MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2026-01-27 12:47:24 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

sctp: Stop accepting md5 and sha1 for net.sctp.cookie_hmac_alg

Browse Source 
The upgrade of the cookie authentication algorithm to HMAC-SHA256 kept
some backwards compatibility for the net.sctp.cookie_hmac_alg sysctl by
still accepting the values 'md5' and 'sha1'.  Those algorithms are no
longer actually used, but rather those values were just treated as
requests to enable cookie authentication.

As requested at
https://lore.kernel.org/netdev/CADvbK_fmCRARc8VznH8cQa-QKaCOQZ6yFbF=1-VDK=zRqv_cXw@mail.gmail.com/
and https://lore.kernel.org/netdev/20250818084345.708ac796@kernel.org/ ,
go further and start rejecting 'md5' and 'sha1' completely.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/20250818205426.30222-6-ebiggers@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Eric Biggers 2025-08-18 13:54:26 -07:00 committed by Jakub Kicinski
parent 2f3dd6ec90
commit d5a253702a
2 changed files with 1 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Documentation/networking/ip-sysctl.rst
View File

@ -3511,9 +3511,6 @@ cookie_hmac_alg - STRING
* sha256
* none
md5 and sha1 are also accepted for backwards compatibility, but cause
sha256 to be selected.
Default: sha256
rcvbuf_policy - INTEGER

4
net/sctp/sysctl.c
View File

@ -401,9 +401,7 @@ static int proc_sctp_do_hmac_alg(const struct ctl_table *ctl, int write,
ret = proc_dostring(&tbl, 1, buffer, lenp, ppos);
if (ret)
return ret;
if (!strcmp(tmp, "sha256") ||
/* for backwards compatibility */
!strcmp(tmp, "md5") || !strcmp(tmp, "sha1")) {
if (!strcmp(tmp, "sha256")) {
net->sctp.cookie_auth_enable = 1;
return 0;
}