Re: [PATCH net 0/2] netfilter: nf_conntrack_h323: fixes for NAT bypass and ASN.1 decode

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Wed, Sep 23, 2026 at 09:50:22AM +0530, Subham Pal wrote:
> This series resolves two separate issues in the Netfilter H.323 helper:
> 
> 1. Overly restrictive tuple comparisons across expectation helpers
>    (expect_h245, expect_rtp_rtcp, expect_t120, expect_callforwarding)
>    that bypass NAT payload mangling under DNAT, hairpin routing, and
>    reverse/reply traffic directions.
> 2. An ASN.1 PER decoding bug in decode_seq() where absent extension fields
>    are processed before verifying their presence in the extension bitmap,
>    leading to packet bitstream desynchronization or premature aborts.

I understand these are correctness fixes.

Do you have a reproducer/PoC? Do you tests for this?

> Subham Pal (2):
>   netfilter: nf_conntrack_h323: do not bypass NAT helpers when tuple
>     source matches reply destination
>   netfilter: nf_conntrack_h323: check extension bitmap before decoding
>     components
> 
>  net/netfilter/nf_conntrack_h323_asn1.c |  6 +++---
>  net/netfilter/nf_conntrack_h323_main.c | 24 ++++++------------------
>  2 files changed, 9 insertions(+), 21 deletions(-)