pf: verify that ABORT chunks are not mixed with DATA chunks

RFC4960 3.3.7: DATA chunks MUST NOT be bundled with ABORT.

MFC after:	2 weeks
Sponsored by:	Orange Business Services

(cherry picked from commit 541ea3d7828e0ede161ac2d8ef3e8419657ef5cb)

sys/netpfil/pf/pf_norm.c

@@ -2186,6 +2186,14 @@ pf_scan_sctp(struct mbuf *m, int ipoff, int off, struct pf_pdesc *pd,
 	if ((pd->sctp_flags & PFDESC_SCTP_SHUTDOWN_COMPLETE) &&
 	    (pd->sctp_flags & ~PFDESC_SCTP_SHUTDOWN_COMPLETE))
 		return (PF_DROP);
+	if ((pd->sctp_flags & PFDESC_SCTP_ABORT) &&
+	    (pd->sctp_flags & PFDESC_SCTP_DATA)) {
+		/*
+		 * RFC4960 3.3.7: DATA chunks MUST NOT be
+		 * bundled with ABORT.
+		 */
+		return (PF_DROP);
+	}
 
 	return (PF_PASS);
 }