Re: [H.323 Helper 1/3]: Add support for Call Forwarding

[Patrick McHardy <kaber@trash.net>]

Jing Min Zhao wrote:
>>>>--- a/include/linux/netfilter_ipv4/ip_conntrack.h
>>>>+++ b/include/linux/netfilter_ipv4/ip_conntrack.h
>>>>@@ -154,6 +154,7 @@ struct ip_conntrack_expect
>>>>      unsigned int flags;
>>>>
>>>>#ifdef CONFIG_IP_NF_NAT_NEEDED
>>>>+       u_int32_t saved_ip;
>>>>      /* This is the original per-proto part, used to map the
>>>>       * expected connection the way the recipient expects. */
>>>>      union ip_conntrack_manip_proto saved_proto;
>>>>
>>>>Please explain why this is needed.
>>>>
>>>>
>>>
>>>If an external endpoint A calls an internal endpoint B, and B forwards 
>>>the call to an internal endpoint C, then the second call will come from 
>>>A, pass through firewall, and go to C. The current architecture assumes 
>>>any expected connections come back to the same internal endpoint, so 
>>>only the port (saved_proto) is saved. But in this case, it is not 
>>>enough - the expected connection will go to the third endpoint. So we 
>>>need to save not only C's port but also C's IP.
>>
>>OK, this seems to be unavoidable. But please just replace
>>ip_conntrack_manip_proto by ip_conntrack_manip.
>>
>>
> 
> 
> Do you mean to delete saved_ip and replace 
> "union ip_conntrack_manip_proto saved_proto" with 
> "struct ip_conntrack_manip saved_xxx"? This will break other code, 
> for example, ip_nat_follow_master(). Or I misunderstood.


Yes, these places need to be changes as well. But ip_conntrack_manip
is semantically correct, you use the saved_ip for the manip of the
new connection, so we can instead just save an entire manip.
But its still a good point, please make this change in a seperate patch
from the call forwarding patch.