Re: [PATCH nf 1/1] netfilter: xt_nat: reject unsupported target families

[Florian Westphal <fw@strlen.de>]

Florian Westphal <fw@strlen.de> wrote:
> Ren Wei <n05ec@lzu.edu.cn> wrote:
> > xt_nat SNAT and DNAT target handlers assume IP-family conntrack state
> > is present and can dereference a NULL pointer when instantiated from an
> > unsupported family through nft_compat. A bridge-family compat rule can
> > therefore trigger a NULL-dereference in nf_nat_setup_info().
> 
> Are you sure this is related to nft_compat?  What prevents attaching
> -j D|SNAT to classic ebtables?
> 
> > Reject non-IP families in xt_nat_checkentry() so unsupported targets
> > cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT
> > compat users and leave the runtime fast path unchanged.
> 
> Not so sure, I don't think there is harm in allowing NFPROTO_INET but
> such users should not exist.
> 
> Patch is fine. There are already many different targets here,
> I don't think we should do a NFPROTO_IPV4 / IPV6 split in this case.

I take that back.  This problem goes beyond xt_nat.c;  see
11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets")

Can you make a patch like this one for nft_compat?
We can only use NFPROTO_BRIDGE targets, never UNSPEC, for NF_BRIDGE
caller.