Commit d023f629 authored by Vlad Yasevich's avatar Vlad Yasevich Committed by David S. Miller

[SCTP]: Verify some mandatory parameters.

Verify init_tag and a_rwnd mandatory parameters in INIT and
INIT-ACK chunks.
Signed-off-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: default avatarSridhar Samudrala <sri@us.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ebdfcad4
...@@ -1775,7 +1775,9 @@ int sctp_verify_init(const struct sctp_association *asoc, ...@@ -1775,7 +1775,9 @@ int sctp_verify_init(const struct sctp_association *asoc,
/* Verify stream values are non-zero. */ /* Verify stream values are non-zero. */
if ((0 == peer_init->init_hdr.num_outbound_streams) || if ((0 == peer_init->init_hdr.num_outbound_streams) ||
(0 == peer_init->init_hdr.num_inbound_streams)) { (0 == peer_init->init_hdr.num_inbound_streams) ||
(0 == peer_init->init_hdr.init_tag) ||
(SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) {
sctp_process_inv_mandatory(asoc, chunk, errp); sctp_process_inv_mandatory(asoc, chunk, errp);
return 0; return 0;
......
...@@ -440,7 +440,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep, ...@@ -440,7 +440,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
{ {
struct sctp_chunk *chunk = arg; struct sctp_chunk *chunk = arg;
sctp_init_chunk_t *initchunk; sctp_init_chunk_t *initchunk;
__u32 init_tag;
struct sctp_chunk *err_chunk; struct sctp_chunk *err_chunk;
struct sctp_packet *packet; struct sctp_packet *packet;
sctp_error_t error; sctp_error_t error;
...@@ -462,24 +461,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep, ...@@ -462,24 +461,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
/* Grab the INIT header. */ /* Grab the INIT header. */
chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data; chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
init_tag = ntohl(chunk->subh.init_hdr->init_tag);
/* Verification Tag: 3.3.3
* If the value of the Initiate Tag in a received INIT ACK
* chunk is found to be 0, the receiver MUST treat it as an
* error and close the association by transmitting an ABORT.
*/
if (!init_tag) {
struct sctp_chunk *reply = sctp_make_abort(asoc, chunk, 0);
if (!reply)
goto nomem;
sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
return sctp_stop_t1_and_abort(commands, SCTP_ERROR_INV_PARAM,
ECONNREFUSED, asoc,
chunk->transport);
}
/* Verify the INIT chunk before processing it. */ /* Verify the INIT chunk before processing it. */
err_chunk = NULL; err_chunk = NULL;
if (!sctp_verify_init(asoc, chunk->chunk_hdr->type, if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment