[PATCH] netfilter: nf_conntrack: validate template helper protocol

[PATCH] netfilter: nf_conntrack: validate template helper protocol

[Kyle Zeng]

nftables compatibility metadata is used to select an xt_CT helper when
the conntrack template is created, but it does not constrain the protocol
of packets evaluated by the rule. A template can therefore carry a helper
for one transport protocol into a conntrack for another.

Only copy a helper from a template when its registered transport protocol
matches the new conntrack tuple. This restores the invariant expected by
helper callbacks and matches the protocol validation already performed by
native nftables helper assignment and the OVS helper path.

Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 net/netfilter/nf_conntrack_helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 500509b17..419af6f76 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -205,6 +205,8 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
 	help = nfct_help(tmpl);
 	if (help)
 		helper = rcu_dereference(help->helper);
+	if (helper && helper->tuple.dst.protonum != nf_ct_protonum(ct))
+		helper = NULL;
 
 	help = nfct_help(ct);
 
-- 
2.53.0