1 files changed, 9 insertions, 0 deletions

diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index a937d4f75613..8cb62805fd68 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -394,6 +394,15 @@ static int sctp_packet(struct nf_conn *ct,
                         pr_debug("Setting vtag %x for dir %d\n",
                                  ih->init_tag, !dir);
                         ct->proto.sctp.vtag[!dir] = ih->init_tag;
+
+                        /* don't renew timeout on init retransmit so
+                         * port reuse by client or NAT middlebox cannot
+                         * keep entry alive indefinitely (incl. nat info).
+                         */
+                        if (new_state == SCTP_CONNTRACK_CLOSED &&
+                            old_state == SCTP_CONNTRACK_CLOSED &&
+                            nf_ct_is_confirmed(ct))
+                                ignore = true;
                 }
 
                 ct->proto.sctp.state = new_state;