[PATCH] netfilter: nf_ct_helper: warn when not applying default helper assignment (was Re: [RFC PATCH 0/2] restore original default of nf_conntrack_helper sysctl)

2017-01-23 Thread Jiri Kosina
On Mon, 23 Jan 2017, Linus Torvalds wrote: > For all I know, there may be some security reason why we really don't > want the automatic helpers, even if they can be convenient. > > Also, you can just enable them with a kernel command line or a sysctl, > so it's not like you can't get the old beha

Re: [RFC PATCH 0/2] restore original default of nf_conntrack_helper sysctl

2017-01-23 Thread Pablo Neira Ayuso
On Mon, Jan 23, 2017 at 05:09:55PM -0800, Linus Torvalds wrote: > On Mon, Jan 23, 2017 at 4:06 PM, Jiri Kosina wrote: > > > > Considering this being really close to the "userspace breakage" > > borderline, I'm CCing Linus as well. > > For all I know, there may be some security reason why we reall

Re: [RFC PATCH 0/2] restore original default of nf_conntrack_helper sysctl

2017-01-23 Thread Linus Torvalds
On Mon, Jan 23, 2017 at 4:06 PM, Jiri Kosina wrote: > > Considering this being really close to the "userspace breakage" > borderline, I'm CCing Linus as well. For all I know, there may be some security reason why we really don't want the automatic helpers, even if they can be convenient. Also, y

[RFC PATCH 0/2] restore original default of nf_conntrack_helper sysctl

2017-01-23 Thread Jiri Kosina
After I've upgraded backbone router of rather large-ish network to 4.9, users started complaining about their GRE / PPTP tunnels not working any more. Long time of staring into code revealed that 4.9 kernel has static bool nf_ct_auto_assign_helper __read_mostly = false; which causes au