linux-kernel - Re: [PATCH v2] netfilter: nf_ct_helper: warn when not applying default helper assignment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 1 Feb 2017 20:43:51 +0100 (CET)
From:   Jiri Kosina <jikos@...nel.org>
To:     Pablo Neira Ayuso <pablo@...filter.org>
cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>,
        Florian Westphal <fw@...len.de>,
        NetFilter <netfilter-devel@...r.kernel.org>,
        coreteam@...filter.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        info@...lonka.cz, eric@...it.org
Subject: Re: [PATCH v2] netfilter: nf_ct_helper: warn when not applying
 default helper assignment

On Wed, 1 Feb 2017, Pablo Neira Ayuso wrote:

> > +{
> > +	struct nf_conntrack_helper *ret;
> > +
> > +	if (!net->ct.sysctl_auto_assign_helper) {
> > +		if (net->ct.auto_assign_helper_warned)
> > +			return NULL;
> > +		if (!find_auto_helper(ct))
> 
> This fits in one line, so I think no need for find_auto_helper(), look:

It does, but OTOH we're calling the lookup more than once, and that for me 
justifies extra function (with a descriptive name), so that we don't have 
to change multiple places in case the data structure changes in the 
future.

But I don't have a strong preference either way, so I'll change it.

> > +	if (!ret || net->ct.auto_assign_helper_warned)
> > +		return ret;
> > +	pr_info("nf_conntrack: automatic helper assignment is deprecated and it will "
> > +		"be removed soon. Use the iptables CT target to attach helpers "
> > +		" instead.\n");
> 
> You can probably remove this older message now if you prefer the new
> one you wrote, actually it's a bit redundant IMO.

Fair enough; we'll be issuing the warning in cases where actual "harm" 
would be caused, and that should be enough.

I'll trim down the CC list a little bit and submit v3 shortly.

Thanks,

-- 
Jiri Kosina
SUSE Labs