From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753241AbcGTAvW (ORCPT ); Tue, 19 Jul 2016 20:51:22 -0400 Received: from mail-vk0-f67.google.com ([209.85.213.67]:32941 "EHLO mail-vk0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752338AbcGTAvT (ORCPT ); Tue, 19 Jul 2016 20:51:19 -0400 MIME-Version: 1.0 In-Reply-To: <1468813163-18139-1-git-send-email-fgao@ikuai8.com> References: <1468813163-18139-1-git-send-email-fgao@ikuai8.com> From: Liping Zhang Date: Wed, 20 Jul 2016 08:51:17 +0800 Message-ID: Subject: Re: [PATCH 1/1] netfilter: Add helper array register/unregister functions To: fgao@ikuai8.com.aqb.so Cc: Pablo Neira Ayuso , Patrick McHardy , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, gfree.wind@gmail.com Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2016-07-18 11:39 GMT+08:00 : > From: Gao Feng > > Add nf_ct_helper_init, nf_conntrack_helpers_register/unregister > functions to enhance the conntrack helper codes. I think this patch is breaking something ... This irc: > - if (ports[i] == IRC_PORT) > - sprintf(irc[i].name, "irc"); > - else > - sprintf(irc[i].name, "irc-%u", i); > - > - ret = nf_conntrack_helper_register(&irc[i]); > + nf_ct_helper_init(&irc[i], AF_INET, IPPROTO_TCP, "irc", > + IRC_PORT, ports[i], &irc_exp_policy, 0, 0, > + help, NULL, THIS_MODULE); > + } This sip: > - if (ports[i] == SIP_PORT) > - sprintf(sip[i][j].name, "sip"); > - else > - sprintf(sip[i][j].name, "sip-%u", i); And this tftp: > - if (ports[i] == TFTP_PORT) > - sprintf(tftp[i][j].name, "tftp"); > - else > - sprintf(tftp[i][j].name, "tftp-%u", i); For example, if the user install the nf_conntrack_tftp module an specify the ports to "69,10069", then the helper name is "tftp" and "tftp-1". But apply this patch, the helper name will be changed to "tftp" and "tftp-10069", this may break the existing iptables rules which used the helper match or CT target. And this was already discussed at https://patchwork.ozlabs.org/patch/622238/ From mboxrd@z Thu Jan 1 00:00:00 1970 From: Liping Zhang Subject: Re: [PATCH 1/1] netfilter: Add helper array register/unregister functions Date: Wed, 20 Jul 2016 08:51:17 +0800 Message-ID: References: <1468813163-18139-1-git-send-email-fgao@ikuai8.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Cc: Pablo Neira Ayuso , Patrick McHardy , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, gfree.wind@gmail.com To: fgao@ikuai8.com Return-path: In-Reply-To: <1468813163-18139-1-git-send-email-fgao@ikuai8.com> Sender: netfilter-devel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org 2016-07-18 11:39 GMT+08:00 : > From: Gao Feng > > Add nf_ct_helper_init, nf_conntrack_helpers_register/unregister > functions to enhance the conntrack helper codes. I think this patch is breaking something ... This irc: > - if (ports[i] == IRC_PORT) > - sprintf(irc[i].name, "irc"); > - else > - sprintf(irc[i].name, "irc-%u", i); > - > - ret = nf_conntrack_helper_register(&irc[i]); > + nf_ct_helper_init(&irc[i], AF_INET, IPPROTO_TCP, "irc", > + IRC_PORT, ports[i], &irc_exp_policy, 0, 0, > + help, NULL, THIS_MODULE); > + } This sip: > - if (ports[i] == SIP_PORT) > - sprintf(sip[i][j].name, "sip"); > - else > - sprintf(sip[i][j].name, "sip-%u", i); And this tftp: > - if (ports[i] == TFTP_PORT) > - sprintf(tftp[i][j].name, "tftp"); > - else > - sprintf(tftp[i][j].name, "tftp-%u", i); For example, if the user install the nf_conntrack_tftp module an specify the ports to "69,10069", then the helper name is "tftp" and "tftp-1". But apply this patch, the helper name will be changed to "tftp" and "tftp-10069", this may break the existing iptables rules which used the helper match or CT target. And this was already discussed at https://patchwork.ozlabs.org/patch/622238/