diff mbox series

netfilter: nf_conntrack: validate template helper protocol

Message ID 20260810221628.34800-1-kylebot@openai.com
State Under Review
Headers show
Series netfilter: nf_conntrack: validate template helper protocol | expand

Commit Message

Kyle Zeng Aug. 10, 2026, 10:16 p.m. UTC 
nftables compatibility metadata is used to select an xt_CT helper when
the conntrack template is created, but it does not constrain the protocol
of packets evaluated by the rule. A template can therefore carry a helper
for one transport protocol into a conntrack for another.

Only copy a helper from a template when its registered transport protocol
matches the new conntrack tuple. This restores the invariant expected by
helper callbacks and matches the protocol validation already performed by
native nftables helper assignment and the OVS helper path.

Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 net/netfilter/nf_conntrack_helper.c | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 500509b17..419af6f76 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -205,6 +205,8 @@  int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
 	help = nfct_help(tmpl);
 	if (help)
 		helper = rcu_dereference(help->helper);
+	if (helper && helper->tuple.dst.protonum != nf_ct_protonum(ct))
+		helper = NULL;
 
 	help = nfct_help(ct);