1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (c) 2020 Hannes Reinecke, SUSE Linux 4 */ 5 6 #include <linux/module.h> 7 #include <linux/crc32.h> 8 #include <linux/base64.h> 9 #include <linux/prandom.h> 10 #include <linux/scatterlist.h> 11 #include <linux/unaligned.h> 12 #include <crypto/hash.h> 13 #include <crypto/dh.h> 14 #include <crypto/hkdf.h> 15 #include <crypto/sha2.h> 16 #include <linux/nvme.h> 17 #include <linux/nvme-auth.h> 18 19 static u32 nvme_dhchap_seqnum; 20 static DEFINE_MUTEX(nvme_dhchap_mutex); 21 22 u32 nvme_auth_get_seqnum(void) 23 { 24 u32 seqnum; 25 26 mutex_lock(&nvme_dhchap_mutex); 27 if (!nvme_dhchap_seqnum) 28 nvme_dhchap_seqnum = get_random_u32(); 29 else { 30 nvme_dhchap_seqnum++; 31 if (!nvme_dhchap_seqnum) 32 nvme_dhchap_seqnum++; 33 } 34 seqnum = nvme_dhchap_seqnum; 35 mutex_unlock(&nvme_dhchap_mutex); 36 return seqnum; 37 } 38 EXPORT_SYMBOL_GPL(nvme_auth_get_seqnum); 39 40 static const struct nvme_auth_dhgroup_map { 41 char name[16]; 42 char kpp[16]; 43 } dhgroup_map[] = { 44 [NVME_AUTH_DHGROUP_NULL] = { 45 .name = "null", .kpp = "null" }, 46 [NVME_AUTH_DHGROUP_2048] = { 47 .name = "ffdhe2048", .kpp = "ffdhe2048(dh)" }, 48 [NVME_AUTH_DHGROUP_3072] = { 49 .name = "ffdhe3072", .kpp = "ffdhe3072(dh)" }, 50 [NVME_AUTH_DHGROUP_4096] = { 51 .name = "ffdhe4096", .kpp = "ffdhe4096(dh)" }, 52 [NVME_AUTH_DHGROUP_6144] = { 53 .name = "ffdhe6144", .kpp = "ffdhe6144(dh)" }, 54 [NVME_AUTH_DHGROUP_8192] = { 55 .name = "ffdhe8192", .kpp = "ffdhe8192(dh)" }, 56 }; 57 58 const char *nvme_auth_dhgroup_name(u8 dhgroup_id) 59 { 60 if (dhgroup_id >= ARRAY_SIZE(dhgroup_map)) 61 return NULL; 62 return dhgroup_map[dhgroup_id].name; 63 } 64 EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_name); 65 66 const char *nvme_auth_dhgroup_kpp(u8 dhgroup_id) 67 { 68 if (dhgroup_id >= ARRAY_SIZE(dhgroup_map)) 69 return NULL; 70 return dhgroup_map[dhgroup_id].kpp; 71 } 72 EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_kpp); 73 74 u8 nvme_auth_dhgroup_id(const char *dhgroup_name) 75 { 76 int i; 77 78 if (!dhgroup_name || !strlen(dhgroup_name)) 79 return NVME_AUTH_DHGROUP_INVALID; 80 for (i = 0; i < ARRAY_SIZE(dhgroup_map); i++) { 81 if (!strlen(dhgroup_map[i].name)) 82 continue; 83 if (!strncmp(dhgroup_map[i].name, dhgroup_name, 84 strlen(dhgroup_map[i].name))) 85 return i; 86 } 87 return NVME_AUTH_DHGROUP_INVALID; 88 } 89 EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_id); 90 91 static const struct nvme_dhchap_hash_map { 92 int len; 93 char hmac[15]; 94 char digest[8]; 95 } hash_map[] = { 96 [NVME_AUTH_HASH_SHA256] = { 97 .len = 32, 98 .hmac = "hmac(sha256)", 99 .digest = "sha256", 100 }, 101 [NVME_AUTH_HASH_SHA384] = { 102 .len = 48, 103 .hmac = "hmac(sha384)", 104 .digest = "sha384", 105 }, 106 [NVME_AUTH_HASH_SHA512] = { 107 .len = 64, 108 .hmac = "hmac(sha512)", 109 .digest = "sha512", 110 }, 111 }; 112 113 const char *nvme_auth_hmac_name(u8 hmac_id) 114 { 115 if (hmac_id >= ARRAY_SIZE(hash_map)) 116 return NULL; 117 return hash_map[hmac_id].hmac; 118 } 119 EXPORT_SYMBOL_GPL(nvme_auth_hmac_name); 120 121 const char *nvme_auth_digest_name(u8 hmac_id) 122 { 123 if (hmac_id >= ARRAY_SIZE(hash_map)) 124 return NULL; 125 return hash_map[hmac_id].digest; 126 } 127 EXPORT_SYMBOL_GPL(nvme_auth_digest_name); 128 129 u8 nvme_auth_hmac_id(const char *hmac_name) 130 { 131 int i; 132 133 if (!hmac_name || !strlen(hmac_name)) 134 return NVME_AUTH_HASH_INVALID; 135 136 for (i = 0; i < ARRAY_SIZE(hash_map); i++) { 137 if (!strlen(hash_map[i].hmac)) 138 continue; 139 if (!strncmp(hash_map[i].hmac, hmac_name, 140 strlen(hash_map[i].hmac))) 141 return i; 142 } 143 return NVME_AUTH_HASH_INVALID; 144 } 145 EXPORT_SYMBOL_GPL(nvme_auth_hmac_id); 146 147 size_t nvme_auth_hmac_hash_len(u8 hmac_id) 148 { 149 if (hmac_id >= ARRAY_SIZE(hash_map)) 150 return 0; 151 return hash_map[hmac_id].len; 152 } 153 EXPORT_SYMBOL_GPL(nvme_auth_hmac_hash_len); 154 155 u32 nvme_auth_key_struct_size(u32 key_len) 156 { 157 struct nvme_dhchap_key key; 158 159 return struct_size(&key, key, key_len); 160 } 161 EXPORT_SYMBOL_GPL(nvme_auth_key_struct_size); 162 163 struct nvme_dhchap_key *nvme_auth_extract_key(const char *secret, u8 key_hash) 164 { 165 struct nvme_dhchap_key *key; 166 const char *p; 167 u32 crc; 168 int ret, key_len; 169 size_t allocated_len = strlen(secret); 170 171 /* Secret might be affixed with a ':' */ 172 p = strrchr(secret, ':'); 173 if (p) 174 allocated_len = p - secret; 175 key = nvme_auth_alloc_key(allocated_len, 0); 176 if (!key) 177 return ERR_PTR(-ENOMEM); 178 179 key_len = base64_decode(secret, allocated_len, key->key, true, BASE64_STD); 180 if (key_len < 0) { 181 pr_debug("base64 key decoding error %d\n", 182 key_len); 183 ret = key_len; 184 goto out_free_key; 185 } 186 187 if (key_len != 36 && key_len != 52 && 188 key_len != 68) { 189 pr_err("Invalid key len %d\n", key_len); 190 ret = -EINVAL; 191 goto out_free_key; 192 } 193 194 /* The last four bytes is the CRC in little-endian format */ 195 key_len -= 4; 196 /* 197 * The linux implementation doesn't do pre- and post-increments, 198 * so we have to do it manually. 199 */ 200 crc = ~crc32(~0, key->key, key_len); 201 202 if (get_unaligned_le32(key->key + key_len) != crc) { 203 pr_err("key crc mismatch (key %08x, crc %08x)\n", 204 get_unaligned_le32(key->key + key_len), crc); 205 ret = -EKEYREJECTED; 206 goto out_free_key; 207 } 208 key->len = key_len; 209 key->hash = key_hash; 210 return key; 211 out_free_key: 212 nvme_auth_free_key(key); 213 return ERR_PTR(ret); 214 } 215 EXPORT_SYMBOL_GPL(nvme_auth_extract_key); 216 217 struct nvme_dhchap_key *nvme_auth_alloc_key(u32 len, u8 hash) 218 { 219 u32 num_bytes = nvme_auth_key_struct_size(len); 220 struct nvme_dhchap_key *key = kzalloc(num_bytes, GFP_KERNEL); 221 222 if (key) { 223 key->len = len; 224 key->hash = hash; 225 } 226 return key; 227 } 228 EXPORT_SYMBOL_GPL(nvme_auth_alloc_key); 229 230 void nvme_auth_free_key(struct nvme_dhchap_key *key) 231 { 232 if (!key) 233 return; 234 kfree_sensitive(key); 235 } 236 EXPORT_SYMBOL_GPL(nvme_auth_free_key); 237 238 /* 239 * Start computing an HMAC value, given the algorithm ID and raw key. 240 * 241 * The context should be zeroized at the end of its lifetime. The caller can do 242 * that implicitly by calling nvme_auth_hmac_final(), or explicitly (needed when 243 * a context is abandoned without finalizing it) by calling memzero_explicit(). 244 */ 245 int nvme_auth_hmac_init(struct nvme_auth_hmac_ctx *hmac, u8 hmac_id, 246 const u8 *key, size_t key_len) 247 { 248 hmac->hmac_id = hmac_id; 249 switch (hmac_id) { 250 case NVME_AUTH_HASH_SHA256: 251 hmac_sha256_init_usingrawkey(&hmac->sha256, key, key_len); 252 return 0; 253 case NVME_AUTH_HASH_SHA384: 254 hmac_sha384_init_usingrawkey(&hmac->sha384, key, key_len); 255 return 0; 256 case NVME_AUTH_HASH_SHA512: 257 hmac_sha512_init_usingrawkey(&hmac->sha512, key, key_len); 258 return 0; 259 } 260 pr_warn("%s: invalid hash algorithm %d\n", __func__, hmac_id); 261 return -EINVAL; 262 } 263 EXPORT_SYMBOL_GPL(nvme_auth_hmac_init); 264 265 void nvme_auth_hmac_update(struct nvme_auth_hmac_ctx *hmac, const u8 *data, 266 size_t data_len) 267 { 268 switch (hmac->hmac_id) { 269 case NVME_AUTH_HASH_SHA256: 270 hmac_sha256_update(&hmac->sha256, data, data_len); 271 return; 272 case NVME_AUTH_HASH_SHA384: 273 hmac_sha384_update(&hmac->sha384, data, data_len); 274 return; 275 case NVME_AUTH_HASH_SHA512: 276 hmac_sha512_update(&hmac->sha512, data, data_len); 277 return; 278 } 279 /* Unreachable because nvme_auth_hmac_init() validated hmac_id */ 280 WARN_ON_ONCE(1); 281 } 282 EXPORT_SYMBOL_GPL(nvme_auth_hmac_update); 283 284 /* Finish computing an HMAC value. Note that this zeroizes the HMAC context. */ 285 void nvme_auth_hmac_final(struct nvme_auth_hmac_ctx *hmac, u8 *out) 286 { 287 switch (hmac->hmac_id) { 288 case NVME_AUTH_HASH_SHA256: 289 hmac_sha256_final(&hmac->sha256, out); 290 return; 291 case NVME_AUTH_HASH_SHA384: 292 hmac_sha384_final(&hmac->sha384, out); 293 return; 294 case NVME_AUTH_HASH_SHA512: 295 hmac_sha512_final(&hmac->sha512, out); 296 return; 297 } 298 /* Unreachable because nvme_auth_hmac_init() validated hmac_id */ 299 WARN_ON_ONCE(1); 300 } 301 EXPORT_SYMBOL_GPL(nvme_auth_hmac_final); 302 303 struct nvme_dhchap_key *nvme_auth_transform_key( 304 const struct nvme_dhchap_key *key, const char *nqn) 305 { 306 const char *hmac_name; 307 struct crypto_shash *key_tfm; 308 SHASH_DESC_ON_STACK(shash, key_tfm); 309 struct nvme_dhchap_key *transformed_key; 310 int ret, key_len; 311 312 if (!key) { 313 pr_warn("No key specified\n"); 314 return ERR_PTR(-ENOKEY); 315 } 316 if (key->hash == 0) { 317 key_len = nvme_auth_key_struct_size(key->len); 318 transformed_key = kmemdup(key, key_len, GFP_KERNEL); 319 if (!transformed_key) 320 return ERR_PTR(-ENOMEM); 321 return transformed_key; 322 } 323 hmac_name = nvme_auth_hmac_name(key->hash); 324 if (!hmac_name) { 325 pr_warn("Invalid key hash id %d\n", key->hash); 326 return ERR_PTR(-EINVAL); 327 } 328 329 key_tfm = crypto_alloc_shash(hmac_name, 0, 0); 330 if (IS_ERR(key_tfm)) 331 return ERR_CAST(key_tfm); 332 333 key_len = crypto_shash_digestsize(key_tfm); 334 transformed_key = nvme_auth_alloc_key(key_len, key->hash); 335 if (!transformed_key) { 336 ret = -ENOMEM; 337 goto out_free_key; 338 } 339 340 shash->tfm = key_tfm; 341 ret = crypto_shash_setkey(key_tfm, key->key, key->len); 342 if (ret < 0) 343 goto out_free_transformed_key; 344 ret = crypto_shash_init(shash); 345 if (ret < 0) 346 goto out_free_transformed_key; 347 ret = crypto_shash_update(shash, nqn, strlen(nqn)); 348 if (ret < 0) 349 goto out_free_transformed_key; 350 ret = crypto_shash_update(shash, "NVMe-over-Fabrics", 17); 351 if (ret < 0) 352 goto out_free_transformed_key; 353 ret = crypto_shash_final(shash, transformed_key->key); 354 if (ret < 0) 355 goto out_free_transformed_key; 356 357 crypto_free_shash(key_tfm); 358 359 return transformed_key; 360 361 out_free_transformed_key: 362 nvme_auth_free_key(transformed_key); 363 out_free_key: 364 crypto_free_shash(key_tfm); 365 366 return ERR_PTR(ret); 367 } 368 EXPORT_SYMBOL_GPL(nvme_auth_transform_key); 369 370 static int nvme_auth_hash_skey(int hmac_id, const u8 *skey, size_t skey_len, 371 u8 *hkey) 372 { 373 const char *digest_name; 374 struct crypto_shash *tfm; 375 int ret; 376 377 digest_name = nvme_auth_digest_name(hmac_id); 378 if (!digest_name) { 379 pr_debug("%s: failed to get digest for %d\n", __func__, 380 hmac_id); 381 return -EINVAL; 382 } 383 tfm = crypto_alloc_shash(digest_name, 0, 0); 384 if (IS_ERR(tfm)) 385 return -ENOMEM; 386 387 ret = crypto_shash_tfm_digest(tfm, skey, skey_len, hkey); 388 if (ret < 0) 389 pr_debug("%s: Failed to hash digest len %zu\n", __func__, 390 skey_len); 391 392 crypto_free_shash(tfm); 393 return ret; 394 } 395 396 int nvme_auth_augmented_challenge(u8 hmac_id, const u8 *skey, size_t skey_len, 397 const u8 *challenge, u8 *aug, size_t hlen) 398 { 399 struct crypto_shash *tfm; 400 u8 *hashed_key; 401 const char *hmac_name; 402 int ret; 403 404 hashed_key = kmalloc(hlen, GFP_KERNEL); 405 if (!hashed_key) 406 return -ENOMEM; 407 408 ret = nvme_auth_hash_skey(hmac_id, skey, 409 skey_len, hashed_key); 410 if (ret < 0) 411 goto out_free_key; 412 413 hmac_name = nvme_auth_hmac_name(hmac_id); 414 if (!hmac_name) { 415 pr_warn("%s: invalid hash algorithm %d\n", 416 __func__, hmac_id); 417 ret = -EINVAL; 418 goto out_free_key; 419 } 420 421 tfm = crypto_alloc_shash(hmac_name, 0, 0); 422 if (IS_ERR(tfm)) { 423 ret = PTR_ERR(tfm); 424 goto out_free_key; 425 } 426 427 ret = crypto_shash_setkey(tfm, hashed_key, hlen); 428 if (ret) 429 goto out_free_hash; 430 431 ret = crypto_shash_tfm_digest(tfm, challenge, hlen, aug); 432 out_free_hash: 433 crypto_free_shash(tfm); 434 out_free_key: 435 kfree_sensitive(hashed_key); 436 return ret; 437 } 438 EXPORT_SYMBOL_GPL(nvme_auth_augmented_challenge); 439 440 int nvme_auth_gen_privkey(struct crypto_kpp *dh_tfm, u8 dh_gid) 441 { 442 int ret; 443 444 ret = crypto_kpp_set_secret(dh_tfm, NULL, 0); 445 if (ret) 446 pr_debug("failed to set private key, error %d\n", ret); 447 448 return ret; 449 } 450 EXPORT_SYMBOL_GPL(nvme_auth_gen_privkey); 451 452 int nvme_auth_gen_pubkey(struct crypto_kpp *dh_tfm, 453 u8 *host_key, size_t host_key_len) 454 { 455 struct kpp_request *req; 456 struct crypto_wait wait; 457 struct scatterlist dst; 458 int ret; 459 460 req = kpp_request_alloc(dh_tfm, GFP_KERNEL); 461 if (!req) 462 return -ENOMEM; 463 464 crypto_init_wait(&wait); 465 kpp_request_set_input(req, NULL, 0); 466 sg_init_one(&dst, host_key, host_key_len); 467 kpp_request_set_output(req, &dst, host_key_len); 468 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 469 crypto_req_done, &wait); 470 471 ret = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait); 472 kpp_request_free(req); 473 return ret; 474 } 475 EXPORT_SYMBOL_GPL(nvme_auth_gen_pubkey); 476 477 int nvme_auth_gen_shared_secret(struct crypto_kpp *dh_tfm, 478 const u8 *ctrl_key, size_t ctrl_key_len, 479 u8 *sess_key, size_t sess_key_len) 480 { 481 struct kpp_request *req; 482 struct crypto_wait wait; 483 struct scatterlist src, dst; 484 int ret; 485 486 req = kpp_request_alloc(dh_tfm, GFP_KERNEL); 487 if (!req) 488 return -ENOMEM; 489 490 crypto_init_wait(&wait); 491 sg_init_one(&src, ctrl_key, ctrl_key_len); 492 kpp_request_set_input(req, &src, ctrl_key_len); 493 sg_init_one(&dst, sess_key, sess_key_len); 494 kpp_request_set_output(req, &dst, sess_key_len); 495 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 496 crypto_req_done, &wait); 497 498 ret = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait); 499 500 kpp_request_free(req); 501 return ret; 502 } 503 EXPORT_SYMBOL_GPL(nvme_auth_gen_shared_secret); 504 505 int nvme_auth_parse_key(const char *secret, struct nvme_dhchap_key **ret_key) 506 { 507 struct nvme_dhchap_key *key; 508 u8 key_hash; 509 510 if (!secret) { 511 *ret_key = NULL; 512 return 0; 513 } 514 515 if (sscanf(secret, "DHHC-1:%hhd:%*s:", &key_hash) != 1) 516 return -EINVAL; 517 518 /* Pass in the secret without the 'DHHC-1:XX:' prefix */ 519 key = nvme_auth_extract_key(secret + 10, key_hash); 520 if (IS_ERR(key)) { 521 *ret_key = NULL; 522 return PTR_ERR(key); 523 } 524 525 *ret_key = key; 526 return 0; 527 } 528 EXPORT_SYMBOL_GPL(nvme_auth_parse_key); 529 530 /** 531 * nvme_auth_generate_psk - Generate a PSK for TLS 532 * @hmac_id: Hash function identifier 533 * @skey: Session key 534 * @skey_len: Length of @skey 535 * @c1: Value of challenge C1 536 * @c2: Value of challenge C2 537 * @hash_len: Hash length of the hash algorithm 538 * @ret_psk: Pointer to the resulting generated PSK 539 * @ret_len: length of @ret_psk 540 * 541 * Generate a PSK for TLS as specified in NVMe base specification, section 542 * 8.13.5.9: Generated PSK for TLS 543 * 544 * The generated PSK for TLS shall be computed applying the HMAC function 545 * using the hash function H( ) selected by the HashID parameter in the 546 * DH-HMAC-CHAP_Challenge message with the session key KS as key to the 547 * concatenation of the two challenges C1 and C2 (i.e., generated 548 * PSK = HMAC(KS, C1 || C2)). 549 * 550 * Returns 0 on success with a valid generated PSK pointer in @ret_psk and 551 * the length of @ret_psk in @ret_len, or a negative error number otherwise. 552 */ 553 int nvme_auth_generate_psk(u8 hmac_id, const u8 *skey, size_t skey_len, 554 const u8 *c1, const u8 *c2, size_t hash_len, 555 u8 **ret_psk, size_t *ret_len) 556 { 557 struct crypto_shash *tfm; 558 SHASH_DESC_ON_STACK(shash, tfm); 559 u8 *psk; 560 const char *hmac_name; 561 int ret, psk_len; 562 563 if (!c1 || !c2) 564 return -EINVAL; 565 566 hmac_name = nvme_auth_hmac_name(hmac_id); 567 if (!hmac_name) { 568 pr_warn("%s: invalid hash algorithm %d\n", 569 __func__, hmac_id); 570 return -EINVAL; 571 } 572 573 tfm = crypto_alloc_shash(hmac_name, 0, 0); 574 if (IS_ERR(tfm)) 575 return PTR_ERR(tfm); 576 577 psk_len = crypto_shash_digestsize(tfm); 578 psk = kzalloc(psk_len, GFP_KERNEL); 579 if (!psk) { 580 ret = -ENOMEM; 581 goto out_free_tfm; 582 } 583 584 shash->tfm = tfm; 585 ret = crypto_shash_setkey(tfm, skey, skey_len); 586 if (ret) 587 goto out_free_psk; 588 589 ret = crypto_shash_init(shash); 590 if (ret) 591 goto out_free_psk; 592 593 ret = crypto_shash_update(shash, c1, hash_len); 594 if (ret) 595 goto out_free_psk; 596 597 ret = crypto_shash_update(shash, c2, hash_len); 598 if (ret) 599 goto out_free_psk; 600 601 ret = crypto_shash_final(shash, psk); 602 if (!ret) { 603 *ret_psk = psk; 604 *ret_len = psk_len; 605 } 606 607 out_free_psk: 608 if (ret) 609 kfree_sensitive(psk); 610 out_free_tfm: 611 crypto_free_shash(tfm); 612 613 return ret; 614 } 615 EXPORT_SYMBOL_GPL(nvme_auth_generate_psk); 616 617 /** 618 * nvme_auth_generate_digest - Generate TLS PSK digest 619 * @hmac_id: Hash function identifier 620 * @psk: Generated input PSK 621 * @psk_len: Length of @psk 622 * @subsysnqn: NQN of the subsystem 623 * @hostnqn: NQN of the host 624 * @ret_digest: Pointer to the returned digest 625 * 626 * Generate a TLS PSK digest as specified in TP8018 Section 3.6.1.3: 627 * TLS PSK and PSK identity Derivation 628 * 629 * The PSK digest shall be computed by encoding in Base64 (refer to RFC 630 * 4648) the result of the application of the HMAC function using the hash 631 * function specified in item 4 above (ie the hash function of the cipher 632 * suite associated with the PSK identity) with the PSK as HMAC key to the 633 * concatenation of: 634 * - the NQN of the host (i.e., NQNh) not including the null terminator; 635 * - a space character; 636 * - the NQN of the NVM subsystem (i.e., NQNc) not including the null 637 * terminator; 638 * - a space character; and 639 * - the seventeen ASCII characters "NVMe-over-Fabrics" 640 * (i.e., <PSK digest> = Base64(HMAC(PSK, NQNh || " " || NQNc || " " || 641 * "NVMe-over-Fabrics"))). 642 * The length of the PSK digest depends on the hash function used to compute 643 * it as follows: 644 * - If the SHA-256 hash function is used, the resulting PSK digest is 44 645 * characters long; or 646 * - If the SHA-384 hash function is used, the resulting PSK digest is 64 647 * characters long. 648 * 649 * Returns 0 on success with a valid digest pointer in @ret_digest, or a 650 * negative error number on failure. 651 */ 652 int nvme_auth_generate_digest(u8 hmac_id, const u8 *psk, size_t psk_len, 653 const char *subsysnqn, const char *hostnqn, 654 char **ret_digest) 655 { 656 struct crypto_shash *tfm; 657 SHASH_DESC_ON_STACK(shash, tfm); 658 u8 *digest; 659 char *enc; 660 const char *hmac_name; 661 size_t digest_len, hmac_len; 662 int ret; 663 664 if (WARN_ON(!subsysnqn || !hostnqn)) 665 return -EINVAL; 666 667 hmac_name = nvme_auth_hmac_name(hmac_id); 668 if (!hmac_name) { 669 pr_warn("%s: invalid hash algorithm %d\n", 670 __func__, hmac_id); 671 return -EINVAL; 672 } 673 674 switch (nvme_auth_hmac_hash_len(hmac_id)) { 675 case 32: 676 hmac_len = 44; 677 break; 678 case 48: 679 hmac_len = 64; 680 break; 681 default: 682 pr_warn("%s: invalid hash algorithm '%s'\n", 683 __func__, hmac_name); 684 return -EINVAL; 685 } 686 687 enc = kzalloc(hmac_len + 1, GFP_KERNEL); 688 if (!enc) 689 return -ENOMEM; 690 691 tfm = crypto_alloc_shash(hmac_name, 0, 0); 692 if (IS_ERR(tfm)) { 693 ret = PTR_ERR(tfm); 694 goto out_free_enc; 695 } 696 697 digest_len = crypto_shash_digestsize(tfm); 698 digest = kzalloc(digest_len, GFP_KERNEL); 699 if (!digest) { 700 ret = -ENOMEM; 701 goto out_free_tfm; 702 } 703 704 shash->tfm = tfm; 705 ret = crypto_shash_setkey(tfm, psk, psk_len); 706 if (ret) 707 goto out_free_digest; 708 709 ret = crypto_shash_init(shash); 710 if (ret) 711 goto out_free_digest; 712 713 ret = crypto_shash_update(shash, hostnqn, strlen(hostnqn)); 714 if (ret) 715 goto out_free_digest; 716 717 ret = crypto_shash_update(shash, " ", 1); 718 if (ret) 719 goto out_free_digest; 720 721 ret = crypto_shash_update(shash, subsysnqn, strlen(subsysnqn)); 722 if (ret) 723 goto out_free_digest; 724 725 ret = crypto_shash_update(shash, " NVMe-over-Fabrics", 18); 726 if (ret) 727 goto out_free_digest; 728 729 ret = crypto_shash_final(shash, digest); 730 if (ret) 731 goto out_free_digest; 732 733 ret = base64_encode(digest, digest_len, enc, true, BASE64_STD); 734 if (ret < hmac_len) { 735 ret = -ENOKEY; 736 goto out_free_digest; 737 } 738 *ret_digest = enc; 739 ret = 0; 740 741 out_free_digest: 742 kfree_sensitive(digest); 743 out_free_tfm: 744 crypto_free_shash(tfm); 745 out_free_enc: 746 if (ret) 747 kfree_sensitive(enc); 748 749 return ret; 750 } 751 EXPORT_SYMBOL_GPL(nvme_auth_generate_digest); 752 753 /** 754 * hkdf_expand_label - HKDF-Expand-Label (RFC 8846 section 7.1) 755 * @hmac_tfm: hash context keyed with pseudorandom key 756 * @label: ASCII label without "tls13 " prefix 757 * @labellen: length of @label 758 * @context: context bytes 759 * @contextlen: length of @context 760 * @okm: output keying material 761 * @okmlen: length of @okm 762 * 763 * Build the TLS 1.3 HkdfLabel structure and invoke hkdf_expand(). 764 * 765 * Returns 0 on success with output keying material stored in @okm, 766 * or a negative errno value otherwise. 767 */ 768 static int hkdf_expand_label(struct crypto_shash *hmac_tfm, 769 const u8 *label, unsigned int labellen, 770 const u8 *context, unsigned int contextlen, 771 u8 *okm, unsigned int okmlen) 772 { 773 int err; 774 u8 *info; 775 unsigned int infolen; 776 const char *tls13_prefix = "tls13 "; 777 unsigned int prefixlen = strlen(tls13_prefix); 778 779 if (WARN_ON(labellen > (255 - prefixlen))) 780 return -EINVAL; 781 if (WARN_ON(contextlen > 255)) 782 return -EINVAL; 783 784 infolen = 2 + (1 + prefixlen + labellen) + (1 + contextlen); 785 info = kzalloc(infolen, GFP_KERNEL); 786 if (!info) 787 return -ENOMEM; 788 789 /* HkdfLabel.Length */ 790 put_unaligned_be16(okmlen, info); 791 792 /* HkdfLabel.Label */ 793 info[2] = prefixlen + labellen; 794 memcpy(info + 3, tls13_prefix, prefixlen); 795 memcpy(info + 3 + prefixlen, label, labellen); 796 797 /* HkdfLabel.Context */ 798 info[3 + prefixlen + labellen] = contextlen; 799 memcpy(info + 4 + prefixlen + labellen, context, contextlen); 800 801 err = hkdf_expand(hmac_tfm, info, infolen, okm, okmlen); 802 kfree_sensitive(info); 803 return err; 804 } 805 806 /** 807 * nvme_auth_derive_tls_psk - Derive TLS PSK 808 * @hmac_id: Hash function identifier 809 * @psk: generated input PSK 810 * @psk_len: size of @psk 811 * @psk_digest: TLS PSK digest 812 * @ret_psk: Pointer to the resulting TLS PSK 813 * 814 * Derive a TLS PSK as specified in TP8018 Section 3.6.1.3: 815 * TLS PSK and PSK identity Derivation 816 * 817 * The TLS PSK shall be derived as follows from an input PSK 818 * (i.e., either a retained PSK or a generated PSK) and a PSK 819 * identity using the HKDF-Extract and HKDF-Expand-Label operations 820 * (refer to RFC 5869 and RFC 8446) where the hash function is the 821 * one specified by the hash specifier of the PSK identity: 822 * 1. PRK = HKDF-Extract(0, Input PSK); and 823 * 2. TLS PSK = HKDF-Expand-Label(PRK, "nvme-tls-psk", PskIdentityContext, L), 824 * where PskIdentityContext is the hash identifier indicated in 825 * the PSK identity concatenated to a space character and to the 826 * Base64 PSK digest (i.e., "<hash> <PSK digest>") and L is the 827 * output size in bytes of the hash function (i.e., 32 for SHA-256 828 * and 48 for SHA-384). 829 * 830 * Returns 0 on success with a valid psk pointer in @ret_psk or a negative 831 * error number otherwise. 832 */ 833 int nvme_auth_derive_tls_psk(int hmac_id, const u8 *psk, size_t psk_len, 834 const char *psk_digest, u8 **ret_psk) 835 { 836 struct crypto_shash *hmac_tfm; 837 const char *hmac_name; 838 const char *label = "nvme-tls-psk"; 839 static const u8 default_salt[NVME_AUTH_MAX_DIGEST_SIZE]; 840 size_t prk_len; 841 const char *ctx; 842 u8 *prk, *tls_key; 843 int ret; 844 845 hmac_name = nvme_auth_hmac_name(hmac_id); 846 if (!hmac_name) { 847 pr_warn("%s: invalid hash algorithm %d\n", 848 __func__, hmac_id); 849 return -EINVAL; 850 } 851 if (hmac_id == NVME_AUTH_HASH_SHA512) { 852 pr_warn("%s: unsupported hash algorithm %s\n", 853 __func__, hmac_name); 854 return -EINVAL; 855 } 856 857 if (psk_len != nvme_auth_hmac_hash_len(hmac_id)) { 858 pr_warn("%s: unexpected psk_len %zu\n", __func__, psk_len); 859 return -EINVAL; 860 } 861 862 hmac_tfm = crypto_alloc_shash(hmac_name, 0, 0); 863 if (IS_ERR(hmac_tfm)) 864 return PTR_ERR(hmac_tfm); 865 866 prk_len = crypto_shash_digestsize(hmac_tfm); 867 prk = kzalloc(prk_len, GFP_KERNEL); 868 if (!prk) { 869 ret = -ENOMEM; 870 goto out_free_shash; 871 } 872 873 if (WARN_ON(prk_len > NVME_AUTH_MAX_DIGEST_SIZE)) { 874 ret = -EINVAL; 875 goto out_free_prk; 876 } 877 ret = hkdf_extract(hmac_tfm, psk, psk_len, 878 default_salt, prk_len, prk); 879 if (ret) 880 goto out_free_prk; 881 882 ret = crypto_shash_setkey(hmac_tfm, prk, prk_len); 883 if (ret) 884 goto out_free_prk; 885 886 ctx = kasprintf(GFP_KERNEL, "%02d %s", hmac_id, psk_digest); 887 if (!ctx) { 888 ret = -ENOMEM; 889 goto out_free_prk; 890 } 891 892 tls_key = kzalloc(psk_len, GFP_KERNEL); 893 if (!tls_key) { 894 ret = -ENOMEM; 895 goto out_free_ctx; 896 } 897 ret = hkdf_expand_label(hmac_tfm, 898 label, strlen(label), 899 ctx, strlen(ctx), 900 tls_key, psk_len); 901 if (ret) { 902 kfree(tls_key); 903 goto out_free_ctx; 904 } 905 *ret_psk = tls_key; 906 907 out_free_ctx: 908 kfree(ctx); 909 out_free_prk: 910 kfree(prk); 911 out_free_shash: 912 crypto_free_shash(hmac_tfm); 913 914 return ret; 915 } 916 EXPORT_SYMBOL_GPL(nvme_auth_derive_tls_psk); 917 918 MODULE_DESCRIPTION("NVMe Authentication framework"); 919 MODULE_LICENSE("GPL v2"); 920