Re: [PATCH net 1/2] netfilter: skip recording stale or retransmitted INIT

Florian Westphal <[email protected]> Sat, 11 Apr 2026 22:16:18 +0200

Newsgroups	org.kernel.vger.linux-sctp,org.kernel.vger.netdev
Message-ID	<[email protected]>

Xin Long <[email protected]> wrote:
 
> diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> index 645d2c43ebf7..7e10fa65cbdd 100644
> --- a/net/netfilter/nf_conntrack_proto_sctp.c
> +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> @@ -466,9 +466,13 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
>  			if (!ih)
>  				goto out_unlock;
>  
> -			if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
> -				ct->proto.sctp.init[!dir] = 0;
> -			ct->proto.sctp.init[dir] = 1;
> +			/* Do not record INIT matching peer vtag (stale or retransmitted INIT). */
> +			if (old_state == SCTP_CONNTRACK_NONE ||
> +			    ct->proto.sctp.vtag[!dir] != ih->init_tag) {

Should    ct->proto.sctp.vtag[!dir] == ih->init_tag case also
set ignore = true?