3c68198e75
Currently sctp allows for the optional use of md5 of sha1 hmac algorithms to generate cookie values when establishing new connections via two build time config options. Theres no real reason to make this a static selection. We can add a sysctl that allows for the dynamic selection of these algorithms at run time, with the default value determined by the corresponding crypto library availability. This comes in handy when, for example running a system in FIPS mode, where use of md5 is disallowed, but SHA1 is permitted. Note: This new sysctl has no corresponding socket option to select the cookie hmac algorithm. I chose not to implement that intentionally, as RFC 6458 contains no option for this value, and I opted not to pollute the socket option namespace. Change notes: v2) * Updated subject to have the proper sctp prefix as per Dave M. * Replaced deafult selection options with new options that allow developers to explicitly select available hmac algs at build time as per suggestion by Vlad Y. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Vlad Yasevich <vyasevich@gmail.com> CC: "David S. Miller" <davem@davemloft.net> CC: netdev@vger.kernel.org Acked-by: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
87 lines
2.6 KiB
Text
87 lines
2.6 KiB
Text
#
|
|
# SCTP configuration
|
|
#
|
|
|
|
menuconfig IP_SCTP
|
|
tristate "The SCTP Protocol (EXPERIMENTAL)"
|
|
depends on INET && EXPERIMENTAL
|
|
depends on IPV6 || IPV6=n
|
|
select CRYPTO
|
|
select CRYPTO_HMAC
|
|
select CRYPTO_SHA1
|
|
select LIBCRC32C
|
|
---help---
|
|
Stream Control Transmission Protocol
|
|
|
|
From RFC 2960 <http://www.ietf.org/rfc/rfc2960.txt>.
|
|
|
|
"SCTP is a reliable transport protocol operating on top of a
|
|
connectionless packet network such as IP. It offers the following
|
|
services to its users:
|
|
|
|
-- acknowledged error-free non-duplicated transfer of user data,
|
|
-- data fragmentation to conform to discovered path MTU size,
|
|
-- sequenced delivery of user messages within multiple streams,
|
|
with an option for order-of-arrival delivery of individual user
|
|
messages,
|
|
-- optional bundling of multiple user messages into a single SCTP
|
|
packet, and
|
|
-- network-level fault tolerance through supporting of multi-
|
|
homing at either or both ends of an association."
|
|
|
|
To compile this protocol support as a module, choose M here: the
|
|
module will be called sctp.
|
|
|
|
If in doubt, say N.
|
|
|
|
if IP_SCTP
|
|
|
|
config NET_SCTPPROBE
|
|
tristate "SCTP: Association probing"
|
|
depends on PROC_FS && KPROBES
|
|
---help---
|
|
This module allows for capturing the changes to SCTP association
|
|
state in response to incoming packets. It is used for debugging
|
|
SCTP congestion control algorithms. If you don't understand
|
|
what was just said, you don't need it: say N.
|
|
|
|
To compile this code as a module, choose M here: the
|
|
module will be called sctp_probe.
|
|
|
|
config SCTP_DBG_MSG
|
|
bool "SCTP: Debug messages"
|
|
help
|
|
If you say Y, this will enable verbose debugging messages.
|
|
|
|
If unsure, say N. However, if you are running into problems, use
|
|
this option to gather detailed trace information
|
|
|
|
config SCTP_DBG_OBJCNT
|
|
bool "SCTP: Debug object counts"
|
|
depends on PROC_FS
|
|
help
|
|
If you say Y, this will enable debugging support for counting the
|
|
type of objects that are currently allocated. This is useful for
|
|
identifying memory leaks. This debug information can be viewed by
|
|
'cat /proc/net/sctp/sctp_dbg_objcnt'
|
|
|
|
If unsure, say N
|
|
|
|
config SCTP_COOKIE_HMAC_MD5
|
|
bool "Enable optional MD5 hmac cookie generation"
|
|
help
|
|
Enable optional MD5 hmac based SCTP cookie generation
|
|
default y
|
|
select CRYPTO_HMAC if SCTP_COOKIE_HMAC_MD5
|
|
select CRYPTO_MD5 if SCTP_COOKIE_HMAC_MD5
|
|
|
|
config SCTP_COOKIE_HMAC_SHA1
|
|
bool "Enable optional SHA1 hmac cookie generation"
|
|
help
|
|
Enable optional SHA1 hmac based SCTP cookie generation
|
|
default y
|
|
select CRYPTO_HMAC if SCTP_COOKIE_HMAC_SHA1
|
|
select CRYPTO_SHA1 if SCTP_COOKIE_HMAC_SHA1
|
|
|
|
|
|
endif # IP_SCTP
|