Bug 485933 - Use CONFIG_SCTP_HMAC_SHA1 instead of ..._MD5
Use CONFIG_SCTP_HMAC_SHA1 instead of ..._MD5
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
rawhide
All Linux
low Severity low
: ---
: ---
Assigned To: Neil Horman
Fedora Extras Quality Assurance
:
Depends On:
Blocks: fedora-sha2-pkgs
  Show dependency treegraph
 
Reported: 2009-02-17 10:14 EST by Miloslav Trmač
Modified: 2009-04-01 01:48 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-04-01 01:48:15 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Miloslav Trmač 2009-02-17 10:14:23 EST
Version-Release number of selected component (if applicable):
kernel-2.6.27.12-170.2.5.fc10.x86_64

Disclaimer: I know very little about SCTP, and I don't use it.

The cookies used for connection establishment (similar to TCP SYN cookies) use a configurable hash type.  The Fedora kernel currently uses a MD5 HMAC; MD5 is all but broken, it seems prudent to change the configuration to use a SHA-1 HMAC.
Comment 1 Neil Horman 2009-02-18 14:05:51 EST
I think there has been some concern in the past here that using SHA1 hmacs might be a problem on some older systems that don't support that algorithm.   But its probably worth updating rawhide, if for no other reason than to see what breaks.
Comment 2 Miloslav Trmač 2009-02-18 14:14:04 EST
As far as I understand sctp, these cookies are only used by the host that generated them, so the only possible compatibility problem could arise if the peer has buffers so small that they can not handle the additional 4 bytes.
Comment 3 Chuck Ebbert 2009-04-01 01:48:15 EDT
This has been done:

config-generic:# CONFIG_SCTP_HMAC_NONE is not set
config-generic:CONFIG_SCTP_HMAC_SHA1=y
config-generic:# CONFIG_SCTP_HMAC_MD5 is not set

Note You need to log in before you can comment on or make changes to this bug.