d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Harden the handling of outgoing streams in case of an restart or INIT

Browse Source 
collision. This avouds an out-of-bounce access in case the peer can
break the cookie signature. Thanks to Felix Wilhelm from Google for
reporting the issue.

MFC after:		1 week
This commit is contained in:
Michael Tuexen 2020-12-13 23:51:51 +00:00
parent 6404d7ffc1
commit 0066de1c4b
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=368622
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/netinet/sctp_input.c
View File

@ -1699,7 +1699,9 @@ sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
NULL);
}
asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
if (asoc->pre_open_streams < asoc->streamoutcnt) {
asoc->pre_open_streams = asoc->streamoutcnt;
}
if (ntohl(init_cp->init.initiate_tag) != asoc->peer_vtag) {
/*
@ -1831,7 +1833,9 @@ sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
/* move to OPEN state, if not in SHUTDOWN_SENT */
SCTP_SET_STATE(stcb, SCTP_STATE_OPEN);
}
asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
if (asoc->pre_open_streams < asoc->streamoutcnt) {
asoc->pre_open_streams = asoc->streamoutcnt;
}
asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
@ -2108,7 +2112,6 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
/* process the INIT-ACK info (my info) */
asoc->my_vtag = ntohl(initack_cp->init.initiate_tag);
asoc->my_rwnd = ntohl(initack_cp->init.a_rwnd);
asoc->pre_open_streams = ntohs(initack_cp->init.num_outbound_streams);
asoc->init_seq_number = ntohl(initack_cp->init.initial_tsn);
asoc->sending_seq = asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number;
asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;