• Liping Zhang's avatar
    netfilter: nf_ct_helper: permit cthelpers with different names via nfnetlink · 66e5a6b1
    Liping Zhang authored
    cthelpers added via nfnetlink may have the same tuple, i.e. except for
    the l3proto and l4proto, other fields are all zero. So even with the
    different names, we will also fail to add them:
      # nfct helper add ssdp inet udp
      # nfct helper add tftp inet udp
      nfct v1.4.3: netlink error: File exists
    
    So in order to avoid unpredictable behaviour, we should:
    1. cthelpers can be selected by nft ct helper obj or xt_CT target, so
    report error if duplicated { name, l3proto, l4proto } tuple exist.
    2. cthelpers can be selected by nf_ct_tuple_src_mask_cmp when
    nf_ct_auto_assign_helper is enabled, so also report error if duplicated
    { l3proto, l4proto, src-port } tuple exist.
    
    Also note, if the cthelper is added from userspace, then the src-port will
    always be zero, it's invalid for nf_ct_auto_assign_helper, so there's no
    need to check the second point listed above.
    
    Fixes: 893e093c ("netfilter: nf_ct_helper: bail out on duplicated helpers")
    Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    66e5a6b1
nf_conntrack_helper.c 15.6 KB