* [PATCH nf] netfilter: xtables: restrict several matches to ipv4 and ipv6
@ 2026-04-15 10:47 Pablo Neira Ayuso
2026-04-15 11:18 ` Florian Westphal
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2026-04-15 10:47 UTC (permalink / raw)
To: netfilter-devel; +Cc: fw
This is a partial revert of:
ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
to allow ipv4 and ipv6 only.
- xt_mac
- xt_owner
- xt_physdev
- xt_realm
these extensions are not used by ebtables in userspace.
Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
Reported-by: "Kito Xu (veritas501)" <hxzene@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/xt_mac.c | 34 +++++++++++++++++++++++-----------
net/netfilter/xt_owner.c | 37 +++++++++++++++++++++++++------------
net/netfilter/xt_physdev.c | 29 +++++++++++++++++++----------
net/netfilter/xt_realm.c | 31 +++++++++++++++++++++----------
4 files changed, 88 insertions(+), 43 deletions(-)
diff --git a/net/netfilter/xt_mac.c b/net/netfilter/xt_mac.c
index 81649da57ba5..bd2354760895 100644
--- a/net/netfilter/xt_mac.c
+++ b/net/netfilter/xt_mac.c
@@ -38,25 +38,37 @@ static bool mac_mt(const struct sk_buff *skb, struct xt_action_param *par)
return ret;
}
-static struct xt_match mac_mt_reg __read_mostly = {
- .name = "mac",
- .revision = 0,
- .family = NFPROTO_UNSPEC,
- .match = mac_mt,
- .matchsize = sizeof(struct xt_mac_info),
- .hooks = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN) |
- (1 << NF_INET_FORWARD),
- .me = THIS_MODULE,
+static struct xt_match mac_mt_reg[] __read_mostly = {
+ {
+ .name = "mac",
+ .family = NFPROTO_IPV4,
+ .match = mac_mt,
+ .matchsize = sizeof(struct xt_mac_info),
+ .hooks = (1 << NF_INET_PRE_ROUTING) |
+ (1 << NF_INET_LOCAL_IN) |
+ (1 << NF_INET_FORWARD),
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "mac",
+ .family = NFPROTO_IPV6,
+ .match = mac_mt,
+ .matchsize = sizeof(struct xt_mac_info),
+ .hooks = (1 << NF_INET_PRE_ROUTING) |
+ (1 << NF_INET_LOCAL_IN) |
+ (1 << NF_INET_FORWARD),
+ .me = THIS_MODULE,
+ },
};
static int __init mac_mt_init(void)
{
- return xt_register_match(&mac_mt_reg);
+ return xt_register_matches(mac_mt_reg, ARRAY_SIZE(mac_mt_reg));
}
static void __exit mac_mt_exit(void)
{
- xt_unregister_match(&mac_mt_reg);
+ xt_unregister_matches(mac_mt_reg, ARRAY_SIZE(mac_mt_reg));
}
module_init(mac_mt_init);
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index 50332888c8d2..4786ea157269 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -127,26 +127,39 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
return true;
}
-static struct xt_match owner_mt_reg __read_mostly = {
- .name = "owner",
- .revision = 1,
- .family = NFPROTO_UNSPEC,
- .checkentry = owner_check,
- .match = owner_mt,
- .matchsize = sizeof(struct xt_owner_match_info),
- .hooks = (1 << NF_INET_LOCAL_OUT) |
- (1 << NF_INET_POST_ROUTING),
- .me = THIS_MODULE,
+static struct xt_match owner_mt_reg[] __read_mostly = {
+ {
+ .name = "owner",
+ .revision = 1,
+ .family = NFPROTO_IPV4,
+ .checkentry = owner_check,
+ .match = owner_mt,
+ .matchsize = sizeof(struct xt_owner_match_info),
+ .hooks = (1 << NF_INET_LOCAL_OUT) |
+ (1 << NF_INET_POST_ROUTING),
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "owner",
+ .revision = 1,
+ .family = NFPROTO_IPV6,
+ .checkentry = owner_check,
+ .match = owner_mt,
+ .matchsize = sizeof(struct xt_owner_match_info),
+ .hooks = (1 << NF_INET_LOCAL_OUT) |
+ (1 << NF_INET_POST_ROUTING),
+ .me = THIS_MODULE,
+ }
};
static int __init owner_mt_init(void)
{
- return xt_register_match(&owner_mt_reg);
+ return xt_register_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
}
static void __exit owner_mt_exit(void)
{
- xt_unregister_match(&owner_mt_reg);
+ xt_unregister_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
}
module_init(owner_mt_init);
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 343e65f377d4..130842c35c6f 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -115,24 +115,33 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
return 0;
}
-static struct xt_match physdev_mt_reg __read_mostly = {
- .name = "physdev",
- .revision = 0,
- .family = NFPROTO_UNSPEC,
- .checkentry = physdev_mt_check,
- .match = physdev_mt,
- .matchsize = sizeof(struct xt_physdev_info),
- .me = THIS_MODULE,
+static struct xt_match physdev_mt_reg[] __read_mostly = {
+ {
+ .name = "physdev",
+ .family = NFPROTO_IPV4,
+ .checkentry = physdev_mt_check,
+ .match = physdev_mt,
+ .matchsize = sizeof(struct xt_physdev_info),
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "physdev",
+ .family = NFPROTO_IPV6,
+ .checkentry = physdev_mt_check,
+ .match = physdev_mt,
+ .matchsize = sizeof(struct xt_physdev_info),
+ .me = THIS_MODULE,
+ },
};
static int __init physdev_mt_init(void)
{
- return xt_register_match(&physdev_mt_reg);
+ return xt_register_matches(physdev_mt_reg, ARRAY_SIZE(physdev_mt_reg));
}
static void __exit physdev_mt_exit(void)
{
- xt_unregister_match(&physdev_mt_reg);
+ xt_unregister_matches(physdev_mt_reg, ARRAY_SIZE(physdev_mt_reg));
}
module_init(physdev_mt_init);
diff --git a/net/netfilter/xt_realm.c b/net/netfilter/xt_realm.c
index 6df485f4403d..130ebe5d1c43 100644
--- a/net/netfilter/xt_realm.c
+++ b/net/netfilter/xt_realm.c
@@ -27,24 +27,35 @@ realm_mt(const struct sk_buff *skb, struct xt_action_param *par)
return (info->id == (dst->tclassid & info->mask)) ^ info->invert;
}
-static struct xt_match realm_mt_reg __read_mostly = {
- .name = "realm",
- .match = realm_mt,
- .matchsize = sizeof(struct xt_realm_info),
- .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
- (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
- .family = NFPROTO_UNSPEC,
- .me = THIS_MODULE
+static struct xt_match realm_mt_reg[] __read_mostly = {
+ {
+ .name = "realm",
+ .match = realm_mt,
+ .matchsize = sizeof(struct xt_realm_info),
+ .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
+ (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
+ .family = NFPROTO_IPV4,
+ .me = THIS_MODULE
+ },
+ {
+ .name = "realm",
+ .match = realm_mt,
+ .matchsize = sizeof(struct xt_realm_info),
+ .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
+ (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
+ .family = NFPROTO_IPV6,
+ .me = THIS_MODULE
+ }
};
static int __init realm_mt_init(void)
{
- return xt_register_match(&realm_mt_reg);
+ return xt_register_matches(realm_mt_reg, ARRAY_SIZE(realm_mt_reg));
}
static void __exit realm_mt_exit(void)
{
- xt_unregister_match(&realm_mt_reg);
+ xt_unregister_matches(realm_mt_reg, ARRAY_SIZE(realm_mt_reg));
}
module_init(realm_mt_init);
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH nf] netfilter: xtables: restrict several matches to ipv4 and ipv6
2026-04-15 10:47 [PATCH nf] netfilter: xtables: restrict several matches to ipv4 and ipv6 Pablo Neira Ayuso
@ 2026-04-15 11:18 ` Florian Westphal
2026-04-15 11:20 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Florian Westphal @ 2026-04-15 11:18 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> diff --git a/net/netfilter/xt_realm.c b/net/netfilter/xt_realm.c
> index 6df485f4403d..130ebe5d1c43 100644
> --- a/net/netfilter/xt_realm.c
> +++ b/net/netfilter/xt_realm.c
> @@ -27,24 +27,35 @@ realm_mt(const struct sk_buff *skb, struct xt_action_param *par)
> return (info->id == (dst->tclassid & info->mask)) ^ info->invert;
> }
>
> -static struct xt_match realm_mt_reg __read_mostly = {
> - .name = "realm",
> - .match = realm_mt,
> - .matchsize = sizeof(struct xt_realm_info),
> - .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
> - (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
> - .family = NFPROTO_UNSPEC,
> - .me = THIS_MODULE
> +static struct xt_match realm_mt_reg[] __read_mostly = {
> + {
> + .name = "realm",
> + .match = realm_mt,
> + .matchsize = sizeof(struct xt_realm_info),
> + .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
> + (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
> + .family = NFPROTO_IPV4,
> + .me = THIS_MODULE
> + },
> + {
> + .name = "realm",
> + .match = realm_mt,
> + .matchsize = sizeof(struct xt_realm_info),
> + .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
> + (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
> + .family = NFPROTO_IPV6,
> + .me = THIS_MODULE
> + }
> };
Is this for possible users of ip6tables ... -t realm?
AFAICS dst->tclassid is never populated for ipv6, so while its possible
to use it from ip6tables I don't think it can match.
I don't object to this change of course. I just wonder why this was
ever changed from ipt_realm to xt in the first place.
It was done as part of 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables").
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH nf] netfilter: xtables: restrict several matches to ipv4 and ipv6
2026-04-15 11:18 ` Florian Westphal
@ 2026-04-15 11:20 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2026-04-15 11:20 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
On Wed, Apr 15, 2026 at 01:18:08PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > diff --git a/net/netfilter/xt_realm.c b/net/netfilter/xt_realm.c
> > index 6df485f4403d..130ebe5d1c43 100644
> > --- a/net/netfilter/xt_realm.c
> > +++ b/net/netfilter/xt_realm.c
> > @@ -27,24 +27,35 @@ realm_mt(const struct sk_buff *skb, struct xt_action_param *par)
> > return (info->id == (dst->tclassid & info->mask)) ^ info->invert;
> > }
> >
> > -static struct xt_match realm_mt_reg __read_mostly = {
> > - .name = "realm",
> > - .match = realm_mt,
> > - .matchsize = sizeof(struct xt_realm_info),
> > - .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
> > - (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
> > - .family = NFPROTO_UNSPEC,
> > - .me = THIS_MODULE
> > +static struct xt_match realm_mt_reg[] __read_mostly = {
> > + {
> > + .name = "realm",
> > + .match = realm_mt,
> > + .matchsize = sizeof(struct xt_realm_info),
> > + .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
> > + (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
> > + .family = NFPROTO_IPV4,
> > + .me = THIS_MODULE
> > + },
> > + {
> > + .name = "realm",
> > + .match = realm_mt,
> > + .matchsize = sizeof(struct xt_realm_info),
> > + .hooks = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
> > + (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
> > + .family = NFPROTO_IPV6,
> > + .me = THIS_MODULE
> > + }
> > };
>
> Is this for possible users of ip6tables ... -t realm?
> AFAICS dst->tclassid is never populated for ipv6, so while its possible
> to use it from ip6tables I don't think it can match.
>
> I don't object to this change of course. I just wonder why this was
> ever changed from ipt_realm to xt in the first place.
Patch description is quite terse...
I can just restrict realm to IPv4 only, sending v2.
> It was done as part of 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables").
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-15 11:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-15 10:47 [PATCH nf] netfilter: xtables: restrict several matches to ipv4 and ipv6 Pablo Neira Ayuso
2026-04-15 11:18 ` Florian Westphal
2026-04-15 11:20 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.