On Fri, 17 Aug 2012, Pablo Neira Ayuso wrote:

On Thu, Aug 09, 2012 at 10:08:49PM +0200, kaber@trash.net wrote:

quoted

+
+		/* Conntrack helpers need the entire reassembled packet in the
+		 * POST_ROUTING hook.
+		 */
+		ct = nf_ct_get(reasm, &ctinfo);
+		if (ct != NULL && test_bit(IPS_HELPER_BIT, &ct->status)) {

Two things regarding the line above:

- I think this also need to check for !nf_ct_is_untracked(ct)

Fixed, thanks.

- IPS_HELPER_BIT is only set if the CT target is used to attach
 helpers. I know, this behaviour may seem confusing, but I didn't
 find any better way to avoid that NAT removes the helper
 explicitly attached via CT.

 So basically now that status bit means: "this helper has been attached
 via CT".

 Setting it inconditionally in __nf_ct_try_assign_helper would break
 the magic auto-assign helper code.

 On the other hand, the automatic helper assignment is scheduled to
 be removed (well, it would still take at least one 1.5/2 years
 before we do so). At that time, we'll be able to say that all
 conntrack with IPS_HELPER really has one helper. But now I think that
 you'll have to use for nfct_help instead to check if that ct has a
 helper.

I see. Also fixed, thanks. New patch attached.