[PATCH nf] netfilter: conntrack: sctp: verify vtag before state changes

[PATCH nf] netfilter: conntrack: sctp: verify vtag before state changes

[Yizhou Zhao]

The packet-wide vtag check in nf_conntrack_sctp_packet() is skipped when
the bundle map contains any chunk type with special vtag handling.  The
per-chunk path re-checks INIT, ABORT, SHUTDOWN_COMPLETE, and
COOKIE_ECHO, but other state-changing chunks still fall through to
sctp_new_state() without validating sh->vtag.

This lets a wrong-vtag packet bundle HEARTBEAT with COOKIE_ACK, ERROR,
SHUTDOWN, or SHUTDOWN_ACK and still advance conntrack state.  That can
desynchronize conntrack from the real SCTP association and cause denial
of service for SCTP traffic behind a stateful firewall.

Check sh->vtag before processing those chunks when conntrack already
knows the expected direction vtag.  This keeps the existing
HEARTBEAT/HEARTBEAT_ACK learning and connection-reuse behavior for the
`vtag == 0` cases.

Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
---
 net/netfilter/nf_conntrack_proto_sctp.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 7e10fa65cbdd..9978ecd05b1e 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -407,9 +407,17 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
 			/* (D) vtag must be same as init_vtag as found in INIT_ACK */
 			if (sh->vtag != ct->proto.sctp.vtag[dir])
 				goto out_unlock;
-		} else if (sch->type == SCTP_CID_COOKIE_ACK) {
-			ct->proto.sctp.init[dir] = 0;
-			ct->proto.sctp.init[!dir] = 0;
+		} else if (sch->type == SCTP_CID_COOKIE_ACK ||
+			   sch->type == SCTP_CID_ERROR ||
+			   sch->type == SCTP_CID_SHUTDOWN ||
+			   sch->type == SCTP_CID_SHUTDOWN_ACK) {
+			if (ct->proto.sctp.vtag[dir] &&
+			    sh->vtag != ct->proto.sctp.vtag[dir])
+				goto out_unlock;
+			if (sch->type == SCTP_CID_COOKIE_ACK) {
+				ct->proto.sctp.init[dir] = 0;
+				ct->proto.sctp.init[!dir] = 0;
+			}
 		} else if (sch->type == SCTP_CID_HEARTBEAT) {
 			if (ct->proto.sctp.vtag[dir] == 0) {
 				pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir);
-- 
2.47.3

Re: [PATCH nf] netfilter: conntrack: sctp: verify vtag before state changes

[Pablo Neira Ayuso]

Hi,

On Tue, Jul 28, 2026 at 03:35:06PM +0800, Yizhou Zhao wrote:
> The packet-wide vtag check in nf_conntrack_sctp_packet() is skipped when
> the bundle map contains any chunk type with special vtag handling.  The
> per-chunk path re-checks INIT, ABORT, SHUTDOWN_COMPLETE, and
> COOKIE_ECHO, but other state-changing chunks still fall through to
> sctp_new_state() without validating sh->vtag.
> 
> This lets a wrong-vtag packet bundle HEARTBEAT with COOKIE_ACK, ERROR,
> SHUTDOWN, or SHUTDOWN_ACK and still advance conntrack state.  That can
> desynchronize conntrack from the real SCTP association and cause denial
> of service for SCTP traffic behind a stateful firewall.

Are you assuming a specific policy in place? The connection tracking
does not police packets, it just provides tracking.

Can you provide a more specific scenario?

We are seeing several reports related to the connection tracking from
your university lately.

> Check sh->vtag before processing those chunks when conntrack already
> knows the expected direction vtag.  This keeps the existing
> HEARTBEAT/HEARTBEAT_ACK learning and connection-reuse behavior for the
> `vtag == 0` cases.

Proposed patches to hardening the connection tracking state machine
should be targeted at nf-next.

Thanks.

> Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
> Cc: stable@vger.kernel.org
> Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
> Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
> Reported-by: Ao Wang <wangao@seu.edu.cn>
> Reported-by: Xuewei Feng <fengxw06@126.com>
> Reported-by: Qi Li <qli01@tsinghua.edu.cn>
> Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
> Assisted-by: Claude-Code:GLM-5.2
> Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
> ---
>  net/netfilter/nf_conntrack_proto_sctp.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> index 7e10fa65cbdd..9978ecd05b1e 100644
> --- a/net/netfilter/nf_conntrack_proto_sctp.c
> +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> @@ -407,9 +407,17 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
>  			/* (D) vtag must be same as init_vtag as found in INIT_ACK */
>  			if (sh->vtag != ct->proto.sctp.vtag[dir])
>  				goto out_unlock;
> -		} else if (sch->type == SCTP_CID_COOKIE_ACK) {
> -			ct->proto.sctp.init[dir] = 0;
> -			ct->proto.sctp.init[!dir] = 0;
> +		} else if (sch->type == SCTP_CID_COOKIE_ACK ||
> +			   sch->type == SCTP_CID_ERROR ||
> +			   sch->type == SCTP_CID_SHUTDOWN ||
> +			   sch->type == SCTP_CID_SHUTDOWN_ACK) {
> +			if (ct->proto.sctp.vtag[dir] &&
> +			    sh->vtag != ct->proto.sctp.vtag[dir])
> +				goto out_unlock;
> +			if (sch->type == SCTP_CID_COOKIE_ACK) {
> +				ct->proto.sctp.init[dir] = 0;
> +				ct->proto.sctp.init[!dir] = 0;
> +			}
>  		} else if (sch->type == SCTP_CID_HEARTBEAT) {
>  			if (ct->proto.sctp.vtag[dir] == 0) {
>  				pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir);
> -- 
> 2.47.3
> 

Re: [PATCH nf] netfilter: conntrack: sctp: verify vtag before state changes

[Yizhou Zhao]

Hi Pablo,

Thank you for the review.

> On Jul 29, 2026, at 03:26, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> 
> Hi,
> 
> On Tue, Jul 28, 2026 at 03:35:06PM +0800, Yizhou Zhao wrote:
>> The packet-wide vtag check in nf_conntrack_sctp_packet() is skipped when
>> the bundle map contains any chunk type with special vtag handling.  The
>> per-chunk path re-checks INIT, ABORT, SHUTDOWN_COMPLETE, and
>> COOKIE_ECHO, but other state-changing chunks still fall through to
>> sctp_new_state() without validating sh->vtag.
>> 
>> This lets a wrong-vtag packet bundle HEARTBEAT with COOKIE_ACK, ERROR,
>> SHUTDOWN, or SHUTDOWN_ACK and still advance conntrack state.  That can
>> desynchronize conntrack from the real SCTP association and cause denial
>> of service for SCTP traffic behind a stateful firewall.
> 
> Are you assuming a specific policy in place? The connection tracking
> does not police packets, it just provides tracking.

You are right, I overstated the impact.  Conntrack only tracks packet
state, and whether a packet is dropped depends on a firewall rule that
uses that state.

> 
> Can you provide a more specific scenario?

The issue I reproduced is that a wrong-vtag [SHUTDOWN, HEARTBEAT] bundle
changes SCTP conntrack state from ESTABLISHED to SHUTDOWN_SENT, while the
SCTP endpoints discard the packet because of the invalid vtag.  This can
therefore desynchronize conntrack from the association.

For example, a stateful policy that drops INVALID, accepts
ESTABLISHED/RELATED, and accepts new SCTP only for INIT will see the
conntrack timeout change from 210 seconds to 3 seconds.  If the entry
expires while the real association remains established, a later DATA
packet is invalid and that policy drops it.  This requires an attacker
that can inject a matching SCTP 4-tuple into the firewall path, and it does
not require knowing the correct vtag.

> 
> We are seeing several reports related to the connection tracking from
> your university lately.
> 
>> Check sh->vtag before processing those chunks when conntrack already
>> knows the expected direction vtag.  This keeps the existing
>> HEARTBEAT/HEARTBEAT_ACK learning and connection-reuse behavior for the
>> `vtag == 0` cases.
> 
> Proposed patches to hardening the connection tracking state machine
> should be targeted at nf-next.

I agree this is better treated as SCTP conntrack state-machine hardening.
If you agree, I will respin the patch for nf-next without Fixes or stable Cc.

Regards,
Yizhou

Re: [PATCH nf] netfilter: conntrack: sctp: verify vtag before state changes

[Pablo Neira Ayuso]

On Wed, Jul 29, 2026 at 12:56:39PM +0800, Yizhou Zhao wrote:
> Hi Pablo,
> 
> Thank you for the review.
> 
> > On Jul 29, 2026, at 03:26, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > 
> > Hi,
> > 
> > On Tue, Jul 28, 2026 at 03:35:06PM +0800, Yizhou Zhao wrote:
> >> The packet-wide vtag check in nf_conntrack_sctp_packet() is skipped when
> >> the bundle map contains any chunk type with special vtag handling.  The
> >> per-chunk path re-checks INIT, ABORT, SHUTDOWN_COMPLETE, and
> >> COOKIE_ECHO, but other state-changing chunks still fall through to
> >> sctp_new_state() without validating sh->vtag.
> >> 
> >> This lets a wrong-vtag packet bundle HEARTBEAT with COOKIE_ACK, ERROR,
> >> SHUTDOWN, or SHUTDOWN_ACK and still advance conntrack state.  That can
> >> desynchronize conntrack from the real SCTP association and cause denial
> >> of service for SCTP traffic behind a stateful firewall.
> > 
> > Are you assuming a specific policy in place? The connection tracking
> > does not police packets, it just provides tracking.
> 
> You are right, I overstated the impact.  Conntrack only tracks packet
> state, and whether a packet is dropped depends on a firewall rule that
> uses that state.
> 
> > 
> > Can you provide a more specific scenario?
> 
> The issue I reproduced is that a wrong-vtag [SHUTDOWN, HEARTBEAT] bundle
> changes SCTP conntrack state from ESTABLISHED to SHUTDOWN_SENT, while the
> SCTP endpoints discard the packet because of the invalid vtag.  This can
> therefore desynchronize conntrack from the association.
> 
> For example, a stateful policy that drops INVALID, accepts
> ESTABLISHED/RELATED, and accepts new SCTP only for INIT will see the
> conntrack timeout change from 210 seconds to 3 seconds.  If the entry
> expires while the real association remains established, a later DATA
> packet is invalid and that policy drops it.  This requires an attacker
> that can inject a matching SCTP 4-tuple into the firewall path, and it does
> not require knowing the correct vtag.
> 
> > 
> > We are seeing several reports related to the connection tracking from
> > your university lately.
> > 
> >> Check sh->vtag before processing those chunks when conntrack already
> >> knows the expected direction vtag.  This keeps the existing
> >> HEARTBEAT/HEARTBEAT_ACK learning and connection-reuse behavior for the
> >> `vtag == 0` cases.
> > 
> > Proposed patches to hardening the connection tracking state machine
> > should be targeted at nf-next.
> 
> I agree this is better treated as SCTP conntrack state-machine hardening.
> If you agree, I will respin the patch for nf-next without Fixes or stable Cc.

Yes, repurpose this patch to nf-next without Fixes tag and stable for review.

Thanks.

Re: [PATCH nf] netfilter: conntrack: sctp: verify vtag before state changes

[Yizhou Zhao]

Hi Pablo,

> On Jul 31, 2026, at 18:33, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> 
> Yes, repurpose this patch to nf-next without Fixes tag and stable for review.
> 
> Thanks.

Thank you for your suggestion.

We have posted an nf-next patch at https://lore.kernel.org/netfilter-devel/20260731145342.56890-1-zhaoyz24@mails.tsinghua.edu.cn/T/#u
following your suggestion.

Regards,
Yizhou