Re: [PATCH net 1/2] netfilter: skip recording stale or retransmitted INIT

On Fri, Apr 10, 2026 at 02:59:16PM -0400, Xin Long wrote:
> An INIT whose init_tag matches the peer's vtag does not provide new state
> information. It indicates either:
> 
> - a stale INIT (after INIT-ACK has already been seen on the same side), or
> - a retransmitted INIT (after INIT has already been recorded on the same
>   side).
> 
> In both cases, the INIT must not update ct->proto.sctp.init[] state, since
> it does not advance the handshake tracking and may otherwise corrupt
> INIT/INIT-ACK validation logic.
> 
> Allow INIT processing only when the conntrack entry is newly created
> (SCTP_CONNTRACK_NONE), or when the init_tag differs from the stored peer
> vtag.
> 
> Note it skips the check for the ct with old_state SCTP_CONNTRACK_NONE in
> nf_conntrack_sctp_packet(), as it is just created in sctp_new() where it
> set ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = ih->init_tag.
> 
> Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
> Signed-off-by: Xin Long <[email protected]>

Reviewed-by: Marcelo Ricardo Leitner <[email protected]>