Commit 1cc4a018 authored by Xin Long's avatar Xin Long Committed by Pablo Neira Ayuso

netfilter: ipvs: fix the issue that sctp_conn_schedule drops non-INIT packet

Commit 5e26b1b3 ("ipvs: support scheduling inverse and icmp SCTP
packets") changed to check packet type early. It introduced a side
effect: if it's not a INIT packet, ports will be set as  NULL, and
the packet will be dropped later.

It caused that sctp couldn't create connection when ipvs module is
loaded and any scheduler is registered on server.

Li Shuang reproduced it by running the cmds on sctp server:
  # ipvsadm -A -t 1.1.1.1:80 -s rr
  # ipvsadm -D -t 1.1.1.1:80
then the server could't work any more.

This patch is to return 1 when it's not an INIT packet. It means ipvs
will accept it without creating a conn for it, just like what it does
for tcp.

Fixes: 5e26b1b3 ("ipvs: support scheduling inverse and icmp SCTP packets")
Reported-by: default avatarLi Shuang <shuali@redhat.com>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 8e0deed9
...@@ -24,10 +24,13 @@ sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, ...@@ -24,10 +24,13 @@ sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
if (sh) { if (sh) {
sch = skb_header_pointer(skb, iph->len + sizeof(_sctph), sch = skb_header_pointer(skb, iph->len + sizeof(_sctph),
sizeof(_schunkh), &_schunkh); sizeof(_schunkh), &_schunkh);
if (sch && (sch->type == SCTP_CID_INIT || if (sch) {
sysctl_sloppy_sctp(ipvs))) if (!(sysctl_sloppy_sctp(ipvs) ||
sch->type == SCTP_CID_INIT))
return 1;
ports = &sh->source; ports = &sh->source;
} }
}
} else { } else {
ports = skb_header_pointer( ports = skb_header_pointer(
skb, iph->len, sizeof(_ports), &_ports); skb, iph->len, sizeof(_ports), &_ports);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment