[nf-next PATCH] netfilter: nf_tables: Reject tables of unsupported family

[nf-next PATCH] netfilter: nf_tables: Reject tables of unsupported family

[Phil Sutter]

An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 net/netfilter/nf_tables_api.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5fa16990da951..753114f86e6b1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1072,6 +1072,33 @@ static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
 	return strcmp(obj->key.name, k->name);
 }
 
+static bool nft_supported_family(int family)
+{
+	switch (family) {
+#ifdef CONFIG_NF_TABLES_INET
+	case NFPROTO_INET:
+#endif
+#ifdef CONFIG_NF_TABLES_IPV4
+	case NFPROTO_IPV4:
+#endif
+#ifdef CONFIG_NF_TABLES_ARP
+	case NFPROTO_ARP:
+#endif
+#ifdef CONFIG_NF_TABLES_NETDEV
+	case NFPROTO_NETDEV:
+#endif
+#if IS_ENABLED(CONIFG_NF_TABLES_BRIDGE)
+	case NFPROTO_BRIDGE:
+#endif
+#ifdef CONFIG_NF_TABLES_IPV6
+	case NFPROTO_IPV6:
+#endif
+		return true;
+	default:
+		return false;
+	}
+}
+
 static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
 			      const struct nlattr * const nla[])
 {
@@ -1086,6 +1113,9 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
 	u32 flags = 0;
 	int err;
 
+	if (!nft_supported_family(family))
+		return -EOPNOTSUPP;
+
 	lockdep_assert_held(&nft_net->commit_mutex);
 	attr = nla[NFTA_TABLE_NAME];
 	table = nft_table_lookup(net, attr, family, genmask,
-- 
2.34.1