With nftables, no template is being used and instead helper assignment
happens after conntrack initialization. With helper auto assignment
being disabled by default, this leads to this spurious kernel log
suggesting to use iptables CT target.
To avoid the bogus and confusing message, check helper's refcount: It is
initialized to 1 by nf_conntrack_helper_register() and incremented by
nf_conntrack_helper_try_module_get() during nft_ct_helper_obj_init(). So
if its value is larger than 1, it must be in use *somewhere*.
This approach is not perfect since there is no guarantee the helper will
actually be assigned to the packet's flow. Yet it should still cover the
intended use-case of merely loading the module.
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
net/netfilter/nf_conntrack_helper.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index ae4488a13c70c..828957f1802d8 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -213,11 +213,13 @@ static struct nf_conntrack_helper *
nf_ct_lookup_helper(struct nf_conn *ct, struct net *net)
{
struct nf_conntrack_net *cnet = nf_ct_pernet(net);
+ struct nf_conntrack_helper *helper =
+ __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
if (!cnet->sysctl_auto_assign_helper) {
if (cnet->auto_assign_helper_warned)
return NULL;
- if (!__nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple))
+ if (!helper || refcount_read(&helper->refcnt) > 1)
return NULL;
pr_info("nf_conntrack: default automatic helper assignment "
"has been turned off for security reasons and CT-based "
@@ -227,7 +229,7 @@ nf_ct_lookup_helper(struct nf_conn *ct, struct net *net)
return NULL;
}
- return __nf_ct_helper_find(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+ return helper;
}
int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
--
2.34.1
