diff options
Diffstat (limited to 'net/sctp')
-rw-r--r-- | net/sctp/sm_make_chunk.c | 4 | ||||
-rw-r--r-- | net/sctp/sm_statefuns.c | 19 |
2 files changed, 3 insertions, 20 deletions
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index ea0f8fac3f01..0b1ddb1005ac 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c | |||
@@ -1775,7 +1775,9 @@ int sctp_verify_init(const struct sctp_association *asoc, | |||
1775 | 1775 | ||
1776 | /* Verify stream values are non-zero. */ | 1776 | /* Verify stream values are non-zero. */ |
1777 | if ((0 == peer_init->init_hdr.num_outbound_streams) || | 1777 | if ((0 == peer_init->init_hdr.num_outbound_streams) || |
1778 | (0 == peer_init->init_hdr.num_inbound_streams)) { | 1778 | (0 == peer_init->init_hdr.num_inbound_streams) || |
1779 | (0 == peer_init->init_hdr.init_tag) || | ||
1780 | (SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) { | ||
1779 | 1781 | ||
1780 | sctp_process_inv_mandatory(asoc, chunk, errp); | 1782 | sctp_process_inv_mandatory(asoc, chunk, errp); |
1781 | return 0; | 1783 | return 0; |
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index aa51d190bfb2..2c165dc9fb71 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c | |||
@@ -440,7 +440,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep, | |||
440 | { | 440 | { |
441 | struct sctp_chunk *chunk = arg; | 441 | struct sctp_chunk *chunk = arg; |
442 | sctp_init_chunk_t *initchunk; | 442 | sctp_init_chunk_t *initchunk; |
443 | __u32 init_tag; | ||
444 | struct sctp_chunk *err_chunk; | 443 | struct sctp_chunk *err_chunk; |
445 | struct sctp_packet *packet; | 444 | struct sctp_packet *packet; |
446 | sctp_error_t error; | 445 | sctp_error_t error; |
@@ -462,24 +461,6 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep, | |||
462 | /* Grab the INIT header. */ | 461 | /* Grab the INIT header. */ |
463 | chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data; | 462 | chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data; |
464 | 463 | ||
465 | init_tag = ntohl(chunk->subh.init_hdr->init_tag); | ||
466 | |||
467 | /* Verification Tag: 3.3.3 | ||
468 | * If the value of the Initiate Tag in a received INIT ACK | ||
469 | * chunk is found to be 0, the receiver MUST treat it as an | ||
470 | * error and close the association by transmitting an ABORT. | ||
471 | */ | ||
472 | if (!init_tag) { | ||
473 | struct sctp_chunk *reply = sctp_make_abort(asoc, chunk, 0); | ||
474 | if (!reply) | ||
475 | goto nomem; | ||
476 | |||
477 | sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply)); | ||
478 | return sctp_stop_t1_and_abort(commands, SCTP_ERROR_INV_PARAM, | ||
479 | ECONNREFUSED, asoc, | ||
480 | chunk->transport); | ||
481 | } | ||
482 | |||
483 | /* Verify the INIT chunk before processing it. */ | 464 | /* Verify the INIT chunk before processing it. */ |
484 | err_chunk = NULL; | 465 | err_chunk = NULL; |
485 | if (!sctp_verify_init(asoc, chunk->chunk_hdr->type, | 466 | if (!sctp_verify_init(asoc, chunk->chunk_hdr->type, |