Subject: Re: [PATCH net 1/2] netfilter: skip recording stale or retransmitted INIT

From: Florian Westphal <[email-masked]>
Date: Sat, 11 Apr 2026 22:16:18 +0200

Xin Long <[email-masked]> wrote:
 
> diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
> index 645d2c43ebf7..7e10fa65cbdd 100644
> --- a/net/netfilter/nf_conntrack_proto_sctp.c
> +++ b/net/netfilter/nf_conntrack_proto_sctp.c
> @@ -466,9 +466,13 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
>  			if (!ih)
>  				goto out_unlock;
>  
> -			if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir])
> -				ct->proto.sctp.init[!dir] = 0;
> -			ct->proto.sctp.init[dir] = 1;
> +			/* Do not record INIT matching peer vtag (stale or retransmitted INIT). */
> +			if (old_state == SCTP_CONNTRACK_NONE ||
> +			    ct->proto.sctp.vtag[!dir] != ih->init_tag) {

Should    ct->proto.sctp.vtag[!dir] == ih->init_tag case also
set ignore = true?