From: Rahul Chandelkar <rc@rexion.ai>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Jozsef Kadlecsik <kadlec@netfilter.org>,
Florian Westphal <fw@strlen.de>, Phil Sutter <phil@nwl.cc>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
pabeni@redhat.com, netdev@vger.kernel.org,
Rahul Chandelkar <rc@rexion.ai>
Subject: [PATCH nf-next v4 4/4] netfilter: nf_conntrack_sip: use shared helper parsers
Date: Wed, 23 Sep 2026 17:15:01 +0000 [thread overview]
Message-ID: <20260923171501.3254823-1-rc@rexion.ai> (raw)
In-Reply-To: <20260923091608.2617604-1-rc@rexion.ai>
nf_conntrack_sip open-coded its own bounded integer parser
(sip_strtouint()) and its own digit loop in sip_parse_port(). Now that
equivalent parsers live in the conntrack helper core, drop the private
copies:
- sip_strtouint() is replaced by nf_ct_helper_parse_uint() (same
signature and semantics) at all call sites and removed.
- sip_parse_port() uses nf_ct_helper_parse_port() for the numeric part,
keeping the SIP-specific handling of the ':' separator, the default
SIP_PORT and the minimum port of 1024.
No functional change intended.
Signed-off-by: Rahul Chandelkar <rc@rexion.ai>
---
net/netfilter/nf_conntrack_sip.c | 86 +++++++-------------------------
1 file changed, 18 insertions(+), 68 deletions(-)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 64bc440b1181..0e12426227a8 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -183,8 +183,8 @@ static int sip_parse_addr(const struct nf_conn *ct, const char *cp,
static bool sip_parse_port(const char *dptr, const char **endp,
const char *limit, __be16 *port)
{
- unsigned int p = 0;
- int len = 0;
+ char *end;
+ u16 p;
if (dptr >= limit)
return false;
@@ -199,29 +199,22 @@ static bool sip_parse_port(const char *dptr, const char **endp,
dptr++; /* skip ':' */
- while (dptr < limit && isdigit(*dptr)) {
- p = p * 10 + (*dptr - '0');
- dptr++;
- len++;
- if (len > 5) /* max "65535" */
- return false;
- }
-
- if (len == 0)
+ if (nf_ct_helper_parse_port(dptr, limit - dptr, &p, &end))
return false;
/* reached limit while parsing port */
- if (dptr >= limit)
+ if (end >= limit)
return false;
- if (p < 1024 || p > 65535)
+ /* SIP ports below 1024 are not accepted */
+ if (p < 1024)
return false;
if (port)
*port = htons(p);
if (endp)
- *endp = dptr;
+ *endp = end;
return true;
}
@@ -270,51 +263,6 @@ static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr,
return epaddr_len(ct, dptr, limit, shift);
}
-/* simple_strtoul stops after first non-number character.
- * But as we're not dealing with c-strings, we can't rely on
- * hitting \r,\n,\0 etc. before moving past end of buffer.
- *
- * This is a variant of simple_strtoul, but doesn't require
- * a c-string.
- *
- * If value exceeds UINT_MAX, 0 is returned.
- */
-static unsigned int sip_strtouint(const char *cp, unsigned int len, char **endp)
-{
- const unsigned int max = sizeof("4294967295");
- unsigned int olen = len;
- const char *s = cp;
- u64 result = 0;
-
- if (len > max)
- len = max;
-
- while (olen > 0 && isdigit(*s)) {
- unsigned int value;
-
- if (len == 0)
- goto err;
-
- value = *s - '0';
- result = result * 10 + value;
-
- if (result > UINT_MAX)
- goto err;
- s++;
- len--;
- olen--;
- }
-
- if (endp)
- *endp = (char *)s;
-
- return result;
-err:
- if (endp)
- *endp = (char *)cp;
- return 0;
-}
-
/* Parse a SIP request line of the form:
*
* Request-Line = Method SP Request-URI SP SIP-Version CRLF
@@ -682,7 +630,7 @@ int ct_sip_parse_numerical_param(const struct nf_conn *ct, const char *dptr,
return 0;
start += strlen(name);
- *val = sip_strtouint(start, limit - start, (char **)&end);
+ *val = nf_ct_helper_parse_uint(start, limit - start, (char **)&end);
if (start == end)
return -1;
if (matchoff && matchlen) {
@@ -1166,7 +1114,8 @@ static int process_sdp(struct sk_buff *skb, unsigned int protoff,
mediaoff += t->len;
medialen -= t->len;
- port = sip_strtouint(*dptr + mediaoff, *datalen - mediaoff, (char **)&end);
+ port = nf_ct_helper_parse_uint(*dptr + mediaoff, *datalen - mediaoff,
+ (char **)&end);
if (port == 0 || *dptr + mediaoff == end)
continue;
if (port < 1024 || port > 65535) {
@@ -1357,7 +1306,7 @@ static int process_register_request(struct sk_buff *skb, unsigned int protoff,
*/
if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
&matchoff, &matchlen) > 0)
- expires = sip_strtouint(*dptr + matchoff, *datalen - matchoff, NULL);
+ expires = nf_ct_helper_parse_uint(*dptr + matchoff, *datalen - matchoff, NULL);
ret = ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
SIP_HDR_CONTACT, NULL,
@@ -1467,7 +1416,7 @@ static int process_register_response(struct sk_buff *skb, unsigned int protoff,
if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_EXPIRES,
&matchoff, &matchlen) > 0)
- expires = sip_strtouint(*dptr + matchoff, *datalen - matchoff, NULL);
+ expires = nf_ct_helper_parse_uint(*dptr + matchoff, *datalen - matchoff, NULL);
while (1) {
unsigned int c_expires = expires;
@@ -1531,8 +1480,8 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
if (*datalen < strlen("SIP/2.0 200"))
return NF_ACCEPT;
- code = sip_strtouint(*dptr + strlen("SIP/2.0 "),
- *datalen - strlen("SIP/2.0 "), NULL);
+ code = nf_ct_helper_parse_uint(*dptr + strlen("SIP/2.0 "),
+ *datalen - strlen("SIP/2.0 "), NULL);
if (!code) {
nf_ct_helper_log(skb, ct, "cannot get code");
return NF_DROP;
@@ -1543,7 +1492,7 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
nf_ct_helper_log(skb, ct, "cannot parse cseq");
return NF_DROP;
}
- cseq = sip_strtouint(*dptr + matchoff, *datalen - matchoff, (char **)&end);
+ cseq = nf_ct_helper_parse_uint(*dptr + matchoff, *datalen - matchoff, (char **)&end);
if (*dptr + matchoff == end) {
nf_ct_helper_log(skb, ct, "cannot get cseq");
return NF_DROP;
@@ -1613,7 +1562,8 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
nf_ct_helper_log(skb, ct, "cannot parse cseq");
return NF_DROP;
}
- cseq = sip_strtouint(*dptr + matchoff, *datalen - matchoff, (char **)&end);
+ cseq = nf_ct_helper_parse_uint(*dptr + matchoff, *datalen - matchoff,
+ (char **)&end);
if (*dptr + matchoff == end) {
nf_ct_helper_log(skb, ct, "cannot get cseq");
return NF_DROP;
@@ -1690,7 +1640,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
&matchoff, &matchlen) <= 0)
break;
- clen = sip_strtouint(dptr + matchoff, datalen - matchoff, (char **)&end);
+ clen = nf_ct_helper_parse_uint(dptr + matchoff, datalen - matchoff, (char **)&end);
if (dptr + matchoff == end)
break;
--
2.43.0
next prev parent reply other threads:[~2026-09-23 17:15 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-23 9:16 [PATCH nf-next v4 0/4] netfilter: conntrack: shared port parser for helpers Rahul Chandelkar
2026-09-23 12:07 ` [PATCH nf-next v4 1/4] netfilter: conntrack: add shared uint and port parsers " Rahul Chandelkar
2026-09-27 17:37 ` netdev-bot+sashiko
2026-09-28 14:18 ` Rahul Chandelkar
2026-09-23 13:15 ` [PATCH nf-next v4 2/4] netfilter: nf_conntrack_irc: use nf_ct_helper_parse_port() Rahul Chandelkar
2026-09-27 17:37 ` netdev-bot+sashiko
2026-09-28 15:23 ` Rahul Chandelkar
2026-09-23 15:15 ` [PATCH nf-next v4 3/4] netfilter: nf_conntrack_amanda: " Rahul Chandelkar
2026-09-27 17:37 ` netdev-bot+sashiko
2026-09-28 11:58 ` Rahul Chandelkar
2026-09-23 17:15 ` Rahul Chandelkar [this message]
2026-09-27 17:37 ` [PATCH nf-next v4 4/4] netfilter: nf_conntrack_sip: use shared helper parsers netdev-bot+sashiko
2026-09-28 13:13 ` Rahul Chandelkar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260923171501.3254823-1-rc@rexion.ai \
--to=rc@rexion.ai \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=kadlec@netfilter.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox