: Netfilter fixes

Hi Dave,

following are two netfilter fixes for 2.6.22, adding a few new SIP message types that are necessary to get Jerome's setup working, and a patch to forbid changing helpers of an existing connection to avoid races while changing the helper private area.

Please apply, thanks.

 net/netfilter/nf_conntrack_netlink.c |    3 +--
 net/netfilter/nf_conntrack_sip.c     |    3 +++
 2 files changed, 4 insertions(+), 2 deletions(-)

Jerome Borsboom (1):
[NETFILTER]: nf_conntrack_sip: add missing message types containing RTP info

Yasuyuki Kozakai (1):
[NETFILTER]: nfctnetlink: Don't allow to change helper

[NETFILTER]: nf_conntrack_sip: add missing message types containing RTP info

---
commit 845abcbe6c8ef918b3499e820aafe4d26119c737
tree a07a4b377afbcfcb3cae6c93e50fc09c3006dd29
parent 188e1f81ba31af1b65a2f3611df4c670b092bbac
author Jerome Borsboom <[email protected]> Mon, 18 Jun 2007 14:56:42 +0200 committer Patrick McHardy <[email protected]> Mon, 18 Jun 2007 14:56:42 +0200

 net/netfilter/nf_conntrack_sip.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

index 7aaa8c9..1b5c6c1 100644
@@ -442,6 +442,9 @@ static int sip_help(struct sk_buff **pskb,
 
 	/* RTP info only in some SDP pkts */
 	if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
+	    memcmp(dptr, "UPDATE", sizeof("UPDATE") - 1) != 0 &&
+	    memcmp(dptr, "SIP/2.0 180", sizeof("SIP/2.0 180") - 1) != 0 &&
+	    memcmp(dptr, "SIP/2.0 183", sizeof("SIP/2.0 183") - 1) != 0 &&
 	    memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
 		goto out;
 	}

[NETFILTER]: nfctnetlink: Don't allow to change helper

There is no realistic situation to change helper (Who wants IRC helper to track FTP traffic ?). Moreover, if we want to do that, we need to fix race issue by nfctnetlink and running helper. That will add overhead to packet processing. It wouldn't pay. So this rejects the request to change helper. The requests to add or remove helper are accepted as ever.

---
commit 4c56b708f2c447527749492fd53e85d1e1483f02
tree 6d3f9fd34752e010f5c597a5e2b1611469cb2917
parent 845abcbe6c8ef918b3499e820aafe4d26119c737
author Yasuyuki Kozakai <[email protected]> Wed, 20 Jun 2007 14:52:57 +0200 committer Patrick McHardy <[email protected]> Wed, 20 Jun 2007 14:52:57 +0200

 net/netfilter/nf_conntrack_netlink.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

index 3f73327..d0fe3d7 100644
@@ -869,8 +869,7 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
 		return 0;
 
 	if (help->helper)
-		/* we had a helper before ... */
-		nf_ct_remove_expectations(ct);
+		return -EBUSY;
 
 	/* need to zero data of old helper */
 	memset(&help->help, 0, sizeof(help->help));

From: Patrick McHardy <[email protected]>
Date: Fri, 22 Jun 2007 13:47:30 +0200 (MEST)

Both patches applied, thanks Patrick!