Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

net: sctp: remove unused multiple cookie keys

Browse source 
Vlad says: The whole multiple cookie keys code is completely unused
and has been all this time. Noone uses anything other then the
secret_key[0] since there is no changeover support anywhere.

Thus, for now clean up its left-over fragments.

Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Vlad Yasevich <vyasevic@redhat.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Daniel Borkmann 2013-02-12 05:15:33 +00:00 committed by David S. Miller
parent 0790bbb68f
commit 570617e79c
4 changed files with 11 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
include/net/sctp/constants.h
View file

@ -303,7 +303,7 @@ enum { SCTP_MAX_GABS = 16 };
* to which we will raise the P-MTU. * to which we will raise the P-MTU.
*/ */
#define SCTP_DEFAULT_MINSEGMENT 512 /* MTU size ... if no mtu disc */ #define SCTP_DEFAULT_MINSEGMENT 512 /* MTU size ... if no mtu disc */
#define SCTP_HOW_MANY_SECRETS 2 /* How many secrets I keep */
#define SCTP_SECRET_SIZE 32 /* Number of octets in a 256 bits. */ #define SCTP_SECRET_SIZE 32 /* Number of octets in a 256 bits. */
#define SCTP_SIGNATURE_SIZE 20 /* size of a SLA-1 signature */ #define SCTP_SIGNATURE_SIZE 20 /* size of a SLA-1 signature */

5
include/net/sctp/structs.h
View file

@ -1236,10 +1236,7 @@ struct sctp_endpoint {
* Discussion in [RFC1750] can be helpful in * Discussion in [RFC1750] can be helpful in
* selection of the key. * selection of the key.
*/ */
__u8 secret_key[SCTP_HOW_MANY_SECRETS][SCTP_SECRET_SIZE]; __u8 secret_key[SCTP_SECRET_SIZE];
int current_key;
int last_key;
int key_changed_at;
/* digest: This is a digest of the sctp cookie. This field is /* digest: This is a digest of the sctp cookie. This field is
* only used on the receive path when we try to validate * only used on the receive path when we try to validate

9
net/sctp/endpointola.c
View file

@ -151,9 +151,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
ep->rcvbuf_policy = net->sctp.rcvbuf_policy; ep->rcvbuf_policy = net->sctp.rcvbuf_policy;
/* Initialize the secret key used with cookie. */ /* Initialize the secret key used with cookie. */
get_random_bytes(&ep->secret_key[0], SCTP_SECRET_SIZE); get_random_bytes(ep->secret_key, sizeof(ep->secret_key));
ep->last_key = ep->current_key = 0;
ep->key_changed_at = jiffies;
/* SCTP-AUTH extensions*/ /* SCTP-AUTH extensions*/
INIT_LIST_HEAD(&ep->endpoint_shared_keys); INIT_LIST_HEAD(&ep->endpoint_shared_keys);
@ -249,8 +247,6 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
/* Final destructor for endpoint. */ /* Final destructor for endpoint. */
static void sctp_endpoint_destroy(struct sctp_endpoint *ep) static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
{ {
int i;
SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return); SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
/* Free up the HMAC transform. */ /* Free up the HMAC transform. */
@ -273,8 +269,7 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
sctp_inq_free(&ep->base.inqueue); sctp_inq_free(&ep->base.inqueue);
sctp_bind_addr_free(&ep->base.bind_addr); sctp_bind_addr_free(&ep->base.bind_addr);
for (i = 0; i < SCTP_HOW_MANY_SECRETS; ++i) memset(ep->secret_key, 0, sizeof(ep->secret_key));
memset(&ep->secret_key[i], 0, SCTP_SECRET_SIZE);
/* Remove and free the port */ /* Remove and free the port */
if (sctp_sk(ep->base.sk)->bind_hash) if (sctp_sk(ep->base.sk)->bind_hash)

27
net/sctp/sm_make_chunk.c
View file

@ -1589,8 +1589,6 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
struct sctp_signed_cookie *cookie; struct sctp_signed_cookie *cookie;
struct scatterlist sg; struct scatterlist sg;
int headersize, bodysize; int headersize, bodysize;
unsigned int keylen;
char *key;
/* Header size is static data prior to the actual cookie, including /* Header size is static data prior to the actual cookie, including
* any padding. * any padding.
@ -1650,12 +1648,11 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
/* Sign the message. */ /* Sign the message. */
sg_init_one(&sg, &cookie->c, bodysize); sg_init_one(&sg, &cookie->c, bodysize);
keylen = SCTP_SECRET_SIZE;
key = (char *)ep->secret_key[ep->current_key];
desc.tfm = sctp_sk(ep->base.sk)->hmac; desc.tfm = sctp_sk(ep->base.sk)->hmac;
desc.flags = 0; desc.flags = 0;
if (crypto_hash_setkey(desc.tfm, key, keylen) || if (crypto_hash_setkey(desc.tfm, ep->secret_key,
sizeof(ep->secret_key)) ||
crypto_hash_digest(&desc, &sg, bodysize, cookie->signature)) crypto_hash_digest(&desc, &sg, bodysize, cookie->signature))
goto free_cookie; goto free_cookie;
} }
@ -1682,8 +1679,7 @@ struct sctp_association *sctp_unpack_cookie(
int headersize, bodysize, fixed_size; int headersize, bodysize, fixed_size;
__u8 *digest = ep->digest; __u8 *digest = ep->digest;
struct scatterlist sg; struct scatterlist sg;
unsigned int keylen, len; unsigned int len;
char *key;
sctp_scope_t scope; sctp_scope_t scope;
struct sk_buff *skb = chunk->skb; struct sk_buff *skb = chunk->skb;
struct timeval tv; struct timeval tv;
@ -1718,35 +1714,22 @@ struct sctp_association *sctp_unpack_cookie(
goto no_hmac; goto no_hmac;
/* Check the signature. */ /* Check the signature. */
keylen = SCTP_SECRET_SIZE;
sg_init_one(&sg, bear_cookie, bodysize); sg_init_one(&sg, bear_cookie, bodysize);
key = (char *)ep->secret_key[ep->current_key];
desc.tfm = sctp_sk(ep->base.sk)->hmac; desc.tfm = sctp_sk(ep->base.sk)->hmac;
desc.flags = 0; desc.flags = 0;
memset(digest, 0x00, SCTP_SIGNATURE_SIZE); memset(digest, 0x00, SCTP_SIGNATURE_SIZE);
if (crypto_hash_setkey(desc.tfm, key, keylen) || if (crypto_hash_setkey(desc.tfm, ep->secret_key,
sizeof(ep->secret_key)) ||
crypto_hash_digest(&desc, &sg, bodysize, digest)) { crypto_hash_digest(&desc, &sg, bodysize, digest)) {
*error = -SCTP_IERROR_NOMEM; *error = -SCTP_IERROR_NOMEM;
goto fail; goto fail;
} }
if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) { if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) {
/* Try the previous key. */
key = (char *)ep->secret_key[ep->last_key];
memset(digest, 0x00, SCTP_SIGNATURE_SIZE);
if (crypto_hash_setkey(desc.tfm, key, keylen) ||
crypto_hash_digest(&desc, &sg, bodysize, digest)) {
*error = -SCTP_IERROR_NOMEM;
goto fail;
}
if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) {
/* Yikes! Still bad signature! */
*error = -SCTP_IERROR_BAD_SIG; *error = -SCTP_IERROR_BAD_SIG;
goto fail; goto fail;
} }
}
no_hmac: no_hmac:
/* IG Section 2.35.2: /* IG Section 2.35.2: