Re: [PATCH nf] netfilter: xtables: restrict several matches to ipv4 and ipv6

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Apr 15, 2026 at 01:18:08PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > diff --git a/net/netfilter/xt_realm.c b/net/netfilter/xt_realm.c
> > index 6df485f4403d..130ebe5d1c43 100644
> > --- a/net/netfilter/xt_realm.c
> > +++ b/net/netfilter/xt_realm.c
> > @@ -27,24 +27,35 @@ realm_mt(const struct sk_buff *skb, struct xt_action_param *par)
> >  	return (info->id == (dst->tclassid & info->mask)) ^ info->invert;
> >  }
> >  
> > -static struct xt_match realm_mt_reg __read_mostly = {
> > -	.name		= "realm",
> > -	.match		= realm_mt,
> > -	.matchsize	= sizeof(struct xt_realm_info),
> > -	.hooks		= (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
> > -			  (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
> > -	.family		= NFPROTO_UNSPEC,
> > -	.me		= THIS_MODULE
> > +static struct xt_match realm_mt_reg[] __read_mostly = {
> > +	{
> > +		.name		= "realm",
> > +		.match		= realm_mt,
> > +		.matchsize	= sizeof(struct xt_realm_info),
> > +		.hooks		= (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
> > +				  (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
> > +		.family		= NFPROTO_IPV4,
> > +		.me		= THIS_MODULE
> > +	},
> > +	{
> > +		.name		= "realm",
> > +		.match		= realm_mt,
> > +		.matchsize	= sizeof(struct xt_realm_info),
> > +		.hooks		= (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
> > +				  (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
> > +		.family		= NFPROTO_IPV6,
> > +		.me		= THIS_MODULE
> > +	}
> >  };
> 
> Is this for possible users of ip6tables ... -t realm?
> AFAICS dst->tclassid is never populated for ipv6, so while its possible
> to use it from ip6tables I don't think it can match.
> 
> I don't object to this change of course.  I just wonder why this was
> ever changed from ipt_realm to xt in the first place.

Patch description is quite terse...

I can just restrict realm to IPv4 only, sending v2.

> It was done as part of 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables").