* [PATCH nf-next 1/1] netfilter: ctlink: Return error directly when create expect without help
@ 2017-03-28 1:52 gfree.wind
2017-04-06 19:55 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: gfree.wind @ 2017-03-28 1:52 UTC (permalink / raw)
To: pablo, netfilter-devel, gfree.wind; +Cc: Gao Feng
From: Gao Feng <fgao@ikuai8.com>
The expect check func "__nf_ct_expect_check" asks the master_help is
necessary. So it is unnecessary to go ahead in ctnetlink_alloc_expect
when there is no help.
Actually the commit bc01befdcf3e ("netfilter: ctnetlink: add support
for user-space expectation helpers") permits ctlink create one expect
even though there is no master help. But the latter commit 3d058d7bc2c5
("netfilter: rework user-space expectation helper support") disables
it again.
Signed-off-by: Gao Feng <fgao@ikuai8.com>
---
net/netfilter/nf_conntrack_netlink.c | 14 ++------------
1 file changed, 2 insertions(+), 12 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d49cc1e..c9af545 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3049,18 +3049,8 @@ static int ctnetlink_del_expect(struct net *net, struct sock *ctnl,
help = nfct_help(ct);
if (!help) {
- if (!cda[CTA_EXPECT_TIMEOUT]) {
- err = -EINVAL;
- goto err_out;
- }
- exp->timeout.expires =
- jiffies + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
-
- exp->flags = NF_CT_EXPECT_USERSPACE;
- if (cda[CTA_EXPECT_FLAGS]) {
- exp->flags |=
- ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
- }
+ err = -EOPNOTSUPP;
+ goto err_out;
} else {
if (cda[CTA_EXPECT_FLAGS]) {
exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH nf-next 1/1] netfilter: ctlink: Return error directly when create expect without help
2017-03-28 1:52 [PATCH nf-next 1/1] netfilter: ctlink: Return error directly when create expect without help gfree.wind
@ 2017-04-06 19:55 ` Pablo Neira Ayuso
2017-04-06 22:19 ` Gao Feng
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2017-04-06 19:55 UTC (permalink / raw)
To: gfree.wind; +Cc: netfilter-devel, Gao Feng
[-- Attachment #1: Type: text/plain, Size: 662 bytes --]
On Tue, Mar 28, 2017 at 09:52:52AM +0800, gfree.wind@foxmail.com wrote:
> From: Gao Feng <fgao@ikuai8.com>
>
> The expect check func "__nf_ct_expect_check" asks the master_help is
> necessary. So it is unnecessary to go ahead in ctnetlink_alloc_expect
> when there is no help.
>
> Actually the commit bc01befdcf3e ("netfilter: ctnetlink: add support
> for user-space expectation helpers") permits ctlink create one expect
> even though there is no master help. But the latter commit 3d058d7bc2c5
> ("netfilter: rework user-space expectation helper support") disables
> it again.
Probably reject this upfront if no nfct_help(ct) is there.
See patch attached.
[-- Attachment #2: x.patch --]
[-- Type: text/x-diff, Size: 2285 bytes --]
commit 543b8a39eaacef70822f23f8e8de336c18761c40
Author: Gao Feng <fgao@ikuai8.com>
Date: Tue Mar 28 09:52:52 2017 +0800
netfilter: ctnetlink: Expectations must have a conntrack helper area
The expect check function __nf_ct_expect_check() asks the master_help
is necessary. So it is unnecessary to go ahead in ctnetlink_alloc_expect
when there is no help.
Actually the commit bc01befdcf3e ("netfilter: ctnetlink: add support
for user-space expectation helpers") permits ctnetlink create one expect
even though there is no master help. But the latter commit 3d058d7bc2c5
("netfilter: rework user-space expectation helper support") disables
it again.
Signed-off-by: Gao Feng <fgao@ikuai8.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index ecdc324c7785..cd0a6d270ebe 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3038,6 +3038,10 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
struct nf_conn_help *help;
int err;
+ help = nfct_help(ct);
+ if (!help)
+ return ERR_PTR(-EOPNOTSUPP);
+
if (cda[CTA_EXPECT_CLASS] && helper) {
class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
if (class > helper->expect_class_max)
@@ -3047,26 +3051,11 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
if (!exp)
return ERR_PTR(-ENOMEM);
- help = nfct_help(ct);
- if (!help) {
- if (!cda[CTA_EXPECT_TIMEOUT]) {
- err = -EINVAL;
- goto err_out;
- }
- exp->timeout.expires =
- jiffies + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
-
- exp->flags = NF_CT_EXPECT_USERSPACE;
- if (cda[CTA_EXPECT_FLAGS]) {
- exp->flags |=
- ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
- }
+ if (cda[CTA_EXPECT_FLAGS]) {
+ exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
+ exp->flags &= ~NF_CT_EXPECT_USERSPACE;
} else {
- if (cda[CTA_EXPECT_FLAGS]) {
- exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
- exp->flags &= ~NF_CT_EXPECT_USERSPACE;
- } else
- exp->flags = 0;
+ exp->flags = 0;
}
if (cda[CTA_EXPECT_FN]) {
const char *name = nla_data(cda[CTA_EXPECT_FN]);
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH nf-next 1/1] netfilter: ctlink: Return error directly when create expect without help
2017-04-06 19:55 ` Pablo Neira Ayuso
@ 2017-04-06 22:19 ` Gao Feng
2017-04-06 22:44 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Gao Feng @ 2017-04-06 22:19 UTC (permalink / raw)
To: 'Pablo Neira Ayuso'; +Cc: netfilter-devel, 'Gao Feng'
Hi Pablo,
> -----Original Message-----
> From: Pablo Neira Ayuso [mailto:pablo@netfilter.org]
> Sent: Friday, April 7, 2017 3:55 AM
> To: gfree.wind@foxmail.com
> Cc: netfilter-devel@vger.kernel.org; Gao Feng <fgao@ikuai8.com>
> Subject: Re: [PATCH nf-next 1/1] netfilter: ctlink: Return error directly
when
> create expect without help
>
> On Tue, Mar 28, 2017 at 09:52:52AM +0800, gfree.wind@foxmail.com wrote:
> > From: Gao Feng <fgao@ikuai8.com>
> >
> > The expect check func "__nf_ct_expect_check" asks the master_help is
> > necessary. So it is unnecessary to go ahead in ctnetlink_alloc_expect
> > when there is no help.
> >
> > Actually the commit bc01befdcf3e ("netfilter: ctnetlink: add support
> > for user-space expectation helpers") permits ctlink create one expect
> > even though there is no master help. But the latter commit
> > 3d058d7bc2c5
> > ("netfilter: rework user-space expectation helper support") disables
> > it again.
>
> Probably reject this upfront if no nfct_help(ct) is there.
>
> See patch attached.
Yes, it is better.
Would you apply this patch which you attached directly, or need I send
another v2 update?
Best Regards
Feng
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH nf-next 1/1] netfilter: ctlink: Return error directly when create expect without help
2017-04-06 22:19 ` Gao Feng
@ 2017-04-06 22:44 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2017-04-06 22:44 UTC (permalink / raw)
To: Gao Feng; +Cc: netfilter-devel, 'Gao Feng'
On Fri, Apr 07, 2017 at 06:19:07AM +0800, Gao Feng wrote:
> Yes, it is better.
> Would you apply this patch which you attached directly, or need I send
> another v2 update?
I'll apply this one. No need to send v2.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-04-06 22:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-28 1:52 [PATCH nf-next 1/1] netfilter: ctlink: Return error directly when create expect without help gfree.wind
2017-04-06 19:55 ` Pablo Neira Ayuso
2017-04-06 22:19 ` Gao Feng
2017-04-06 22:44 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.