Re: [PATCH nf 1/1] netfilter: xt_nat: reject unsupported target families

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Jun 14, 2026 at 12:25:47AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > We can only use NFPROTO_BRIDGE targets, never UNSPEC, for NF_BRIDGE
> > > caller.
> > 
> > Maybe it is simply this patch:
> > 
> > commit b6fe26f86a1649f84e057f3f15605b08eda15497
> > Author: Pablo Neira Ayuso <pablo@netfilter.org>
> > Date:   Wed Apr 15 12:21:00 2026 +0200
> >  
> >     netfilter: xtables: restrict several matches to inet family
> > 
> > which was missing xt_nat.c?
> 
> No, ebtables targets are incompatible, they return different
> values compared to ip/ip6tables.
> 
> We need a nft_target_bridge_validate (or alternative method) that
> rejects all targets that are not NFPROTO_BRIDGE.

Yes, but there are still around 33 match/targets extensions in the
tree that use NFPROTO_UNSPEC as a .family.

And some of these NFPROTO_UNSPEC are supported by ebtables, eg.
xt_string (match), see ebt_string.c in ebtables userspace.

I think NFPROTO_UNSPEC should be replaced by explicit families that
are supported.

> This is wnat ebtables.c already does which is why this poc would
> not work for classic xtables.

Do you refer to targets specifically, correct?

        /* Reject UNSPEC, xtables verdicts/return values are incompatible */
        if (target->family != NFPROTO_BRIDGE) {
                module_put(target->me);
                ret = -ENOENT;
                goto cleanup_watchers;
        }

> That said, this patch (the xt_nat.c patch) might be a good idea
> anyway, but I don't think its enough.

I would probably replace all of the remaining NFPROTO_UNSPEC by
explicit families.

As for xt_nat_target_reg, it does not set NFPROTO_UNSPEC explicitly,
but given that target is allocated in the BSS, it results in an
implicit NFPROTO_UNSPEC, which is the reason why it when uncaught by
b6fe26f86a1649f84e057f3f15605b08eda15497.