netfilter: ct_extend: alloc space for xt_portscan

netfilter: ct_extend: alloc space for xt_portscan

[Jan Engelhardt]

parent b58602a4bac012b5f4fc12fe6b46ab237b610d5d
commit 7634e5f586394eafc85973712ff11e60a9ae2f70
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Thu Jan 8 09:20:03 2009 +0100

netfilter: ct_extend: alloc space for xt_portscan

The out-of-tree xt_portscan module currently (ab)uses skb->mark and
nfct->mark to store its state, but such may collide with
user-specified marks.

Using nfct_extend alleviates that problem and hopefully paves way
for inclusion of the module.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
 include/net/netfilter/nf_conntrack_extend.h |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
index da8ee52..389794a 100644
--- a/include/net/netfilter/nf_conntrack_extend.h
+++ b/include/net/netfilter/nf_conntrack_extend.h
@@ -8,6 +8,7 @@ enum nf_ct_ext_id
 	NF_CT_EXT_HELPER,
 	NF_CT_EXT_NAT,
 	NF_CT_EXT_ACCT,
+	NF_CT_EXT_PORTSCAN, /* xt_portscan state */
 	NF_CT_EXT_NUM,
 };
 

Re: netfilter: ct_extend: alloc space for xt_portscan

[Pablo Neira Ayuso]

Jan Engelhardt wrote:
> parent b58602a4bac012b5f4fc12fe6b46ab237b610d5d
> commit 7634e5f586394eafc85973712ff11e60a9ae2f70
> Author: Jan Engelhardt <jengelh@medozas.de>
> Date:   Thu Jan 8 09:20:03 2009 +0100
> 
> netfilter: ct_extend: alloc space for xt_portscan
> 
> The out-of-tree xt_portscan module currently (ab)uses skb->mark and
> nfct->mark to store its state, but such may collide with
> user-specified marks.
> 
> Using nfct_extend alleviates that problem and hopefully paves way
> for inclusion of the module.
> 
> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
> ---
>  include/net/netfilter/nf_conntrack_extend.h |    1 +
>  1 files changed, 1 insertions(+), 0 deletions(-)
> 
> diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
> index da8ee52..389794a 100644
> --- a/include/net/netfilter/nf_conntrack_extend.h
> +++ b/include/net/netfilter/nf_conntrack_extend.h
> @@ -8,6 +8,7 @@ enum nf_ct_ext_id
>  	NF_CT_EXT_HELPER,
>  	NF_CT_EXT_NAT,
>  	NF_CT_EXT_ACCT,
> +	NF_CT_EXT_PORTSCAN, /* xt_portscan state */
>  	NF_CT_EXT_NUM,
>  };

Sorry, I would not reserve an entry unless I know what xt_portscan is.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers

Re: netfilter: ct_extend: alloc space for xt_portscan

[Patrick McHardy]

Pablo Neira Ayuso wrote:
> Jan Engelhardt wrote:
>> parent b58602a4bac012b5f4fc12fe6b46ab237b610d5d
>> commit 7634e5f586394eafc85973712ff11e60a9ae2f70
>> Author: Jan Engelhardt <jengelh@medozas.de>
>> Date:   Thu Jan 8 09:20:03 2009 +0100
>>
>> netfilter: ct_extend: alloc space for xt_portscan
>>
>> The out-of-tree xt_portscan module currently (ab)uses skb->mark and
>> nfct->mark to store its state, but such may collide with
>> user-specified marks.
>>
>> Using nfct_extend alleviates that problem and hopefully paves way
>> for inclusion of the module.
>>
> 
> Sorry, I would not reserve an entry unless I know what xt_portscan is.

I feel the same way. And I would like to know why it needs
connection state. That seems counterintuitive to a portscan
detector, which is by definition trying to detect something
happening in multiple connections.

Re: netfilter: ct_extend: alloc space for xt_portscan

[Jan Engelhardt]

On Monday 2009-01-12 05:07, Patrick McHardy wrote:
>>>
>>> The out-of-tree xt_portscan module currently (ab)uses skb->mark and
>>> nfct->mark to store its state, but such may collide with
>>> user-specified marks.
>>>
>>> Using nfct_extend alleviates that problem and hopefully paves way
>>> for inclusion of the module.
>>
>> Sorry, I would not reserve an entry unless I know what xt_portscan is.

http://article.gmane.org/gmane.linux.kernel/502344

> I feel the same way. And I would like to know why it needs
> connection state. That seems counterintuitive to a portscan
> detector, which is by definition trying to detect something
> happening in multiple connections.

Is it so? Maybe it should be called portscantype then, but what's in a name.

Re: netfilter: ct_extend: alloc space for xt_portscan

[Patrick McHardy]

Jan Engelhardt wrote:
> On Monday 2009-01-12 05:07, Patrick McHardy wrote:
>>>> The out-of-tree xt_portscan module currently (ab)uses skb->mark and
>>>> nfct->mark to store its state, but such may collide with
>>>> user-specified marks.
>>>>
>>>> Using nfct_extend alleviates that problem and hopefully paves way
>>>> for inclusion of the module.
>>> Sorry, I would not reserve an entry unless I know what xt_portscan is.
> 
> http://article.gmane.org/gmane.linux.kernel/502344

Just send the patch please.

> 
>> I feel the same way. And I would like to know why it needs
>> connection state. That seems counterintuitive to a portscan
>> detector, which is by definition trying to detect something
>> happening in multiple connections.
> 
> Is it so? Maybe it should be called portscantype then, but what's in a name.
>