Re: [PATCH net v2 0/2] sctp: fix a vtag verification failure caused by stale INITs

On Tue, Apr 28, 2026 at 10:06 AM Simon Horman <[email protected]> wrote:
>
> On Sun, Apr 26, 2026 at 10:46:39AM -0400, Xin Long wrote:
> > Similar to Scenario B in commit 8e56b063c865 ( netfilter: handle the
> > connecting collision properly in nf_conntrack_proto_sctp"):
> >
> > Scenario B: INIT_ACK is delayed until the peer completes its own handshake
> >
> >   192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]
> >     192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]
> >     192.168.1.2 > 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408]
> >     192.168.1.1 > 192.168.1.2: sctp (1) [COOKIE ECHO]
> >     192.168.1.2 > 192.168.1.1: sctp (1) [COOKIE ACK]
> >   192.168.1.1 > 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] *
> >
> > There is another case:
> >
> > Scenario F: INIT is delayed until the peer completes its own handshake
> >
> >   192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]
> >   (OVS upcall)
> >     192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]
> >     192.168.1.2 > 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408]
> >     192.168.1.1 > 192.168.1.2: sctp (1) [COOKIE ECHO]
> >     192.168.1.2 > 192.168.1.1: sctp (1) [COOKIE ACK]
> >   192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]
> >   (delayed)
> >   192.168.1.1 > 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] *
> >
> > In this case, the delayed INIT (e.g. due to OVS upcall) is recorded by
> > conntrack, which prevents vtag verification from dropping the unexpected
> > INIT-ACK in nf_conntrack_sctp_packet():
> >
> >   vtag = ct->proto.sctp.vtag[!dir];
> >   if (!ct->proto.sctp.init[!dir] && vtag && vtag != ih->init_tag)
> >           goto out_unlock;
> >
> > This happens because ct->proto.sctp.init[!dir] is set by the delayed INIT,
> > even though it is stale.
> >
> > Fix this in two parts:
> >
> > - In netfilter: Do not record INITs whose init_tag matches the peer vtag,
> >   as they carry no new handshake state in the 1st patch.
> >
> > - In SCTP: Prevent endpoints from responding to such INITs with INIT-ACK,
> >   ensuring correctness even when middleboxes lack the netfilter fix in
> >   the 2nd patch.
> >
> > A follow-up selftest for this scenario will be posted in a separate patch
> > by Yi Chen.
>
> Hi Xin,
>
> FTR: There is an AI generated review of this patchset available on
> sashiko.dev. I have looked over this and I do not believe the feedback
> there should block progress of this patchset.
Right, the feedback is false in practice::

- "No response" is not a clean signal
  (could be loss, firewall, rate limiting, etc.).
- Even guessing this init_tag does not let attackers hijack the association
  (they still lack the correct verification tag and state).

Thanks.