[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.63.1208181438060.17600@stinky-local.trash.net>
Date: Sat, 18 Aug 2012 14:43:57 +0200 (MEST)
From: Patrick McHardy <kaber@...sh.net>
To: Pablo Neira Ayuso <pablo@...filter.org>
cc: netfilter-devel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [PATCH 05/19] netfilter: nf_conntrack_ipv6: improve fragmentation
handling
On Fri, 17 Aug 2012, Pablo Neira Ayuso wrote:
> On Thu, Aug 09, 2012 at 10:08:49PM +0200, kaber@...sh.net wrote:
>> +
>> + /* Conntrack helpers need the entire reassembled packet in the
>> + * POST_ROUTING hook.
>> + */
>> + ct = nf_ct_get(reasm, &ctinfo);
>> + if (ct != NULL && test_bit(IPS_HELPER_BIT, &ct->status)) {
>
> Two things regarding the line above:
>
> - I think this also need to check for !nf_ct_is_untracked(ct)
Fixed, thanks.
>
> - IPS_HELPER_BIT is only set if the CT target is used to attach
> helpers. I know, this behaviour may seem confusing, but I didn't
> find any better way to avoid that NAT removes the helper
> explicitly attached via CT.
>
> So basically now that status bit means: "this helper has been attached
> via CT".
>
> Setting it inconditionally in __nf_ct_try_assign_helper would break
> the magic auto-assign helper code.
>
> On the other hand, the automatic helper assignment is scheduled to
> be removed (well, it would still take at least one 1.5/2 years
> before we do so). At that time, we'll be able to say that all
> conntrack with IPS_HELPER really has one helper. But now I think that
> you'll have to use for nfct_help instead to check if that ct has a
> helper.
I see. Also fixed, thanks. New patch attached.
View attachment "ct-frag6.diff" of type "TEXT/PLAIN" (9573 bytes)
Powered by blists - more mailing lists