sctp: discard ABORT chunk with zero verification tag in COOKIE-WAIT

PATCH New Wei Yongjun 1 participant 1 message Jan 12, 2010

Subsystems (2)

Networking SCTP protocol

lore

Share & tools

lore

Wei Yongjun

author

2010-01-12 08:17 UTC #0 lore raw

PATCH 1/1 sctp: discard ABORT chunk with zero verification tag in COOKIE-WAIT

In current implementation if ABORT chunk is received with T flag is set and zero verification tag in COOKIE-WAIT state, the ABORT chunk will be always accepted. This is because in COOKIE-WAIT state, the endpoint does not know the peer's verification tag, and it's zero in the endpoint.

Signed-off-by Wei Yongjun <[email protected]>

---
 include/net/sctp/sm.h |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

include/net/sctp/sm.h +1 -1

index 851c813..273a8bb 100644
@@ -437,7 +437,7 @@ sctp_vtag_verify_either(const struct sctp_chunk *chunk,
 	 */
         if ((!sctp_test_T_bit(chunk) &&
              (ntohl(chunk->sctp_hdr->vtag) = asoc->c.my_vtag)) ||
-	    (sctp_test_T_bit(chunk) &&
+	    (sctp_test_T_bit(chunk) && asoc->c.peer_vtag &&
 	     (ntohl(chunk->sctp_hdr->vtag) = asoc->c.peer_vtag))) {
                 return 1;
 	}

Signature · 1 line

1.6.2.2