Subject: 答复: [PATCH 1/1] netfilter: Add helper array register/unregister functions

From: 高峰 <[email-masked]>
Date: Wed, 20 Jul 2016 09:02:52 +0800

Oh, thanks Liping.
I have not found the extra port styles are different of irc, sane and tftp with ftp.

Hi Pablo,
Then should I modify the original patch or send a new one?

-----邮件原件-----
发件人: Liping Zhang [mailto:[email-masked]] 
发送时间: 2016年7月20日 8:51
收件人: [email-masked]
抄送: Pablo Neira Ayuso <[email-masked]>; Patrick McHardy <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; [email-masked]
主题: Re: [PATCH 1/1] netfilter: Add helper array register/unregister functions

2016-07-18 11:39 GMT+08:00  <[email-masked]>:
> From: Gao Feng <[email-masked]>
>
> Add nf_ct_helper_init, nf_conntrack_helpers_register/unregister
> functions to enhance the conntrack helper codes.

I think this patch is breaking something ...

This irc:
> -               if (ports[i] == IRC_PORT)
> -                       sprintf(irc[i].name, "irc");
> -               else
> -                       sprintf(irc[i].name, "irc-%u", i);
> -
> -               ret = nf_conntrack_helper_register(&irc[i]);
> +               nf_ct_helper_init(&irc[i], AF_INET, IPPROTO_TCP, "irc",
> +                                 IRC_PORT, ports[i], &irc_exp_policy, 0, 0,
> +                                 help, NULL, THIS_MODULE);
> +       }

This sip:
> -                       if (ports[i] == SIP_PORT)
> -                               sprintf(sip[i][j].name, "sip");
> -                       else
> -                               sprintf(sip[i][j].name, "sip-%u", i);

And this tftp:
> -                       if (ports[i] == TFTP_PORT)
> -                               sprintf(tftp[i][j].name, "tftp");
> -                       else
> -                               sprintf(tftp[i][j].name, "tftp-%u", i);

For example, if the user install the nf_conntrack_tftp module an specify the ports to "69,10069", then the helper name is "tftp" and "tftp-1".

But apply this patch, the helper name will be changed to "tftp" and "tftp-10069", this may break the existing iptables rules which used the helper match or CT target.

And this was already discussed  at https://patchwork.ozlabs.org/patch/622238/