Julian Anastasov <ja@xxxxxx> wrote:
> On Sat, 24 Feb 2018, Florian Westphal wrote:
>
> > FTP passive mode got broken by this change:
> > - if (.. && nfct_nat(ct)) {
> > + if (.. (ct->status & IPS_NAT_MASK)) {
>
> Looks like this check was needed to avoid crash in 2.6.35,
> see commit 7bcbf81a2296a8 ("ipvs: avoid oops for passive FTP").
>
> I just tested such fix and it should be enough
> to fix the passive FTP:
>
> diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
> index 3e17d32..58d5d05 100644
> --- a/net/netfilter/ipvs/ip_vs_ftp.c
> +++ b/net/netfilter/ipvs/ip_vs_ftp.c
> @@ -260,7 +260,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
> buf_len = strlen(buf);
>
> ct = nf_ct_get(skb, &ctinfo);
> - if (ct && (ct->status & IPS_NAT_MASK)) {
> + if (ct) {
> bool mangled;
>
> /* If mangling fails this function will return 0
>
> If it looks ok to you and if you prefer you can submit it
> as patch, otherwise I'll do it in the following days...
Looks good to me, its better to get rid of additional condition.
Feel free to submit this patch officially thank you!
> But for now we do not need to set them. If your patch
> works, it was because the bits helped for the IPS_NAT_MASK
> check to allow the nf_nat_mangle_tcp_packet call.
Yes, exactly.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
