[SCTP]: Tie ADD-IP and AUTH functionality as required by spec.

ADD-IP spec requires AUTH. It is, in fact, dangerous without AUTH.
So, disable ADD-IP functionality if the peer claims to support
ADD-IP, but not AUTH.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 12 insertions, 1 deletions

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index fa2ba543183d..f983a369d4e2 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1851,7 +1851,8 @@ static void sctp_process_ext_param(struct sctp_association *asoc,
                             break;
                     case SCTP_CID_ASCONF:
                     case SCTP_CID_ASCONF_ACK:
-                            /* don't need to do anything for ASCONF */
+                            asoc->peer.addip_capable = 1;
+                            break;
                     default:
                             break;
                 }
@@ -2137,6 +2138,16 @@ int sctp_process_init(struct sctp_association *asoc, sctp_cid_t cid,
                                         !asoc->peer.peer_hmacs))
                 asoc->peer.auth_capable = 0;
 
+
+        /* If the peer claims support for ADD-IP without support
+         * for AUTH, disable support for ADD-IP.
+         */
+        if (asoc->peer.addip_capable && !asoc->peer.auth_capable) {
+                asoc->peer.addip_disabled_mask |= (SCTP_PARAM_ADD_IP |
+                                                  SCTP_PARAM_DEL_IP |
+                                                  SCTP_PARAM_SET_PRIMARY);
+        }
+
         /* Walk list of transports, removing transports in the UNKNOWN state. */
         list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
                 transport = list_entry(pos, struct sctp_transport, transports);