From: Fernando Fernandez Mancera <fmancera@suse.de>
To: netfilter-devel@vger.kernel.org
Cc: coreteam@netfilter.org, phil@nwl.cc, fw@strlen.de,
pablo@netfilter.org,
Fernando Fernandez Mancera <fmancera@suse.de>
Subject: [PATCH 5/9 nf-next] netfilter: nat: use DEBUG_NET_WARN_ON_ONCE in core and helper paths
Date: Mon, 1 Jun 2026 21:30:45 +0200 [thread overview]
Message-ID: <20260601193049.8131-6-fmancera@suse.de> (raw)
In-Reply-To: <20260601193049.8131-1-fmancera@suse.de>
Replace WARN_ON and WARN_ON_ONCE with DEBUG_NET_WARN_ON_ONCE across core
NAT setup functions, masquerade, redirect, and helpers. This prevents
unnecessary system panics when panic_on_warn=1 is enabled in production
systems.
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
net/ipv4/netfilter/nf_nat_pptp.c | 16 +++++++++----
net/netfilter/nf_nat_core.c | 39 +++++++++++++++++++++----------
net/netfilter/nf_nat_masquerade.c | 6 +++--
net/netfilter/nf_nat_proto.c | 14 +++++++----
net/netfilter/nf_nat_redirect.c | 5 ++--
5 files changed, 55 insertions(+), 25 deletions(-)
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index fab357cc8559..f4f7cf0a5aba 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -53,8 +53,10 @@ static void pptp_nat_expected(struct nf_conn *ct,
struct nf_conn_nat *nat;
nat = nf_ct_nat_ext_add(ct);
- if (WARN_ON_ONCE(!nat))
+ if (unlikely(!nat)) {
+ DEBUG_NET_WARN_ON_ONCE(1);
return;
+ }
nat_pptp_info = &nat->help.nat_pptp_info;
ct_pptp_info = nfct_help_data(master);
@@ -132,8 +134,10 @@ pptp_outbound_pkt(struct sk_buff *skb,
__be16 new_callid;
unsigned int cid_off;
- if (WARN_ON_ONCE(!nat))
+ if (unlikely(!nat)) {
+ DEBUG_NET_WARN_ON_ONCE(1);
return NF_DROP;
+ }
nat_pptp_info = &nat->help.nat_pptp_info;
ct_pptp_info = nfct_help_data(ct);
@@ -204,8 +208,10 @@ pptp_exp_gre(struct nf_conntrack_expect *expect_orig,
struct nf_ct_pptp_master *ct_pptp_info;
struct nf_nat_pptp *nat_pptp_info;
- if (WARN_ON_ONCE(!nat))
+ if (unlikely(!nat)) {
+ DEBUG_NET_WARN_ON_ONCE(1);
return;
+ }
nat_pptp_info = &nat->help.nat_pptp_info;
ct_pptp_info = nfct_help_data(ct);
@@ -241,8 +247,10 @@ pptp_inbound_pkt(struct sk_buff *skb,
__be16 new_pcid;
unsigned int pcid_off;
- if (WARN_ON_ONCE(!nat))
+ if (unlikely(!nat)) {
+ DEBUG_NET_WARN_ON_ONCE(1);
return NF_DROP;
+ }
nat_pptp_info = &nat->help.nat_pptp_info;
new_pcid = nat_pptp_info->pns_call_id;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 74ec224ce0d6..99ff65e89952 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -366,8 +366,10 @@ nf_nat_used_tuple_harder(const struct nf_conntrack_tuple *tuple,
if (thash->tuple.dst.dir == IP_CT_DIR_ORIGINAL)
goto out;
- if (WARN_ON_ONCE(ct == ignored_conntrack))
+ if (unlikely(ct == ignored_conntrack)) {
+ DEBUG_NET_WARN_ON_ONCE(1);
goto out;
+ }
flags = READ_ONCE(ct->status);
if (!nf_nat_may_kill(ct, flags))
@@ -773,11 +775,13 @@ nf_nat_setup_info(struct nf_conn *ct,
if (nf_ct_is_confirmed(ct))
return NF_ACCEPT;
- WARN_ON(maniptype != NF_NAT_MANIP_SRC &&
- maniptype != NF_NAT_MANIP_DST);
+ if (unlikely(maniptype != NF_NAT_MANIP_SRC && maniptype != NF_NAT_MANIP_DST))
+ DEBUG_NET_WARN_ON_ONCE(1);
- if (WARN_ON(nf_nat_initialized(ct, maniptype)))
+ if (unlikely(nf_nat_initialized(ct, maniptype))) {
+ DEBUG_NET_WARN_ON_ONCE(1);
return NF_DROP;
+ }
/* What we've got will look like inverse of reply. Normally
* this is what is in the conntrack, except for prior
@@ -955,8 +959,8 @@ nf_nat_inet_fn(void *priv, struct sk_buff *skb,
break;
default:
/* ESTABLISHED */
- WARN_ON(ctinfo != IP_CT_ESTABLISHED &&
- ctinfo != IP_CT_ESTABLISHED_REPLY);
+ if (unlikely(ctinfo != IP_CT_ESTABLISHED && ctinfo != IP_CT_ESTABLISHED_REPLY))
+ DEBUG_NET_WARN_ON_ONCE(1);
if (nf_nat_oif_changed(state->hook, ctinfo, nat, state->out))
goto oif_changed;
}
@@ -1143,8 +1147,10 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
/* Should not happen, restricted to creating new conntracks
* via ctnetlink.
*/
- if (WARN_ON_ONCE(nf_nat_initialized(ct, manip)))
+ if (unlikely(nf_nat_initialized(ct, manip))) {
+ DEBUG_NET_WARN_ON_ONCE(1);
return -EEXIST;
+ }
/* No NAT information has been passed, allocate the null-binding */
if (attr == NULL)
@@ -1181,8 +1187,10 @@ int nf_nat_register_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
struct nf_hook_ops *nat_ops;
int i, ret;
- if (WARN_ON_ONCE(pf >= ARRAY_SIZE(nat_net->nat_proto_net)))
+ if (unlikely(pf >= ARRAY_SIZE(nat_net->nat_proto_net))) {
+ DEBUG_NET_WARN_ON_ONCE(1);
return -EINVAL;
+ }
nat_proto_net = &nat_net->nat_proto_net[pf];
@@ -1193,8 +1201,10 @@ int nf_nat_register_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
}
}
- if (WARN_ON_ONCE(i == ops_count))
+ if (unlikely(i == ops_count)) {
+ DEBUG_NET_WARN_ON_ONCE(1);
return -EINVAL;
+ }
mutex_lock(&nf_nat_proto_mutex);
if (!nat_proto_net->nat_hook_ops) {
@@ -1235,7 +1245,8 @@ int nf_nat_register_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
nat_ops = nat_proto_net->nat_hook_ops;
priv = nat_ops[hooknum].priv;
- if (WARN_ON_ONCE(!priv)) {
+ if (unlikely(!priv)) {
+ DEBUG_NET_WARN_ON_ONCE(1);
mutex_unlock(&nf_nat_proto_mutex);
return -EOPNOTSUPP;
}
@@ -1264,8 +1275,10 @@ void nf_nat_unregister_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
nat_proto_net = &nat_net->nat_proto_net[pf];
mutex_lock(&nf_nat_proto_mutex);
- if (WARN_ON(nat_proto_net->users == 0))
+ if (unlikely(nat_proto_net->users == 0)) {
+ DEBUG_NET_WARN_ON_ONCE(1);
goto unlock;
+ }
nat_proto_net->users--;
@@ -1276,8 +1289,10 @@ void nf_nat_unregister_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
break;
}
}
- if (WARN_ON_ONCE(i == ops_count))
+ if (unlikely(i == ops_count)) {
+ DEBUG_NET_WARN_ON_ONCE(1);
goto unlock;
+ }
priv = nat_ops[hooknum].priv;
nf_hook_entries_delete_raw(&priv->entries, ops);
diff --git a/net/netfilter/nf_nat_masquerade.c b/net/netfilter/nf_nat_masquerade.c
index 4de6e0a51701..660961ca4e31 100644
--- a/net/netfilter/nf_nat_masquerade.c
+++ b/net/netfilter/nf_nat_masquerade.c
@@ -36,7 +36,8 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
const struct rtable *rt;
__be32 newsrc, nh;
- WARN_ON(hooknum != NF_INET_POST_ROUTING);
+ if (unlikely(hooknum != NF_INET_POST_ROUTING))
+ DEBUG_NET_WARN_ON_ONCE(1);
ct = nf_ct_get(skb, &ctinfo);
@@ -297,7 +298,8 @@ int nf_nat_masquerade_inet_register_notifiers(void)
int ret = 0;
mutex_lock(&masq_mutex);
- if (WARN_ON_ONCE(masq_refcnt == UINT_MAX)) {
+ if (masq_refcnt == UINT_MAX) {
+ DEBUG_NET_WARN_ON_ONCE(1);
ret = -EOVERFLOW;
goto out_unlock;
}
diff --git a/net/netfilter/nf_nat_proto.c b/net/netfilter/nf_nat_proto.c
index 07f51fe75fbe..21a525b2490f 100644
--- a/net/netfilter/nf_nat_proto.c
+++ b/net/netfilter/nf_nat_proto.c
@@ -373,7 +373,7 @@ unsigned int nf_nat_manip_pkt(struct sk_buff *skb, struct nf_conn *ct,
return NF_ACCEPT;
break;
default:
- WARN_ON_ONCE(1);
+ DEBUG_NET_WARN_ON_ONCE(1);
break;
}
@@ -491,7 +491,7 @@ void nf_nat_csum_recalc(struct sk_buff *skb,
#endif
}
- WARN_ON_ONCE(1);
+ DEBUG_NET_WARN_ON_ONCE(1);
}
int nf_nat_icmp_reply_translation(struct sk_buff *skb,
@@ -509,7 +509,8 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb,
struct nf_conntrack_tuple target;
unsigned long statusbit;
- WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);
+ if (unlikely(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY))
+ DEBUG_NET_WARN_ON_ONCE(1);
if (skb_ensure_writable(skb, hdrlen + sizeof(*inside)))
return 0;
@@ -823,7 +824,8 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
struct nf_conntrack_tuple target;
unsigned long statusbit;
- WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);
+ if (unlikely(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY))
+ DEBUG_NET_WARN_ON_ONCE(1);
if (skb_ensure_writable(skb, hdrlen + sizeof(*inside)))
return 0;
@@ -1074,8 +1076,10 @@ int nf_nat_inet_register_fn(struct net *net, const struct nf_hook_ops *ops)
{
int ret;
- if (WARN_ON_ONCE(ops->pf != NFPROTO_INET))
+ if (ops->pf != NFPROTO_INET) {
+ DEBUG_NET_WARN_ON_ONCE(1);
return -EINVAL;
+ }
ret = nf_nat_register_fn(net, NFPROTO_IPV6, ops, nf_nat_ipv6_ops,
ARRAY_SIZE(nf_nat_ipv6_ops));
diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c
index 5b37487d9d11..138a805a36af 100644
--- a/net/netfilter/nf_nat_redirect.c
+++ b/net/netfilter/nf_nat_redirect.c
@@ -52,8 +52,9 @@ nf_nat_redirect_ipv4(struct sk_buff *skb, const struct nf_nat_range2 *range,
{
union nf_inet_addr newdst = {};
- WARN_ON(hooknum != NF_INET_PRE_ROUTING &&
- hooknum != NF_INET_LOCAL_OUT);
+ if (unlikely(hooknum != NF_INET_PRE_ROUTING &&
+ hooknum != NF_INET_LOCAL_OUT))
+ DEBUG_NET_WARN_ON_ONCE(1);
/* Local packets: make them go to loopback */
if (hooknum == NF_INET_LOCAL_OUT) {
--
2.54.0
next prev parent reply other threads:[~2026-06-01 19:31 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-01 19:30 [PATCH 0/9 nf-next] netfilter: replace raw warnings with Fernando Fernandez Mancera
2026-06-01 19:30 ` [PATCH 1/9 nf-next] netfilter: xtables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths Fernando Fernandez Mancera
2026-06-01 19:30 ` [PATCH 2/9 nf-next] netfilter: nf_tables: " Fernando Fernandez Mancera
2026-06-01 19:30 ` [PATCH 3/9 nf-next] netfilter: nfnetlink: use DEBUG_NET_WARN_ON_ONCE for attribute validation Fernando Fernandez Mancera
2026-06-01 19:30 ` [PATCH 4/9 nf-next] netfilter: conntrack: use DEBUG_NET_WARN_ON_ONCE on packet paths Fernando Fernandez Mancera
2026-06-18 17:11 ` Pablo Neira Ayuso
2026-06-18 17:32 ` Florian Westphal
2026-06-18 18:15 ` Pablo Neira Ayuso
2026-06-18 20:32 ` Fernando Fernandez Mancera
2026-06-18 20:38 ` Fernando Fernandez Mancera
2026-06-01 19:30 ` Fernando Fernandez Mancera [this message]
2026-06-01 19:30 ` [PATCH 6/9 nf-next] netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks Fernando Fernandez Mancera
2026-06-01 19:30 ` [PATCH 7/9 nf-next] netfilter: bpf: use DEBUG_NET_WARN_ON_ONCE for missing BTF structures Fernando Fernandez Mancera
2026-06-01 19:30 ` [PATCH 8/9 nf-next] netfilter: flowtable: use DEBUG_NET_WARN_ON_ONCE in offload path Fernando Fernandez Mancera
2026-06-01 19:30 ` [PATCH 9/9 nf-next] netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit Fernando Fernandez Mancera
2026-06-01 19:35 ` [PATCH 0/9 nf-next] netfilter: replace raw warnings with Fernando Fernandez Mancera
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260601193049.8131-6-fmancera@suse.de \
--to=fmancera@suse.de \
--cc=coreteam@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.