Re: [PATCH net 1/2] netfilter: skip recording stale or retransmitted INIT

Florian Westphal
2026-04-11T20:16:21Z

Xin Long <lucien.xin@gmail.com> wrote:

> diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> index 645d2c43ebf7..7e10fa65cbdd 100644
> --- a/net/netfilter/nf_conntrack_proto_sctp.c
> +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> @@ -466,9 +466,13 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
> if (!ih)
> goto out_unlock;
>
> - if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
> - ct->proto.sctp.init[!dir] = 0;
> - ct->proto.sctp.init[dir] = 1;
> + /* Do not record INIT matching peer vtag (stale or retransmitted INIT). */
> + if (old_state == SCTP_CONNTRACK_NONE ||
> + ct->proto.sctp.vtag[!dir] != ih->init_tag) {

Should ct->proto.sctp.vtag[!dir] == ih->init_tag case also
set ignore = true?