_SECP_NVME + 1;



	nvmf_auth_send_exec(&req);

	CU_ASSERT(g_req_completed);

	CU_ASSERT_EQUAL(cpl->status.sct, SPDK_NVME_SCT_GENERIC);

	CU_ASSERT_EQUAL(cpl->status.sc, SPDK_NVME_SC_INVALID_FIELD);

	CU_ASSERT_EQUAL(cpl->status.dnr, 1);

	send_cmd.secp = SPDK_NVMF_AUTH_SECP_NVME;



	/* Bad secp (recv) */

	g_req_completed = false;

	req.cmd = (void *)&recv_cmd;

	ut_clear_resp(&req);

	recv_cmd.secp = SPDK_NVMF_AUTH_SECP_NVME + 1;



	nvmf_auth_recv_exec(&req);

	CU_ASSERT(g_req_completed);

	CU_ASSERT_EQUAL(cpl->status.sct, SPDK_NVME_SCT_GENERIC);

	CU_ASSERT_EQUAL(cpl->status.sc, SPDK_NVME_SC_INVALID_FIELD);

	CU_ASSERT_EQUAL(cpl->status.dnr, 1);

	recv_cmd.secp = SPDK_NVMF_AUTH_SECP_NVME;



	/* Bad spsp0 (send) */

	g_req_completed = false;

	req.cmd = (void *)&send_cmd;

	ut_clear_resp(&req);

	send_cmd.spsp0 = 2;



	nvmf_auth_send_exec(&req);

	CU_ASSERT(g_req_completed);

	CU_ASSERT_EQUAL(cpl->status.sct, SPDK_NVME_SCT_GENERIC);

	CU_ASSERT_EQUAL(cpl->status.sc, SPDK_NVME_SC_INVALID_FIELD);

	CU_ASSERT_EQUAL(cpl->status.dnr, 1);

	send_cmd.spsp0 = 1;



	/* Bad spsp0 (recv) */

	g_req_completed = false;

	req.cmd = (void *)&recv_cmd;

	ut_clear_resp(&req);

	recv_cmd.spsp0 = 2;



	nvmf_auth_recv_exec(&req);

	CU_ASSERT(g_req_completed);

	CU_ASSERT_EQUAL(cpl->status.sct, SPDK_NVME_SCT_GENERIC);

	CU_ASSERT_EQUAL(cpl->status.sc, SPDK_NVME_SC_INVALID_FIELD);

	CU_ASSERT_EQUAL(cpl->status.dnr, 1);

	recv_cmd.spsp0 = 1;



	/* Bad spsp1 (send) */

	g_req_completed = false;

	req.cmd = (void *)&send_cmd;

	ut_clear_resp(&req);

	send_cmd.spsp1 = 2;



	nvmf_auth_send_exec(&req);

	CU_ASSERT(g_req_completed);

	CU_ASSERT_EQUAL(cpl->status.sct, SPDK_NVME_SCT_GENERIC);

	CU_ASSERT_EQUAL(cpl->status.sc, SPDK_NVME_SC_INVALID_FIELD);

	CU_ASSERT_EQUAL(cpl->status.dnr, 1);

	send_cmd.spsp1 = 1;



	/* Bad spsp1 (recv) */

	g_req_completed = false;

	req.cmd = (void *)&recv_cmd;

	ut_clear_resp(&req);

	recv_cmd.spsp1 = 2;



	nvmf_auth_recv_exec(&req);

	CU_ASSERT(g_req_completed);

	CU_ASSERT_EQUAL(cpl->status.sct, SPDK_NVME_SCT_GENERIC);

	CU_ASSERT_EQUAL(cpl->status.sc, SPDK_NVME_SC_INVALID_FIELD);

	CU_ASSERT_EQUAL(cpl->status.dnr, 1);

	recv_cmd.spsp1 = 1;



	/* Bad length (send) */

	g_req_completed = false;

	req.cmd = (void *)&send_cmd;

	ut_clear_resp(&req);

	send_cmd.tl = req.length + 1;



	nvmf_auth_recv_exec(&req);

	CU_ASSERT(g_req_completed);

	CU_ASSERT_EQUAL(cpl->status.sct, SPDK_NVME_SCT_GENERIC);

	CU_ASSERT_EQUAL(cpl->status.sc, SPDK_NVME_SC_INVALID_FIELD);

	CU_ASSERT_EQUAL(cpl->status.dnr, 1);

	send_cmd.tl = req.length;



	/* Bad length (recv) */

	g_req_completed = false;

	req.cmd = (void *)&recv_cmd;

	ut_clear_resp(&req);

	recv_cmd.al = req.length - 1;



	nvmf_auth_recv_exec(&req);

	CU_ASSERT(g_req_completed);

	CU_ASSERT_EQUAL(cpl->status.sct, SPDK_NVME_SCT_GENERIC);

	CU_ASSERT_EQUAL(cpl->status.sc, SPDK_NVME_SC_INVALID_FIELD);

	CU_ASSERT_EQUAL(cpl->status.dnr, 1);

	recv_cmd.al = req.length;



	nvmf_qpair_auth_destroy(&qpair);

}



int

main(int argc, char **argv)

{

	CU_pSuite suite = NULL;

	unsigned int num_failures;



	CU_initialize_registry();

	suite = CU_add_suite("nvmf_auth", NULL, NULL);

	CU_ADD_TEST(suite, test_auth_send_recv_error);



	allocate_threads(1);

	set_thread(0);



	num_failures = spdk_ut_run_tests(argc, argv, NULL);

	CU_cleanup_registry();



	free_threads();



	return num_failures;

}