Improve the input validation and processing of cookies.
This avoids setting the association in an inconsistent state, which could result in a use-after-free situation. This can be triggered by a malicious peer, if the peer can modify the cookie without the local endpoint recognizing it. Thanks to Ned Williamson for reporting the issue. MFC after: 3 days
This commit is contained in:
parent
822967e7e5
commit
b15f541113
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=366248
@ -2032,10 +2032,6 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
|
||||
vrf_id, port);
|
||||
return (NULL);
|
||||
}
|
||||
/* get the correct sctp_nets */
|
||||
if (netp)
|
||||
*netp = sctp_findnet(stcb, init_src);
|
||||
|
||||
asoc = &stcb->asoc;
|
||||
/* get scope variables out of cookie */
|
||||
asoc->scope.ipv4_local_scope = cookie->ipv4_scope;
|
||||
@ -2074,10 +2070,7 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
|
||||
asoc->advanced_peer_ack_point = asoc->last_acked_seq;
|
||||
|
||||
/* process the INIT info (peer's info) */
|
||||
if (netp)
|
||||
retval = sctp_process_init(init_cp, stcb);
|
||||
else
|
||||
retval = 0;
|
||||
retval = sctp_process_init(init_cp, stcb);
|
||||
if (retval < 0) {
|
||||
(void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
|
||||
SCTP_FROM_SCTP_INPUT + SCTP_LOC_19);
|
||||
@ -2191,19 +2184,21 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
|
||||
*/
|
||||
;
|
||||
}
|
||||
/* since we did not send a HB make sure we don't double things */
|
||||
if ((netp) && (*netp))
|
||||
(*netp)->hb_responded = 1;
|
||||
|
||||
if (stcb->asoc.sctp_autoclose_ticks &&
|
||||
sctp_is_feature_on(inp, SCTP_PCB_FLAGS_AUTOCLOSE)) {
|
||||
sctp_timer_start(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL);
|
||||
}
|
||||
(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
|
||||
if ((netp != NULL) && (*netp != NULL)) {
|
||||
*netp = sctp_findnet(stcb, init_src);
|
||||
if (*netp != NULL) {
|
||||
struct timeval old;
|
||||
|
||||
/* calculate the RTT and set the encaps port */
|
||||
/*
|
||||
* Since we did not send a HB, make sure we don't double
|
||||
* things.
|
||||
*/
|
||||
(*netp)->hb_responded = 1;
|
||||
/* Calculate the RTT. */
|
||||
old.tv_sec = cookie->time_entered.tv_sec;
|
||||
old.tv_usec = cookie->time_entered.tv_usec;
|
||||
sctp_calculate_rto(stcb, asoc, *netp, &old, SCTP_RTT_FROM_NON_DATA);
|
||||
|
@ -4242,7 +4242,9 @@ sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
|
||||
if ((ntohs(sin->sin_port) == 0) ||
|
||||
(sin->sin_addr.s_addr == INADDR_ANY) ||
|
||||
(sin->sin_addr.s_addr == INADDR_BROADCAST) ||
|
||||
IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
|
||||
IN_MULTICAST(ntohl(sin->sin_addr.s_addr)) ||
|
||||
(((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) != 0) &&
|
||||
(SCTP_IPV6_V6ONLY(inp) != 0))) {
|
||||
/* Invalid address */
|
||||
SCTP_INP_RUNLOCK(inp);
|
||||
SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
|
||||
@ -4261,7 +4263,8 @@ sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
|
||||
sin6 = (struct sockaddr_in6 *)firstaddr;
|
||||
if ((ntohs(sin6->sin6_port) == 0) ||
|
||||
IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
|
||||
IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
|
||||
IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr) ||
|
||||
((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)) {
|
||||
/* Invalid address */
|
||||
SCTP_INP_RUNLOCK(inp);
|
||||
SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
|
||||
|
Loading…
Reference in New Issue
Block a user