Re: [PATCH net,v3 00/12] Netfilter for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Mar 26, 2026 at 02:16:51PM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > This is v3, I kept back an ipset fix and another to tigthen the xtables
> > interface to reject invalid combinations with the NFPROTO_ARP family.
> > They need a bit more discussion. I fixed the issues reported by AI on
> > patch 9 (add #ifdef to access ct zone, update nf_conntrack_broadcast
> > and patch 10 (use better Fixes: tag). Thanks!
> 
> Dropping netdev@.
> 
> I think the NFPROTO_ARP fix is legit.
> 
> If anything, we should also consider this (not even compile tested):

This chunk below looks easier to understand.

The issue can only happen from nft_compat, correct?

> diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
> index 53a614a0e3cd..39446edb0d70 100644
> --- a/net/netfilter/nft_compat.c
> +++ b/net/netfilter/nft_compat.c
> @@ -778,6 +778,20 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = {
>  
>  static struct nft_expr_type nft_match_type;
>  
> +static bool is_valid_compat_family(u32 family)
> +{
> +	switch (family) {
> +	case NFPROTO_IPV4:
> +	case NFPROTO_ARP:
> +	case NFPROTO_BRIDGE:
> +	case NFPROTO_IPV6:
> +		return true;
> +	}
> +
> +	/* others are nftables only */
> +	return false;
> +}
> +
>  static const struct nft_expr_ops *
>  nft_match_select_ops(const struct nft_ctx *ctx,
>  		     const struct nlattr * const tb[])
> @@ -798,6 +812,9 @@ nft_match_select_ops(const struct nft_ctx *ctx,
>  	rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
>  	family = ctx->family;
>  
> +	if (!is_valid_compat_family(family))
> +		return ERR_PTR(-EAFNOSUPPORT);
> +
>  	match = xt_request_find_match(family, mt_name, rev);
>  	if (IS_ERR(match))
>  		return ERR_PTR(-ENOENT);
> @@ -877,6 +894,9 @@ nft_target_select_ops(const struct nft_ctx *ctx,
>  	rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
>  	family = ctx->family;
>  
> +	if (!is_valid_compat_family(family))
> +		return ERR_PTR(-EAFNOSUPPORT);
> +
>  	if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
>  	    strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
>  	    strcmp(tg_name, "standard") == 0)