Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2224803/?format=api
{ "id": 2224803, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2224803/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260418195843.303946-1-yiche.cy@gmail.com/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.1/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null }, "msgid": "<20260418195843.303946-1-yiche.cy@gmail.com>", "date": "2026-04-18T19:58:43", "name": "[net,v2] selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "2aab3fec73014c162a1ff5b18d4a2ede55060470", "submitter": { "id": 93187, "url": "http://patchwork.ozlabs.org/api/1.1/people/93187/?format=api", "name": "Yi Chen", "email": "yiche.cy@gmail.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260418195843.303946-1-yiche.cy@gmail.com/mbox/", "series": [ { "id": 500464, "url": "http://patchwork.ozlabs.org/api/1.1/series/500464/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500464", "date": "2026-04-18T19:58:43", "name": "[net,v2] selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test", "version": 2, "mbox": "http://patchwork.ozlabs.org/series/500464/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2224803/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2224803/checks/", "tags": {}, "headers": { "Return-Path": "\n <netfilter-devel+bounces-12022-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=Snvl1j2j;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12022-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=\"Snvl1j2j\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=209.85.128.68", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=gmail.com" ], "Received": [ "from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fyjJ35WPDz1yGt\n\tfor <incoming@patchwork.ozlabs.org>; Sun, 19 Apr 2026 05:59:15 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 74255300DF5F\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 18 Apr 2026 19:59:09 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 847B0340A6B;\n\tSat, 18 Apr 2026 19:59:02 +0000 (UTC)", "from mail-wm1-f68.google.com (mail-wm1-f68.google.com\n [209.85.128.68])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 54E442DF719\n\tfor <netfilter-devel@vger.kernel.org>; Sat, 18 Apr 2026 19:58:59 +0000 (UTC)", "by mail-wm1-f68.google.com with SMTP id\n 5b1f17b1804b1-488a041eae5so11074935e9.1\n for <netfilter-devel@vger.kernel.org>;\n Sat, 18 Apr 2026 12:58:59 -0700 (PDT)", "from yiche-laptop ([2a09:0:1:2::30c5])\n by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-488fb78becdsm72593675e9.5.2026.04.18.12.58.53\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Sat, 18 Apr 2026 12:58:57 -0700 (PDT)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776542342; cv=none;\n b=jcbJtseFoThEBI+wTLhlJDsChKqc6R+byyyy/ScTzM+XL8uqwZ/kIIyOS6FXjkuoamiPlFpQFAA1T8cxOgDkr2HJZ6T++jfOjmpgDGMdIgoG6cs1i9dr0E2TBkNZ3UM7J/Id5mGSbkOAoN1oT+Hn0ItkZdwzYXm06Z1gahf7Uz0=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776542342; c=relaxed/simple;\n\tbh=g+jbqedVJeXVkDa41E9XlF9r/7lQOFTqNLPXjDQEnlQ=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=jHMu0M0upUtMjq0YKf6iyp8COOPl3E4reVVv+YRHWZQPwZoB7jM4zH+GG38zZkwr65tvZ4KKNGfzJbjr3YhCWG70LompHAiFQ+YqeVjfzUz5pM8grH0HnFDWwuQ0TjjLqq8C2lD2kL7wvWvAJ9BU3s7FEnB86kTwek3Sqbpn+Zo=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com;\n spf=pass smtp.mailfrom=gmail.com;\n dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=Snvl1j2j; arc=none smtp.client-ip=209.85.128.68", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1776542338; x=1777147138;\n darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=tm2PCGa1F10nJuRUcP6mAyFe2uLBjcoG5dv2Op3y66U=;\n b=Snvl1j2jPaRYyS/BArRe630VPb4NfR7OSMs9o2Lf/4Ir7Woa8sYFSdSU4/AbOqJZn2\n rjDCY2xWDxTTn5b/kgk2VfTWR0Q8sq9+VaBxNOGuaBDYxv2+Mwbu8RTwbDLcMtOOuzbg\n plG2kntcEsywSVXyqfWE6Y/QYhLFzGH9mt+SMDkttE/NAD1tGL9Jpw74Q3ls7gNNzmIq\n UVYe+109de7YeZkRayHeh+HElHFq2DGy98BuC6cNJJw9GBKDVDCyZ8SoSOUxymY5N75Y\n pBRWSFkiqY4CwK8kPEKKjHfQucVVfF6HJ3QRa4gkPlv/3dIoOlSuBNmyNFbCFWRUQGBI\n VKcA==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776542338; x=1777147138;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=tm2PCGa1F10nJuRUcP6mAyFe2uLBjcoG5dv2Op3y66U=;\n b=LEzQTRZYTebXnZUvziA/weSYvsjp4DLuZEAE/+Tq94+vR4Uu0BkgiMEwX9ywotgQMA\n a/N9gn7m8zgL/hP5kFwHu0SzfGz06Z1CEtwtmaZna5SW7yT7eoVKVBW5YQFukdR9Oxql\n AJ7u0Bd2jHQNmU93XTSogaGHIwlbr+31gZiFbfBBLQ74yoxPExG7y4bs6EUEuNdPH1Fv\n IHqFSFFMzQB2K8q4cF/yjpf1X6oNtzDu23xPZVlulWPx6wJUdUugdtofznXyjGtOsQNV\n PsRX5wemFCnnOTqHp2aUem8ZCJiJ7fA918mDlyS8aOCFbc7JDkOXFJSmWHaw14a89/kD\n wm1w==", "X-Forwarded-Encrypted": "i=1;\n AFNElJ95uc0dX6v9uDC+xjB7mRM+FJLw+DL931iPQWVR8tgWbgVIyyA0bxHoL5XiA4u45K/WNlHM1qD6jlaaLMZjP9k=@vger.kernel.org", "X-Gm-Message-State": "AOJu0YxsWwDLK4fj3NiKWESoGz+KZH9SlUJnR568TDIwzs7K8+Gwyb3X\n\tH3ey5ejJ9FIya7CJ5TGiKpgSbzoyTMgdeT6Uq8tCNeX0RjAlPrVm6+NM", "X-Gm-Gg": "AeBDieuZEUZeT5c1MTb32hv7MG04A5kAhgbPG1SFViBfv3gVchkBX4rSCdFK4gVIYya\n\tf7G7zAgoPosy7eSs6d/LDYzqn3GXZC3iYA9OBGJcIiH8bqFio9806iD7KYpvdvH0Ykp8ts7QU7m\n\t+GpX9Nt2AMna7W8Mnb0Y7To53p7HMEIAIi7lQfUnQEfHteHgDbYFEyF9dK9Nwo1+Ztvg+exT+AW\n\t7fGIjuLeYeVPfpdDrqu1uFUT2BQ2+H9AhAqEl1AHoV3irdT50gotjlYL06rpO1sp63L4TlHT/s6\n\t0YLyFJ4HVLPSshw+UR7xOJBGiqp06QznhBc8ZVOIunZu2+5ZBFfDnhEDmdTD7Kj5i5mh1Rrbzsp\n\t7U97w7+a0ntXeWIVMk1Rlawckxs2s9YjWlBtSN65+pGWc4YHJeAaNwhDoLT4y8fP46ryK0oe82L\n\tg6/9xsx45Cp1o=", "X-Received": "by 2002:a05:600c:a404:b0:47e:e2eb:bc22 with SMTP id\n 5b1f17b1804b1-488fb73b2a3mr96678055e9.5.1776542337501;\n Sat, 18 Apr 2026 12:58:57 -0700 (PDT)", "From": "Yi Chen <yiche.cy@gmail.com>", "To": "Yi Chen <yiche.cy@gmail.com>,\n\tPablo Neira Ayuso <pablo@netfilter.org>,\n\tFlorian Westphal <fw@strlen.de>,\n\tPhil Sutter <phil@nwl.cc>,\n\tLong Xin <lucien.xin@gmail.com>,\n\t\"David S . Miller\" <davem@davemloft.net>,\n\tJakub Kicinski <kuba@kernel.org>,\n\tEric Dumazet <edumazet@google.com>,\n\tPaolo Abeni <pabeni@redhat.com>,\n\tSimon Horman <horms@kernel.org>,\n\tShuah Khan <shuah@kernel.org>", "Cc": "coreteam@netfilter.org,\n\tnetfilter-devel@vger.kernel.org,\n\tlinux-kselftest@vger.kernel.org,\n\tlinux-kernel@vger.kernel.org,\n\tnetdev@vger.kernel.org", "Subject": "[PATCH net v2] selftests: netfilter: conntrack_sctp_collision.sh:\n Introduce SCTP INIT collision test", "Date": "Sun, 19 Apr 2026 03:58:43 +0800", "Message-ID": "<20260418195843.303946-1-yiche.cy@gmail.com>", "X-Mailer": "git-send-email 2.53.0", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "The existing test covered a scenario where a delayed INIT_ACK chunk\nupdates the vtag in conntrack after the association has already been\nestablished.\n\nA similar issue can occur with a delayed SCTP INIT chunk.\n\nAdd a new simultaneous-open test case where the client's INIT is\ndelayed, allowing conntrack to establish the association based on\nthe server-initiated handshake.\n\nWhen the stale INIT arrives later, it may get recorded and cause a\nfollowing INIT_ACK from the peer to be accepted instead of dropped.\nThis INIT_ACK overwrites the vtag in conntrack, causing subsequent\nSCTP DATA chunks to be considered as invalid and then dropped by\nnft rules matching on ct state invalid.\n\nThis test verifies such stale INIT chunks do not cause problems.\n\nSigned-off-by: Yi Chen <yiche.cy@gmail.com>\nAcked-by: Xin Long <lucien.xin@gmail.com>\n---\nv1 -> v2:\n- Simplify conf_delay() by passing arguments.\n- Avoid calling exit() inside the function.\n- Enable nft log by setting net.netfilter.nf_log_all_netns=1.\n- Add a description for the \"ct invalid drop\" rule match.\n---\n .../net/netfilter/conntrack_sctp_collision.sh | 85 ++++++++++++++-----\n 1 file changed, 63 insertions(+), 22 deletions(-)", "diff": "diff --git a/tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh b/tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh\nindex d860f7d9744b..31823050391e 100755\n--- a/tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh\n+++ b/tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh\n@@ -2,18 +2,32 @@\n # SPDX-License-Identifier: GPL-2.0\n #\n # Testing For SCTP COLLISION SCENARIO as Below:\n-#\n+# 1. Stale INIT_ACK capture:\n # 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]\n # 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]\n # 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]\n # 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]\n # 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]\n # 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]\n+# (Delayed)\n+#\n+# 2. Stale INIT capture:\n+# 14:35:48.353250 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT] [init tag: 1187206187]\n+# 14:35:48.353275 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT ACK] [init tag: 2017837359]\n+# 14:35:48.353283 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [COOKIE ECHO]\n+# 14:35:48.353977 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [COOKIE ACK]\n+# 14:35:47.655279 IP CLIENT_IP.PORT > SERVER_IP.PORT: sctp (1) [INIT] [init tag: 2017837359]\n+# (Delayed)\n+# 14:35:48.855335 IP SERVER_IP.PORT > CLIENT_IP.PORT: sctp (1) [INIT ACK] [init tag: 164579970]\n #\n # TOPO: SERVER_NS (link0)<--->(link1) ROUTER_NS (link2)<--->(link3) CLIENT_NS\n \n source lib.sh\n \n+checktool \"nft --version\" \"run test without nft\"\n+checktool \"tc -h\" \"run test without tc\"\n+checktool \"modprobe -q sctp\" \"load sctp module\"\n+\n CLIENT_IP=\"198.51.200.1\"\n CLIENT_PORT=1234\n \n@@ -24,7 +38,8 @@ CLIENT_GW=\"198.51.200.2\"\n SERVER_GW=\"198.51.100.2\"\n \n # setup the topo\n-setup() {\n+topo_setup() {\n+\t# setup_ns cleans up existing net namespaces first.\n \tsetup_ns CLIENT_NS SERVER_NS ROUTER_NS\n \tip -n \"$SERVER_NS\" link add link0 type veth peer name link1 netns \"$ROUTER_NS\"\n \tip -n \"$CLIENT_NS\" link add link3 type veth peer name link2 netns \"$ROUTER_NS\"\n@@ -38,35 +53,53 @@ setup() {\n \tip -n \"$ROUTER_NS\" addr add $SERVER_GW/24 dev link1\n \tip -n \"$ROUTER_NS\" addr add $CLIENT_GW/24 dev link2\n \tip net exec \"$ROUTER_NS\" sysctl -wq net.ipv4.ip_forward=1\n+\tsysctl -wq net.netfilter.nf_log_all_netns=1\n \n \tip -n \"$CLIENT_NS\" link set link3 up\n \tip -n \"$CLIENT_NS\" addr add $CLIENT_IP/24 dev link3\n \tip -n \"$CLIENT_NS\" route add $SERVER_IP dev link3 via $CLIENT_GW\n+}\n \n-\t# simulate the delay on OVS upcall by setting up a delay for INIT_ACK with\n-\t# tc on $SERVER_NS side\n-\ttc -n \"$SERVER_NS\" qdisc add dev link0 root handle 1: htb r2q 64\n-\ttc -n \"$SERVER_NS\" class add dev link0 parent 1: classid 1:1 htb rate 100mbit\n-\ttc -n \"$SERVER_NS\" filter add dev link0 parent 1: protocol ip u32 match ip protocol 132 \\\n-\t\t0xff match u8 2 0xff at 32 flowid 1:1\n-\tif ! tc -n \"$SERVER_NS\" qdisc add dev link0 parent 1:1 handle 10: netem delay 1200ms; then\n+conf_delay()\n+{\n+\t# simulate the delay on OVS upcall by setting up a delay for INIT_ACK/INIT with\n+\tlocal ns=$1\n+\tlocal link=$2\n+\tlocal chunk_type=$3\n+\n+\t# use a smaller number for assoc's max_retrans to reproduce the issue\n+\tip net exec \"$CLIENT_NS\" sysctl -wq net.sctp.association_max_retrans=3\n+\n+\ttc -n \"$ns\" qdisc add dev \"$link\" root handle 1: htb r2q 64\n+\ttc -n \"$ns\" class add dev \"$link\" parent 1: classid 1:1 htb rate 100mbit\n+\ttc -n \"$ns\" filter add dev \"$link\" parent 1: protocol ip \\\n+\t\tu32 match ip protocol 132 0xff match u8 \"$chunk_type\" 0xff at 32 flowid 1:1\n+\tif ! tc -n \"$ns\" qdisc add dev \"$link\" parent 1:1 handle 10: netem delay 1200ms; then\n \t\techo \"SKIP: Cannot add netem qdisc\"\n-\t\texit $ksft_skip\n+\t\treturn $ksft_skip\n \tfi\n \n \t# simulate the ctstate check on OVS nf_conntrack\n-\tip net exec \"$ROUTER_NS\" iptables -A FORWARD -m state --state INVALID,UNTRACKED -j DROP\n-\tip net exec \"$ROUTER_NS\" iptables -A INPUT -p sctp -j DROP\n-\n-\t# use a smaller number for assoc's max_retrans to reproduce the issue\n-\tmodprobe -q sctp\n-\tip net exec \"$CLIENT_NS\" sysctl -wq net.sctp.association_max_retrans=3\n+\tip net exec \"$ROUTER_NS\" nft -f - <<-EOF\n+\ttable ip t {\n+\t\tchain forward {\n+\t\t\ttype filter hook forward priority filter; policy accept;\n+\t\t\tmeta l4proto icmp counter accept\n+\t\t\tct state new counter accept\n+\t\t\tct state established,related counter accept\n+\t\t\tct state invalid log flags all counter drop comment \\\n+\t\t\t\"Expect to drop stale INIT/INIT_ACK chunks\"\n+\t\t\tcounter\n+\t\t}\n+\t}\n+\tEOF\n+\treturn 0\n }\n \n cleanup() {\n-\tip net exec \"$CLIENT_NS\" pkill sctp_collision >/dev/null 2>&1\n-\tip net exec \"$SERVER_NS\" pkill sctp_collision >/dev/null 2>&1\n+\t# cleanup_all_ns terminates running processes in the namespaces.\n \tcleanup_all_ns\n+\tsysctl -wq net.netfilter.nf_log_all_netns=0\n }\n \n do_test() {\n@@ -81,7 +114,15 @@ do_test() {\n \n # run the test case\n trap cleanup EXIT\n-setup && \\\n-echo \"Test for SCTP Collision in nf_conntrack:\" && \\\n-do_test && echo \"PASS!\"\n-exit $?\n+\n+echo \"Test for SCTP INIT_ACK Collision in nf_conntrack:\"\n+(topo_setup && conf_delay $SERVER_NS link0 2) || exit $?\n+if ! do_test; then\n+\texit $ksft_fail\n+fi\n+\n+echo \"Test for SCTP INIT Collision in nf_conntrack:\"\n+(topo_setup && conf_delay $CLIENT_NS link3 1) || exit $?\n+if ! do_test; then\n+\texit $ksft_fail\n+fi\n", "prefixes": [ "net", "v2" ] }