netdev - Re: [PATCH 2.6.25 9/9] SCTP: Follow Add-IP security consideratiosn wrt INIT/INIT-ACK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20071220.141339.196266068.davem@davemloft.net>
Date:	Thu, 20 Dec 2007 14:13:39 -0800 (PST)
From:	David Miller <davem@...emloft.net>
To:	vladislav.yasevich@...com
Cc:	netdev@...r.kernel.org, lksctp-developers@...ts.sourceforge.net
Subject: Re: [PATCH 2.6.25 9/9] SCTP: Follow Add-IP security consideratiosn
 wrt INIT/INIT-ACK

From: Vlad Yasevich <vladislav.yasevich@...com>
Date: Mon, 17 Dec 2007 16:32:49 -0500

> The Security Considerations section of RFC 5061 has the following
> text:
> 
>    If an SCTP endpoint that supports this extension receives an INIT
>    that indicates that the peer supports the ASCONF extension but does
>    NOT support the [RFC4895] extension, the receiver of such an INIT
>    MUST send an ABORT in response.  Note that an implementation is
>    allowed to silently discard such an INIT as an option as well, but
>    under NO circumstance is an implementation allowed to proceed with
>    the association setup by sending an INIT-ACK in response.
> 
>    An implementation that receives an INIT-ACK that indicates that the
>    peer does not support the [RFC4895] extension MUST NOT send the
>    COOKIE-ECHO to establish the association.  Instead, the
>    implementation MUST discard the INIT-ACK and report to the upper-
>    layer user that an association cannot be established destroying the
>    Transmission Control Block (TCB).
> 
> Follow the recomendations.
> 
> Signed-off-by: Vlad Yasevich <vladislav.yasevich@...com>

Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html