8 files changed, 63 insertions, 11 deletions

diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 036bfcc8d15b..e45e44c60635 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -110,8 +110,9 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
                 spin_lock_bh(&sctp_local_addr_lock);
                 list_for_each_entry_safe(addr, temp,
                                         &sctp_local_addr_list, list) {
-                        if (ipv6_addr_equal(&addr->a.v6.sin6_addr,
-                                             &ifa->addr)) {
+                        if (addr->a.sa.sa_family == AF_INET6 &&
+                                        ipv6_addr_equal(&addr->a.v6.sin6_addr,
+                                                &ifa->addr)) {
                                 found = 1;
                                 addr->valid = 0;
                                 list_del_rcu(&addr->list);
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 213c2e2926a9..a7ba9e146dff 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -794,6 +794,9 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                         break;
 
                 case SCTP_CID_ABORT:
+                        if (sctp_test_T_bit(chunk)) {
+                                packet->vtag = asoc->c.my_vtag;
+                        }
                 case SCTP_CID_SACK:
                 case SCTP_CID_HEARTBEAT:
                 case SCTP_CID_HEARTBEAT_ACK:
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b34437fdea26..0ec234b762c2 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -650,7 +650,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
                 spin_lock_bh(&sctp_local_addr_lock);
                 list_for_each_entry_safe(addr, temp,
                                         &sctp_local_addr_list, list) {
-                        if (addr->a.v4.sin_addr.s_addr == ifa->ifa_local) {
+                        if (addr->a.sa.sa_family == AF_INET &&
+                                        addr->a.v4.sin_addr.s_addr ==
+                                        ifa->ifa_local) {
                                 found = 1;
                                 addr->valid = 0;
                                 list_del_rcu(&addr->list);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 0679bddf3a95..81b606424e12 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1982,7 +1982,10 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
                                         struct sctp_chunk *chunk,
                                         struct sctp_chunk **err_chunk)
 {
+        struct sctp_hmac_algo_param *hmacs;
         int retval = SCTP_IERROR_NO_ERROR;
+        __u16 n_elt, id = 0;
+        int i;
 
         /* FIXME - This routine is not looking at each parameter per the
          * chunk type, i.e., unrecognized parameters should be further
@@ -2056,9 +2059,29 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
                 break;
 
         case SCTP_PARAM_HMAC_ALGO:
-                if (sctp_auth_enable)
-                        break;
-                /* Fall Through */
+                if (!sctp_auth_enable)
+                        goto fallthrough;
+
+                hmacs = (struct sctp_hmac_algo_param *)param.p;
+                n_elt = (ntohs(param.p->length) - sizeof(sctp_paramhdr_t)) >> 1;
+
+                /* SCTP-AUTH: Section 6.1
+                 * The HMAC algorithm based on SHA-1 MUST be supported and
+                 * included in the HMAC-ALGO parameter.
+                 */
+                for (i = 0; i < n_elt; i++) {
+                        id = ntohs(hmacs->hmac_ids[i]);
+
+                        if (id == SCTP_AUTH_HMAC_ID_SHA1)
+                                break;
+                }
+
+                if (id != SCTP_AUTH_HMAC_ID_SHA1) {
+                        sctp_process_inv_paramlength(asoc, param.p, chunk,
+                                                     err_chunk);
+                        retval = SCTP_IERROR_ABORT;
+                }
+                break;
 fallthrough:
         default:
                 SCTP_DEBUG_PRINTK("Unrecognized param: %d for chunk %d.\n",
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 13beed263e31..23a9f1a95b7d 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1529,6 +1529,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         error = sctp_auth_asoc_init_active_key(asoc,
                                                 GFP_ATOMIC);
                         break;
+                case SCTP_CMD_UPDATE_INITTAG:
+                        asoc->peer.i.init_tag = cmd->obj.u32;
+                        break;
 
                 default:
                         printk(KERN_WARNING "Impossible command: %u, %p\n",
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 622284805500..0c9d5a6950fe 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4138,6 +4138,24 @@ static sctp_disposition_t sctp_sf_abort_violation(
                 goto nomem;
 
         if (asoc) {
+                /* Treat INIT-ACK as a special case during COOKIE-WAIT. */
+                if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
+                    !asoc->peer.i.init_tag) {
+                        sctp_initack_chunk_t *initack;
+
+                        initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
+                        if (!sctp_chunk_length_valid(chunk,
+                                                     sizeof(sctp_initack_chunk_t)))
+                                abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
+                        else {
+                                unsigned int inittag;
+
+                                inittag = ntohl(initack->init_hdr.init_tag);
+                                sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
+                                                SCTP_U32(inittag));
+                        }
+                }
+
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
                 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 
@@ -4343,6 +4361,7 @@ sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
                                        sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *repl;
+        struct sctp_association* my_asoc;
 
         /* The comment below says that we enter COOKIE-WAIT AFTER
          * sending the INIT, but that doesn't actually work in our
@@ -4366,8 +4385,8 @@ sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
         /* Cast away the const modifier, as we want to just
          * rerun it through as a sideffect.
          */
-        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC,
-                        SCTP_ASOC((struct sctp_association *) asoc));
+        my_asoc = (struct sctp_association *)asoc;
+        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
 
         /* Choose transport for INIT. */
         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 8c90289ba400..e7e3baf7009e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5848,11 +5848,12 @@ SCTP_STATIC int sctp_msghdr_parse(const struct msghdr *msg,
                                   sctp_cmsgs_t *cmsgs)
 {
         struct cmsghdr *cmsg;
+        struct msghdr *my_msg = (struct msghdr *)msg;
 
         for (cmsg = CMSG_FIRSTHDR(msg);
              cmsg != NULL;
-             cmsg = CMSG_NXTHDR((struct msghdr*)msg, cmsg)) {
-                if (!CMSG_OK(msg, cmsg))
+             cmsg = CMSG_NXTHDR(my_msg, cmsg)) {
+                if (!CMSG_OK(my_msg, cmsg))
                         return -EINVAL;
 
                 /* Should we parse this header or ignore?  */
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index b43f1f110f87..ce6cda6b6994 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -859,7 +859,7 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event)
         union sctp_notification *notification;
         struct sk_buff *skb;
 
-        skb = sctp_event2skb((struct sctp_ulpevent *)event);
+        skb = sctp_event2skb(event);
         notification = (union sctp_notification *) skb->data;
         return notification->sn_header.sn_type;
 }