diff options
| author | Vlad Yasevich <vladislav.yasevich@hp.com> | 2007-05-04 22:34:09 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2007-05-04 22:34:09 +0200 |
| commit | 16d00fb7765a43a1b05989062e985d283b3a1f2d (patch) | |
| tree | 8395f341ee34c1bb57433253eb6b722b5644665c /net | |
| parent | [XFRM] SPD info TLV aggregation (diff) | |
| download | linux-16d00fb7765a43a1b05989062e985d283b3a1f2d.tar.xz linux-16d00fb7765a43a1b05989062e985d283b3a1f2d.zip | |
[SCTP]: Verify all destination ports in sctp_connectx.
We need to make sure that all destination ports are the same, since
the association really must not connect to multiple different ports
at once. This was reported on the sctp-impl list.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sctp/socket.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 2fc0a92caa78..b2ffab62a229 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -972,6 +972,7 @@ static int __sctp_connect(struct sock* sk, int walk_size = 0; union sctp_addr *sa_addr; void *addr_buf; + unsigned short port; sp = sctp_sk(sk); ep = sp->ep; @@ -992,6 +993,7 @@ static int __sctp_connect(struct sock* sk, while (walk_size < addrs_size) { sa_addr = (union sctp_addr *)addr_buf; af = sctp_get_af_specific(sa_addr->sa.sa_family); + port = ntohs(sa_addr->v4.sin_port); /* If the address family is not supported or if this address * causes the address buffer to overflow return EINVAL. @@ -1005,6 +1007,12 @@ static int __sctp_connect(struct sock* sk, if (err) goto out_free; + /* Make sure the destination port is correctly set + * in all addresses. + */ + if (asoc && asoc->peer.port && asoc->peer.port != port) + goto out_free; + memcpy(&to, sa_addr, af->sockaddr_len); /* Check if there already is a matching association on the |