linux.git/net/sctp, branch v2.6.23

fix sctp_del_bind_addr() last argument type

2007-09-26T16:22:04+00:00

It gets pointer to fastcall function, expects a pointer to normal
one and calls the sucker.

Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

SCTP : Add paramters validity check for ASCONF chunk

2007-09-26T05:55:49+00:00

If ADDIP is enabled, when an ASCONF chunk is received with ASCONF
paramter length set to zero, this will cause infinite loop.
By the way, if an malformed ASCONF chunk is received, will cause
processing to access memory without verifying.

This is because of not check the validity of parameters in ASCONF chunk.
This patch fixed this.

Signed-off-by: Wei Yongjun 
Signed-off-by: Vlad Yasevich

SCTP: Discard OOTB packetes with bundled INIT early.

2007-09-26T05:55:48+00:00

RFC 4460 and future RFC 4960 (2960-bis) specify that packets
with bundled INIT chunks need to be dropped.  We currenlty do
that only after processing any leading chunks.  For OOTB chunks,
since we already walk the entire packet, we should discard packets
with bundled INITs.

There are other chunks chunks that MUST NOT be bundled, but the spec
is silent on theire treatment.  Thus, we'll leave their teatment
alone for the moment.

Signed-off-by: Vlad Yasevich 
Acked-by: Wei Yongjun

SCTP: Clean up OOTB handling and fix infinite loop processing

2007-09-26T05:55:47+00:00

While processing OOTB chunks as well as chunks with an invalid
length of 0, it was possible to SCTP to get wedged inside an
infinite loop because we didn't catch the condition correctly,
or didn't mark the packet for discard correctly.
This work is based on original findings and work by
Wei Yongjun 

Signed-off-by: Vlad Yasevich

SCTP: Explicitely discard OOTB chunks

2007-09-26T05:55:47+00:00

Explicitely discard OOTB chunks, whether the result is a
SHUTDOWN COMPLETE or an ABORT.  We need to discard the OOTB
SHUTDOWN ACK to prevent bombing attackes since responsed
MUST NOT be bundled.  We also explicietely discard in the
ABORT case since that function is widely used internally.

Signed-off-by: Vlad Yasevich 
Acked-by: Neil Horman

SCTP: Send ABORT chunk with correct tag in response to INIT ACK

2007-09-26T05:55:46+00:00

When SCTP client received an INIT ACK chunk with missing mandatory
parameter such as "cookie parameter", it will send back a ABORT
with T-bit not set and verification tag is set to 0.
This is because before we accept this INIT ACK chunk, we do not know
the peer's tag.  This patch change to reflect vtag when responding to
INIT ACK with missing mandatory parameter.

Signed-off-by: Wei Yongjun 
Signed-off-by: Vlad Yasevich

SCTP: Validate buffer room when processing sequential chunks

2007-09-26T05:55:45+00:00

When we process bundled chunks, we need to make sure that
the skb has the buffer for each header since we assume it's
always there.  Some malicious node can send us something like
DATA + 2 bytes and we'll try to walk off the end refrencing
potentially uninitialized memory.

Signed-off-by: Vlad Yasevich

[SCTP]: Convert bind_addr_list locking to RCU

2007-09-16T23:03:28+00:00

Since the sctp_sockaddr_entry is now RCU enabled as part of
the patch to synchronize sctp_localaddr_list, it makes sense to
change all handling of these entries to RCU.  This includes the
sctp_bind_addrs structure and it's list of bound addresses.

This list is currently protected by an external rw_lock and that
looks like an overkill.  There are only 2 writers to the list:
bind()/bindx() calls, and BH processing of ASCONF-ACK chunks.
These are already seriealized via the socket lock, so they will
not step on each other.  These are also relatively rare, so we
should be good with RCU.

The readers are varied and they are easily converted to RCU.

Signed-off-by: Vlad Yasevich 
Acked-by: Paul E. McKenney 
Acked-by: Sridhar Samdurala 
Signed-off-by: David S. Miller

[SCTP]: Add RCU synchronization around sctp_localaddr_list

2007-09-16T23:02:12+00:00

sctp_localaddr_list is modified dynamically via NETDEV_UP
and NETDEV_DOWN events, but there is not synchronization
between writer (even handler) and readers.  As a result,
the readers can access an entry that has been freed and
crash the sytem.

Signed-off-by: Vlad Yasevich 
Acked-by: Paul E. McKenney 
Acked-by: Sridhar Samdurala 
Signed-off-by: David S. Miller

SCTP: Fix to handle invalid parameter length correctly

2007-08-30T20:44:27+00:00

If an INIT with invalid parameter length look like this:
Parameter Type : 1
Parameter Length: 800
and not contain any payload, SCTP will ignore this  parameter and send
back a INIT-ACK.
This patch is fix to handle this invalid parameter length correctly.

Signed-off-by: Wei Yongjun 
Signed-off-by: Vlad Yasevich