Re: [PATCH 4/7] Helper modules load on-demand support for ctnetlink

[Patrick McHardy <kaber@trash.net>]

Pablo Neira Ayuso wrote:
> Sorry, it's wrong. Please, take this.

> @@ -1672,9 +1660,24 @@ ctnetlink_create_expect(struct nlattr *c
>  	help = nfct_help(ct);
>  
>  	if (!help || !help->helper) {
> -		/* such conntrack hasn't got any helper, abort */
> +#ifdef CONFIG_KMOD
> +		char *name;
> +
>  		err = -EINVAL;
> +		if (!cda[CTA_EXPECT_HELP_NAME])
> +			goto out;
> +
> +		err = -ENOTSUPP;
> +		name = nla_data(cda[CTA_EXPECT_HELP_NAME]);
> +		if (request_module("nfct-helper-%s", name) < 0)
> +			goto out;
> +
> +		if (nf_ct_set_helper(ct, GFP_KERNEL) < 0)
> +			goto out;

This strikes me as quite inconsistent. First, we only perform
autoloading for expectation creation, but not for conntracks.
Second, this implicit helper assignment is also a bit unusual,
why don't we simply insist that the conntrack has a helper
assigned through the ctnetlink conntrack interface?