[PATCH nf-next v5 1/4] netfilter: conntrack: add shared uint and port parsers for helpers

[Rahul Chandelkar <rc@rexion.ai>]

Several conntrack helpers parse integers and port numbers out of
application-layer payload.  Some open-code simple_strtoul(), which
requires a NUL-terminated string and returns unsigned long without any
range check, while nf_conntrack_sip carries its own sip_strtouint() and
a digit loop in sip_parse_port().

Add two length-delimited parsers to the conntrack helper core so that
the helpers can share one implementation:

  nf_ct_helper_parse_uint() - bounded decimal parser for a buffer that
    need not be NUL-terminated.  Its body is sip_strtouint() unchanged:
    the result is capped at UINT_MAX and a run of more than 11 digits is
    rejected.

  nf_ct_helper_parse_port() - parses a port number and returns -EINVAL
    for a digit run longer than five characters, for zero and for values
    above 65535, matching what sip_parse_port() accepts today.

Both are exported; the following patches convert the IRC, Amanda and SIP
helpers to them.

Assisted-by: Claude-Code:claude-opus-5-5 sparse
Signed-off-by: Rahul Chandelkar <rc@rexion.ai>
---
 include/net/netfilter/nf_conntrack_helper.h |  5 ++
 net/netfilter/nf_conntrack_helper.c         | 79 +++++++++++++++++++++
 2 files changed, 84 insertions(+)

diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 335b8c43694f..4d5ad5ae1d13 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -184,6 +184,11 @@ nf_ct_helper_expectfn_find_by_name(const char *name);
 struct nf_ct_helper_expectfn *
 nf_ct_helper_expectfn_find_by_symbol(const void *symbol);
 
+unsigned int nf_ct_helper_parse_uint(const char *cp, unsigned int len,
+				     char **endp);
+int nf_ct_helper_parse_port(const char *cp, unsigned int len,
+			    u16 *port, char **endp);
+
 extern struct hlist_head *nf_ct_helper_hash;
 extern unsigned int nf_ct_helper_hsize;
 
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index c30ae3f203be..bcdbe493d412 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -16,6 +16,8 @@
 #include <linux/random.h>
 #include <linux/err.h>
 #include <linux/kernel.h>
+#include <linux/ctype.h>
+#include <linux/limits.h>
 #include <linux/netdevice.h>
 #include <linux/rculist.h>
 #include <linux/rtnetlink.h>
@@ -569,6 +571,83 @@ void nf_nat_helper_unregister(struct nf_conntrack_nat_helper *nat)
 }
 EXPORT_SYMBOL_GPL(nf_nat_helper_unregister);
 
+/**
+ * nf_ct_helper_parse_uint - parse a decimal number from a packet buffer
+ * @cp: first byte to parse; the buffer need not be NUL-terminated
+ * @len: number of bytes available at @cp
+ * @endp: if not NULL, set to the byte after the last digit, or to @cp on
+ *	error
+ *
+ * Return: the parsed value, or 0 if @cp does not start with a digit, the
+ * digit run is longer than 11 characters, or the value exceeds UINT_MAX.
+ */
+unsigned int nf_ct_helper_parse_uint(const char *cp, unsigned int len,
+				     char **endp)
+{
+	const unsigned int max = sizeof("4294967295");
+	unsigned int olen = len;
+	const char *s = cp;
+	u64 result = 0;
+
+	if (len > max)
+		len = max;
+
+	while (olen > 0 && isdigit(*s)) {
+		unsigned int value;
+
+		if (len == 0)
+			goto err;
+
+		value = *s - '0';
+		result = result * 10 + value;
+
+		if (result > UINT_MAX)
+			goto err;
+		s++;
+		len--;
+		olen--;
+	}
+
+	if (endp)
+		*endp = (char *)s;
+
+	return result;
+err:
+	if (endp)
+		*endp = (char *)cp;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(nf_ct_helper_parse_uint);
+
+/**
+ * nf_ct_helper_parse_port - parse a TCP/UDP port number from a packet buffer
+ * @cp: first byte to parse; the buffer need not be NUL-terminated
+ * @len: number of bytes available at @cp
+ * @port: set to the parsed port on success
+ * @endp: if not NULL, set to the byte after the last digit on success
+ *
+ * Return: 0 on success, or -EINVAL if @cp does not start with a digit, the
+ * digit run is longer than five characters, or the value is 0 or above
+ * 65535.
+ */
+int nf_ct_helper_parse_port(const char *cp, unsigned int len,
+			    u16 *port, char **endp)
+{
+	char *e = (char *)cp;
+	unsigned int val;
+
+	val = nf_ct_helper_parse_uint(cp, len, &e);
+	if (e == cp || e - cp > 5 || val == 0 || val > 65535)
+		return -EINVAL;
+
+	*port = val;
+	if (endp)
+		*endp = e;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(nf_ct_helper_parse_port);
+
 int nf_conntrack_helper_init(void)
 {
 	nf_ct_helper_hsize = 1; /* gets rounded up to use one page */
-- 
2.43.0