netfilter: nf_ct_helper: warn when not applying default helper assignment

[linux-beck.git] / net / netfilter / nf_conntrack_helper.c

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 7341adf7059d3232f458bc02528d9631107ebfce..6dc44d9b41900bea12f487e5a044259e92a47f7e 100644 (file)
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -188,6 +188,26 @@ nf_ct_helper_ext_add(struct nf_conn *ct,
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_ext_add);
 
+static struct nf_conntrack_helper *
+nf_ct_lookup_helper(struct nf_conn *ct, struct net *net)
+{
+       if (!net->ct.sysctl_auto_assign_helper) {
+               if (net->ct.auto_assign_helper_warned)
+                       return NULL;
+               if (!__nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple))
+                       return NULL;
+               pr_info("nf_conntrack: default automatic helper assignment "
+                       "has been turned off for security reasons and CT-based "
+                       " firewall rule not found. Use the iptables CT target "
+                       "to attach helpers instead.\n");
+               net->ct.auto_assign_helper_warned = 1;
+               return NULL;
+       }
+
+       return __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+}
+
+
 int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
                              gfp_t flags)
 {
@@ -213,21 +233,14 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
        }
 
        help = nfct_help(ct);
-       if (net->ct.sysctl_auto_assign_helper && helper == NULL) {
-               helper = __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
-               if (unlikely(!net->ct.auto_assign_helper_warned && helper)) {
-                       pr_info("nf_conntrack: automatic helper "
-                               "assignment is deprecated and it will "
-                               "be removed soon. Use the iptables CT target "
-                               "to attach helpers instead.\n");
-                       net->ct.auto_assign_helper_warned = true;
-               }
-       }
 
        if (helper == NULL) {
-               if (help)
-                       RCU_INIT_POINTER(help->helper, NULL);
-               return 0;
+               helper = nf_ct_lookup_helper(ct, net);
+               if (helper == NULL) {
+                       if (help)
+                               RCU_INIT_POINTER(help->helper, NULL);
+                       return 0;
+               }
        }
 
        if (help == NULL) {