mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-30 12:49:36 +00:00
sctp: process duplicated strreset out and addstrm out requests correctly
Now sctp stream reconf will process a request again even if it's seqno is less than asoc->strreset_inseq. If one request has been done successfully and some data chunks have been accepted and then a duplicated strreset out request comes, the streamin's ssn will be cleared. It will cause that stream will never receive chunks any more because of unsynchronized ssn. It allows a replay attack. A similar issue also exists when processing addstrm out requests. It will cause more extra streams being added. This patch is to fix it by saving the last 2 results into asoc. When a duplicated strreset out or addstrm out request is received, reply it with bad seqno if it's seqno < asoc->strreset_inseq - 2, and reply it with the result saved in asoc if it's seqno >= asoc->strreset_inseq - 2. Note that it saves last 2 results instead of only last 1 result, because two requests can be sent together in one chunk. And note that when receiving a duplicated request, the receiver side will still reply it even if the peer has received the response. It's safe, As the response will be dropped by the peer. Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
b89f04c61e
commit
e4dc99c7c2
2 changed files with 30 additions and 10 deletions
|
@ -1889,6 +1889,7 @@ struct sctp_association {
|
||||||
|
|
||||||
__u32 strreset_outseq; /* Update after receiving response */
|
__u32 strreset_outseq; /* Update after receiving response */
|
||||||
__u32 strreset_inseq; /* Update after receiving request */
|
__u32 strreset_inseq; /* Update after receiving request */
|
||||||
|
__u32 strreset_result[2]; /* save the results of last 2 responses */
|
||||||
|
|
||||||
struct sctp_chunk *strreset_chunk; /* save request chunk */
|
struct sctp_chunk *strreset_chunk; /* save request chunk */
|
||||||
|
|
||||||
|
|
|
@ -344,6 +344,13 @@ static sctp_paramhdr_t *sctp_chunk_lookup_strreset_param(
|
||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void sctp_update_strreset_result(struct sctp_association *asoc,
|
||||||
|
__u32 result)
|
||||||
|
{
|
||||||
|
asoc->strreset_result[1] = asoc->strreset_result[0];
|
||||||
|
asoc->strreset_result[0] = result;
|
||||||
|
}
|
||||||
|
|
||||||
struct sctp_chunk *sctp_process_strreset_outreq(
|
struct sctp_chunk *sctp_process_strreset_outreq(
|
||||||
struct sctp_association *asoc,
|
struct sctp_association *asoc,
|
||||||
union sctp_params param,
|
union sctp_params param,
|
||||||
|
@ -360,15 +367,19 @@ struct sctp_chunk *sctp_process_strreset_outreq(
|
||||||
if (ntohl(outreq->send_reset_at_tsn) >
|
if (ntohl(outreq->send_reset_at_tsn) >
|
||||||
sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map)) {
|
sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map)) {
|
||||||
result = SCTP_STRRESET_IN_PROGRESS;
|
result = SCTP_STRRESET_IN_PROGRESS;
|
||||||
goto out;
|
goto err;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (request_seq > asoc->strreset_inseq) {
|
if (TSN_lt(asoc->strreset_inseq, request_seq) ||
|
||||||
|
TSN_lt(request_seq, asoc->strreset_inseq - 2)) {
|
||||||
result = SCTP_STRRESET_ERR_BAD_SEQNO;
|
result = SCTP_STRRESET_ERR_BAD_SEQNO;
|
||||||
goto out;
|
goto err;
|
||||||
} else if (request_seq == asoc->strreset_inseq) {
|
} else if (TSN_lt(request_seq, asoc->strreset_inseq)) {
|
||||||
asoc->strreset_inseq++;
|
i = asoc->strreset_inseq - request_seq - 1;
|
||||||
|
result = asoc->strreset_result[i];
|
||||||
|
goto err;
|
||||||
}
|
}
|
||||||
|
asoc->strreset_inseq++;
|
||||||
|
|
||||||
/* Check strreset_enable after inseq inc, as sender cannot tell
|
/* Check strreset_enable after inseq inc, as sender cannot tell
|
||||||
* the peer doesn't enable strreset after receiving response with
|
* the peer doesn't enable strreset after receiving response with
|
||||||
|
@ -427,6 +438,8 @@ struct sctp_chunk *sctp_process_strreset_outreq(
|
||||||
GFP_ATOMIC);
|
GFP_ATOMIC);
|
||||||
|
|
||||||
out:
|
out:
|
||||||
|
sctp_update_strreset_result(asoc, result);
|
||||||
|
err:
|
||||||
return sctp_make_strreset_resp(asoc, result, request_seq);
|
return sctp_make_strreset_resp(asoc, result, request_seq);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -582,15 +595,19 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
|
||||||
__u32 result = SCTP_STRRESET_DENIED;
|
__u32 result = SCTP_STRRESET_DENIED;
|
||||||
struct sctp_stream_in *streamin;
|
struct sctp_stream_in *streamin;
|
||||||
__u32 request_seq, incnt;
|
__u32 request_seq, incnt;
|
||||||
__u16 in;
|
__u16 in, i;
|
||||||
|
|
||||||
request_seq = ntohl(addstrm->request_seq);
|
request_seq = ntohl(addstrm->request_seq);
|
||||||
if (request_seq > asoc->strreset_inseq) {
|
if (TSN_lt(asoc->strreset_inseq, request_seq) ||
|
||||||
|
TSN_lt(request_seq, asoc->strreset_inseq - 2)) {
|
||||||
result = SCTP_STRRESET_ERR_BAD_SEQNO;
|
result = SCTP_STRRESET_ERR_BAD_SEQNO;
|
||||||
goto out;
|
goto err;
|
||||||
} else if (request_seq == asoc->strreset_inseq) {
|
} else if (TSN_lt(request_seq, asoc->strreset_inseq)) {
|
||||||
asoc->strreset_inseq++;
|
i = asoc->strreset_inseq - request_seq - 1;
|
||||||
|
result = asoc->strreset_result[i];
|
||||||
|
goto err;
|
||||||
}
|
}
|
||||||
|
asoc->strreset_inseq++;
|
||||||
|
|
||||||
if (!(asoc->strreset_enable & SCTP_ENABLE_CHANGE_ASSOC_REQ))
|
if (!(asoc->strreset_enable & SCTP_ENABLE_CHANGE_ASSOC_REQ))
|
||||||
goto out;
|
goto out;
|
||||||
|
@ -638,6 +655,8 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
|
||||||
0, ntohs(addstrm->number_of_streams), 0, GFP_ATOMIC);
|
0, ntohs(addstrm->number_of_streams), 0, GFP_ATOMIC);
|
||||||
|
|
||||||
out:
|
out:
|
||||||
|
sctp_update_strreset_result(asoc, result);
|
||||||
|
err:
|
||||||
return sctp_make_strreset_resp(asoc, result, request_seq);
|
return sctp_make_strreset_resp(asoc, result, request_seq);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue