7 files changed, 92 insertions, 60 deletions

diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index d992ca3145fe..0dfcc92600e8 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1241,6 +1241,7 @@ struct sctp_endpoint {
         /* SCTP-AUTH: endpoint shared keys */
         struct list_head endpoint_shared_keys;
         __u16 active_key_id;
+        __u8  auth_enable;
 };
 
 /* Recover the outter endpoint structure. */
@@ -1269,7 +1270,8 @@ struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *,
 int sctp_has_association(struct net *net, const union sctp_addr *laddr,
                          const union sctp_addr *paddr);
 
-int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
+int sctp_verify_init(struct net *net, const struct sctp_endpoint *ep,
+                     const struct sctp_association *asoc,
                      sctp_cid_t, sctp_init_chunk_t *peer_init,
                      struct sctp_chunk *chunk, struct sctp_chunk **err_chunk);
 int sctp_process_init(struct sctp_association *, struct sctp_chunk *chunk,
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 683c7d1b1306..0e8529113dc5 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -386,14 +386,13 @@ nomem:
  */
 int sctp_auth_asoc_init_active_key(struct sctp_association *asoc, gfp_t gfp)
 {
-        struct net *net = sock_net(asoc->base.sk);
         struct sctp_auth_bytes  *secret;
         struct sctp_shared_key *ep_key;
 
         /* If we don't support AUTH, or peer is not capable
          * we don't need to do anything.
          */
-        if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
+        if (!asoc->ep->auth_enable || !asoc->peer.auth_capable)
                 return 0;
 
         /* If the key_id is non-zero and we couldn't find an
@@ -440,16 +439,16 @@ struct sctp_shared_key *sctp_auth_get_shkey(
  */
 int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
 {
-        struct net *net = sock_net(ep->base.sk);
         struct crypto_hash *tfm = NULL;
         __u16   id;
 
-        /* if the transforms are already allocted, we are done */
-        if (!net->sctp.auth_enable) {
+        /* If AUTH extension is disabled, we are done */
+        if (!ep->auth_enable) {
                 ep->auth_hmacs = NULL;
                 return 0;
         }
 
+        /* If the transforms are already allocated, we are done */
         if (ep->auth_hmacs)
                 return 0;
 
@@ -665,12 +664,10 @@ static int __sctp_auth_cid(sctp_cid_t chunk, struct sctp_chunks_param *param)
 /* Check if peer requested that this chunk is authenticated */
 int sctp_auth_send_cid(sctp_cid_t chunk, const struct sctp_association *asoc)
 {
-        struct net  *net;
         if (!asoc)
                 return 0;
 
-        net = sock_net(asoc->base.sk);
-        if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
+        if (!asoc->ep->auth_enable || !asoc->peer.auth_capable)
                 return 0;
 
         return __sctp_auth_cid(chunk, asoc->peer.peer_chunks);
@@ -679,12 +676,10 @@ int sctp_auth_send_cid(sctp_cid_t chunk, const struct sctp_association *asoc)
 /* Check if we requested that peer authenticate this chunk. */
 int sctp_auth_recv_cid(sctp_cid_t chunk, const struct sctp_association *asoc)
 {
-        struct net *net;
         if (!asoc)
                 return 0;
 
-        net = sock_net(asoc->base.sk);
-        if (!net->sctp.auth_enable)
+        if (!asoc->ep->auth_enable)
                 return 0;
 
         return __sctp_auth_cid(chunk,
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 8e5fdea05216..3d9f429858dc 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -68,7 +68,8 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         if (!ep->digest)
                 return NULL;
 
-        if (net->sctp.auth_enable) {
+        ep->auth_enable = net->sctp.auth_enable;
+        if (ep->auth_enable) {
                 /* Allocate space for HMACS and CHUNKS authentication
                  * variables.  There are arrays that we encode directly
                  * into parameters to make the rest of the operations easier.
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 3a1767ef3201..fee5552ddf92 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -219,6 +219,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
                              gfp_t gfp, int vparam_len)
 {
         struct net *net = sock_net(asoc->base.sk);
+        struct sctp_endpoint *ep = asoc->ep;
         sctp_inithdr_t init;
         union sctp_params addrs;
         size_t chunksize;
@@ -278,7 +279,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         chunksize += vparam_len;
 
         /* Account for AUTH related parameters */
-        if (net->sctp.auth_enable) {
+        if (ep->auth_enable) {
                 /* Add random parameter length*/
                 chunksize += sizeof(asoc->c.auth_random);
 
@@ -363,7 +364,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         }
 
         /* Add SCTP-AUTH chunks to the parameter list */
-        if (net->sctp.auth_enable) {
+        if (ep->auth_enable) {
                 sctp_addto_chunk(retval, sizeof(asoc->c.auth_random),
                                  asoc->c.auth_random);
                 if (auth_hmacs)
@@ -2010,7 +2011,7 @@ static void sctp_process_ext_param(struct sctp_association *asoc,
                         /* if the peer reports AUTH, assume that he
                          * supports AUTH.
                          */
-                        if (net->sctp.auth_enable)
+                        if (asoc->ep->auth_enable)
                                 asoc->peer.auth_capable = 1;
                         break;
                 case SCTP_CID_ASCONF:
@@ -2102,6 +2103,7 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
  *      SCTP_IERROR_NO_ERROR - continue with the chunk
  */
 static sctp_ierror_t sctp_verify_param(struct net *net,
+                                        const struct sctp_endpoint *ep,
                                         const struct sctp_association *asoc,
                                         union sctp_params param,
                                         sctp_cid_t cid,
@@ -2152,7 +2154,7 @@ static sctp_ierror_t sctp_verify_param(struct net *net,
                 goto fallthrough;
 
         case SCTP_PARAM_RANDOM:
-                if (!net->sctp.auth_enable)
+                if (!ep->auth_enable)