* [PATCH nf,v7 2/6] netfilter: nfnetlink_queue: consolidate access to hook entries on reinjection
2026-11-12 22:11 [PATCH nf,v7 1/6] netfilter: nfnetlink_queue: add helper function to retrieve hook entries Pablo Neira Ayuso
@ 2026-11-12 22:11 ` Pablo Neira Ayuso
2026-11-12 22:11 ` [PATCH nf,v7 3/6] netfilter: ctnetlink: restrict expectation creation glue to userspace helpers Pablo Neira Ayuso
` (3 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-12 22:11 UTC (permalink / raw)
To: netfilter-devel
Fetch struct nf_hook_entries only once then pass it on to reinject path,
otherwise re-fetching the pointer breaks atomicity when checking for the
conntrack hook type, since hook registration/unregistration might occur
while following nfqueue reinjection path.
This is a preparation patch, not behaviour change is intended.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v7: no changes
net/netfilter/nfnetlink_queue.c | 42 +++++++++++++++++++++++----------
1 file changed, 30 insertions(+), 12 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 09af8faf8675..7fb6b6b82a24 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -382,10 +382,11 @@ nf_queue_hook_entry(const struct nf_hook_entries *hooks,
}
/* caller must hold rcu read-side lock */
-static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
+static void nf_reinject(struct nf_queue_entry *entry,
+ const struct nf_hook_entries *hooks,
+ unsigned int verdict)
{
const struct nf_hook_entry *hook_entry;
- const struct nf_hook_entries *hooks;
struct sk_buff *skb = entry->skb;
bool old_in_nf_duplicate;
unsigned int i;
@@ -400,13 +401,6 @@ static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
current->in_nf_duplicate = entry->in_nf_duplicate;
- hooks = nf_queue_hook_entries(entry);
- if (!hooks) {
- kfree_skb_reason(skb, SKB_DROP_REASON_NETFILTER_DROP);
- nf_queue_entry_free(entry);
- goto out;
- }
-
hook_entry = nf_queue_hook_entry(hooks, entry);
if (!hook_entry) {
kfree_skb_reason(skb, SKB_DROP_REASON_NETFILTER_DROP);
@@ -515,7 +509,9 @@ static bool nf_bridge_ports_valid(const struct nf_queue_entry *entry)
return true;
}
-static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict)
+static void __nfqnl_reinject(struct nf_queue_entry *entry,
+ const struct nf_hook_entries *hooks,
+ unsigned int verdict)
{
const struct nf_ct_hook *ct_hook;
@@ -562,8 +558,21 @@ static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict)
if (nf_ct_drop_unconfirmed(entry, NULL))
verdict = NF_DROP;
}
+ nf_reinject(entry, hooks, verdict);
+}
+
+static void nfqnl_reinject(struct nf_queue_entry *entry,
+ unsigned int verdict)
+{
+ const struct nf_hook_entries *hooks = nf_queue_hook_entries(entry);
+
+ if (!hooks) {
+ kfree_skb_reason(entry->skb, SKB_DROP_REASON_NETFILTER_DROP);
+ nf_queue_entry_free(entry);
+ return;
+ }
- nf_reinject(entry, verdict);
+ __nfqnl_reinject(entry, hooks, verdict);
}
static void
@@ -1866,6 +1875,7 @@ static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,
{
struct nfnl_queue_net *q = nfnl_queue_pernet(info->net);
u_int16_t queue_num = ntohs(info->nfmsg->res_id);
+ const struct nf_hook_entries *hooks;
const struct nfnl_ct_hook *nfnl_ct;
struct nfqnl_msg_verdict_hdr *vhdr;
enum ip_conntrack_info ctinfo;
@@ -1890,6 +1900,13 @@ static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,
if (entry == NULL)
return -ENOENT;
+ hooks = nf_queue_hook_entries(entry);
+ if (!hooks) {
+ kfree_skb_reason(entry->skb, SKB_DROP_REASON_NETFILTER_DROP);
+ nf_queue_entry_free(entry);
+ return -ENOENT;
+ }
+
/* rcu lock already held from nfnl->call_rcu. */
nfnl_ct = rcu_dereference(nfnl_ct_hook);
@@ -1924,7 +1941,8 @@ static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,
if (nfqa[NFQA_PRIORITY])
entry->skb->priority = ntohl(nla_get_be32(nfqa[NFQA_PRIORITY]));
- nfqnl_reinject(entry, verdict);
+ __nfqnl_reinject(entry, hooks, verdict);
+
return 0;
}
--
2.47.3
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH nf,v7 3/6] netfilter: ctnetlink: restrict expectation creation glue to userspace helpers
2026-11-12 22:11 [PATCH nf,v7 1/6] netfilter: nfnetlink_queue: add helper function to retrieve hook entries Pablo Neira Ayuso
2026-11-12 22:11 ` [PATCH nf,v7 2/6] netfilter: nfnetlink_queue: consolidate access to hook entries on reinjection Pablo Neira Ayuso
@ 2026-11-12 22:11 ` Pablo Neira Ayuso
2026-11-12 22:11 ` [PATCH nf,v7 4/6] netfilter: nfnetlink_queue: restrict NFQA_EXP " Pablo Neira Ayuso
` (2 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-12 22:11 UTC (permalink / raw)
To: netfilter-devel
The integration between ctnetlink and nfnetlink_queue that allows to
create expectations is targeted at the userspace conntrack helpers.
Fixes: bd0779370588 ("netfilter: nfnetlink_queue: allow to attach expectations to conntracks")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v7: no changes
net/netfilter/nf_conntrack_netlink.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 1f8d94a05240..fa9024bc6dc3 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2644,7 +2644,8 @@ static struct nf_conntrack_expect *
ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct,
const struct nf_conntrack_helper *assign_helper,
struct nf_conntrack_tuple *tuple,
- struct nf_conntrack_tuple *mask);
+ struct nf_conntrack_tuple *mask,
+ bool userspace);
#ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
static size_t
@@ -2899,7 +2900,7 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
}
exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct,
- assign_helper, &tuple, &mask);
+ assign_helper, &tuple, &mask, true);
if (IS_ERR(exp))
return PTR_ERR(exp);
@@ -3534,14 +3535,14 @@ static struct nf_conntrack_expect *
ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
const struct nf_conntrack_helper *assign_helper,
struct nf_conntrack_tuple *tuple,
- struct nf_conntrack_tuple *mask)
+ struct nf_conntrack_tuple *mask, bool userspace)
{
struct net *net = read_pnet(&ct->ct_net);
struct nf_conntrack_helper *helper;
struct nf_conntrack_ecache *ecache;
struct nf_conntrack_expect *exp;
struct nf_conn_help *help;
- u32 class = 0;
+ u32 class = 0, flags;
int err;
help = nfct_help(ct);
@@ -3552,6 +3553,12 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
if (!helper)
return ERR_PTR(-EOPNOTSUPP);
+ if (userspace) {
+ flags = READ_ONCE(helper->flags);
+ if (!(flags & NF_CT_HELPER_F_USERSPACE))
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
if (cda[CTA_EXPECT_CLASS]) {
class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
if (class > helper->expect_class_max)
@@ -3639,7 +3646,7 @@ ctnetlink_create_expect(struct net *net,
ct = nf_ct_tuplehash_to_ctrack(h);
rcu_read_lock();
- exp = ctnetlink_alloc_expect(cda, ct, NULL, &tuple, &mask);
+ exp = ctnetlink_alloc_expect(cda, ct, NULL, &tuple, &mask, false);
if (IS_ERR(exp)) {
err = PTR_ERR(exp);
goto err_rcu;
--
2.47.3
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH nf,v7 4/6] netfilter: nfnetlink_queue: restrict NFQA_EXP to userspace helpers
2026-11-12 22:11 [PATCH nf,v7 1/6] netfilter: nfnetlink_queue: add helper function to retrieve hook entries Pablo Neira Ayuso
2026-11-12 22:11 ` [PATCH nf,v7 2/6] netfilter: nfnetlink_queue: consolidate access to hook entries on reinjection Pablo Neira Ayuso
2026-11-12 22:11 ` [PATCH nf,v7 3/6] netfilter: ctnetlink: restrict expectation creation glue to userspace helpers Pablo Neira Ayuso
@ 2026-11-12 22:11 ` Pablo Neira Ayuso
2026-11-13 18:47 ` kernel test robot
2026-11-13 20:24 ` kernel test robot
2026-11-12 22:11 ` [PATCH nf,v7 5/6] netfilter: nfnetlink_queue: restrict upper verdict bitmask to queue and drop Pablo Neira Ayuso
2026-11-12 22:11 ` [PATCH nf,v7 6/6] netfilter: nfnetlink_queue: do not skip ct confirmation with userspace ct helpers Pablo Neira Ayuso
4 siblings, 2 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-12 22:11 UTC (permalink / raw)
To: netfilter-devel
Adding expectations to unconfirmed conntracks from any hook is
problematic because of reallocations of the ct extension area can happen
while expectations are placed in the ct extension expectation list.
Note that NFQA_EXP was added with the purpose of supporting userspace
conntrack helpers, which create expectations in confirmation hook.
This patch restricts expectation creation to userspace ct helpers to the
conntrack confirmation hook (ie. NF_HOOK_OP_CONNTRACK), where the
expectation creation for userspace helpers is allowed.
On packet reinjection, hook updates could result in a stale hook_index
that point to different hooks, but this is not an issue because the hook
type is validated.
Fixes: bd0779370588 ("netfilter: nfnetlink_queue: allow to attach expectations to conntracks")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v7: no changes
net/netfilter/nfnetlink_queue.c | 36 ++++++++++++++++++++++++++++-----
1 file changed, 31 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 7fb6b6b82a24..c6ea584d5e9d 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -381,6 +381,19 @@ nf_queue_hook_entry(const struct nf_hook_entries *hooks,
return &hooks->hooks[i];
}
+#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+static bool nfqnl_hook_exp_support(struct nf_hook_ops *ops)
+{
+ return (ops->hook_ops_type == NF_HOOK_OP_CONNTRACK &&
+ (((ops->pf == NFPROTO_IPV4 ||
+ ops->pf == NFPROTO_IPV6) &&
+ (ops->hooknum == NF_INET_LOCAL_IN ||
+ ops->hooknum == NF_INET_POST_ROUTING)) ||
+ (ops->pf == NFPROTO_BRIDGE &&
+ ops->hooknum == NF_BR_POST_ROUTING)));
+}
+#endif
+
/* caller must hold rcu read-side lock */
static void nf_reinject(struct nf_queue_entry *entry,
const struct nf_hook_entries *hooks,
@@ -1813,6 +1826,7 @@ static struct nf_conn *nfqnl_ct_parse(const struct nfnl_ct_hook *nfnl_ct,
const struct nlmsghdr *nlh,
const struct nlattr * const nfqa[],
struct nf_queue_entry *entry,
+ const struct nf_hook_entries *hooks,
enum ip_conntrack_info *ctinfo)
{
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
@@ -1825,10 +1839,22 @@ static struct nf_conn *nfqnl_ct_parse(const struct nfnl_ct_hook *nfnl_ct,
if (nfnl_ct->parse(nfqa[NFQA_CT], ct) < 0)
return NULL;
- if (nfqa[NFQA_EXP])
- nfnl_ct->attach_expect(nfqa[NFQA_EXP], ct,
- NETLINK_CB(entry->skb).portid,
- nlmsg_report(nlh));
+ if (nfqa[NFQA_EXP]) {
+ struct nf_hook_ops **ops;
+ unsigned int i;
+
+ ops = nf_hook_entries_get_hook_ops(hooks);
+
+ i = entry->hook_index;
+ if (i >= hooks->num_hook_entries)
+ return ct;
+
+ if (nfqnl_hook_exp_support(ops[i])) {
+ nfnl_ct->attach_expect(nfqa[NFQA_EXP], ct,
+ NETLINK_CB(entry->skb).portid,
+ nlmsg_report(nlh));
+ }
+ }
return ct;
#else
return NULL;
@@ -1913,7 +1939,7 @@ static int nfqnl_recv_verdict(struct sk_buff *skb, const struct nfnl_info *info,
if (nfqa[NFQA_CT]) {
if (nfnl_ct != NULL)
ct = nfqnl_ct_parse(nfnl_ct, info->nlh, nfqa, entry,
- &ctinfo);
+ hooks, &ctinfo);
}
if (entry->state.pf == PF_BRIDGE) {
--
2.47.3
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH nf,v7 4/6] netfilter: nfnetlink_queue: restrict NFQA_EXP to userspace helpers
2026-11-12 22:11 ` [PATCH nf,v7 4/6] netfilter: nfnetlink_queue: restrict NFQA_EXP " Pablo Neira Ayuso
@ 2026-11-13 18:47 ` kernel test robot
2026-11-13 20:24 ` kernel test robot
1 sibling, 0 replies; 8+ messages in thread
From: kernel test robot @ 2026-11-13 18:47 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: llvm, oe-kbuild-all
Hi Pablo,
kernel test robot noticed the following build errors:
[auto build test ERROR on linus/master]
[also build test ERROR on next-20261112]
[cannot apply to netfilter-nf/main nf-next/main v7.4-rc2]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Pablo-Neira-Ayuso/netfilter-nfnetlink_queue-consolidate-access-to-hook-entries-on-reinjection/20261112-231102
base: linus/master
patch link: https://lore.kernel.org/r/20261112221106.2278789-4-pablo%40netfilter.org
patch subject: [PATCH nf,v7 4/6] netfilter: nfnetlink_queue: restrict NFQA_EXP to userspace helpers
config: s390-defconfig (https://download.01.org/0day-ci/archive/20261114/202611140202.rnnhGYL0-lkp@intel.com/config)
compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261114/202611140202.rnnhGYL0-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611140202.rnnhGYL0-lkp@intel.com/
All errors (new ones prefixed by >>):
>> net/netfilter/nfnetlink_queue.c:387:32: error: use of undeclared identifier 'NF_HOOK_OP_CONNTRACK'
387 | return (ops->hook_ops_type == NF_HOOK_OP_CONNTRACK &&
| ^
1 error generated.
vim +/NF_HOOK_OP_CONNTRACK +387 net/netfilter/nfnetlink_queue.c
383
384 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
385 static bool nfqnl_hook_exp_support(struct nf_hook_ops *ops)
386 {
> 387 return (ops->hook_ops_type == NF_HOOK_OP_CONNTRACK &&
388 (((ops->pf == NFPROTO_IPV4 ||
389 ops->pf == NFPROTO_IPV6) &&
390 (ops->hooknum == NF_INET_LOCAL_IN ||
391 ops->hooknum == NF_INET_POST_ROUTING)) ||
392 (ops->pf == NFPROTO_BRIDGE &&
393 ops->hooknum == NF_BR_POST_ROUTING)));
394 }
395 #endif
396
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH nf,v7 4/6] netfilter: nfnetlink_queue: restrict NFQA_EXP to userspace helpers
2026-11-12 22:11 ` [PATCH nf,v7 4/6] netfilter: nfnetlink_queue: restrict NFQA_EXP " Pablo Neira Ayuso
2026-11-13 18:47 ` kernel test robot
@ 2026-11-13 20:24 ` kernel test robot
1 sibling, 0 replies; 8+ messages in thread
From: kernel test robot @ 2026-11-13 20:24 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel; +Cc: oe-kbuild-all
Hi Pablo,
kernel test robot noticed the following build errors:
[auto build test ERROR on linus/master]
[also build test ERROR on next-20261112]
[cannot apply to netfilter-nf/main nf-next/main v7.4-rc2]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Pablo-Neira-Ayuso/netfilter-nfnetlink_queue-consolidate-access-to-hook-entries-on-reinjection/20261112-231102
base: linus/master
patch link: https://lore.kernel.org/r/20261112221106.2278789-4-pablo%40netfilter.org
patch subject: [PATCH nf,v7 4/6] netfilter: nfnetlink_queue: restrict NFQA_EXP to userspace helpers
config: x86_64-rhel-9.4-ltp (https://download.01.org/0day-ci/archive/20261114/202611140435.f3WLpg95-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261114/202611140435.f3WLpg95-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611140435.f3WLpg95-lkp@intel.com/
All error/warnings (new ones prefixed by >>):
net/netfilter/nfnetlink_queue.c: In function 'nfqnl_hook_exp_support':
>> net/netfilter/nfnetlink_queue.c:387:39: error: 'NF_HOOK_OP_CONNTRACK' undeclared (first use in this function)
387 | return (ops->hook_ops_type == NF_HOOK_OP_CONNTRACK &&
| ^~~~~~~~~~~~~~~~~~~~
net/netfilter/nfnetlink_queue.c:387:39: note: each undeclared identifier is reported only once for each function it appears in
>> net/netfilter/nfnetlink_queue.c:394:1: warning: control reaches end of non-void function [-Wreturn-type]
394 | }
| ^
vim +/NF_HOOK_OP_CONNTRACK +387 net/netfilter/nfnetlink_queue.c
383
384 #if IS_ENABLED(CONFIG_NF_CONNTRACK)
385 static bool nfqnl_hook_exp_support(struct nf_hook_ops *ops)
386 {
> 387 return (ops->hook_ops_type == NF_HOOK_OP_CONNTRACK &&
388 (((ops->pf == NFPROTO_IPV4 ||
389 ops->pf == NFPROTO_IPV6) &&
390 (ops->hooknum == NF_INET_LOCAL_IN ||
391 ops->hooknum == NF_INET_POST_ROUTING)) ||
392 (ops->pf == NFPROTO_BRIDGE &&
393 ops->hooknum == NF_BR_POST_ROUTING)));
> 394 }
395 #endif
396
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH nf,v7 5/6] netfilter: nfnetlink_queue: restrict upper verdict bitmask to queue and drop
2026-11-12 22:11 [PATCH nf,v7 1/6] netfilter: nfnetlink_queue: add helper function to retrieve hook entries Pablo Neira Ayuso
` (2 preceding siblings ...)
2026-11-12 22:11 ` [PATCH nf,v7 4/6] netfilter: nfnetlink_queue: restrict NFQA_EXP " Pablo Neira Ayuso
@ 2026-11-12 22:11 ` Pablo Neira Ayuso
2026-11-12 22:11 ` [PATCH nf,v7 6/6] netfilter: nfnetlink_queue: do not skip ct confirmation with userspace ct helpers Pablo Neira Ayuso
4 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-12 22:11 UTC (permalink / raw)
To: netfilter-devel
NF_QUEUE and NF_DROP use upper bits in the verdict mask to store
the bypass flags as well as the queue numbers. Reject any other use.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v7: no changes
net/netfilter/nfnetlink_queue.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index c6ea584d5e9d..3f6b38776ff8 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1755,15 +1755,21 @@ static struct nfqnl_msg_verdict_hdr*
verdicthdr_get(const struct nlattr * const nfqa[])
{
struct nfqnl_msg_verdict_hdr *vhdr;
- unsigned int verdict;
+ unsigned int verdict, verdict_mask;
if (!nfqa[NFQA_VERDICT_HDR])
return NULL;
vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
- verdict = ntohl(vhdr->verdict) & NF_VERDICT_MASK;
- if (verdict > NF_MAX_VERDICT || verdict == NF_STOLEN)
+ verdict = ntohl(vhdr->verdict);
+ verdict_mask = verdict & NF_VERDICT_MASK;
+ if (verdict_mask > NF_MAX_VERDICT || verdict_mask == NF_STOLEN)
return NULL;
+ if (verdict_mask != NF_QUEUE &&
+ verdict_mask != NF_DROP &&
+ verdict & ~NF_VERDICT_MASK)
+ return NULL;
+
return vhdr;
}
--
2.47.3
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH nf,v7 6/6] netfilter: nfnetlink_queue: do not skip ct confirmation with userspace ct helpers
2026-11-12 22:11 [PATCH nf,v7 1/6] netfilter: nfnetlink_queue: add helper function to retrieve hook entries Pablo Neira Ayuso
` (3 preceding siblings ...)
2026-11-12 22:11 ` [PATCH nf,v7 5/6] netfilter: nfnetlink_queue: restrict upper verdict bitmask to queue and drop Pablo Neira Ayuso
@ 2026-11-12 22:11 ` Pablo Neira Ayuso
4 siblings, 0 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2026-11-12 22:11 UTC (permalink / raw)
To: netfilter-devel
There are a two more issues with the existing userspace ct helpers:
- Disallow re-queueing packets in userspace ct helpers, none of the
existing helper in userspace use this feature.
- nf_conntrack_update() should only be called if this is the confirmation
hook, there is a new helper function to check this, use it.
While at this, nfqnl_reinject() is already called from a rcu read lock
section, remove the redundant rcu_read_{un,lock}().
Remove #ifdef around nfqnl_hook_exp_support() so this function can be
used regardless conntrack supported to address a compilation warning.
Fixes: ee04805ff54a ("netfilter: conntrack: make conntrack userspace helpers work again")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v7: fix compilation warning due to #ifdef dependencies.
net/netfilter/nfnetlink_queue.c | 45 +++++++++++++++++++++++----------
1 file changed, 31 insertions(+), 14 deletions(-)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 3f6b38776ff8..4d5de657ef95 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -381,7 +381,6 @@ nf_queue_hook_entry(const struct nf_hook_entries *hooks,
return &hooks->hooks[i];
}
-#if IS_ENABLED(CONFIG_NF_CONNTRACK)
static bool nfqnl_hook_exp_support(struct nf_hook_ops *ops)
{
return (ops->hook_ops_type == NF_HOOK_OP_CONNTRACK &&
@@ -392,7 +391,6 @@ static bool nfqnl_hook_exp_support(struct nf_hook_ops *ops)
(ops->pf == NFPROTO_BRIDGE &&
ops->hooknum == NF_BR_POST_ROUTING)));
}
-#endif
/* caller must hold rcu read-side lock */
static void nf_reinject(struct nf_queue_entry *entry,
@@ -526,31 +524,46 @@ static void __nfqnl_reinject(struct nf_queue_entry *entry,
const struct nf_hook_entries *hooks,
unsigned int verdict)
{
- const struct nf_ct_hook *ct_hook;
+ unsigned int verdict_mask = verdict & NF_VERDICT_MASK;
if (!nf_bridge_ports_valid(entry))
- verdict = NF_DROP;
+ goto drop;
+
+ if (verdict_mask == NF_ACCEPT ||
+ verdict_mask == NF_REPEAT ||
+ verdict_mask == NF_STOP ||
+ verdict_mask == NF_QUEUE) {
+ const struct nf_ct_hook *ct_hook;
+ struct nf_hook_ops **ops;
+ unsigned int i;
+
+ ops = nf_hook_entries_get_hook_ops(hooks);
- if (verdict == NF_ACCEPT ||
- verdict == NF_REPEAT ||
- verdict == NF_STOP) {
- unsigned int ct_verdict = verdict;
+ i = entry->hook_index;
+ if (i >= hooks->num_hook_entries)
+ goto drop;
- rcu_read_lock();
ct_hook = rcu_dereference(nf_ct_hook);
- if (ct_hook)
- ct_verdict = ct_hook->update(entry->state.net, entry->skb);
- rcu_read_unlock();
+ if (ct_hook && nfqnl_hook_exp_support(ops[i])) {
+ if (verdict_mask == NF_QUEUE ||
+ verdict_mask == NF_REPEAT)
+ goto drop;
- switch (ct_verdict & NF_VERDICT_MASK) {
+ verdict_mask = ct_hook->update(entry->state.net, entry->skb);
+ }
+
+ switch (verdict_mask) {
case NF_ACCEPT:
/* follow userspace verdict, could be REPEAT */
break;
case NF_STOLEN:
nf_queue_entry_free(entry);
return;
+ case NF_QUEUE:
+ /* follow userspace verdict too */
+ break;
default:
- verdict = ct_verdict & NF_VERDICT_MASK;
+ verdict = verdict_mask;
break;
}
}
@@ -572,6 +585,10 @@ static void __nfqnl_reinject(struct nf_queue_entry *entry,
verdict = NF_DROP;
}
nf_reinject(entry, hooks, verdict);
+ return;
+drop:
+ kfree_skb_reason(entry->skb, SKB_DROP_REASON_NETFILTER_DROP);
+ nf_queue_entry_free(entry);
}
static void nfqnl_reinject(struct nf_queue_entry *entry,
--
2.47.3
^ permalink raw reply related [flat|nested] 8+ messages in thread