linux-kernel - 答复: [PATCH 1/1] netfilter: Add helper array register/unregister functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <015201d1e222$71cfe330$556fa990$@ikuai8.com>
Date:	Wed, 20 Jul 2016 09:02:52 +0800
From:	高峰 <fgao@...ai8.com>
To:	"'Liping Zhang'" <zlpnobody@...il.com>
Cc:	"'Pablo Neira Ayuso'" <pablo@...filter.org>,
	"'Patrick McHardy'" <kaber@...sh.net>,
	<netfilter-devel@...r.kernel.org>, <netdev@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <gfree.wind@...il.com>
Subject: 答复: [PATCH 1/1] netfilter: Add helper array register/unregister functions

Oh, thanks Liping.
I have not found the extra port styles are different of irc, sane and tftp with ftp.

Hi Pablo,
Then should I modify the original patch or send a new one?


-----邮件原件-----
发件人: Liping Zhang [mailto:zlpnobody@...il.com] 
发送时间: 2016年7月20日 8:51
收件人: fgao@...ai8.com
抄送: Pablo Neira Ayuso <pablo@...filter.org>; Patrick McHardy <kaber@...sh.net>; netfilter-devel@...r.kernel.org; netdev@...r.kernel.org; linux-kernel@...r.kernel.org; gfree.wind@...il.com
主题: Re: [PATCH 1/1] netfilter: Add helper array register/unregister functions

2016-07-18 11:39 GMT+08:00  <fgao@...ai8.com>:
> From: Gao Feng <fgao@...ai8.com>
>
> Add nf_ct_helper_init, nf_conntrack_helpers_register/unregister
> functions to enhance the conntrack helper codes.

I think this patch is breaking something ...

This irc:
> -               if (ports[i] == IRC_PORT)
> -                       sprintf(irc[i].name, "irc");
> -               else
> -                       sprintf(irc[i].name, "irc-%u", i);
> -
> -               ret = nf_conntrack_helper_register(&irc[i]);
> +               nf_ct_helper_init(&irc[i], AF_INET, IPPROTO_TCP, "irc",
> +                                 IRC_PORT, ports[i], &irc_exp_policy, 0, 0,
> +                                 help, NULL, THIS_MODULE);
> +       }

This sip:
> -                       if (ports[i] == SIP_PORT)
> -                               sprintf(sip[i][j].name, "sip");
> -                       else
> -                               sprintf(sip[i][j].name, "sip-%u", i);

And this tftp:
> -                       if (ports[i] == TFTP_PORT)
> -                               sprintf(tftp[i][j].name, "tftp");
> -                       else
> -                               sprintf(tftp[i][j].name, "tftp-%u", i);

For example, if the user install the nf_conntrack_tftp module an specify the ports to "69,10069", then the helper name is "tftp" and "tftp-1".

But apply this patch, the helper name will be changed to "tftp" and "tftp-10069", this may break the existing iptables rules which used the helper match or CT target.

And this was already discussed  at https://patchwork.ozlabs.org/patch/622238/