Commit 8a92cb47 authored by Xin Long's avatar Xin Long Committed by Jakub Kicinski
Browse files

sctp: discard stale INIT after handshake completion 



After an association reaches ESTABLISHED, the peer’s init_tag is already
known from the handshake. Any subsequent INIT with the same init_tag is
not a valid restart, but a delayed or duplicate INIT.

Drop such INIT chunks in sctp_sf_do_unexpected_init() instead of
processing them as new association attempts.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://patch.msgid.link/5788c76c1ee122a3ed00189e88dcf9df1fba226c.1777214801.git.lucien.xin@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 576a5d2b

net/sctp/sm_statefuns.c

+6 −0
Original line number Diff line number Diff line
@@ -1556,6 +1556,12 @@ static enum sctp_disposition sctp_sf_do_unexpected_init( 
	/* Tag the variable length parameters.  */

	chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));



	if (asoc->state >= SCTP_STATE_ESTABLISHED) {

		/* Discard INIT matching peer vtag after handshake completion (stale INIT). */

		if (ntohl(chunk->subh.init_hdr->init_tag) == asoc->peer.i.init_tag)

			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);

	}



	/* Verify the INIT chunk before processing it. */

	err_chunk = NULL;

	if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,