From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751929AbdAXAGY (ORCPT ); Mon, 23 Jan 2017 19:06:24 -0500 Received: from mx2.suse.de ([195.135.220.15]:53372 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750860AbdAXAGX (ORCPT ); Mon, 23 Jan 2017 19:06:23 -0500 Date: Tue, 24 Jan 2017 01:06:18 +0100 (CET) From: Jiri Kosina X-X-Sender: jkosina@pobox.suse.cz To: Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org, info@jablonka.cz, Linus Torvalds Subject: [RFC PATCH 0/2] restore original default of nf_conntrack_helper sysctl Message-ID: User-Agent: Alpine 2.20 (LSU 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org After I've upgraded backbone router of rather large-ish network to 4.9, users started complaining about their GRE / PPTP tunnels not working any more. Long time of staring into code revealed that 4.9 kernel has static bool nf_ct_auto_assign_helper __read_mostly = false; which causes automatic matching of conntrack helpers not to work any more. Turns out the default was flipped in 3bb398d925 ("netfilter: nf_ct_helper: disable automatic helper assignment") (*) in 4.7. Digging further back into history, it turns out that the kernel started to print a warning message about automatic helper assignment being deprecated in 3.5+; given the fact that this message is ususally burried somewhere deep in the boot sequence (and therefore hardly noticed by each and every router admin on the planet), and given the fact that this has proven itself to severely break at least mine router config (which has been working for years), I propose to revert the patches flipping the default. Anyone is still of course free to set up an explicit CT-based matching for better reliability, but the automatic assignment should stay. Considering this being really close to the "userspace breakage" borderline, I'm CCing Linus as well. (*) the changelog of that commit is odd by itself as well, as it references SHA-1 72110dfaa907, but that doesn't exist in my tree at least. Jiri Kosina (2): Revert "netfilter: nf_ct_helper: disable automatic helper assignment" Revert "netfilter: fix nf_conntrack_helper documentation" Documentation/networking/nf_conntrack-sysctl.txt | 7 ++----- net/netfilter/nf_conntrack_helper.c | 4 ++-- 2 files changed, 4 insertions(+), 7 deletions(-) -- Jiri Kosina SUSE Labs