]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper
authorJulian Anastasov <ja@ssi.bg>
Tue, 9 Oct 2012 13:00:47 +0000 (13:00 +0000)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 22 Oct 2012 10:21:55 +0000 (12:21 +0200)
commite6293da87fcd2cddcf53af524e622fcd4d9450f8
tree6e7d6ac6740cdb5a9b75352f281c583d8a26ad67
parentb5410230cfa060ddeee80279ea4b7b835e3bfb61
netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper

After the change "Adjust semantics of rt->rt_gateway"
(commit aca2e6f6f2) we should properly match the nexthop when
destinations are directly connected because rt_gateway can be 0.

The rt_gateway checks in H.323 helper try to avoid the creation
of an unnecessary expectation in this call-forwarding case:

http://people.netfilter.org/zhaojingmin/h323_conntrack_nat_helper/#_Toc133598073

However, the existing code fails to avoid that in many cases,
see this thread:

http://marc.info/?l=linux-netdev&m=135043175028620&w=2

It seems it is not trivial to know from the kernel if two hosts
have to go through the firewall to communicate each other, which
is the main point of the call-forwarding filter code to avoid
creating unnecessary expectations.

So this patch just gets things the way they were as before
commit aca2e6f6f2.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_conntrack_h323_main.c