Skip to content
Snippets Groups Projects
Commit 83331bb5 authored by Michael Tüxen's avatar Michael Tüxen
Browse files

Allow injected COOKIE_ECHO chunks to be bundled with other chunks.

parent 4d6efa57
No related branches found
No related tags found
No related merge requests found
...@@ -2154,8 +2154,11 @@ static int do_inbound_script_packet( ...@@ -2154,8 +2154,11 @@ static int do_inbound_script_packet(
if (socket->state == SOCKET_PASSIVE_INIT_ACK_SENT) { if (socket->state == SOCKET_PASSIVE_INIT_ACK_SENT) {
for (; item != NULL; item = item->next) { for (; item != NULL; item = item->next) {
if (item->chunk->type == SCTP_COOKIE_ECHO_CHUNK_TYPE) { if (item->chunk->type == SCTP_COOKIE_ECHO_CHUNK_TYPE) {
assert(item->next == NULL); /*FIXME: Handle chunks after the COOKIE_ECHO */
offset = socket->prepared_state_cookie_length - item->length; offset = socket->prepared_state_cookie_length - item->length;
assert(packet->ip_bytes + offset <= packet->buffer_bytes);
memmove((u8 *)item->chunk + item->length + offset,
(u8 *)item->chunk + item->length,
packet_end(packet) - ((u8 *)item->chunk + item->length));
memcpy(item->chunk, socket->prepared_state_cookie, socket->prepared_state_cookie_length); memcpy(item->chunk, socket->prepared_state_cookie, socket->prepared_state_cookie_length);
item->length = socket->prepared_state_cookie_length; item->length = socket->prepared_state_cookie_length;
packet->buffer_bytes += offset; packet->buffer_bytes += offset;
......
...@@ -4,21 +4,22 @@ ...@@ -4,21 +4,22 @@
+0.0 listen(3, 1) = 0 +0.0 listen(3, 1) = 0
+0.0 < sctp: INIT[tag=1 a_rwnd=1500 os=1 is=1 tsn=0] +0.0 < sctp: INIT[tag=1 a_rwnd=1500 os=1 is=1 tsn=0]
+0.0 > sctp: INIT_ACK[tag=2 tsn=10] // faked cookie +0.0 > sctp: INIT_ACK[tag=2 tsn=10] // faked cookie
+0.1 < sctp: COOKIE_ECHO[] // syntax not clear +0.1 < sctp: COOKIE_ECHO[]; DATA[tsn=0 sid=0 ssn=0 ppid=0]// syntax not clear
+0.0 > sctp: COOKIE_ACK[] +0.0 > sctp: COOKIE_ACK[]; SACK[tsn=0]
+0.0 accept(3, ..., ...) = 4 +0.0 accept(3, ..., ...) = 4
+0.0 read(4, ..., 1000) = 1000
// Send some data. // Send some data.
+1.0 write(4, ..., 1000) = 1000 +1.0 write(4, ..., 1000) = 1000
+0.0 > sctp: DATA[tsn=10 sid=0 ssn=0 ppid=0] +0.0 > sctp: DATA[tsn=10 sid=0 ssn=0 ppid=0]
+0.1 < sctp: SACK[tsn=10 a_rwnd=1500] +0.1 < sctp: SACK[tsn=10 a_rwnd=1500]
// Receive some data // Receive some data
+1.0 < sctp: DATA[tsn=0 sid=0 ssn=0 ppid=0] // How to handle payload? +1.0 < sctp: DATA[tsn=1 sid=0 ssn=1 ppid=0] // How to handle payload?
+0.0 read(4, ..., 2000) = 1000 +0.0 read(4, ..., 2000) = 1000
+0.0 > sctp: SACK[tsn=0] +0.2 > sctp: SACK[tsn=1]
// Receive more data, observe delayed SACKi // Receive more data, observe delayed SACKi
+1.0 < sctp: DATA[tsn=1 sid=0 ssn=1 ppid=0] +1.0 < sctp: DATA[tsn=2 sid=0 ssn=2 ppid=0]
+0.0 read(4, ..., 2000) = 1000 +0.0 read(4, ..., 2000) = 1000
+0.2 > sctp: SACK[tsn=1] +0.2 > sctp: SACK[tsn=2]
// Tear down the association // Tear down the association
+1.0 < sctp: SHUTDOWN[tsn=0] +1.0 < sctp: SHUTDOWN[tsn=0]
+0.0 > sctp: SHUTDOWN_ACK[] +0.0 > sctp: SHUTDOWN_ACK[]
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment