1
2
3
4
5
6
7
8
9
10
11
12
13
14
15#include <crypto/hash.h>
16#include <linux/slab.h>
17#include <linux/types.h>
18#include <linux/scatterlist.h>
19#include <net/sctp/sctp.h>
20#include <net/sctp/auth.h>
21
22static struct sctp_hmac sctp_hmac_list[SCTP_AUTH_NUM_HMACS] = {
23 {
24
25 .hmac_id = SCTP_AUTH_HMAC_ID_RESERVED_0,
26 },
27 {
28 .hmac_id = SCTP_AUTH_HMAC_ID_SHA1,
29 .hmac_name = "hmac(sha1)",
30 .hmac_len = SCTP_SHA1_SIG_SIZE,
31 },
32 {
33
34 .hmac_id = SCTP_AUTH_HMAC_ID_RESERVED_2,
35 },
36#if IS_ENABLED(CONFIG_CRYPTO_SHA256)
37 {
38 .hmac_id = SCTP_AUTH_HMAC_ID_SHA256,
39 .hmac_name = "hmac(sha256)",
40 .hmac_len = SCTP_SHA256_SIG_SIZE,
41 }
42#endif
43};
44
45
46void sctp_auth_key_put(struct sctp_auth_bytes *key)
47{
48 if (!key)
49 return;
50
51 if (refcount_dec_and_test(&key->refcnt)) {
52 kzfree(key);
53 SCTP_DBG_OBJCNT_DEC(keys);
54 }
55}
56
57
58static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
59{
60 struct sctp_auth_bytes *key;
61
62
63 if (key_len > (INT_MAX - sizeof(struct sctp_auth_bytes)))
64 return NULL;
65
66
67 key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp);
68 if (!key)
69 return NULL;
70
71 key->len = key_len;
72 refcount_set(&key->refcnt, 1);
73 SCTP_DBG_OBJCNT_INC(keys);
74
75 return key;
76}
77
78
79struct sctp_shared_key *sctp_auth_shkey_create(__u16 key_id, gfp_t gfp)
80{
81 struct sctp_shared_key *new;
82
83
84 new = kzalloc(sizeof(struct sctp_shared_key), gfp);
85 if (!new)
86 return NULL;
87
88 INIT_LIST_HEAD(&new->key_list);
89 refcount_set(&new->refcnt, 1);
90 new->key_id = key_id;
91
92 return new;
93}
94
95
96static void sctp_auth_shkey_destroy(struct sctp_shared_key *sh_key)
97{
98 BUG_ON(!list_empty(&sh_key->key_list));
99 sctp_auth_key_put(sh_key->key);
100 sh_key->key = NULL;
101 kfree(sh_key);
102}
103
104void sctp_auth_shkey_release(struct sctp_shared_key *sh_key)
105{
106 if (refcount_dec_and_test(&sh_key->refcnt))
107 sctp_auth_shkey_destroy(sh_key);
108}
109
110void sctp_auth_shkey_hold(struct sctp_shared_key *sh_key)
111{
112 refcount_inc(&sh_key->refcnt);
113}
114
115
116
117
118void sctp_auth_destroy_keys(struct list_head *keys)
119{
120 struct sctp_shared_key *ep_key;
121 struct sctp_shared_key *tmp;
122
123 if (list_empty(keys))
124 return;
125
126 key_for_each_safe(ep_key, tmp, keys) {
127 list_del_init(&ep_key->key_list);
128 sctp_auth_shkey_release(ep_key);
129 }
130}
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148static int sctp_auth_compare_vectors(struct sctp_auth_bytes *vector1,
149 struct sctp_auth_bytes *vector2)
150{
151 int diff;
152 int i;
153 const __u8 *longer;
154
155 diff = vector1->len - vector2->len;
156 if (diff) {
157 longer = (diff > 0) ? vector1->data : vector2->data;
158
159
160
161
162
163 for (i = 0; i < abs(diff); i++) {
164 if (longer[i] != 0)
165 return diff;
166 }
167 }
168
169
170 return memcmp(vector1->data, vector2->data, vector1->len);
171}
172
173
174
175
176
177
178
179
180
181
182
183
184static struct sctp_auth_bytes *sctp_auth_make_key_vector(
185 struct sctp_random_param *random,
186 struct sctp_chunks_param *chunks,
187 struct sctp_hmac_algo_param *hmacs,
188 gfp_t gfp)
189{
190 struct sctp_auth_bytes *new;
191 __u32 len;
192 __u32 offset = 0;
193 __u16 random_len, hmacs_len, chunks_len = 0;
194
195 random_len = ntohs(random->param_hdr.length);
196 hmacs_len = ntohs(hmacs->param_hdr.length);
197 if (chunks)
198 chunks_len = ntohs(chunks->param_hdr.length);
199
200 len = random_len + hmacs_len + chunks_len;
201
202 new = sctp_auth_create_key(len, gfp);
203 if (!new)
204 return NULL;
205
206 memcpy(new->data, random, random_len);
207 offset += random_len;
208
209 if (chunks) {
210 memcpy(new->data + offset, chunks, chunks_len);
211 offset += chunks_len;
212 }
213
214 memcpy(new->data + offset, hmacs, hmacs_len);
215
216 return new;
217}
218
219
220
221static struct sctp_auth_bytes *sctp_auth_make_local_vector(
222 const struct sctp_association *asoc,
223 gfp_t gfp)
224{
225 return sctp_auth_make_key_vector(
226 (struct sctp_random_param *)asoc->c.auth_random,
227 (struct sctp_chunks_param *)asoc->c.auth_chunks,
228 (struct sctp_hmac_algo_param *)asoc->c.auth_hmacs, gfp);
229}
230
231
232static struct sctp_auth_bytes *sctp_auth_make_peer_vector(
233 const struct sctp_association *asoc,
234 gfp_t gfp)
235{
236 return sctp_auth_make_key_vector(asoc->peer.peer_random,
237 asoc->peer.peer_chunks,
238 asoc->peer.peer_hmacs,
239 gfp);
240}
241
242
243
244
245
246
247
248
249
250
251
252static struct sctp_auth_bytes *sctp_auth_asoc_set_secret(
253 struct sctp_shared_key *ep_key,
254 struct sctp_auth_bytes *first_vector,
255 struct sctp_auth_bytes *last_vector,
256 gfp_t gfp)
257{
258 struct sctp_auth_bytes *secret;
259 __u32 offset = 0;
260 __u32 auth_len;
261
262 auth_len = first_vector->len + last_vector->len;
263 if (ep_key->key)
264 auth_len += ep_key->key->len;
265
266 secret = sctp_auth_create_key(auth_len, gfp);
267 if (!secret)
268 return NULL;
269
270 if (ep_key->key) {
271 memcpy(secret->data, ep_key->key->data, ep_key->key->len);
272 offset += ep_key->key->len;
273 }
274
275 memcpy(secret->data + offset, first_vector->data, first_vector->len);
276 offset += first_vector->len;
277
278 memcpy(secret->data + offset, last_vector->data, last_vector->len);
279
280 return secret;
281}
282
283
284
285
286static struct sctp_auth_bytes *sctp_auth_asoc_create_secret(
287 const struct sctp_association *asoc,
288 struct sctp_shared_key *ep_key,
289 gfp_t gfp)
290{
291 struct sctp_auth_bytes *local_key_vector;
292 struct sctp_auth_bytes *peer_key_vector;
293 struct sctp_auth_bytes *first_vector,
294 *last_vector;
295 struct sctp_auth_bytes *secret = NULL;
296 int cmp;
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311 local_key_vector = sctp_auth_make_local_vector(asoc, gfp);
312 peer_key_vector = sctp_auth_make_peer_vector(asoc, gfp);
313
314 if (!peer_key_vector || !local_key_vector)
315 goto out;
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330 cmp = sctp_auth_compare_vectors(local_key_vector,
331 peer_key_vector);
332 if (cmp < 0) {
333 first_vector = local_key_vector;
334 last_vector = peer_key_vector;
335 } else {
336 first_vector = peer_key_vector;
337 last_vector = local_key_vector;
338 }
339
340 secret = sctp_auth_asoc_set_secret(ep_key, first_vector, last_vector,
341 gfp);
342out:
343 sctp_auth_key_put(local_key_vector);
344 sctp_auth_key_put(peer_key_vector);
345
346 return secret;
347}
348
349
350
351
352
353int sctp_auth_asoc_copy_shkeys(const struct sctp_endpoint *ep,
354 struct sctp_association *asoc,
355 gfp_t gfp)
356{
357 struct sctp_shared_key *sh_key;
358 struct sctp_shared_key *new;
359
360 BUG_ON(!list_empty(&asoc->endpoint_shared_keys));
361
362 key_for_each(sh_key, &ep->endpoint_shared_keys) {
363 new = sctp_auth_shkey_create(sh_key->key_id, gfp);
364 if (!new)
365 goto nomem;
366
367 new->key = sh_key->key;
368 sctp_auth_key_hold(new->key);
369 list_add(&new->key_list, &asoc->endpoint_shared_keys);
370 }
371
372 return 0;
373
374nomem:
375 sctp_auth_destroy_keys(&asoc->endpoint_shared_keys);
376 return -ENOMEM;
377}
378
379
380
381
382
383int sctp_auth_asoc_init_active_key(struct sctp_association *asoc, gfp_t gfp)
384{
385 struct sctp_auth_bytes *secret;
386 struct sctp_shared_key *ep_key;
387 struct sctp_chunk *chunk;
388
389
390
391
392 if (!asoc->peer.auth_capable)
393 return 0;
394
395
396
397
398
399
400 ep_key = sctp_auth_get_shkey(asoc, asoc->active_key_id);
401 BUG_ON(!ep_key);
402
403 secret = sctp_auth_asoc_create_secret(asoc, ep_key, gfp);
404 if (!secret)
405 return -ENOMEM;
406
407 sctp_auth_key_put(asoc->asoc_shared_key);
408 asoc->asoc_shared_key = secret;
409 asoc->shkey = ep_key;
410
411
412
413
414 list_for_each_entry(chunk, &asoc->outqueue.out_chunk_list, list) {
415 if (sctp_auth_send_cid(chunk->chunk_hdr->type, asoc)) {
416 chunk->auth = 1;
417 if (!chunk->shkey) {
418 chunk->shkey = asoc->shkey;
419 sctp_auth_shkey_hold(chunk->shkey);
420 }
421 }
422 }
423
424 return 0;
425}
426
427
428
429struct sctp_shared_key *sctp_auth_get_shkey(
430 const struct sctp_association *asoc,
431 __u16 key_id)
432{
433 struct sctp_shared_key *key;
434
435
436 key_for_each(key, &asoc->endpoint_shared_keys) {
437 if (key->key_id == key_id) {
438 if (!key->deactivated)
439 return key;
440 break;
441 }
442 }
443
444 return NULL;
445}
446
447
448
449
450
451
452
453
454int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
455{
456 struct crypto_shash *tfm = NULL;
457 __u16 id;
458
459
460 if (ep->auth_hmacs)
461 return 0;
462
463
464 ep->auth_hmacs = kcalloc(SCTP_AUTH_NUM_HMACS,
465 sizeof(struct crypto_shash *),
466 gfp);
467 if (!ep->auth_hmacs)
468 return -ENOMEM;
469
470 for (id = 0; id < SCTP_AUTH_NUM_HMACS; id++) {
471
472
473
474
475
476
477 if (!sctp_hmac_list[id].hmac_name)
478 continue;
479
480
481 if (ep->auth_hmacs[id])
482 continue;
483
484
485 tfm = crypto_alloc_shash(sctp_hmac_list[id].hmac_name, 0, 0);
486 if (IS_ERR(tfm))
487 goto out_err;
488
489 ep->auth_hmacs[id] = tfm;
490 }
491
492 return 0;
493
494out_err:
495
496 sctp_auth_destroy_hmacs(ep->auth_hmacs);
497 return -ENOMEM;
498}
499
500
501void sctp_auth_destroy_hmacs(struct crypto_shash *auth_hmacs[])
502{
503 int i;
504
505 if (!auth_hmacs)
506 return;
507
508 for (i = 0; i < SCTP_AUTH_NUM_HMACS; i++) {
509 crypto_free_shash(auth_hmacs[i]);
510 }
511 kfree(auth_hmacs);
512}
513
514
515struct sctp_hmac *sctp_auth_get_hmac(__u16 hmac_id)
516{
517 return &sctp_hmac_list[hmac_id];
518}
519
520
521
522
523struct sctp_hmac *sctp_auth_asoc_get_hmac(const struct sctp_association *asoc)
524{
525 struct sctp_hmac_algo_param *hmacs;
526 __u16 n_elt;
527 __u16 id = 0;
528 int i;
529
530
531 if (asoc->default_hmac_id)
532 return &sctp_hmac_list[asoc->default_hmac_id];
533
534
535
536
537 hmacs = asoc->peer.peer_hmacs;
538 if (!hmacs)
539 return NULL;
540
541 n_elt = (ntohs(hmacs->param_hdr.length) -
542 sizeof(struct sctp_paramhdr)) >> 1;
543 for (i = 0; i < n_elt; i++) {
544 id = ntohs(hmacs->hmac_ids[i]);
545
546
547
548
549
550
551
552 if (id > SCTP_AUTH_HMAC_ID_MAX ||
553 !sctp_hmac_list[id].hmac_name) {
554 id = 0;
555 continue;
556 }
557
558 break;
559 }
560
561 if (id == 0)
562 return NULL;
563
564 return &sctp_hmac_list[id];
565}
566
567static int __sctp_auth_find_hmacid(__be16 *hmacs, int n_elts, __be16 hmac_id)
568{
569 int found = 0;
570 int i;
571
572 for (i = 0; i < n_elts; i++) {
573 if (hmac_id == hmacs[i]) {
574 found = 1;
575 break;
576 }
577 }
578
579 return found;
580}
581
582
583int sctp_auth_asoc_verify_hmac_id(const struct sctp_association *asoc,
584 __be16 hmac_id)
585{
586 struct sctp_hmac_algo_param *hmacs;
587 __u16 n_elt;
588
589 if (!asoc)
590 return 0;
591
592 hmacs = (struct sctp_hmac_algo_param *)asoc->c.auth_hmacs;
593 n_elt = (ntohs(hmacs->param_hdr.length) -
594 sizeof(struct sctp_paramhdr)) >> 1;
595
596 return __sctp_auth_find_hmacid(hmacs->hmac_ids, n_elt, hmac_id);
597}
598
599
600
601
602
603
604
605void sctp_auth_asoc_set_default_hmac(struct sctp_association *asoc,
606 struct sctp_hmac_algo_param *hmacs)
607{
608 struct sctp_endpoint *ep;
609 __u16 id;
610 int i;
611 int n_params;
612
613
614 if (asoc->default_hmac_id)
615 return;
616
617 n_params = (ntohs(hmacs->param_hdr.length) -
618 sizeof(struct sctp_paramhdr)) >> 1;
619 ep = asoc->ep;
620 for (i = 0; i < n_params; i++) {
621 id = ntohs(hmacs->hmac_ids[i]);
622
623
624 if (id > SCTP_AUTH_HMAC_ID_MAX)
625 continue;
626
627
628 if (ep->auth_hmacs[id]) {
629 asoc->default_hmac_id = id;
630 break;
631 }
632 }
633}
634
635
636
637static int __sctp_auth_cid(enum sctp_cid chunk, struct sctp_chunks_param *param)
638{
639 unsigned short len;
640 int found = 0;
641 int i;
642
643 if (!param || param->param_hdr.length == 0)
644 return 0;
645
646 len = ntohs(param->param_hdr.length) - sizeof(struct sctp_paramhdr);
647
648
649
650
651
652
653
654 for (i = 0; !found && i < len; i++) {
655 switch (param->chunks[i]) {
656 case SCTP_CID_INIT:
657 case SCTP_CID_INIT_ACK:
658 case SCTP_CID_SHUTDOWN_COMPLETE:
659 case SCTP_CID_AUTH:
660 break;
661
662 default:
663 if (param->chunks[i] == chunk)
664 found = 1;
665 break;
666 }
667 }
668
669 return found;
670}
671
672
673int sctp_auth_send_cid(enum sctp_cid chunk, const struct sctp_association *asoc)
674{
675 if (!asoc)
676 return 0;
677
678 if (!asoc->peer.auth_capable)
679 return 0;
680
681 return __sctp_auth_cid(chunk, asoc->peer.peer_chunks);
682}
683
684
685int sctp_auth_recv_cid(enum sctp_cid chunk, const struct sctp_association *asoc)
686{
687 if (!asoc)
688 return 0;
689
690 if (!asoc->peer.auth_capable)
691 return 0;
692
693 return __sctp_auth_cid(chunk,
694 (struct sctp_chunks_param *)asoc->c.auth_chunks);
695}
696
697
698
699
700
701
702
703
704
705
706void sctp_auth_calculate_hmac(const struct sctp_association *asoc,
707 struct sk_buff *skb, struct sctp_auth_chunk *auth,
708 struct sctp_shared_key *ep_key, gfp_t gfp)
709{
710 struct sctp_auth_bytes *asoc_key;
711 struct crypto_shash *tfm;
712 __u16 key_id, hmac_id;
713 unsigned char *end;
714 int free_key = 0;
715 __u8 *digest;
716
717
718
719
720
721 key_id = ntohs(auth->auth_hdr.shkey_id);
722 hmac_id = ntohs(auth->auth_hdr.hmac_id);
723
724 if (key_id == asoc->active_key_id)
725 asoc_key = asoc->asoc_shared_key;
726 else {
727
728 asoc_key = sctp_auth_asoc_create_secret(asoc, ep_key, gfp);
729 if (!asoc_key)
730 return;
731
732 free_key = 1;
733 }
734
735
736 end = skb_tail_pointer(skb);
737
738 tfm = asoc->ep->auth_hmacs[hmac_id];
739
740 digest = auth->auth_hdr.hmac;
741 if (crypto_shash_setkey(tfm, &asoc_key->data[0], asoc_key->len))
742 goto free;
743
744 crypto_shash_tfm_digest(tfm, (u8 *)auth, end - (unsigned char *)auth,
745 digest);
746
747free:
748 if (free_key)
749 sctp_auth_key_put(asoc_key);
750}
751
752
753
754
755int sctp_auth_ep_add_chunkid(struct sctp_endpoint *ep, __u8 chunk_id)
756{
757 struct sctp_chunks_param *p = ep->auth_chunk_list;
758 __u16 nchunks;
759 __u16 param_len;
760
761
762 if (__sctp_auth_cid(chunk_id, p))
763 return 0;
764
765
766 param_len = ntohs(p->param_hdr.length);
767 nchunks = param_len - sizeof(struct sctp_paramhdr);
768 if (nchunks == SCTP_NUM_CHUNK_TYPES)
769 return -EINVAL;
770
771 p->chunks[nchunks] = chunk_id;
772 p->param_hdr.length = htons(param_len + 1);
773 return 0;
774}
775
776
777int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
778 struct sctp_hmacalgo *hmacs)
779{
780 int has_sha1 = 0;
781 __u16 id;
782 int i;
783
784
785
786
787 for (i = 0; i < hmacs->shmac_num_idents; i++) {
788 id = hmacs->shmac_idents[i];
789
790 if (id > SCTP_AUTH_HMAC_ID_MAX)
791 return -EOPNOTSUPP;
792
793 if (SCTP_AUTH_HMAC_ID_SHA1 == id)
794 has_sha1 = 1;
795
796 if (!sctp_hmac_list[id].hmac_name)
797 return -EOPNOTSUPP;
798 }
799
800 if (!has_sha1)
801 return -EINVAL;
802
803 for (i = 0; i < hmacs->shmac_num_idents; i++)
804 ep->auth_hmacs_list->hmac_ids[i] =
805 htons(hmacs->shmac_idents[i]);
806 ep->auth_hmacs_list->param_hdr.length =
807 htons(sizeof(struct sctp_paramhdr) +
808 hmacs->shmac_num_idents * sizeof(__u16));
809 return 0;
810}
811
812
813
814
815
816int sctp_auth_set_key(struct sctp_endpoint *ep,
817 struct sctp_association *asoc,
818 struct sctp_authkey *auth_key)
819{
820 struct sctp_shared_key *cur_key, *shkey;
821 struct sctp_auth_bytes *key;
822 struct list_head *sh_keys;
823 int replace = 0;
824
825
826
827
828 if (asoc) {
829 if (!asoc->peer.auth_capable)
830 return -EACCES;
831 sh_keys = &asoc->endpoint_shared_keys;
832 } else {
833 if (!ep->auth_enable)
834 return -EACCES;
835 sh_keys = &ep->endpoint_shared_keys;
836 }
837
838 key_for_each(shkey, sh_keys) {
839 if (shkey->key_id == auth_key->sca_keynumber) {
840 replace = 1;
841 break;
842 }
843 }
844
845 cur_key = sctp_auth_shkey_create(auth_key->sca_keynumber, GFP_KERNEL);
846 if (!cur_key)
847 return -ENOMEM;
848
849
850 key = sctp_auth_create_key(auth_key->sca_keylength, GFP_KERNEL);
851 if (!key) {
852 kfree(cur_key);
853 return -ENOMEM;
854 }
855
856 memcpy(key->data, &auth_key->sca_key[0], auth_key->sca_keylength);
857 cur_key->key = key;
858
859 if (replace) {
860 list_del_init(&shkey->key_list);
861 sctp_auth_shkey_release(shkey);
862 }
863 list_add(&cur_key->key_list, sh_keys);
864
865 return 0;
866}
867
868int sctp_auth_set_active_key(struct sctp_endpoint *ep,
869 struct sctp_association *asoc,
870 __u16 key_id)
871{
872 struct sctp_shared_key *key;
873 struct list_head *sh_keys;
874 int found = 0;
875
876
877 if (asoc) {
878 if (!asoc->peer.auth_capable)
879 return -EACCES;
880 sh_keys = &asoc->endpoint_shared_keys;
881 } else {
882 if (!ep->auth_enable)
883 return -EACCES;
884 sh_keys = &ep->endpoint_shared_keys;
885 }
886
887 key_for_each(key, sh_keys) {
888 if (key->key_id == key_id) {
889 found = 1;
890 break;
891 }
892 }
893
894 if (!found || key->deactivated)
895 return -EINVAL;
896
897 if (asoc) {
898 asoc->active_key_id = key_id;
899 sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
900 } else
901 ep->active_key_id = key_id;
902
903 return 0;
904}
905
906int sctp_auth_del_key_id(struct sctp_endpoint *ep,
907 struct sctp_association *asoc,
908 __u16 key_id)
909{
910 struct sctp_shared_key *key;
911 struct list_head *sh_keys;
912 int found = 0;
913
914
915
916
917 if (asoc) {
918 if (!asoc->peer.auth_capable)
919 return -EACCES;
920 if (asoc->active_key_id == key_id)
921 return -EINVAL;
922
923 sh_keys = &asoc->endpoint_shared_keys;
924 } else {
925 if (!ep->auth_enable)
926 return -EACCES;
927 if (ep->active_key_id == key_id)
928 return -EINVAL;
929
930 sh_keys = &ep->endpoint_shared_keys;
931 }
932
933 key_for_each(key, sh_keys) {
934 if (key->key_id == key_id) {
935 found = 1;
936 break;
937 }
938 }
939
940 if (!found)
941 return -EINVAL;
942
943
944 list_del_init(&key->key_list);
945 sctp_auth_shkey_release(key);
946
947 return 0;
948}
949
950int sctp_auth_deact_key_id(struct sctp_endpoint *ep,
951 struct sctp_association *asoc, __u16 key_id)
952{
953 struct sctp_shared_key *key;
954 struct list_head *sh_keys;
955 int found = 0;
956
957
958
959
960 if (asoc) {
961 if (!asoc->peer.auth_capable)
962 return -EACCES;
963 if (asoc->active_key_id == key_id)
964 return -EINVAL;
965
966 sh_keys = &asoc->endpoint_shared_keys;
967 } else {
968 if (!ep->auth_enable)
969 return -EACCES;
970 if (ep->active_key_id == key_id)
971 return -EINVAL;
972
973 sh_keys = &ep->endpoint_shared_keys;
974 }
975
976 key_for_each(key, sh_keys) {
977 if (key->key_id == key_id) {
978 found = 1;
979 break;
980 }
981 }
982
983 if (!found)
984 return -EINVAL;
985
986
987
988
989
990 if (asoc && !list_empty(&key->key_list) &&
991 refcount_read(&key->refcnt) == 1) {
992 struct sctp_ulpevent *ev;
993
994 ev = sctp_ulpevent_make_authkey(asoc, key->key_id,
995 SCTP_AUTH_FREE_KEY, GFP_KERNEL);
996 if (ev)
997 asoc->stream.si->enqueue_event(&asoc->ulpq, ev);
998 }
999
1000 key->deactivated = 1;
1001
1002 return 0;
1003}
1004
1005int sctp_auth_init(struct sctp_endpoint *ep, gfp_t gfp)
1006{
1007 int err = -ENOMEM;
1008
1009
1010
1011
1012
1013 if (!ep->auth_hmacs_list) {
1014 struct sctp_hmac_algo_param *auth_hmacs;
1015
1016 auth_hmacs = kzalloc(struct_size(auth_hmacs, hmac_ids,
1017 SCTP_AUTH_NUM_HMACS), gfp);
1018 if (!auth_hmacs)
1019 goto nomem;
1020
1021
1022
1023
1024
1025 auth_hmacs->param_hdr.type = SCTP_PARAM_HMAC_ALGO;
1026 auth_hmacs->param_hdr.length =
1027 htons(sizeof(struct sctp_paramhdr) + 2);
1028 auth_hmacs->hmac_ids[0] = htons(SCTP_AUTH_HMAC_ID_SHA1);
1029 ep->auth_hmacs_list = auth_hmacs;
1030 }
1031
1032 if (!ep->auth_chunk_list) {
1033 struct sctp_chunks_param *auth_chunks;
1034
1035 auth_chunks = kzalloc(sizeof(*auth_chunks) +
1036 SCTP_NUM_CHUNK_TYPES, gfp);
1037 if (!auth_chunks)
1038 goto nomem;
1039
1040 auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS;
1041 auth_chunks->param_hdr.length =
1042 htons(sizeof(struct sctp_paramhdr));
1043 ep->auth_chunk_list = auth_chunks;
1044 }
1045
1046
1047
1048
1049 err = sctp_auth_init_hmacs(ep, gfp);
1050 if (err)
1051 goto nomem;
1052
1053 return 0;
1054
1055nomem:
1056
1057 kfree(ep->auth_hmacs_list);
1058 kfree(ep->auth_chunk_list);
1059 ep->auth_hmacs_list = NULL;
1060 ep->auth_chunk_list = NULL;
1061 return err;
1062}
1063
1064void sctp_auth_free(struct sctp_endpoint *ep)
1065{
1066 kfree(ep->auth_hmacs_list);
1067 kfree(ep->auth_chunk_list);
1068 ep->auth_hmacs_list = NULL;
1069 ep->auth_chunk_list = NULL;
1070 sctp_auth_destroy_hmacs(ep->auth_hmacs);
1071 ep->auth_hmacs = NULL;
1072}
1073