Skip to contentSkip to conversation

PPTP connection tracking and NAT helper

DISCUSSION Harald Welte 2 participants 3 messages May 5, 2005 1 message not in the archive netfilter

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Harald Welte

author
#1 lore raw
Quoted 5 lines · Lukasz Kosewski

The problem I have is that in 2.6.11, there no longer exists a 'union ip_conntrack_nat_help' in include/linux/netfilter_ipv4/ip_conntrack.h, to which the PPTP/NAT patches make changes. While I can simply change the patches such that they ignore this, I am not certain whether or not this is intended, or whether I will be losing some functionality.

please read the netfilter-devel archive. I get asked this question at least ten times a week:

There is no pptp/gre conntrack and nat helper for 2.6.11+, since this kernel version contains a redesigned infrastructure for such helpers.

At this time, I see very limited chance that this new infrastructure is sufficient enough to actually implement the same functionality. A straight 1:1 port ist definitely not possible.

Signature · 5 lines
- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie
#2 lore raw
Quoted 5 lines · Harald Welte

please read the netfilter-devel archive. I get asked this question at least ten times a week:

There is no pptp/gre conntrack and nat helper for 2.6.11+, since this kernel version contains a redesigned infrastructure for such helpers.

How bout we make it harder for people to try? Attached patch adds a 'Requires' to pptp in pom, and fixes up broken Requires handling.

Phil

Netfilter_POM.pm +3 -3
diff -ru pom-orig/Netfilter_POM.pm pom-new/Netfilter_POM.pm
@@ -196,10 +196,10 @@
 		# if the requirement refers to the tested patchlet,
 		# project version must fulfil the requirement.
 		# Multiple requirements are ANDed.
-		return 0 if $pver eq $prog 
-			    && !$self->version_compare($proj, $op, $ver);
+		return 1 if $pver eq $prog 
+			    && $self->version_compare($proj, $op, $ver);
 	}
-	return 1;
+	return 0;
 }
 
 # are the requirements for a specific patchlet fulfilled?
pptp-conntrack-nat/help +1 -0
diff -ru pom-orig/pptp-conntrack-nat/help pom-new/pptp-conntrack-nat/help
@@ -20,3 +20,4 @@
 - doesnt' support multiple calls within one session
 - you have to recompile your iptables userspace program since some 
   structure sizes change
+- does NOT work with kernels > 2.6.10
pptp-conntrack-nat/info +1 -0
diff -ru pom-orig/pptp-conntrack-nat/info pom-new/pptp-conntrack-nat/info
@@ -3,3 +3,4 @@
 Status: Testing, especially the 2.6.x port
 Repository: extra
 Depends: !nat-reservations
+Requires: linux < 2.6.11
author
#3 lore raw
Quoted 9 lines · Phil Oester
Quoted 5 lines · Harald Welte

please read the netfilter-devel archive. I get asked this question at least ten times a week:

There is no pptp/gre conntrack and nat helper for 2.6.11+, since this kernel version contains a redesigned infrastructure for such helpers.

How bout we make it harder for people to try? Attached patch adds a 'Requires' to pptp in pom, and fixes up broken Requires handling.

oh, I wasn't aware of that. I've committed your changes, thanks.

Signature · 5 lines
- Harald Welte <[email protected]>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie