Commit 68913a01 authored Aug 20, 2017 by Xin Long Committed by Pablo Neira Ayuso Sep 08, 2017

netfilter: ipvs: do not create conn for ABORT packet in sctp_conn_schedule



There's no reason for ipvs to create a conn for an ABORT packet
even if sysctl_sloppy_sctp is set.

This patch is to accept it without creating a conn, just as ipvs
does for tcp's RST packet.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 1cc4a018

net/netfilter/ipvs/ip_vs_proto_sctp.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -25,7 +25,8 @@ sctp_conn_schedule(struct netns_ipvs ipvs, int af, struct sk_buff skb,
		sch = skb_header_pointer(skb, iph->len + sizeof(_sctph),
		sizeof(_schunkh), &_schunkh);
		if (sch) {
		if (!(sysctl_sloppy_sctp(ipvs) \|\|
		if (sch->type == SCTP_CID_ABORT \|\|
		!(sysctl_sloppy_sctp(ipvs) \|\|
		sch->type == SCTP_CID_INIT))
		return 1;
		ports = &sh->source;