netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper
authorJulian Anastasov <ja@ssi.bg>
Tue, 9 Oct 2012 13:00:47 +0000 (13:00 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 26 Nov 2012 20:14:20 +0000 (12:14 -0800)
commitd3230589b189623d8d79fd56826001a8076ac5a6
tree5cc34ff43efc20f2809256821f8c6dc1975bf4bd
parent2b5ea01a9e4664d772ec9c8fc088ae48614564cd
netfilter: nf_conntrack: fix rt_gateway checks for H.323 helper

commit bbb5823cf742a7e955f35c7d891e4e936944c33a upstream.

After the change "Adjust semantics of rt->rt_gateway"
(commit f8126f1d51) we should properly match the nexthop when
destinations are directly connected because rt_gateway can be 0.

The rt_gateway checks in H.323 helper try to avoid the creation
of an unnecessary expectation in this call-forwarding case:

http://people.netfilter.org/zhaojingmin/h323_conntrack_nat_helper/#_Toc133598073

However, the existing code fails to avoid that in many cases,
see this thread:

http://marc.info/?l=linux-netdev&m=135043175028620&w=2

It seems it is not trivial to know from the kernel if two hosts
have to go through the firewall to communicate each other, which
is the main point of the call-forwarding filter code to avoid
creating unnecessary expectations.

So this patch just gets things the way they were as before
commit f8126f1d51.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/netfilter/nf_conntrack_h323_main.c