From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.netfilter.org (mail.netfilter.org [217.70.190.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 55E942F616B; Sun, 18 Oct 2026 00:57:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.190.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792285025; cv=none; b=LIbxlB/KvzmlGRb4aNvD1E0XdFNZP1GZmIrWRKD9KB6mNPl+Fe/APL+odwyglkFFlHcLykmWiCbFtNoZuL54Iq37Y5a4UJvdKa3fRwLVlp5Sko+jM8QCias1r7xN/M7wW6vTmDbDohewUuzBohJU7gAeewzD+7T2Y5+KxUtkcso= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792285025; c=relaxed/simple; bh=TYHnYf3AjHb7ptmmOjcW7MUoTjWPnLWPyjviWbHYzGc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YihVgwExL0975NacvnHdFiCb5038AgGW0oSWdvArHB6cQuS+as0xSn9syKE0A4FmtUL5B+I6EUMcbhluAegYyQd9NC7vn60TJgo0Cn0Pu/SwtFFwE4woTVDHsq0evZBXG/LcL+TbT/Dj6+sJGKUmDp1wvQrf3dQTTWolDt2JSRM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org; spf=pass smtp.mailfrom=netfilter.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b=NcDWPnMf; arc=none smtp.client-ip=217.70.190.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=netfilter.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b="NcDWPnMf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org; s=2025; t=1792285022; bh=SipV94fFbELTwFs+C6inlAWJIbsHSk4z46ZlC6GDbDI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NcDWPnMfYRb+f5Y5NE2WUMlCrHjK3HCl2KvcguX/3zHBfYZUYxW2zhTIvX91K10A5 EXUn1clUn9dDkAOfznOfVN9ooS3EpVwXk6Aerb9MhwGzVgRlpvAqgZvCN2XLpp+qIk XdLQHBT2bDpWOCktKRb21Lfxn9eDChQykvZgFzQ5/0QhqDOCJcKfYd2QmcYNrMsQEA YFZXiGILz/SOBYNnl6/2pz9tevnTo0JOCZ0vRNneNH6nBJrWq2pbxcQT9CDFz0cwbc hVqE/jnBK5Eggbfuvvw+ljCGSQMkfoXfr+4egdCmQ8KcWVbODQugTXA9givZzahps0 PQSvvummrZTNA== Received: from localhost.localdomain (mail-agni [217.70.190.124]) by mail.netfilter.org (Postfix) with ESMTPSA id C6A3160078; Sun, 18 Oct 2026 02:57:01 +0200 (CEST) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com, edumazet@kernel.org, horms@kernel.org, fw@strlen.de, ja@ssi.bg Subject: [PATCH net-next 11/15] netfilter: nft_compat: restrict raw table targets/matches Date: Sun, 18 Oct 2026 02:56:34 +0200 Message-ID: <20261018005638.1776148-12-pablo@netfilter.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261018005638.1776148-1-pablo@netfilter.org> References: <20261018005638.1776148-1-pablo@netfilter.org> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Florian Westphal xt targets and matches declaring .table = "raw" (CT, NOTRACK) rely on only ever running in the legacy raw table's prerouting/output chains, ahead of conntrack. nft_compat_chain_validate_dependency() already enforces this kind of correspondence for "nat" by requiring the chain type to actually be NAT, but did nothing for "raw": a rule wrapping the CT target could be loaded into any hook and any priority via nft_compat, including after the real conntrack hook has already run. The CT target attaches a conntrack template to the skb when none is set yet. Require that a "raw" table dependency actually matches what xtables enforces via the implict/builtin table dependency. Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") Assisted-by: LLM Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_compat.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c index 63864b928259..88ddaf47f587 100644 --- a/net/netfilter/nft_compat.c +++ b/net/netfilter/nft_compat.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include @@ -45,6 +46,20 @@ static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, type = NFT_CHAIN_T_NAT; if (basechain->type->type != type) return -EINVAL; + } else if (strcmp(tablename, "raw") == 0) { + /* iptables-nft emulates the legacy raw table, which only + * ever has prerouting/output chains at this exact priority. + */ + if (ctx->family != NFPROTO_IPV4 && + ctx->family != NFPROTO_IPV6) + return -EINVAL; + + if (basechain->ops.hooknum != NF_INET_PRE_ROUTING && + basechain->ops.hooknum != NF_INET_LOCAL_OUT) + return -EINVAL; + + if (basechain->ops.priority != NF_IP_PRI_RAW) + return -EINVAL; } return 0; -- 2.47.3