Re: bugs in ftp conntrack

[Patrick McHardy <kaber@trash.net>]

YU, Haitao wrote:
>>From: Patrick McHardy <kaber@trash.net>
>>
>>There's not much we can do about this case, we already keep a history
>>of sequence numbers. As you note below that code is pretty broken
>>currently, but I have patches queued to fix it (attached to this mail).
>>
> 
> 
> 
> I think if it's possible that we don't record the new seqence of too new packets.
> "Too new packets" means the sequence of the packet is greater than all
> seq_aft_nl[] values.  We just wait until another "port", "227", etc. packet is
> parsed correctly.
> 
> 
> So the return value of function find_nl_seq() shoule be three: 
> 1: too new, then parse pattern, only if found > 0,  then update seq, else keep
> current seq_aft_nl;
> 0: match one of the remembered seq, then parse pattern, update seq when found >=
> 0;
> -1: too old(less than all remembered seq),  just goto out, (not goto
> out_update_nl)


Would you mind sending a patch to demonstrate your idea?