Re: [PATCH net 1/2] netfilter: skip recording stale or retransmitted INIT

Xin Long
2026-04-12T16:36:00Z

On Sat, Apr 11, 2026 at 4:16 PM Florian Westphal <fw@strlen.de> wrote:
>
> Xin Long <lucien.xin@gmail.com> wrote:
>
> > diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> > index 645d2c43ebf7..7e10fa65cbdd 100644
> > --- a/net/netfilter/nf_conntrack_proto_sctp.c
> > +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> > @@ -466,9 +466,13 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
> > if (!ih)
> > goto out_unlock;
> >
> > - if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
> > - ct->proto.sctp.init[!dir] = 0;
> > - ct->proto.sctp.init[dir] = 1;
> > + /* Do not record INIT matching peer vtag (stale or retransmitted INIT). */
> > + if (old_state == SCTP_CONNTRACK_NONE ||
> > + ct->proto.sctp.vtag[!dir] != ih->init_tag) {
>
> Should ct->proto.sctp.vtag[!dir] == ih->init_tag case also
> set ignore = true?

It should for a stale INIT, but not for a retransmitted one. At this point,
though, we don't reliably distinguish between the two.

Also, as this patch only aims to prevent updating ct->proto.sctp.init[]
(introduced in 8e56b063c865) in this scenario, it’s safer to avoid
changing other behavior.

Thanks.