From 6eb76db1fc96cba4ee778a49a217d228075cf9a4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 18 Oct 2023 13:02:43 +0000 Subject: [PATCH] Revert "netfilter: conntrack: allow sctp hearbeat after connection re-use" This reverts commit 59d2b1e5cb058122d53ab140831d69740034f951 which is commit cc5453a5b7e90c39f713091a7ebc53c1f87d1700 upstream. It breaks the Android ABI so revert it for now, if it is needed in the future, it can be brought back in an ABI-safe way. Bug: 161946584 Change-Id: I407c279668ad07b0356d4c7540eae0fb7f523b71 Signed-off-by: Greg Kroah-Hartman --- include/linux/netfilter/nf_conntrack_sctp.h | 2 -- net/netfilter/nf_conntrack_proto_sctp.c | 39 +++------------------ 2 files changed, 4 insertions(+), 37 deletions(-) diff --git a/include/linux/netfilter/nf_conntrack_sctp.h b/include/linux/netfilter/nf_conntrack_sctp.h index 625f491b95de..9a33f171aa82 100644 --- a/include/linux/netfilter/nf_conntrack_sctp.h +++ b/include/linux/netfilter/nf_conntrack_sctp.h @@ -9,8 +9,6 @@ struct ip_ct_sctp { enum sctp_conntrack state; __be32 vtag[IP_CT_DIR_MAX]; - u8 last_dir; - u8 flags; }; #endif /* _NF_CONNTRACK_SCTP_H */ diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c index 8eaa0d15a5a7..f4687a330a28 100644 --- a/net/netfilter/nf_conntrack_proto_sctp.c +++ b/net/netfilter/nf_conntrack_proto_sctp.c @@ -55,8 +55,6 @@ static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = { [SCTP_CONNTRACK_HEARTBEAT_SENT] = 30 SECS, }; -#define SCTP_FLAG_HEARTBEAT_VTAG_FAILED 1 - #define sNO SCTP_CONNTRACK_NONE #define sCL SCTP_CONNTRACK_CLOSED #define sCW SCTP_CONNTRACK_COOKIE_WAIT @@ -360,7 +358,6 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, u_int32_t offset, count; unsigned int *timeouts; unsigned long map[256 / sizeof(unsigned long)] = { 0 }; - bool ignore = false; if (sctp_error(skb, dataoff, state)) return -NF_ACCEPT; @@ -426,39 +423,15 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, /* (D) vtag must be same as init_vtag as found in INIT_ACK */ if (sh->vtag != ct->proto.sctp.vtag[dir]) goto out_unlock; - } else if (sch->type == SCTP_CID_HEARTBEAT) { - if (ct->proto.sctp.vtag[dir] == 0) { - pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir); - ct->proto.sctp.vtag[dir] = sh->vtag; - } else if (sh->vtag != ct->proto.sctp.vtag[dir]) { - if (test_bit(SCTP_CID_DATA, map) || ignore) - goto out_unlock; - - ct->proto.sctp.flags |= SCTP_FLAG_HEARTBEAT_VTAG_FAILED; - ct->proto.sctp.last_dir = dir; - ignore = true; - continue; - } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) { - ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED; - } - } else if (sch->type == SCTP_CID_HEARTBEAT_ACK) { + } else if (sch->type == SCTP_CID_HEARTBEAT || + sch->type == SCTP_CID_HEARTBEAT_ACK) { if (ct->proto.sctp.vtag[dir] == 0) { pr_debug("Setting vtag %x for dir %d\n", sh->vtag, dir); ct->proto.sctp.vtag[dir] = sh->vtag; } else if (sh->vtag != ct->proto.sctp.vtag[dir]) { - if (test_bit(SCTP_CID_DATA, map) || ignore) - goto out_unlock; - - if ((ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) == 0 || - ct->proto.sctp.last_dir == dir) - goto out_unlock; - - ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED; - ct->proto.sctp.vtag[dir] = sh->vtag; - ct->proto.sctp.vtag[!dir] = 0; - } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) { - ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED; + pr_debug("Verification tag check failed\n"); + goto out_unlock; } } @@ -497,10 +470,6 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, } spin_unlock_bh(&ct->lock); - /* allow but do not refresh timeout */ - if (ignore) - return NF_ACCEPT; - timeouts = nf_ct_timeout_lookup(ct); if (!timeouts) timeouts = nf_sctp_pernet(nf_ct_net(ct))->timeouts;