[PATCH] conntrack-mms / keep hook private.

[PATCH] conntrack-mms / keep hook private.

[Pawel Sikora]

[-- Attachment #1: Type: text/plain, Size: 308 bytes --]

Hi All,

IMHO the hook should be a private part of a kernel
(similar to other conntrack modules).
Attached patch hide the mms hook from userland.

Regards,
Pawel.

-- 
The only thing necessary for the triumph of evil
  is for good men to do nothing.
                                           - Edmund Burke

[-- Attachment #2: mms-conntrack-keep_hook_private.patch --]
[-- Type: text/x-diff, Size: 677 bytes --]

Index: mms-conntrack-nat/linux-2.6.11/include/linux/netfilter_ipv4/ip_conntrack_mms.h
===================================================================
--- mms-conntrack-nat/linux-2.6.11/include/linux/netfilter_ipv4/ip_conntrack_mms.h	(revision 3889)
+++ mms-conntrack-nat/linux-2.6.11/include/linux/netfilter_ipv4/ip_conntrack_mms.h	(working copy)
@@ -30,9 +30,11 @@
 };
 
 struct ip_conntrack_expect;
+#ifdef __KERNEL__
 extern unsigned int (*ip_nat_mms_hook)(struct sk_buff **pskb,
 				       enum ip_conntrack_info ctinfo,
 				       const struct ip_ct_mms_expect *exp_mms_info,
 				       struct ip_conntrack_expect *exp);
+#endif
 
 #endif /* _IP_CONNTRACK_MMS_H */

Re: [PATCH] conntrack-mms / keep hook private.

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 280 bytes --]

Pawel Sikora wrote:
> Hi All,
> 
> IMHO the hook should be a private part of a kernel
> (similar to other conntrack modules).
> Attached patch hide the mms hook from userland.

I agree, but in fact nothing of the entire file should be
visible, so I've applied this patch instead.

[-- Attachment #2: x --]
[-- Type: text/plain, Size: 743 bytes --]

Index: linux-2.6.11/include/linux/netfilter_ipv4/ip_conntrack_mms.h
===================================================================
--- linux-2.6.11/include/linux/netfilter_ipv4/ip_conntrack_mms.h	(Revision 3890)
+++ linux-2.6.11/include/linux/netfilter_ipv4/ip_conntrack_mms.h	(Arbeitskopie)
@@ -15,7 +15,6 @@
 #define MMS_SRV_CHUNKLENLV_OFFSET        16
 #define MMS_SRV_CHUNKLENLM_OFFSET        32
 #define MMS_SRV_MESSAGELENGTH_OFFSET     8
-#endif
 
 /* This structure is per expected connection */
 struct ip_ct_mms_expect {
@@ -34,5 +33,5 @@
 				       enum ip_conntrack_info ctinfo,
 				       const struct ip_ct_mms_expect *exp_mms_info,
 				       struct ip_conntrack_expect *exp);
-
+#endif
 #endif /* _IP_CONNTRACK_MMS_H */