Patchwork H.245v10+ support in nf_conntrack_h323?

login
register
mail settings
Submitter Andreas Jaggi
Date Sept. 2, 2009, 8:05 a.m.
Message ID <20090902080516.GA6766@urbino.open.ch>
Download mbox | patch
Permalink /patch/32817/
State RFC
Delegated to: David Miller
Headers show

Comments

Andreas Jaggi - Sept. 2, 2009, 8:05 a.m.
On Tue, Sep 01, 2009 at 02:20:51PM +0200, Patrick McHardy wrote:
> Its unfortunately necessary to drop packets in some cases after parsing
> errors when the helper might have already (partially) mangled the
> packet.

Do the helpers also mangle packets when there is no NAT involved?
(in out setup we don't use NAT, btw)
If they don't, would it be reasonable to return NF_ACCEPT when there is
no NAT. For example like in the patch below?

> You could try this patch in combination with ulogd and the pcap output
> plugin to capture the packets which are dropped by the helper for
> analysis.

Unfortunately the videoconferencing system is currently not available
for testing (and might be so for while). But I can have some tcpdumps from
both sides of the Linux Gateway from which I can extract the packets that
were dropped by the H.323 helper.

Andreas


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

--- a/net/netfilter/nf_conntrack_h323_main.c	2009-05-19 01:52:34.000000000 +0200
+++ b/net/netfilter/nf_conntrack_h323_main.c	2009-09-01 17:36:08.000000000 +0200
@@ -596,8 +596,12 @@ 
 		}
 
 		/* Process H.245 signal */
-		if (process_h245(skb, ct, ctinfo, &data, dataoff, &mscm) < 0)
-			goto drop;
+		if (process_h245(skb, ct, ctinfo, &data, dataoff, &mscm) < 0) {
+			if (ct->status & IPS_NAT_MASK)
+				goto drop;
+			else
+				break;
+		}
 	}
 
 	spin_unlock_bh(&nf_h323_lock);
@@ -1141,8 +1145,12 @@ 
 		}
 
 		/* Process Q.931 signal */
-		if (process_q931(skb, ct, ctinfo, &data, dataoff, &q931) < 0)
-			goto drop;
+		if (process_q931(skb, ct, ctinfo, &data, dataoff, &q931) < 0) {
+			if (ct->status & IPS_NAT_MASK)
+				goto drop;
+			else
+				break;
+		}
 	}
 
 	spin_unlock_bh(&nf_h323_lock);
@@ -1716,7 +1724,8 @@ 
 	}
 
 	/* Process RAS message */
-	if (process_ras(skb, ct, ctinfo, &data, &ras) < 0)
+	if ((process_ras(skb, ct, ctinfo, &data, &ras) < 0) &&
+	    (ct->status & IPS_NAT_MASK))
 		goto drop;
 
       accept: