[PATCH v2] netfilter: xt_HL: add pr_fmt, drop NULL checks, add checkentry validation

[PATCH v2] netfilter: xt_HL: add pr_fmt, drop NULL checks, add checkentry validation

[Marino Dzalto]

Add pr_fmt for module-prefixed log messages. Remove unnecessary NULL
checks for skb, as netfilter core guarantees skb is non-NULL. Add
checkentry functions to validate match mode at rule registration time.

Signed-off-by: Marino Dzalto <marino.dzalto@gmail.com>
---
 net/netfilter/xt_hl.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/net/netfilter/xt_hl.c b/net/netfilter/xt_hl.c
index c1a70f8f0..4a12a757e 100644
--- a/net/netfilter/xt_hl.c
+++ b/net/netfilter/xt_hl.c
@@ -6,6 +6,7 @@
  * Hop Limit matching module
  * (C) 2001-2002 Maciej Soltysiak <solt@dns.toxicfilms.tv>
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/ip.h>
 #include <linux/ipv6.h>
@@ -22,6 +23,18 @@ MODULE_LICENSE("GPL");
 MODULE_ALIAS("ipt_ttl");
 MODULE_ALIAS("ip6t_hl");
 
+static int ttl_mt_check(const struct xt_mtchk_param *par)
+{
+	const struct ipt_ttl_info *info = par->matchinfo;
+
+	if (info->mode > IPT_TTL_GT) {
+		pr_err("Unknown TTL match mode: %d\n", info->mode);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static bool ttl_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
 	const struct ipt_ttl_info *info = par->matchinfo;
@@ -41,6 +54,18 @@ static bool ttl_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	return false;
 }
 
+static int hl_mt6_check(const struct xt_mtchk_param *par)
+{
+	const struct ip6t_hl_info *info = par->matchinfo;
+
+	if (info->mode > IP6T_HL_GT) {
+		pr_err("Unknown Hop Limit match mode: %d\n", info->mode);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static bool hl_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 {
 	const struct ip6t_hl_info *info = par->matchinfo;
@@ -65,6 +90,7 @@ static struct xt_match hl_mt_reg[] __read_mostly = {
 		.name       = "ttl",
 		.revision   = 0,
 		.family     = NFPROTO_IPV4,
+		.checkentry = ttl_mt_check,
 		.match      = ttl_mt,
 		.matchsize  = sizeof(struct ipt_ttl_info),
 		.me         = THIS_MODULE,
@@ -73,6 +99,7 @@ static struct xt_match hl_mt_reg[] __read_mostly = {
 		.name       = "hl",
 		.revision   = 0,
 		.family     = NFPROTO_IPV6,
+		.checkentry = hl_mt6_check,
 		.match      = hl_mt6,
 		.matchsize  = sizeof(struct ip6t_hl_info),
 		.me         = THIS_MODULE,
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v2] netfilter: xt_HL: add pr_fmt, drop NULL checks, add checkentry validation

[Jacob Keller]

On 4/3/2026 1:03 PM, Marino Dzalto wrote:
> Add pr_fmt for module-prefixed log messages. Remove unnecessary NULL
> checks for skb, as netfilter core guarantees skb is non-NULL. Add
> checkentry functions to validate match mode at rule registration time.
> 

The patch is small so I guess its not a huge deal, but this feels like 3
patches in a trench coat to me. The pr_fmt makes sense to combine, and
the actual patch content just appears to be implementing the .checkentry
callbacks. Seems like this description could use a little update.

> Signed-off-by: Marino Dzalto <marino.dzalto@gmail.com>
> ---
>  net/netfilter/xt_hl.c | 27 +++++++++++++++++++++++++++
>  1 file changed, 27 insertions(+)
> 

The patch also says it removes unnecessary NULL checks. But how is that
even possible when there are no removal lines in the diff? Is that a
leftover from the previous version?

Thanks,
Jake