1. 19 Jun, 2012 36 commits
  2. 18 Jun, 2012 4 commits
    • Pablo Neira Ayuso's avatar
      netfilter: fix compilation of the nfnl_cthelper if NF_CONNTRACK is unset · 6e9c2db3
      Pablo Neira Ayuso authored
      This patch fixes the compilation of net/netfilter/nfnetlink_cthelper.c
      if CONFIG_NF_CONNTRACK is not set.
      
      This patch also moves the definition of the cthelper infrastructure to
      the scope of NF_CONNTRACK things.
      
      I have also renamed NETFILTER_NETLINK_CTHELPER by NF_CT_NETLINK_HELPER,
      to use similar names to other nf_conntrack_netlink extensions. Better now
      that this has been only for two days in David's tree.
      
      Two new dependencies have been added:
      
      * NF_CT_NETLINK
      * NETFILTER_NETLINK_QUEUE
      
      Since these infrastructure requires both ctnetlink and nfqueue.
      Reported-by: default avatarRandy Dunlap <rdunlap@xenotime.net>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      6e9c2db3
    • Pablo Neira Ayuso's avatar
      netfilter: nf_ct_helper: disable automatic helper re-assignment of different type · 32f53760
      Pablo Neira Ayuso authored
      This patch modifies __nf_ct_try_assign_helper in a way that invalidates support
      for the following scenario:
      
      1) attach the helper A for first time when the conntrack is created
      2) attach new (different) helper B due to changes the reply tuple caused by NAT
      
      eg. port redirection from TCP/21 to TCP/5060 with both FTP and SIP helpers
      loaded, which seems to be a quite unorthodox scenario.
      
      I can provide a more elaborated patch to support this scenario but explicit
      helper attachment provides a better solution for this since now the use can
      attach the helpers consistently, without relying on the automatic helper
      lookup magic.
      
      This patch fixes a possible out of bound zeroing of the conntrack helper
      extension if the helper B uses more memory for its private data than
      helper A.
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      32f53760
    • Pablo Neira Ayuso's avatar
      netfilter: ctnetlink: fix NULL dereference while trying to change helper · fd7462de
      Pablo Neira Ayuso authored
      The patch 1afc5679: "netfilter: nf_ct_helper: implement variable
      length helper private data" from Jun 7, 2012, leads to the following
      Smatch complaint:
      
      net/netfilter/nf_conntrack_netlink.c:1231 ctnetlink_change_helper()
               error: we previously assumed 'help->helper' could be null (see line 1228)
      
      This NULL dereference can be triggered with the following sequence:
      
      1) attach the helper for first time when the conntrack is created.
      2) remove the helper module or detach the helper from the conntrack
         via ctnetlink.
      3) attach helper again (the same or different one, no matter) to the
         that existing conntrack again via ctnetlink.
      
      This patch fixes the problem by removing the use case that allows you
      to re-assign again a helper for one conntrack entry via ctnetlink since
      I cannot find any practical use for it.
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      fd7462de
    • Marek Lindner's avatar