Re: [PATCH net 1/2] netfilter: skip recording stale or retransmitted INIT

[Florian Westphal <fw@strlen.de>]

Xin Long <lucien.xin@gmail.com> wrote:
> On Sat, Apr 11, 2026 at 4:16 PM Florian Westphal <fw@strlen.de> wrote:
> > Xin Long <lucien.xin@gmail.com> wrote:
> >
> > > diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> > > index 645d2c43ebf7..7e10fa65cbdd 100644
> > > --- a/net/netfilter/nf_conntrack_proto_sctp.c
> > > +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> > > @@ -466,9 +466,13 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
> > >                       if (!ih)
> > >                               goto out_unlock;
> > >
> > > -                     if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
> > > -                             ct->proto.sctp.init[!dir] = 0;
> > > -                     ct->proto.sctp.init[dir] = 1;
> > > +                     /* Do not record INIT matching peer vtag (stale or retransmitted INIT). */
> > > +                     if (old_state == SCTP_CONNTRACK_NONE ||
> > > +                         ct->proto.sctp.vtag[!dir] != ih->init_tag) {
> >
> > Should    ct->proto.sctp.vtag[!dir] == ih->init_tag case also
> > set ignore = true?
> 
> It should for a stale INIT, but not for a retransmitted one. At this point,
> though, we don't reliably distinguish between the two.
> 
> Also, as this patch only aims to prevent updating ct->proto.sctp.init[]
> (introduced in 8e56b063c865) in this scenario, it’s safer to avoid
> changing other behavior.

Alright. I'm fine with this going in via net directly:

Acked-by: Florian Westphal <fw@strlen.de>