5.10-stable patches

added patches:
	netfilter-set-default-timeout-to-3-secs-for-sctp-shutdown-send-and-recv-state.patch

diff --git a/queue-5.10/netfilter-set-default-timeout-to-3-secs-for-sctp-shutdown-send-and-recv-state.patch b/queue-5.10/netfilter-set-default-timeout-to-3-secs-for-sctp-shutdown-send-and-recv-state.patch
new file mode 100644 (file)
index 0000000..98248bd
--- /dev/null
+++ b/queue-5.10/netfilter-set-default-timeout-to-3-secs-for-sctp-shutdown-send-and-recv-state.patch
@@ -0,0 +1,68 @@
+From 9bfab6d23a2865966a4f89a96536fbf23f83bc8c Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Tue, 15 Aug 2023 14:08:47 -0400
+Subject: netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
+
+From: Xin Long <lucien.xin@gmail.com>
+
+commit 9bfab6d23a2865966a4f89a96536fbf23f83bc8c upstream.
+
+In SCTP protocol, it is using the same timer (T2 timer) for SHUTDOWN and
+SHUTDOWN_ACK retransmission. However in sctp conntrack the default timeout
+value for SCTP_CONNTRACK_SHUTDOWN_ACK_SENT state is 3 secs while it's 300
+msecs for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV state.
+
+As Paolo Valerio noticed, this might cause unwanted expiration of the ct
+entry. In my test, with 1s tc netem delay set on the NAT path, after the
+SHUTDOWN is sent, the sctp ct entry enters SCTP_CONNTRACK_SHUTDOWN_SEND
+state. However, due to 300ms (too short) delay, when the SHUTDOWN_ACK is
+sent back from the peer, the sctp ct entry has expired and been deleted,
+and then the SHUTDOWN_ACK has to be dropped.
+
+Also, it is confusing these two sysctl options always show 0 due to all
+timeout values using sec as unit:
+
+  net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd = 0
+  net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent = 0
+
+This patch fixes it by also using 3 secs for sctp shutdown send and recv
+state in sctp conntrack, which is also RTO.initial value in SCTP protocol.
+
+Note that the very short time value for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV
+was probably used for a rare scenario where SHUTDOWN is sent on 1st path
+but SHUTDOWN_ACK is replied on 2nd path, then a new connection started
+immediately on 1st path. So this patch also moves from SHUTDOWN_SEND/RECV
+to CLOSE when receiving INIT in the ORIGINAL direction.
+
+Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
+Reported-by: Paolo Valerio <pvalerio@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_proto_sctp.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -49,8 +49,8 @@ static const unsigned int sctp_timeouts[
+       [SCTP_CONNTRACK_COOKIE_WAIT]            = 3 SECS,
+       [SCTP_CONNTRACK_COOKIE_ECHOED]          = 3 SECS,
+       [SCTP_CONNTRACK_ESTABLISHED]            = 210 SECS,
+-      [SCTP_CONNTRACK_SHUTDOWN_SENT]          = 300 SECS / 1000,
+-      [SCTP_CONNTRACK_SHUTDOWN_RECD]          = 300 SECS / 1000,
++      [SCTP_CONNTRACK_SHUTDOWN_SENT]          = 3 SECS,
++      [SCTP_CONNTRACK_SHUTDOWN_RECD]          = 3 SECS,
+       [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT]      = 3 SECS,
+       [SCTP_CONNTRACK_HEARTBEAT_SENT]         = 30 SECS,
+ };
+@@ -105,7 +105,7 @@ static const u8 sctp_conntracks[2][11][S
+       {
+ /*    ORIGINAL        */
+ /*                  sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS */
+-/* init         */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW},
++/* init         */ {sCL, sCL, sCW, sCE, sES, sCL, sCL, sSA, sCW},
+ /* init_ack     */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL},
+ /* abort        */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
+ /* shutdown     */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL},

diff --git a/queue-5.10/series b/queue-5.10/series
index 2eeb89dc55b5583c8d5a7cf17533f58840f945b8..4b16e54c3878d761102d4eedd59bf1a59f95ad60 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -118,3 +118,4 @@ alsa-usb-audio-add-support-for-mythware-xa001au-capture-and-playback-interfaces.
 cifs-release-folio-lock-on-fscache-read-hit.patch
 mmc-wbsd-fix-double-mmc_free_host-in-wbsd_init.patch
 mmc-block-fix-in_flight-value-error.patch
+netfilter-set-default-timeout-to-3-secs-for-sctp-shutdown-send-and-recv-state.patch