Re: [PATCH net 1/2] netfilter: skip recording stale or retransmitted INIT

On Sat, Apr 11, 2026 at 4:16 PM Florian Westphal <[email protected]> wrote:
>
> Xin Long <[email protected]> wrote:
>
> > diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> > index 645d2c43ebf7..7e10fa65cbdd 100644
> > --- a/net/netfilter/nf_conntrack_proto_sctp.c
> > +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> > @@ -466,9 +466,13 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
> >                       if (!ih)
> >                               goto out_unlock;
> >
> > -                     if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
> > -                             ct->proto.sctp.init[!dir] = 0;
> > -                     ct->proto.sctp.init[dir] = 1;
> > +                     /* Do not record INIT matching peer vtag (stale or retransmitted INIT). */
> > +                     if (old_state == SCTP_CONNTRACK_NONE ||
> > +                         ct->proto.sctp.vtag[!dir] != ih->init_tag) {
>
> Should    ct->proto.sctp.vtag[!dir] == ih->init_tag case also
> set ignore = true?

It should for a stale INIT, but not for a retransmitted one. At this point,
though, we don't reliably distinguish between the two.

Also, as this patch only aims to prevent updating ct->proto.sctp.init[]
(introduced in 8e56b063c865) in this scenario, it’s safer to avoid
changing other behavior.

Thanks.