From owner-freebsd-net@FreeBSD.ORG Thu Jan 29 17:42:45 2009 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E80FA106566C for ; Thu, 29 Jan 2009 17:42:45 +0000 (UTC) (envelope-from peter.lei@ieee.org) Received: from QMTA10.westchester.pa.mail.comcast.net (qmta10.westchester.pa.mail.comcast.net [76.96.62.17]) by mx1.freebsd.org (Postfix) with ESMTP id 8D3318FC12 for ; Thu, 29 Jan 2009 17:42:45 +0000 (UTC) (envelope-from peter.lei@ieee.org) Received: from OMTA01.westchester.pa.mail.comcast.net ([76.96.62.11]) by QMTA10.westchester.pa.mail.comcast.net with comcast id 9PTN1b0080EZKEL5AVVWc7; Thu, 29 Jan 2009 17:29:30 +0000 Received: from [10.10.0.38] ([98.228.214.213]) by OMTA01.westchester.pa.mail.comcast.net with comcast id 9VVV1b00U4cpPwJ3MVVWtJ; Thu, 29 Jan 2009 17:29:30 +0000 Message-Id: <0EEEB325-C7AF-468F-9374-EFED1BD3B3E4@ieee.org> From: Peter Lei To: =?ISO-8859-1?Q?Michael_T=FCxen?= In-Reply-To: Content-Type: multipart/signed; boundary=Apple-Mail-1--607587122; micalg=sha1; protocol="application/pkcs7-signature" Mime-Version: 1.0 (Apple Message framework v930.3) Date: Thu, 29 Jan 2009 11:29:24 -0600 References: <4980B747.7070400@free.fr> X-Mailer: Apple Mail (2.930.3) X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: freebsd-net@freebsd.org, Yann WANWANSCAPPEL Subject: Re: SCTP, possible bug in peer authentication key X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Jan 2009 17:42:46 -0000 --Apple-Mail-1--607587122 Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable There's a corresponding change that is needed for pulling the auth info out of the cookie for the other direction (i.e. server side =20 handling). I've committed that into the SCTP project repo, and should also get in with Randall's next commit. --peter On Jan 29, 2009, at 2:23 AM, Michael T=FCxen wrote: > Hi Yann, > > very good catch! You are right. > > I have committed your patch to Randalls repository, so it will > show up in the FreeBSD sources soon (next time he syncs them)... > > Best regards > Michael > > On Jan 28, 2009, at 8:51 PM, Yann WANWANSCAPPEL wrote: > >> Hi all, >> >> I think I found a bug in the SCTP authentication code, in >> sctp_load_addresses_from_init() in sctp_pcb.c >> >> keylen =3D sizeof(*p_random) + random_len + sizeof(*chunks) + =20 >> num_chunks + >> sizeof(*hmacs) + hmacs_len; >> >> The keylen calculation assumes the Chunk List Parameter (CHUNKS) >> vl-param was present in the received INIT packet, which can be =20 >> false if >> peer SCTP does not require any chunk to be authenticated (this =20 >> typically >> occurs if peer does not support ASCONF). >> >>> =46rom RFC 4895, 6.1 >> >> * An SCTP endpoint has a list of chunks it only accepts if they are >> * received in an authenticated way. This list is included in the =20 >> INIT >> * and INIT-ACK, and MAY be omitted if it is empty. Since this list >> * does not change during the lifetime of the SCTP endpoint there is =20= >> no >> * problem in case of INIT collision. >> >> This case is properly handled later in the build of the key >> >> /* append in the AUTH chunks */ >> if (chunks !=3D NULL) { >> ..... >> } >> >> I think the calculated keylen should be something like this : >> >> keylen =3D sizeof(*p_random) + random_len + sizeof(*hmacs) + = hmacs_len; >> >> if (chunks !=3D NULL) { >> keylen +=3D sizeof(*chunks) + num_chunks >> } >> >> This problem results in authenticated packets sent from peer SCTP =20 >> to be >> discarded. >> >> The problem does not occurs if peer SCTP is modified to send an empty >> Chunk List Parameter, (eg num_chunks =3D 0 in the decoding). >> >> Br, >> Yann >> >> >> >> >> >> >> >> >> >> _______________________________________________ >> freebsd-net@freebsd.org mailing list >> http://lists.freebsd.org/mailman/listinfo/freebsd-net >> To unsubscribe, send any mail to "freebsd-net-=20 >> unsubscribe@freebsd.org" >> > > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" --Apple-Mail-1--607587122--