diff options
| author | Florian Westphal <fw@strlen.de> | 2026-06-29 14:58:22 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2026-07-02 12:17:14 +0200 |
| commit | 5de6c8ad0bcccef1be55ad07d29833df69b601cf (patch) | |
| tree | bcf5a47c188234eba9f1a4d4b191319772abf9ca /include | |
| parent | 26fb502773bc472723930a59dbe561d250c45a5a (diff) | |
netfilter: conntrack: get rid of tuple in helper definitions
Leftover from the days when the kernel did automatic assignment of helpers
based on a pre-registered / well-known-port.
This helper autoassign was removed from the kernel, so all we really
need are the l3 and l4 protocol numbers.
In the broadcast helper, the only remaining consumer of the port number is
removed. AFAICS its not needed: The expectation is populated from the
control connection reply tuple, so the src port is the original directions
destination (snmp/161 for example).
LLM complained about silent l3num (u16) -> nfproto (u8) truncation, so
add a netlink policy validation to reject large NFPROTO values upfront.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/netfilter/nf_conntrack_helper.h | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h index c761cd8158b2..f3f0c1392e88 100644 --- a/include/net/netfilter/nf_conntrack_helper.h +++ b/include/net/netfilter/nf_conntrack_helper.h @@ -43,11 +43,10 @@ struct nf_conntrack_helper { refcount_t ct_refcnt; - /* Tuple of things we will help (compared against server response) */ - struct nf_conntrack_tuple tuple; + u8 nfproto; /* NFPROTO_*, can be NFPROTO_UNSPEC */ + u8 l4proto; /* IPPROTO_UDP/TCP */ - /* Function to call when data passes; return verdict, or -1 to - invalidate. */ + /* Function to call when data passes; return verdict */ int __rcu (*help)(struct sk_buff *skb, unsigned int protoff, struct nf_conn *ct, enum ip_conntrack_info conntrackinfo); @@ -94,7 +93,7 @@ struct nf_conntrack_helper *nf_conntrack_helper_try_module_get(const char *name, void nf_conntrack_helper_put(struct nf_conntrack_helper *helper); void nf_ct_helper_init(struct nf_conntrack_helper *helper, - u16 l3num, u16 protonum, const char *name, + u8 l3num, u16 protonum, const char *name, u16 default_port, u16 spec_port, u32 id, const struct nf_conntrack_expect_policy *exp_pol, u32 expect_class_max, |