netdev - Re: [Lksctp-developers] [PATCH] SCTP: drop SACK if ctsn is not less than the next tsn of assoc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 1 Aug 2007 07:19:40 -0400
From:	Neil Horman <nhorman@...driver.com>
To:	Michael Tuexen <Michael.Tuexen@...chi.franken.de>
Cc:	Wei Yongjun <yjwei@...fujitsu.com>,
	Sridhar Samudrala <sri@...ibm.com>, netdev@...r.kernel.org,
	lksctp-developers@...ts.sourceforge.net
Subject: Re: [Lksctp-developers] [PATCH] SCTP: drop SACK if ctsn is not less than the next tsn of assoc

On Wed, Aug 01, 2007 at 11:01:21AM +0200, Michael Tuexen wrote:
> Hi Wei,
> 
> see my comments in-line.
> 
> Best regards
> Michael
> 
><snip >
> >(*1) At this point ctsn_ack_point=0,next_tsn=2, ctsn=1, SACK is  
> >accept.
> >After accept SACK, ctsn_ack_point=1.
> >(*2) At this point ctsn_ack_point=1,next_tsn=6, ctsn=5,TSN_lt(ctsn,
> >ctsn_ack_point) is ture, so accept SACK, and then ctsn_ack_point=5
> >(*3) At this point SACK is a dup SACK, ctsn_ack_point=5,next_tsn=6,
> >ctsn=1000,TSN_lt(ctsn, ctsn_ack_point) is ture, so accept SACK, and  
> >then
> >ctsn_ack_point=1000
> I would not consider it a duplicate SACK. RFC 4460, section 2.37.2 says
> that an implementation SHOULD abort the association when receiving a
> SACK acknowledging unsent data. So I would suggest to send an ABORT  
> chunk.

+1.  I didn't notice the ctsn value before.  We can't safely accept that a peer
pre-acks data we haven't sent.  Too many security holes.  

Neil



-- 
/***************************************************
 *Neil Horman
 *Software Engineer
 *Red Hat, Inc.
 *nhorman@...driver.com
 *gpg keyid: 1024D / 0x92A74FA1
 *http://pgp.mit.edu
 ***************************************************/
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html