netfilter: ipvs: some fixes in sctp_conn_schedule

Patch 1/2 fixes the regression introduced by commit 5e26b1b3abce. Patch 2/2 makes ipvs not create conn for sctp ABORT packet.

Xin Long (2):
netfilter: ipvs: fix the issue that sctp_conn_schedule drops non-INIT
packet
netfilter: ipvs: do not create conn for ABORT packet in
sctp_conn_schedule

 net/netfilter/ipvs/ip_vs_proto_sctp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

2.1.0

Commit 5e26b1b3abce ("ipvs: support scheduling inverse and icmp SCTP packets") changed to check packet type early. It introduced a side
effect: if it's not a INIT packet, ports will be set as NULL, and the packet will be dropped later.

It caused that sctp couldn't create connection when ipvs module is loaded and any scheduler is registered on server.

Li Shuang reproduced it by running the cmds on sctp server:

  # ipvsadm -A -t 1.1.1.1:80 -s rr
  # ipvsadm -D -t 1.1.1.1:80
then the server could't work any more.

This patch is to return 1 when it's not an INIT packet. It means ipvs will accept it without creating a conn for it, just like what it does for tcp.

---
 net/netfilter/ipvs/ip_vs_proto_sctp.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

index 3ffad4a..e9b18ac 100644
@@ -24,9 +24,12 @@ sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
 		if (sh) {
 			sch = skb_header_pointer(skb, iph->len + sizeof(_sctph),
 						 sizeof(_schunkh), &_schunkh);
-			if (sch && (sch->type == SCTP_CID_INIT ||
-				    sysctl_sloppy_sctp(ipvs)))
+			if (sch) {
+				if (!(sysctl_sloppy_sctp(ipvs) ||
+				      sch->type == SCTP_CID_INIT))
+					return 1;
 				ports = &sh->source;
+			}
 		}
 	} else {
 		ports = skb_header_pointer(

2.1.0

There's no reason for ipvs to create a conn for an ABORT packet even if sysctl_sloppy_sctp is set.

This patch is to accept it without creating a conn, just as ipvs does for tcp's RST packet.

---
 net/netfilter/ipvs/ip_vs_proto_sctp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index e9b18ac..d86773a 100644
@@ -25,7 +25,8 @@ sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
 			sch = skb_header_pointer(skb, iph->len + sizeof(_sctph),
 						 sizeof(_schunkh), &_schunkh);
 			if (sch) {
-				if (!(sysctl_sloppy_sctp(ipvs) ||
+				if (sch->type == SCTP_CID_ABORT ||
+				    !(sysctl_sloppy_sctp(ipvs) ||
 				      sch->type == SCTP_CID_INIT))
 					return 1;
 				ports = &sh->source;

2.1.0

Hello,

Patchset looks ok to me,

Will wait for Julian and Simon to tell me what I should do with this.

Thanks!

Hi Pablo,

could you take these directly with Julian's Ack and the following?

Series applied, thanks!