1. 19 Jun, 2012 38 commits
  2. 18 Jun, 2012 2 commits
    • Pablo Neira Ayuso's avatar
      netfilter: fix compilation of the nfnl_cthelper if NF_CONNTRACK is unset · 6e9c2db3
      Pablo Neira Ayuso authored
      This patch fixes the compilation of net/netfilter/nfnetlink_cthelper.c
      if CONFIG_NF_CONNTRACK is not set.
      
      This patch also moves the definition of the cthelper infrastructure to
      the scope of NF_CONNTRACK things.
      
      I have also renamed NETFILTER_NETLINK_CTHELPER by NF_CT_NETLINK_HELPER,
      to use similar names to other nf_conntrack_netlink extensions. Better now
      that this has been only for two days in David's tree.
      
      Two new dependencies have been added:
      
      * NF_CT_NETLINK
      * NETFILTER_NETLINK_QUEUE
      
      Since these infrastructure requires both ctnetlink and nfqueue.
      Reported-by: default avatarRandy Dunlap <rdunlap@xenotime.net>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      6e9c2db3
    • Pablo Neira Ayuso's avatar
      netfilter: nf_ct_helper: disable automatic helper re-assignment of different type · 32f53760
      Pablo Neira Ayuso authored
      This patch modifies __nf_ct_try_assign_helper in a way that invalidates support
      for the following scenario:
      
      1) attach the helper A for first time when the conntrack is created
      2) attach new (different) helper B due to changes the reply tuple caused by NAT
      
      eg. port redirection from TCP/21 to TCP/5060 with both FTP and SIP helpers
      loaded, which seems to be a quite unorthodox scenario.
      
      I can provide a more elaborated patch to support this scenario but explicit
      helper attachment provides a better solution for this since now the use can
      attach the helpers consistently, without relying on the automatic helper
      lookup magic.
      
      This patch fixes a possible out of bound zeroing of the conntrack helper
      extension if the helper B uses more memory for its private data than
      helper A.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      32f53760