d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sctp: improve handling of illegal packets containing INIT chunks

Browse Source 
Stop further processing of a packet when detecting that it
contains an INIT chunk, which is too small or is not the only
chunk in the packet. Still allow to finish the processing
of chunks before the INIT chunk.

Thanks to Antoly Korniltsev and Taylor Brandstetter for reporting
an issue with the userland stack, which made me aware of this
issue.

MFC after:	3 days
This commit is contained in:
Michael Tuexen 2021-04-26 10:38:05 +02:00
parent 9f1dc86c46
commit c70d1ef15d
1 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/netinet/sctp_input.c
View File

@ -4611,10 +4611,7 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
chunk_buf); chunk_buf);
if (ch == NULL) { if (ch == NULL) {
*offset = length; *offset = length;
if (stcb != NULL) { return (stcb);
SCTP_TCB_UNLOCK(stcb);
}
return (NULL);
} }
num_chunks++; num_chunks++;
@ -4648,12 +4645,12 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
/* The INIT chunk must be the only chunk. */ /* The INIT chunk must be the only chunk. */
if ((num_chunks > 1) || if ((num_chunks > 1) ||
(length - *offset > (int)SCTP_SIZE32(chk_length))) { (length - *offset > (int)SCTP_SIZE32(chk_length))) {
/* RFC 4960 requires that no ABORT is sent */ /*
* RFC 4960bis requires stopping the
* processing of the packet.
*/
*offset = length; *offset = length;
if (stcb != NULL) { return (stcb);
SCTP_TCB_UNLOCK(stcb);
}
return (NULL);
} }
/* Honor our resource limit. */ /* Honor our resource limit. */
if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) { if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {