From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org,
pabeni@redhat.com, edumazet@google.com, fw@strlen.de,
horms@kernel.org
Subject: [PATCH net-next 5/7] netfilter: conntrack_helper: pass master conntrack to helper functions
Date: Fri, 24 Jul 2026 12:49:30 +0200 [thread overview]
Message-ID: <20260724104932.437729-6-pablo@netfilter.org> (raw)
In-Reply-To: <20260724104932.437729-1-pablo@netfilter.org>
Pass master conntrack as argument to helper functions that parse the
packet payload, instead of using exp->master. Although accessing
exp->master is safe in this case because it refers to the master
conntrack in used by this skb, remove it to step towards turning the
exp->master field into a cookie value.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/linux/netfilter/nf_conntrack_amanda.h | 1 +
include/linux/netfilter/nf_conntrack_ftp.h | 1 +
include/linux/netfilter/nf_conntrack_irc.h | 1 +
include/linux/netfilter/nf_conntrack_tftp.h | 1 +
net/netfilter/nf_conntrack_amanda.c | 2 +-
net/netfilter/nf_conntrack_ftp.c | 2 +-
net/netfilter/nf_conntrack_irc.c | 2 +-
net/netfilter/nf_conntrack_tftp.c | 2 +-
net/netfilter/nf_nat_amanda.c | 7 ++++---
net/netfilter/nf_nat_ftp.c | 4 ++--
net/netfilter/nf_nat_irc.c | 2 +-
net/netfilter/nf_nat_tftp.c | 5 ++---
12 files changed, 17 insertions(+), 13 deletions(-)
diff --git a/include/linux/netfilter/nf_conntrack_amanda.h b/include/linux/netfilter/nf_conntrack_amanda.h
index 1719987e8fd8..deb560bb79c4 100644
--- a/include/linux/netfilter/nf_conntrack_amanda.h
+++ b/include/linux/netfilter/nf_conntrack_amanda.h
@@ -9,6 +9,7 @@
typedef unsigned int
nf_nat_amanda_hook_fn(struct sk_buff *skb,
+ struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
unsigned int protoff,
unsigned int matchoff,
diff --git a/include/linux/netfilter/nf_conntrack_ftp.h b/include/linux/netfilter/nf_conntrack_ftp.h
index 7b62446ccec4..712702183b94 100644
--- a/include/linux/netfilter/nf_conntrack_ftp.h
+++ b/include/linux/netfilter/nf_conntrack_ftp.h
@@ -28,6 +28,7 @@ struct nf_ct_ftp_master {
* connection we should expect. */
typedef unsigned int
nf_nat_ftp_hook_fn(struct sk_buff *skb,
+ struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
enum nf_ct_ftp_type type,
unsigned int protoff,
diff --git a/include/linux/netfilter/nf_conntrack_irc.h b/include/linux/netfilter/nf_conntrack_irc.h
index ce07250afb4e..c73b3b44a0b7 100644
--- a/include/linux/netfilter/nf_conntrack_irc.h
+++ b/include/linux/netfilter/nf_conntrack_irc.h
@@ -10,6 +10,7 @@
typedef unsigned int
nf_nat_irc_hook_fn(struct sk_buff *skb,
+ struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
unsigned int protoff,
unsigned int matchoff,
diff --git a/include/linux/netfilter/nf_conntrack_tftp.h b/include/linux/netfilter/nf_conntrack_tftp.h
index e3d1739c557d..802cb7fc19cd 100644
--- a/include/linux/netfilter/nf_conntrack_tftp.h
+++ b/include/linux/netfilter/nf_conntrack_tftp.h
@@ -19,6 +19,7 @@ struct tftphdr {
typedef unsigned int
nf_nat_tftp_hook_fn(struct sk_buff *skb,
+ struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
struct nf_conntrack_expect *exp);
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index 06d6ec12c86d..14ae660491f3 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -151,7 +151,7 @@ static int amanda_help(struct sk_buff *skb,
nf_nat_amanda = rcu_dereference(nf_nat_amanda_hook);
if (nf_nat_amanda && ct->status & IPS_NAT_MASK)
- ret = nf_nat_amanda(skb, ctinfo, protoff,
+ ret = nf_nat_amanda(skb, ct, ctinfo, protoff,
off - dataoff, len, exp);
else if (nf_ct_expect_related(exp, 0) != 0) {
nf_ct_helper_log(skb, ct, "cannot add expectation");
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index f3944598c172..f4fe13fd0e70 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -515,7 +515,7 @@ static int help(struct sk_buff *skb,
* (possibly changed) expectation itself. */
nf_nat_ftp = rcu_dereference(nf_nat_ftp_hook);
if (nf_nat_ftp && ct->status & IPS_NAT_MASK)
- ret = nf_nat_ftp(skb, ctinfo, search[dir][i].ftptype,
+ ret = nf_nat_ftp(skb, ct, ctinfo, search[dir][i].ftptype,
protoff, matchoff, matchlen, exp);
else {
/* Can't expect this? Best to drop packet now. */
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 4e6bafe41437..92360963757a 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -231,7 +231,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
nf_nat_irc = rcu_dereference(nf_nat_irc_hook);
if (nf_nat_irc && ct->status & IPS_NAT_MASK)
- ret = nf_nat_irc(skb, ctinfo, protoff,
+ ret = nf_nat_irc(skb, ct, ctinfo, protoff,
addr_beg_p - ib_ptr,
addr_end_p - addr_beg_p,
exp);
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index a69559edf9b3..e672d74a6817 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -69,7 +69,7 @@ static int tftp_help(struct sk_buff *skb,
nf_nat_tftp = rcu_dereference(nf_nat_tftp_hook);
if (nf_nat_tftp && ct->status & IPS_NAT_MASK)
- ret = nf_nat_tftp(skb, ctinfo, exp);
+ ret = nf_nat_tftp(skb, ct, ctinfo, exp);
else if (nf_ct_expect_related(exp, 0) != 0) {
nf_ct_helper_log(skb, ct, "cannot add expectation");
ret = NF_DROP;
diff --git a/net/netfilter/nf_nat_amanda.c b/net/netfilter/nf_nat_amanda.c
index 8f1054920a85..330415809425 100644
--- a/net/netfilter/nf_nat_amanda.c
+++ b/net/netfilter/nf_nat_amanda.c
@@ -26,6 +26,7 @@ static struct nf_conntrack_nat_helper nat_helper_amanda =
NF_CT_NAT_HELPER_INIT(NAT_HELPER_NAME);
static unsigned int help(struct sk_buff *skb,
+ struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
unsigned int protoff,
unsigned int matchoff,
@@ -46,15 +47,15 @@ static unsigned int help(struct sk_buff *skb,
/* Try to get same port: if not, try to change it. */
port = nf_nat_exp_find_port(exp, ntohs(exp->saved_proto.tcp.port));
if (port == 0) {
- nf_ct_helper_log(skb, exp->master, "all ports in use");
+ nf_ct_helper_log(skb, ct, "all ports in use");
return NF_DROP;
}
snprintf(buffer, sizeof(buffer), "%u", port);
- if (!nf_nat_mangle_udp_packet(skb, exp->master, ctinfo,
+ if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
protoff, matchoff, matchlen,
buffer, strlen(buffer))) {
- nf_ct_helper_log(skb, exp->master, "cannot mangle packet");
+ nf_ct_helper_log(skb, ct, "cannot mangle packet");
nf_ct_unexpect_related(exp);
return NF_DROP;
}
diff --git a/net/netfilter/nf_nat_ftp.c b/net/netfilter/nf_nat_ftp.c
index c92a436d9c48..25d20e2970ae 100644
--- a/net/netfilter/nf_nat_ftp.c
+++ b/net/netfilter/nf_nat_ftp.c
@@ -61,6 +61,7 @@ static int nf_nat_ftp_fmt_cmd(struct nf_conn *ct, enum nf_ct_ftp_type type,
/* So, this packet has hit the connection tracking matching code.
Mangle it, and change the expectation to match the new version. */
static unsigned int nf_nat_ftp(struct sk_buff *skb,
+ struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
enum nf_ct_ftp_type type,
unsigned int protoff,
@@ -71,7 +72,6 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
union nf_inet_addr newaddr;
u_int16_t port;
int dir = CTINFO2DIR(ctinfo);
- struct nf_conn *ct = exp->master;
char buffer[sizeof("|1||65535|") + INET6_ADDRSTRLEN];
unsigned int buflen;
@@ -88,7 +88,7 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
port = nf_nat_exp_find_port(exp, ntohs(exp->saved_proto.tcp.port));
if (port == 0) {
- nf_ct_helper_log(skb, exp->master, "all ports in use");
+ nf_ct_helper_log(skb, ct, "all ports in use");
return NF_DROP;
}
diff --git a/net/netfilter/nf_nat_irc.c b/net/netfilter/nf_nat_irc.c
index 19c4fcc60c50..89b31fe932ba 100644
--- a/net/netfilter/nf_nat_irc.c
+++ b/net/netfilter/nf_nat_irc.c
@@ -30,6 +30,7 @@ static struct nf_conntrack_nat_helper nat_helper_irc =
NF_CT_NAT_HELPER_INIT(NAT_HELPER_NAME);
static unsigned int help(struct sk_buff *skb,
+ struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
unsigned int protoff,
unsigned int matchoff,
@@ -37,7 +38,6 @@ static unsigned int help(struct sk_buff *skb,
struct nf_conntrack_expect *exp)
{
char buffer[sizeof("4294967296 65635")];
- struct nf_conn *ct = exp->master;
union nf_inet_addr newaddr;
u_int16_t port;
diff --git a/net/netfilter/nf_nat_tftp.c b/net/netfilter/nf_nat_tftp.c
index 1a591132d6eb..7121e6704f34 100644
--- a/net/netfilter/nf_nat_tftp.c
+++ b/net/netfilter/nf_nat_tftp.c
@@ -21,17 +21,16 @@ static struct nf_conntrack_nat_helper nat_helper_tftp =
NF_CT_NAT_HELPER_INIT(NAT_HELPER_NAME);
static unsigned int help(struct sk_buff *skb,
+ struct nf_conn *ct,
enum ip_conntrack_info ctinfo,
struct nf_conntrack_expect *exp)
{
- const struct nf_conn *ct = exp->master;
-
exp->saved_proto.udp.port
= ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
exp->dir = IP_CT_DIR_REPLY;
exp->expectfn = nf_nat_follow_master;
if (nf_ct_expect_related(exp, 0) != 0) {
- nf_ct_helper_log(skb, exp->master, "cannot add expectation");
+ nf_ct_helper_log(skb, ct, "cannot add expectation");
return NF_DROP;
}
return NF_ACCEPT;
--
2.47.3
next prev parent reply other threads:[~2026-07-24 10:49 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-24 10:49 [PATCH net-next 0/7] Netfilter/IPVS updates for net-next Pablo Neira Ayuso
2026-07-24 10:49 ` [PATCH net-next 1/7] ipvs: Move defense_work and est_reload_work to system_dfl_long_wq Pablo Neira Ayuso
2026-07-24 10:49 ` [PATCH net-next 2/7] netfilter: xt_tcpmss: extend checkentry to ipv6 Pablo Neira Ayuso
2026-07-24 10:49 ` [PATCH net-next 3/7] netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet Pablo Neira Ayuso
2026-07-24 10:49 ` [PATCH net-next 4/7] netfilter: flowtable: tear down flow entries with stale dst from GC Pablo Neira Ayuso
2026-07-24 10:49 ` Pablo Neira Ayuso [this message]
2026-07-24 10:49 ` [PATCH net-next 6/7] netfilter: nf_conntrack_expect: store event cache in expectation Pablo Neira Ayuso
2026-07-24 10:49 ` [PATCH net-next 7/7] ipvs: use type-safe allocation helpers in ip_vs_rht_alloc Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260724104932.437729-6-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox