[PATCH nf-next v4 0/4] netfilter: conntrack: shared port parser for helpers

[Rahul Chandelkar <rc@rexion.ai>]

Both nf_conntrack_irc and nf_conntrack_amanda parsed port numbers from
application-layer payload with simple_strtoul(), which requires a
NUL-terminated string and returns unsigned long without any range check,
so a value above 65535 was silently truncated when stored in a u16 (e.g.
65537 became 1) and a conntrack expectation was created for a port that
never appeared in the payload.

Instead of open-coding a range check in each helper, this series adds a
pair of length-delimited parsers to the conntrack helper core and uses
them from the IRC, Amanda and SIP helpers:

  nf_ct_helper_parse_uint() - bounded decimal parser for an unterminated
    buffer, capped at UINT_MAX.  Its body is taken from
    nf_conntrack_sip's sip_strtouint().

  nf_ct_helper_parse_port() - wrapper that rejects port 0 and values
    above 65535.

Patch 1 adds the two helpers.  Patches 2 and 3 convert the IRC and Amanda
helpers (the actual truncation fixes).  Patch 4 removes the now-duplicate
sip_strtouint() and the open-coded digit loop in sip_parse_port() from
nf_conntrack_sip and uses the shared parsers, so there is a single
implementation in the tree.

Compile-tested (W=1) with NF_CONNTRACK_{IRC,AMANDA,SIP,FTP}=m.

v4:
  - Rebased onto nf-next.
  - Move sip_strtouint() into the helper core as
    nf_ct_helper_parse_uint() and build nf_ct_helper_parse_port() on top
    of it, rather than adding a second uint parser; convert
    nf_conntrack_sip to the shared helpers and drop its private copies
    (Pablo Neira Ayuso, Phil Sutter, Florian Westphal).
  - Target nf-next (Pablo Neira Ayuso, Jakub Kicinski).
v3: https://lore.kernel.org/all/20260503083220.630655-1-rc@rexion.ai/
  - Added nf_ct_helper_parse_uint() as the generic base and a fourth
    patch converting nf_conntrack_sip (Phil Sutter).
v2: https://lore.kernel.org/all/20260501063156.2520780-1-rc@rexion.ai/
  - Introduced a shared nf_ct_helper_parse_port() in the helper core
    instead of open-coding range checks in each helper (Florian Westphal,
    Pablo Neira Ayuso).
v1: https://lore.kernel.org/all/20260430161230.3438973-1-rc@rexion.ai/

Rahul Chandelkar (4):
  netfilter: conntrack: add shared uint and port parsers for helpers
  netfilter: nf_conntrack_irc: use nf_ct_helper_parse_port()
  netfilter: nf_conntrack_amanda: use nf_ct_helper_parse_port()
  netfilter: nf_conntrack_sip: use shared helper parsers

 include/net/netfilter/nf_conntrack_helper.h |  5 ++
 net/netfilter/nf_conntrack_amanda.c         |  8 +-
 net/netfilter/nf_conntrack_helper.c         | 68 ++++++++++++++++
 net/netfilter/nf_conntrack_irc.c            |  4 +-
 net/netfilter/nf_conntrack_sip.c            | 86 +++++----------------
 5 files changed, 98 insertions(+), 73 deletions(-)


base-commit: 87b80c2f6b05cad9f0ff9136709c62a0f59923e3
-- 
2.43.0