netfilter: nf_conntrack_irc: Tighten matching on DCC message

netfilter: nf_conntrack_irc: Tighten matching on DCC message

[ Upstream commit 1a4d9c173aca24ccb5b9020fc191aa005486e44b ]

CTCP messages should only be at the start of an IRC message, not
anywhere within it.

While the helper only decodes packes in the ORIGINAL direction, its
possible to make a client send a CTCP message back by empedding one into
a PING request.  As-is, thats enough to make the helper believe that it
saw a CTCP message.

Fixes: f8a64fc724f9 ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port")
Signed-off-by: David Leadbeater <dgl@dgl.cx>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>