Re: [PATCH net 06/12] netfilter: nf_conntrack_expect: honor expectation helper field

[Ilya Maximets <i.maximets@ovn.org>]

On 3/26/26 1:51 PM, Pablo Neira Ayuso wrote:
> The expectation helper field is mostly unused. As a result, the
> netfilter codebase relies on accessing the helper through exp->master.
> 
> Always set on the expectation helper field so it can be used to reach
> the helper.
> 
> nf_ct_expect_init() is called from packet path where the skb owns
> the ct object, therefore accessing exp->master for the newly created
> expectation is safe. This saves a lot of updates in all callsites
> to pass the ct object as parameter to nf_ct_expect_init().
> 
> This is a preparation patches for follow up fixes.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---

Hi, Pablo and Florian.

I was investigating FTP test failures in OVS with 7.0 kernel and bisected
the issue down to this commit.  AFAIU, with this change all the related
connections over time gain their parents' helpers,.  This is causing a change
visible to the userspace, because FTP data connections are now reported to
have helpers in the conntrack dump:

# conntrack -L
tcp      6 119 TIME_WAIT src=10.1.1.1 dst=10.1.1.2 sport=59534 dport=21 \
                         src=10.1.1.2 dst=10.1.1.1 sport=21    dport=59534 \
           [ASSURED] mark=0 helper=ftp use=2
tcp      6 119 TIME_WAIT src=10.1.1.2 dst=10.1.1.1 sport=52709 dport=52381 \
                         src=10.1.1.1 dst=10.1.1.2 sport=52381 dport=52709 \
           [ASSURED] mark=0 helper=ftp use=1

Before this commit only the control connection had helper=ftp reported in
the dump.  The traffic seems to work fine, but our tests fail because we
do not expect the helper attached.

AFAIU, it's generally not something that should be happening, as helpers
on data connections do not really make much sense.  But I'm just trying to
figure out if you would consider this as a regression and fix in the kernel
or if we should adjust our userspace components for this new dump content,
which would not be very straightforward to do if we want to be able to run
tests on both old and the new versions.

What do you think?

Best regards, Ilya Maximets.