pf: initial SCTP support

[kp]

Summary

Basic state tracking for SCTP. This means we scan through the packet to
identify the different chunks (so we can identify state changes).

MFC after: 3 weeks
Sponsored by: Orange Business Services

[tuexen]

sys/netpfil/pf/pf_norm.c

2026

Does this loop provide a way for a DOS attack? Assume an attacker sends a lot of packets containing, for example, (1500 - 12) / 4 = 372 chunks?

2032

If an attacker sends a chunk with chunk_length == 0, doesn't this results in an endless loop?

2132

The same applies to INIT ACK and SHUTDOWN COMPLETE chunks. Why is this not tested?

[kp]

Improve validation of INIT chunks

initiate_tag, num_inbound_streams and num_outbound_streams may not be zero.
v_tag must be zero.

Ensure that the INIT chunk is the only chunk in the packet.

[kp]

Remove redundant check

[kp]

• rebase
• use sctp_calculate_cksum() via pf_sctp_checksum()