From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753449AbdAZW7X (ORCPT ); Thu, 26 Jan 2017 17:59:23 -0500 Received: from mail-pg0-f51.google.com ([74.125.83.51]:36659 "EHLO mail-pg0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752293AbdAZW7W (ORCPT ); Thu, 26 Jan 2017 17:59:22 -0500 From: Kevin Cernekee To: pablo@netfilter.org Cc: dianders@chromium.org, davem@davemloft.net, netfilter-devel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH V2 2/2] netfilter: ctnetlink: Fix regression in CTA_HELP processing Date: Thu, 26 Jan 2017 14:49:44 -0800 Message-Id: <20170126224944.29047-2-cernekee@chromium.org> X-Mailer: git-send-email 2.11.0.483.g087da7b7c-goog In-Reply-To: <20170126224944.29047-1-cernekee@chromium.org> References: <20170126224944.29047-1-cernekee@chromium.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Prior to Linux 4.4, it was usually harmless to send a CTA_HELP attribute containing the name of the current helper. That is no longer the case: as of Linux 4.4, if ctnetlink_change_helper() returns an error from the ct->master check, processing of the request will fail, skipping the NFQA_EXP attribute (if present). This patch changes the behavior to improve compatibility with user programs that expect the kernel interface to work the way it did prior to Linux 4.4. If a user program specifies CTA_HELP but the argument matches the current conntrack helper name, ignore it instead of generating an error. Signed-off-by: Kevin Cernekee --- V1->V2: - Add comment and update changelog, per code review feedback - Rebase + retest on net-next net/netfilter/nf_conntrack_netlink.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index e8f704a6..891f02a 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -1503,14 +1503,23 @@ static int ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *helpinfo = NULL; int err; - /* don't change helper of sibling connections */ - if (ct->master) - return -EBUSY; - err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo); if (err < 0) return err; + /* don't change helper of sibling connections */ + if (ct->master) { + /* If we try to change the helper to the same thing twice, + * treat the second attempt as a no-op instead of returning + * an error. + */ + if (help && help->helper && + !strcmp(help->helper->name, helpname)) + return 0; + else + return -EBUSY; + } + if (!strcmp(helpname, "")) { if (help && help->helper) { /* we had a helper before ... */ -- 2.7.4