Re: [PATCH nf] netfilter: ipvs: flag ct as needing s/dnat in original direction

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Julian Anastasov <ja@xxxxxx> wrote:
> On Sat, 24 Feb 2018, Florian Westphal wrote:
> 
> > FTP passive mode got broken by this change:
> > - if (.. && nfct_nat(ct)) {
> > + if (.. (ct->status & IPS_NAT_MASK)) {
> 
> 	Looks like this check was needed to avoid crash in 2.6.35,
> see commit 7bcbf81a2296a8 ("ipvs: avoid oops for passive FTP").
> 
> 	I just tested such fix and it should be enough
> to fix the passive FTP:
> 
> diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
> index 3e17d32..58d5d05 100644
> --- a/net/netfilter/ipvs/ip_vs_ftp.c
> +++ b/net/netfilter/ipvs/ip_vs_ftp.c
> @@ -260,7 +260,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
>  		buf_len = strlen(buf);
>  
>  		ct = nf_ct_get(skb, &ctinfo);
> -		if (ct && (ct->status & IPS_NAT_MASK)) {
> +		if (ct) {
>  			bool mangled;
>  
>  			/* If mangling fails this function will return 0
> 
> 	If it looks ok to you and if you prefer you can submit it
> as patch, otherwise I'll do it in the following days...

Looks good to me, its better to get rid of additional condition.
Feel free to submit this patch officially thank you!
 
> 	But for now we do not need to set them. If your patch
> works, it was because the bits helped for the IPS_NAT_MASK
> check to allow the nf_nat_mangle_tcp_packet call.

Yes, exactly.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux