]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: use init_tag from inithdr for ABORT chunk
authorXin Long <lucien.xin@gmail.com>
Wed, 20 Oct 2021 11:42:41 +0000 (07:42 -0400)
committerJakub Kicinski <kuba@kernel.org>
Fri, 22 Oct 2021 19:36:43 +0000 (12:36 -0700)
commitc9a5c8e8e094de821aabbf1d93c0e2067ec48164
tree8fd9b74c6777b9f456d7185d324b20fb9eda1a71
parent91fe00fe905d6c35786a2280e5916d4c655f3c7a
sctp: use init_tag from inithdr for ABORT chunk

Currently Linux SCTP uses the verification tag of the existing SCTP
asoc when failing to process and sending the packet with the ABORT
chunk. This will result in the peer accepting the ABORT chunk and
removing the SCTP asoc. One could exploit this to terminate a SCTP
asoc.

This patch is to fix it by always using the initiate tag of the
received INIT chunk for the ABORT chunk to be sent.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/sctp/sm_statefuns.c