netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE

stable inclusion
from stable-v5.10.166
commit 498584ccf46c1996aa4d5677ae7a6417632b9e10
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I87FRA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=498584ccf46c1996aa4d5677ae7a6417632b9e10



--------------------------------

[ Upstream commit a9993591 ]

RFC 9260, Sec 8.5.1 states that for ABORT/SHUTDOWN_COMPLETE, the chunk
MUST be accepted if the vtag of the packet matches its own tag and the
T bit is not set OR if it is set to its peer's vtag and the T bit is set
in chunk flags. Otherwise the packet MUST be silently dropped.

Update vtag verification for ABORT/SHUTDOWN_COMPLETE based on the above
description.

Fixes: 9fb9cbb1 ("[NETFILTER]: Add nf_conntrack subsystem.")
Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: sanglipeng <sanglipeng1@jd.com>