1 /* SCTP kernel implementation
2 * (C) Copyright 2007 Hewlett-Packard Development Company, L.P.
4 * This file is part of the SCTP kernel implementation
6 * This SCTP implementation is free software;
7 * you can redistribute it and/or modify it under the terms of
8 * the GNU General Public License as published by
9 * the Free Software Foundation; either version 2, or (at your option)
12 * This SCTP implementation is distributed in the hope that it
13 * will be useful, but WITHOUT ANY WARRANTY; without even the implied
14 * ************************
15 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
16 * See the GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with GNU CC; see the file COPYING. If not, write to
20 * the Free Software Foundation, 59 Temple Place - Suite 330,
21 * Boston, MA 02111-1307, USA.
23 * Please send any bug reports or fixes you make to the
25 * lksctp developers <linux-sctp@vger.kernel.org>
27 * Written or modified by:
28 * Vlad Yasevich <vladislav.yasevich@hp.com>
31 #include <linux/slab.h>
32 #include <linux/types.h>
33 #include <linux/crypto.h>
34 #include <linux/scatterlist.h>
35 #include <net/sctp/sctp.h>
36 #include <net/sctp/auth.h>
38 static struct sctp_hmac sctp_hmac_list
[SCTP_AUTH_NUM_HMACS
] = {
40 /* id 0 is reserved. as all 0 */
41 .hmac_id
= SCTP_AUTH_HMAC_ID_RESERVED_0
,
44 .hmac_id
= SCTP_AUTH_HMAC_ID_SHA1
,
45 .hmac_name
="hmac(sha1)",
46 .hmac_len
= SCTP_SHA1_SIG_SIZE
,
49 /* id 2 is reserved as well */
50 .hmac_id
= SCTP_AUTH_HMAC_ID_RESERVED_2
,
52 #if defined (CONFIG_CRYPTO_SHA256) || defined (CONFIG_CRYPTO_SHA256_MODULE)
54 .hmac_id
= SCTP_AUTH_HMAC_ID_SHA256
,
55 .hmac_name
="hmac(sha256)",
56 .hmac_len
= SCTP_SHA256_SIG_SIZE
,
62 void sctp_auth_key_put(struct sctp_auth_bytes
*key
)
67 if (atomic_dec_and_test(&key
->refcnt
)) {
69 SCTP_DBG_OBJCNT_DEC(keys
);
73 /* Create a new key structure of a given length */
74 static struct sctp_auth_bytes
*sctp_auth_create_key(__u32 key_len
, gfp_t gfp
)
76 struct sctp_auth_bytes
*key
;
78 /* Verify that we are not going to overflow INT_MAX */
79 if (key_len
> (INT_MAX
- sizeof(struct sctp_auth_bytes
)))
82 /* Allocate the shared key */
83 key
= kmalloc(sizeof(struct sctp_auth_bytes
) + key_len
, gfp
);
88 atomic_set(&key
->refcnt
, 1);
89 SCTP_DBG_OBJCNT_INC(keys
);
94 /* Create a new shared key container with a give key id */
95 struct sctp_shared_key
*sctp_auth_shkey_create(__u16 key_id
, gfp_t gfp
)
97 struct sctp_shared_key
*new;
99 /* Allocate the shared key container */
100 new = kzalloc(sizeof(struct sctp_shared_key
), gfp
);
104 INIT_LIST_HEAD(&new->key_list
);
105 new->key_id
= key_id
;
110 /* Free the shared key structure */
111 static void sctp_auth_shkey_free(struct sctp_shared_key
*sh_key
)
113 BUG_ON(!list_empty(&sh_key
->key_list
));
114 sctp_auth_key_put(sh_key
->key
);
119 /* Destroy the entire key list. This is done during the
120 * associon and endpoint free process.
122 void sctp_auth_destroy_keys(struct list_head
*keys
)
124 struct sctp_shared_key
*ep_key
;
125 struct sctp_shared_key
*tmp
;
127 if (list_empty(keys
))
130 key_for_each_safe(ep_key
, tmp
, keys
) {
131 list_del_init(&ep_key
->key_list
);
132 sctp_auth_shkey_free(ep_key
);
136 /* Compare two byte vectors as numbers. Return values
138 * 0 - vectors are equal
139 * < 0 - vector 1 is smaller than vector2
140 * > 0 - vector 1 is greater than vector2
143 * This is performed by selecting the numerically smaller key vector...
144 * If the key vectors are equal as numbers but differ in length ...
145 * the shorter vector is considered smaller
147 * Examples (with small values):
148 * 000123456789 > 123456789 (first number is longer)
149 * 000123456789 < 234567891 (second number is larger numerically)
150 * 123456789 > 2345678 (first number is both larger & longer)
152 static int sctp_auth_compare_vectors(struct sctp_auth_bytes
*vector1
,
153 struct sctp_auth_bytes
*vector2
)
159 diff
= vector1
->len
- vector2
->len
;
161 longer
= (diff
> 0) ? vector1
->data
: vector2
->data
;
163 /* Check to see if the longer number is
164 * lead-zero padded. If it is not, it
165 * is automatically larger numerically.
167 for (i
= 0; i
< abs(diff
); i
++ ) {
173 /* lengths are the same, compare numbers */
174 return memcmp(vector1
->data
, vector2
->data
, vector1
->len
);
178 * Create a key vector as described in SCTP-AUTH, Section 6.1
179 * The RANDOM parameter, the CHUNKS parameter and the HMAC-ALGO
180 * parameter sent by each endpoint are concatenated as byte vectors.
181 * These parameters include the parameter type, parameter length, and
182 * the parameter value, but padding is omitted; all padding MUST be
183 * removed from this concatenation before proceeding with further
184 * computation of keys. Parameters which were not sent are simply
185 * omitted from the concatenation process. The resulting two vectors
186 * are called the two key vectors.
188 static struct sctp_auth_bytes
*sctp_auth_make_key_vector(
189 sctp_random_param_t
*random
,
190 sctp_chunks_param_t
*chunks
,
191 sctp_hmac_algo_param_t
*hmacs
,
194 struct sctp_auth_bytes
*new;
197 __u16 random_len
, hmacs_len
, chunks_len
= 0;
199 random_len
= ntohs(random
->param_hdr
.length
);
200 hmacs_len
= ntohs(hmacs
->param_hdr
.length
);
202 chunks_len
= ntohs(chunks
->param_hdr
.length
);
204 len
= random_len
+ hmacs_len
+ chunks_len
;
206 new = sctp_auth_create_key(len
, gfp
);
210 memcpy(new->data
, random
, random_len
);
211 offset
+= random_len
;
214 memcpy(new->data
+ offset
, chunks
, chunks_len
);
215 offset
+= chunks_len
;
218 memcpy(new->data
+ offset
, hmacs
, hmacs_len
);
224 /* Make a key vector based on our local parameters */
225 static struct sctp_auth_bytes
*sctp_auth_make_local_vector(
226 const struct sctp_association
*asoc
,
229 return sctp_auth_make_key_vector(
230 (sctp_random_param_t
*)asoc
->c
.auth_random
,
231 (sctp_chunks_param_t
*)asoc
->c
.auth_chunks
,
232 (sctp_hmac_algo_param_t
*)asoc
->c
.auth_hmacs
,
236 /* Make a key vector based on peer's parameters */
237 static struct sctp_auth_bytes
*sctp_auth_make_peer_vector(
238 const struct sctp_association
*asoc
,
241 return sctp_auth_make_key_vector(asoc
->peer
.peer_random
,
242 asoc
->peer
.peer_chunks
,
243 asoc
->peer
.peer_hmacs
,
248 /* Set the value of the association shared key base on the parameters
249 * given. The algorithm is:
250 * From the endpoint pair shared keys and the key vectors the
251 * association shared keys are computed. This is performed by selecting
252 * the numerically smaller key vector and concatenating it to the
253 * endpoint pair shared key, and then concatenating the numerically
254 * larger key vector to that. The result of the concatenation is the
255 * association shared key.
257 static struct sctp_auth_bytes
*sctp_auth_asoc_set_secret(
258 struct sctp_shared_key
*ep_key
,
259 struct sctp_auth_bytes
*first_vector
,
260 struct sctp_auth_bytes
*last_vector
,
263 struct sctp_auth_bytes
*secret
;
267 auth_len
= first_vector
->len
+ last_vector
->len
;
269 auth_len
+= ep_key
->key
->len
;
271 secret
= sctp_auth_create_key(auth_len
, gfp
);
276 memcpy(secret
->data
, ep_key
->key
->data
, ep_key
->key
->len
);
277 offset
+= ep_key
->key
->len
;
280 memcpy(secret
->data
+ offset
, first_vector
->data
, first_vector
->len
);
281 offset
+= first_vector
->len
;
283 memcpy(secret
->data
+ offset
, last_vector
->data
, last_vector
->len
);
288 /* Create an association shared key. Follow the algorithm
289 * described in SCTP-AUTH, Section 6.1
291 static struct sctp_auth_bytes
*sctp_auth_asoc_create_secret(
292 const struct sctp_association
*asoc
,
293 struct sctp_shared_key
*ep_key
,
296 struct sctp_auth_bytes
*local_key_vector
;
297 struct sctp_auth_bytes
*peer_key_vector
;
298 struct sctp_auth_bytes
*first_vector
,
300 struct sctp_auth_bytes
*secret
= NULL
;
304 /* Now we need to build the key vectors
305 * SCTP-AUTH , Section 6.1
306 * The RANDOM parameter, the CHUNKS parameter and the HMAC-ALGO
307 * parameter sent by each endpoint are concatenated as byte vectors.
308 * These parameters include the parameter type, parameter length, and
309 * the parameter value, but padding is omitted; all padding MUST be
310 * removed from this concatenation before proceeding with further
311 * computation of keys. Parameters which were not sent are simply
312 * omitted from the concatenation process. The resulting two vectors
313 * are called the two key vectors.
316 local_key_vector
= sctp_auth_make_local_vector(asoc
, gfp
);
317 peer_key_vector
= sctp_auth_make_peer_vector(asoc
, gfp
);
319 if (!peer_key_vector
|| !local_key_vector
)
322 /* Figure out the order in which the key_vectors will be
323 * added to the endpoint shared key.
324 * SCTP-AUTH, Section 6.1:
325 * This is performed by selecting the numerically smaller key
326 * vector and concatenating it to the endpoint pair shared
327 * key, and then concatenating the numerically larger key
328 * vector to that. If the key vectors are equal as numbers
329 * but differ in length, then the concatenation order is the
330 * endpoint shared key, followed by the shorter key vector,
331 * followed by the longer key vector. Otherwise, the key
332 * vectors are identical, and may be concatenated to the
333 * endpoint pair key in any order.
335 cmp
= sctp_auth_compare_vectors(local_key_vector
,
338 first_vector
= local_key_vector
;
339 last_vector
= peer_key_vector
;
341 first_vector
= peer_key_vector
;
342 last_vector
= local_key_vector
;
345 secret
= sctp_auth_asoc_set_secret(ep_key
, first_vector
, last_vector
,
348 sctp_auth_key_put(local_key_vector
);
349 sctp_auth_key_put(peer_key_vector
);
355 * Populate the association overlay list with the list
358 int sctp_auth_asoc_copy_shkeys(const struct sctp_endpoint
*ep
,
359 struct sctp_association
*asoc
,
362 struct sctp_shared_key
*sh_key
;
363 struct sctp_shared_key
*new;
365 BUG_ON(!list_empty(&asoc
->endpoint_shared_keys
));
367 key_for_each(sh_key
, &ep
->endpoint_shared_keys
) {
368 new = sctp_auth_shkey_create(sh_key
->key_id
, gfp
);
372 new->key
= sh_key
->key
;
373 sctp_auth_key_hold(new->key
);
374 list_add(&new->key_list
, &asoc
->endpoint_shared_keys
);
380 sctp_auth_destroy_keys(&asoc
->endpoint_shared_keys
);
385 /* Public interface to creat the association shared key.
386 * See code above for the algorithm.
388 int sctp_auth_asoc_init_active_key(struct sctp_association
*asoc
, gfp_t gfp
)
390 struct net
*net
= sock_net(asoc
->base
.sk
);
391 struct sctp_auth_bytes
*secret
;
392 struct sctp_shared_key
*ep_key
;
394 /* If we don't support AUTH, or peer is not capable
395 * we don't need to do anything.
397 if (!net
->sctp
.auth_enable
|| !asoc
->peer
.auth_capable
)
400 /* If the key_id is non-zero and we couldn't find an
401 * endpoint pair shared key, we can't compute the
403 * For key_id 0, endpoint pair shared key is a NULL key.
405 ep_key
= sctp_auth_get_shkey(asoc
, asoc
->active_key_id
);
408 secret
= sctp_auth_asoc_create_secret(asoc
, ep_key
, gfp
);
412 sctp_auth_key_put(asoc
->asoc_shared_key
);
413 asoc
->asoc_shared_key
= secret
;
419 /* Find the endpoint pair shared key based on the key_id */
420 struct sctp_shared_key
*sctp_auth_get_shkey(
421 const struct sctp_association
*asoc
,
424 struct sctp_shared_key
*key
;
426 /* First search associations set of endpoint pair shared keys */
427 key_for_each(key
, &asoc
->endpoint_shared_keys
) {
428 if (key
->key_id
== key_id
)
436 * Initialize all the possible digest transforms that we can use. Right now
437 * now, the supported digests are SHA1 and SHA256. We do this here once
438 * because of the restrictiong that transforms may only be allocated in
439 * user context. This forces us to pre-allocated all possible transforms
440 * at the endpoint init time.
442 int sctp_auth_init_hmacs(struct sctp_endpoint
*ep
, gfp_t gfp
)
444 struct net
*net
= sock_net(ep
->base
.sk
);
445 struct crypto_hash
*tfm
= NULL
;
448 /* if the transforms are already allocted, we are done */
449 if (!net
->sctp
.auth_enable
) {
450 ep
->auth_hmacs
= NULL
;
457 /* Allocated the array of pointers to transorms */
458 ep
->auth_hmacs
= kzalloc(
459 sizeof(struct crypto_hash
*) * SCTP_AUTH_NUM_HMACS
,
464 for (id
= 0; id
< SCTP_AUTH_NUM_HMACS
; id
++) {
466 /* See is we support the id. Supported IDs have name and
467 * length fields set, so that we can allocated and use
468 * them. We can safely just check for name, for without the
469 * name, we can't allocate the TFM.
471 if (!sctp_hmac_list
[id
].hmac_name
)
474 /* If this TFM has been allocated, we are all set */
475 if (ep
->auth_hmacs
[id
])
478 /* Allocate the ID */
479 tfm
= crypto_alloc_hash(sctp_hmac_list
[id
].hmac_name
, 0,
484 ep
->auth_hmacs
[id
] = tfm
;
490 /* Clean up any successful allocations */
491 sctp_auth_destroy_hmacs(ep
->auth_hmacs
);
495 /* Destroy the hmac tfm array */
496 void sctp_auth_destroy_hmacs(struct crypto_hash
*auth_hmacs
[])
503 for (i
= 0; i
< SCTP_AUTH_NUM_HMACS
; i
++)
506 crypto_free_hash(auth_hmacs
[i
]);
512 struct sctp_hmac
*sctp_auth_get_hmac(__u16 hmac_id
)
514 return &sctp_hmac_list
[hmac_id
];
517 /* Get an hmac description information that we can use to build
520 struct sctp_hmac
*sctp_auth_asoc_get_hmac(const struct sctp_association
*asoc
)
522 struct sctp_hmac_algo_param
*hmacs
;
527 /* If we have a default entry, use it */
528 if (asoc
->default_hmac_id
)
529 return &sctp_hmac_list
[asoc
->default_hmac_id
];
531 /* Since we do not have a default entry, find the first entry
532 * we support and return that. Do not cache that id.
534 hmacs
= asoc
->peer
.peer_hmacs
;
538 n_elt
= (ntohs(hmacs
->param_hdr
.length
) - sizeof(sctp_paramhdr_t
)) >> 1;
539 for (i
= 0; i
< n_elt
; i
++) {
540 id
= ntohs(hmacs
->hmac_ids
[i
]);
542 /* Check the id is in the supported range. And
543 * see if we support the id. Supported IDs have name and
544 * length fields set, so that we can allocate and use
545 * them. We can safely just check for name, for without the
546 * name, we can't allocate the TFM.
548 if (id
> SCTP_AUTH_HMAC_ID_MAX
||
549 !sctp_hmac_list
[id
].hmac_name
) {
560 return &sctp_hmac_list
[id
];
563 static int __sctp_auth_find_hmacid(__be16
*hmacs
, int n_elts
, __be16 hmac_id
)
568 for (i
= 0; i
< n_elts
; i
++) {
569 if (hmac_id
== hmacs
[i
]) {
578 /* See if the HMAC_ID is one that we claim as supported */
579 int sctp_auth_asoc_verify_hmac_id(const struct sctp_association
*asoc
,
582 struct sctp_hmac_algo_param
*hmacs
;
588 hmacs
= (struct sctp_hmac_algo_param
*)asoc
->c
.auth_hmacs
;
589 n_elt
= (ntohs(hmacs
->param_hdr
.length
) - sizeof(sctp_paramhdr_t
)) >> 1;
591 return __sctp_auth_find_hmacid(hmacs
->hmac_ids
, n_elt
, hmac_id
);
595 /* Cache the default HMAC id. This to follow this text from SCTP-AUTH:
597 * The receiver of a HMAC-ALGO parameter SHOULD use the first listed
598 * algorithm it supports.
600 void sctp_auth_asoc_set_default_hmac(struct sctp_association
*asoc
,
601 struct sctp_hmac_algo_param
*hmacs
)
603 struct sctp_endpoint
*ep
;
608 /* if the default id is already set, use it */
609 if (asoc
->default_hmac_id
)
612 n_params
= (ntohs(hmacs
->param_hdr
.length
)
613 - sizeof(sctp_paramhdr_t
)) >> 1;
615 for (i
= 0; i
< n_params
; i
++) {
616 id
= ntohs(hmacs
->hmac_ids
[i
]);
618 /* Check the id is in the supported range */
619 if (id
> SCTP_AUTH_HMAC_ID_MAX
)
622 /* If this TFM has been allocated, use this id */
623 if (ep
->auth_hmacs
[id
]) {
624 asoc
->default_hmac_id
= id
;
631 /* Check to see if the given chunk is supposed to be authenticated */
632 static int __sctp_auth_cid(sctp_cid_t chunk
, struct sctp_chunks_param
*param
)
638 if (!param
|| param
->param_hdr
.length
== 0)
641 len
= ntohs(param
->param_hdr
.length
) - sizeof(sctp_paramhdr_t
);
643 /* SCTP-AUTH, Section 3.2
644 * The chunk types for INIT, INIT-ACK, SHUTDOWN-COMPLETE and AUTH
645 * chunks MUST NOT be listed in the CHUNKS parameter. However, if
646 * a CHUNKS parameter is received then the types for INIT, INIT-ACK,
647 * SHUTDOWN-COMPLETE and AUTH chunks MUST be ignored.
649 for (i
= 0; !found
&& i
< len
; i
++) {
650 switch (param
->chunks
[i
]) {
652 case SCTP_CID_INIT_ACK
:
653 case SCTP_CID_SHUTDOWN_COMPLETE
:
658 if (param
->chunks
[i
] == chunk
)
667 /* Check if peer requested that this chunk is authenticated */
668 int sctp_auth_send_cid(sctp_cid_t chunk
, const struct sctp_association
*asoc
)
674 net
= sock_net(asoc
->base
.sk
);
675 if (!net
->sctp
.auth_enable
|| !asoc
->peer
.auth_capable
)
678 return __sctp_auth_cid(chunk
, asoc
->peer
.peer_chunks
);
681 /* Check if we requested that peer authenticate this chunk. */
682 int sctp_auth_recv_cid(sctp_cid_t chunk
, const struct sctp_association
*asoc
)
688 net
= sock_net(asoc
->base
.sk
);
689 if (!net
->sctp
.auth_enable
)
692 return __sctp_auth_cid(chunk
,
693 (struct sctp_chunks_param
*)asoc
->c
.auth_chunks
);
696 /* SCTP-AUTH: Section 6.2:
697 * The sender MUST calculate the MAC as described in RFC2104 [2] using
698 * the hash function H as described by the MAC Identifier and the shared
699 * association key K based on the endpoint pair shared key described by
700 * the shared key identifier. The 'data' used for the computation of
701 * the AUTH-chunk is given by the AUTH chunk with its HMAC field set to
702 * zero (as shown in Figure 6) followed by all chunks that are placed
703 * after the AUTH chunk in the SCTP packet.
705 void sctp_auth_calculate_hmac(const struct sctp_association
*asoc
,
707 struct sctp_auth_chunk
*auth
,
710 struct scatterlist sg
;
711 struct hash_desc desc
;
712 struct sctp_auth_bytes
*asoc_key
;
713 __u16 key_id
, hmac_id
;
718 /* Extract the info we need:
722 key_id
= ntohs(auth
->auth_hdr
.shkey_id
);
723 hmac_id
= ntohs(auth
->auth_hdr
.hmac_id
);
725 if (key_id
== asoc
->active_key_id
)
726 asoc_key
= asoc
->asoc_shared_key
;
728 struct sctp_shared_key
*ep_key
;
730 ep_key
= sctp_auth_get_shkey(asoc
, key_id
);
734 asoc_key
= sctp_auth_asoc_create_secret(asoc
, ep_key
, gfp
);
741 /* set up scatter list */
742 end
= skb_tail_pointer(skb
);
743 sg_init_one(&sg
, auth
, end
- (unsigned char *)auth
);
745 desc
.tfm
= asoc
->ep
->auth_hmacs
[hmac_id
];
748 digest
= auth
->auth_hdr
.hmac
;
749 if (crypto_hash_setkey(desc
.tfm
, &asoc_key
->data
[0], asoc_key
->len
))
752 crypto_hash_digest(&desc
, &sg
, sg
.length
, digest
);
756 sctp_auth_key_put(asoc_key
);
761 /* Add a chunk to the endpoint authenticated chunk list */
762 int sctp_auth_ep_add_chunkid(struct sctp_endpoint
*ep
, __u8 chunk_id
)
764 struct sctp_chunks_param
*p
= ep
->auth_chunk_list
;
768 /* If this chunk is already specified, we are done */
769 if (__sctp_auth_cid(chunk_id
, p
))
772 /* Check if we can add this chunk to the array */
773 param_len
= ntohs(p
->param_hdr
.length
);
774 nchunks
= param_len
- sizeof(sctp_paramhdr_t
);
775 if (nchunks
== SCTP_NUM_CHUNK_TYPES
)
778 p
->chunks
[nchunks
] = chunk_id
;
779 p
->param_hdr
.length
= htons(param_len
+ 1);
783 /* Add hmac identifires to the endpoint list of supported hmac ids */
784 int sctp_auth_ep_set_hmacs(struct sctp_endpoint
*ep
,
785 struct sctp_hmacalgo
*hmacs
)
791 /* Scan the list looking for unsupported id. Also make sure that
794 for (i
= 0; i
< hmacs
->shmac_num_idents
; i
++) {
795 id
= hmacs
->shmac_idents
[i
];
797 if (id
> SCTP_AUTH_HMAC_ID_MAX
)
800 if (SCTP_AUTH_HMAC_ID_SHA1
== id
)
803 if (!sctp_hmac_list
[id
].hmac_name
)
810 memcpy(ep
->auth_hmacs_list
->hmac_ids
, &hmacs
->shmac_idents
[0],
811 hmacs
->shmac_num_idents
* sizeof(__u16
));
812 ep
->auth_hmacs_list
->param_hdr
.length
= htons(sizeof(sctp_paramhdr_t
) +
813 hmacs
->shmac_num_idents
* sizeof(__u16
));
817 /* Set a new shared key on either endpoint or association. If the
818 * the key with a same ID already exists, replace the key (remove the
819 * old key and add a new one).
821 int sctp_auth_set_key(struct sctp_endpoint
*ep
,
822 struct sctp_association
*asoc
,
823 struct sctp_authkey
*auth_key
)
825 struct sctp_shared_key
*cur_key
= NULL
;
826 struct sctp_auth_bytes
*key
;
827 struct list_head
*sh_keys
;
830 /* Try to find the given key id to see if
831 * we are doing a replace, or adding a new key
834 sh_keys
= &asoc
->endpoint_shared_keys
;
836 sh_keys
= &ep
->endpoint_shared_keys
;
838 key_for_each(cur_key
, sh_keys
) {
839 if (cur_key
->key_id
== auth_key
->sca_keynumber
) {
845 /* If we are not replacing a key id, we need to allocate
849 cur_key
= sctp_auth_shkey_create(auth_key
->sca_keynumber
,
855 /* Create a new key data based on the info passed in */
856 key
= sctp_auth_create_key(auth_key
->sca_keylength
, GFP_KERNEL
);
860 memcpy(key
->data
, &auth_key
->sca_key
[0], auth_key
->sca_keylength
);
862 /* If we are replacing, remove the old keys data from the
863 * key id. If we are adding new key id, add it to the
867 sctp_auth_key_put(cur_key
->key
);
869 list_add(&cur_key
->key_list
, sh_keys
);
872 sctp_auth_key_hold(key
);
877 sctp_auth_shkey_free(cur_key
);
882 int sctp_auth_set_active_key(struct sctp_endpoint
*ep
,
883 struct sctp_association
*asoc
,
886 struct sctp_shared_key
*key
;
887 struct list_head
*sh_keys
;
890 /* The key identifier MUST correst to an existing key */
892 sh_keys
= &asoc
->endpoint_shared_keys
;
894 sh_keys
= &ep
->endpoint_shared_keys
;
896 key_for_each(key
, sh_keys
) {
897 if (key
->key_id
== key_id
) {
907 asoc
->active_key_id
= key_id
;
908 sctp_auth_asoc_init_active_key(asoc
, GFP_KERNEL
);
910 ep
->active_key_id
= key_id
;
915 int sctp_auth_del_key_id(struct sctp_endpoint
*ep
,
916 struct sctp_association
*asoc
,
919 struct sctp_shared_key
*key
;
920 struct list_head
*sh_keys
;
923 /* The key identifier MUST NOT be the current active key
924 * The key identifier MUST correst to an existing key
927 if (asoc
->active_key_id
== key_id
)
930 sh_keys
= &asoc
->endpoint_shared_keys
;
932 if (ep
->active_key_id
== key_id
)
935 sh_keys
= &ep
->endpoint_shared_keys
;
938 key_for_each(key
, sh_keys
) {
939 if (key
->key_id
== key_id
) {
948 /* Delete the shared key */
949 list_del_init(&key
->key_list
);
950 sctp_auth_shkey_free(key
);