[PATCH net-next 13/15] netfilter: add nf_sk_to_full_sk helper and use it
flat view
HOTtoday
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2026-10-11 22:00:23
Also in:
netfilter-devel
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Revision v1 of 34 in this series.
Revisions (34)
From: Florian Westphal <fw@strlen.de> Some callers of these helpers pass skb->sk as sk_partial argument, but for LOCAL_OUT path an IP tunnel transmits while preserving the original skb owner, so a non-INET socket (e.g. PF_PACKET) can reach these. Like previous patch, add a helper to also check for this case. Related to LLM finding in the earlier patch when querying the agent about other possible scenarios. Assisted-by: LLM Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- include/net/netfilter/nf_socket.h | 15 +++++++++++++++ net/ipv4/netfilter.c | 3 ++- net/ipv6/netfilter.c | 3 ++- 3 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/include/net/netfilter/nf_socket.h b/include/net/netfilter/nf_socket.h
index 39047c73b642..f7da3dc150a9 100644
--- a/include/net/netfilter/nf_socket.h
+++ b/include/net/netfilter/nf_socket.h@@ -3,6 +3,7 @@ #define _NF_SOCK_H_ #include <net/sock.h> +#include <net/inet_sock.h> struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb, const struct net_device *indev);
@@ -30,4 +31,18 @@ static inline struct sock *nf_skb_sk(const struct sk_buff *skb, const struct net return NULL; } + +/** + * nf_sk_to_full_sk - Careful access to a full socket + * @sk: pointer to a socket + * + * %sk_to_full_sk for use when sk might not be an inet socket. + */ +static inline struct sock *nf_sk_to_full_sk(struct sock *sk) +{ + if (sk && sk_is_inet(sk)) + return sk_to_full_sk(sk); + + return NULL; +} #endif
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index ce9e1bfa4259..76e1eb40b8ce 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c@@ -17,6 +17,7 @@ #include <net/xfrm.h> #include <net/ip.h> #include <net/netfilter/nf_queue.h> +#include <net/netfilter/nf_socket.h> /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */ int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, unsigned int addr_type)
@@ -30,7 +31,7 @@ int ip_route_me_harder(struct net *net, struct sock *sk, struct sk_buff *skb, un struct flow_keys flkeys; unsigned int hh_len; - sk = sk_to_full_sk(sk); + sk = nf_sk_to_full_sk(sk); flags = sk ? inet_sk_flowi_flags(sk) : 0; if (addr_type == RTN_UNSPEC)
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index a7025ec87035..70e47ccdf9ae 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c@@ -17,14 +17,15 @@ #include <net/ip6_route.h> #include <net/xfrm.h> #include <net/netfilter/nf_queue.h> +#include <net/netfilter/nf_socket.h> #include <net/netfilter/nf_conntrack_bridge.h> #include <net/netfilter/ipv6/nf_defrag_ipv6.h> #include "../bridge/br_private.h" int ip6_route_me_harder(struct net *net, struct sock *sk_partial, struct sk_buff *skb) { + struct sock *sk = nf_sk_to_full_sk(sk_partial); const struct ipv6hdr *iph = ipv6_hdr(skb); - struct sock *sk = sk_to_full_sk(sk_partial); struct net_device *dev = skb_dst_dev(skb); struct flow_keys flkeys; unsigned int hh_len;
--
2.47.3