Re: [PATCH net,v3 00/12] Netfilter for net

Florian Westphal
2026-03-26T13:17:20Z

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> This is v3, I kept back an ipset fix and another to tigthen the xtables
> interface to reject invalid combinations with the NFPROTO_ARP family.
> They need a bit more discussion. I fixed the issues reported by AI on
> patch 9 (add #ifdef to access ct zone, update nf_conntrack_broadcast
> and patch 10 (use better Fixes: tag). Thanks!

Dropping netdev@.

I think the NFPROTO_ARP fix is legit.

If anything, we should also consider this (not even compile tested):

diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 53a614a0e3cd..39446edb0d70 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -778,6 +778,20 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = {

static struct nft_expr_type nft_match_type;

+static bool is_valid_compat_family(u32 family)
+{
+ switch (family) {
+ case NFPROTO_IPV4:
+ case NFPROTO_ARP:
+ case NFPROTO_BRIDGE:
+ case NFPROTO_IPV6:
+ return true;
+ }
+
+ /* others are nftables only */
+ return false;
+}
+
static const struct nft_expr_ops *
nft_match_select_ops(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
@@ -798,6 +812,9 @@ nft_match_select_ops(const struct nft_ctx *ctx,
rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
family = ctx->family;

+ if (!is_valid_compat_family(family))
+ return ERR_PTR(-EAFNOSUPPORT);
+
match = xt_request_find_match(family, mt_name, rev);
if (IS_ERR(match))
return ERR_PTR(-ENOENT);
@@ -877,6 +894,9 @@ nft_target_select_ops(const struct nft_ctx *ctx,
rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
family = ctx->family;

+ if (!is_valid_compat_family(family))
+ return ERR_PTR(-EAFNOSUPPORT);
+
if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
strcmp(tg_name, "standard") == 0)