Commit e4dc99c7 authored by Xin Long's avatar Xin Long Committed by David S. Miller

sctp: process duplicated strreset out and addstrm out requests correctly

Now sctp stream reconf will process a request again even if it's seqno is
less than asoc->strreset_inseq.

If one request has been done successfully and some data chunks have been
accepted and then a duplicated strreset out request comes, the streamin's
ssn will be cleared. It will cause that stream will never receive chunks
any more because of unsynchronized ssn. It allows a replay attack.

A similar issue also exists when processing addstrm out requests. It will
cause more extra streams being added.

This patch is to fix it by saving the last 2 results into asoc. When a
duplicated strreset out or addstrm out request is received, reply it with
bad seqno if it's seqno < asoc->strreset_inseq - 2, and reply it with the
result saved in asoc if it's seqno >= asoc->strreset_inseq - 2.

Note that it saves last 2 results instead of only last 1 result, because
two requests can be sent together in one chunk.

And note that when receiving a duplicated request, the receiver side will
still reply it even if the peer has received the response. It's safe, As
the response will be dropped by the peer.
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b89f04c6
...@@ -1889,6 +1889,7 @@ struct sctp_association { ...@@ -1889,6 +1889,7 @@ struct sctp_association {
__u32 strreset_outseq; /* Update after receiving response */ __u32 strreset_outseq; /* Update after receiving response */
__u32 strreset_inseq; /* Update after receiving request */ __u32 strreset_inseq; /* Update after receiving request */
__u32 strreset_result[2]; /* save the results of last 2 responses */
struct sctp_chunk *strreset_chunk; /* save request chunk */ struct sctp_chunk *strreset_chunk; /* save request chunk */
......
...@@ -344,6 +344,13 @@ static sctp_paramhdr_t *sctp_chunk_lookup_strreset_param( ...@@ -344,6 +344,13 @@ static sctp_paramhdr_t *sctp_chunk_lookup_strreset_param(
return NULL; return NULL;
} }
static void sctp_update_strreset_result(struct sctp_association *asoc,
__u32 result)
{
asoc->strreset_result[1] = asoc->strreset_result[0];
asoc->strreset_result[0] = result;
}
struct sctp_chunk *sctp_process_strreset_outreq( struct sctp_chunk *sctp_process_strreset_outreq(
struct sctp_association *asoc, struct sctp_association *asoc,
union sctp_params param, union sctp_params param,
...@@ -360,15 +367,19 @@ struct sctp_chunk *sctp_process_strreset_outreq( ...@@ -360,15 +367,19 @@ struct sctp_chunk *sctp_process_strreset_outreq(
if (ntohl(outreq->send_reset_at_tsn) > if (ntohl(outreq->send_reset_at_tsn) >
sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map)) { sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map)) {
result = SCTP_STRRESET_IN_PROGRESS; result = SCTP_STRRESET_IN_PROGRESS;
goto out; goto err;
} }
if (request_seq > asoc->strreset_inseq) { if (TSN_lt(asoc->strreset_inseq, request_seq) ||
TSN_lt(request_seq, asoc->strreset_inseq - 2)) {
result = SCTP_STRRESET_ERR_BAD_SEQNO; result = SCTP_STRRESET_ERR_BAD_SEQNO;
goto out; goto err;
} else if (request_seq == asoc->strreset_inseq) { } else if (TSN_lt(request_seq, asoc->strreset_inseq)) {
asoc->strreset_inseq++; i = asoc->strreset_inseq - request_seq - 1;
result = asoc->strreset_result[i];
goto err;
} }
asoc->strreset_inseq++;
/* Check strreset_enable after inseq inc, as sender cannot tell /* Check strreset_enable after inseq inc, as sender cannot tell
* the peer doesn't enable strreset after receiving response with * the peer doesn't enable strreset after receiving response with
...@@ -427,6 +438,8 @@ struct sctp_chunk *sctp_process_strreset_outreq( ...@@ -427,6 +438,8 @@ struct sctp_chunk *sctp_process_strreset_outreq(
GFP_ATOMIC); GFP_ATOMIC);
out: out:
sctp_update_strreset_result(asoc, result);
err:
return sctp_make_strreset_resp(asoc, result, request_seq); return sctp_make_strreset_resp(asoc, result, request_seq);
} }
...@@ -582,15 +595,19 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out( ...@@ -582,15 +595,19 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
__u32 result = SCTP_STRRESET_DENIED; __u32 result = SCTP_STRRESET_DENIED;
struct sctp_stream_in *streamin; struct sctp_stream_in *streamin;
__u32 request_seq, incnt; __u32 request_seq, incnt;
__u16 in; __u16 in, i;
request_seq = ntohl(addstrm->request_seq); request_seq = ntohl(addstrm->request_seq);
if (request_seq > asoc->strreset_inseq) { if (TSN_lt(asoc->strreset_inseq, request_seq) ||
TSN_lt(request_seq, asoc->strreset_inseq - 2)) {
result = SCTP_STRRESET_ERR_BAD_SEQNO; result = SCTP_STRRESET_ERR_BAD_SEQNO;
goto out; goto err;
} else if (request_seq == asoc->strreset_inseq) { } else if (TSN_lt(request_seq, asoc->strreset_inseq)) {
asoc->strreset_inseq++; i = asoc->strreset_inseq - request_seq - 1;
result = asoc->strreset_result[i];
goto err;
} }
asoc->strreset_inseq++;
if (!(asoc->strreset_enable & SCTP_ENABLE_CHANGE_ASSOC_REQ)) if (!(asoc->strreset_enable & SCTP_ENABLE_CHANGE_ASSOC_REQ))
goto out; goto out;
...@@ -638,6 +655,8 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out( ...@@ -638,6 +655,8 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
0, ntohs(addstrm->number_of_streams), 0, GFP_ATOMIC); 0, ntohs(addstrm->number_of_streams), 0, GFP_ATOMIC);
out: out:
sctp_update_strreset_result(asoc, result);
err:
return sctp_make_strreset_resp(asoc, result, request_seq); return sctp_make_strreset_resp(asoc, result, request_seq);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment