| Message ID | 1360684793-32109-1-git-send-email-fw@strlen.de |
|---|---|
| State | Accepted |
| Headers | show |
On Tue, Feb 12, 2013 at 04:59:53PM +0100, Florian Westphal wrote: > commit 32f5376003920a8bc1bd97c6cddcf42df0b6a833 > (netfilter: nf_ct_helper: disable automatic helper re-assignment of different type) > breaks transparent proxy scenarios. > > For example, initial helper lookup might yield "ftp" (dport 21), > while re-lookup after REDIRECT yields "ftp-2121". > > This causes the autoassign code to toss the ftp helper, even > though these are just different instances of the same. > > Change the test to check for the helper function address instead > of the helper address, as suggested by Pablo. Also applied this one, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 884f2b3..6357441 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -236,7 +236,8 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, /* We only allow helper re-assignment of the same sort since * we cannot reallocate the helper extension area. */ - if (help->helper != helper) { + struct nf_conntrack_helper *tmp = rcu_dereference(help->helper); + if (tmp && tmp->help != helper->help) { RCU_INIT_POINTER(help->helper, NULL); goto out; }
commit 32f5376003920a8bc1bd97c6cddcf42df0b6a833 (netfilter: nf_ct_helper: disable automatic helper re-assignment of different type) breaks transparent proxy scenarios. For example, initial helper lookup might yield "ftp" (dport 21), while re-lookup after REDIRECT yields "ftp-2121". This causes the autoassign code to toss the ftp helper, even though these are just different instances of the same. Change the test to check for the helper function address instead of the helper address, as suggested by Pablo. Signed-off-by: Florian Westphal <fw@strlen.de> --- net/netfilter/nf_conntrack_helper.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)