Re: [PATCH nf 1/1] netfilter: xt_nat: reject unsupported target families

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Jun 14, 2026 at 12:00:56AM +0200, Florian Westphal wrote:
> Florian Westphal <fw@strlen.de> wrote:
> > Ren Wei <n05ec@lzu.edu.cn> wrote:
> > > xt_nat SNAT and DNAT target handlers assume IP-family conntrack state
> > > is present and can dereference a NULL pointer when instantiated from an
> > > unsupported family through nft_compat. A bridge-family compat rule can
> > > therefore trigger a NULL-dereference in nf_nat_setup_info().
> > 
> > Are you sure this is related to nft_compat?  What prevents attaching
> > -j D|SNAT to classic ebtables?
> > 
> > > Reject non-IP families in xt_nat_checkentry() so unsupported targets
> > > cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT
> > > compat users and leave the runtime fast path unchanged.
> > 
> > Not so sure, I don't think there is harm in allowing NFPROTO_INET but
> > such users should not exist.
> > 
> > Patch is fine. There are already many different targets here,
> > I don't think we should do a NFPROTO_IPV4 / IPV6 split in this case.
> 
> I take that back.  This problem goes beyond xt_nat.c;  see
> 11ff7288beb2 ("netfilter: ebtables: reject non-bridge targets")
> 
> Can you make a patch like this one for nft_compat?
> We can only use NFPROTO_BRIDGE targets, never UNSPEC, for NF_BRIDGE
> caller.

Maybe it is simply this patch:

commit b6fe26f86a1649f84e057f3f15605b08eda15497
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Wed Apr 15 12:21:00 2026 +0200
 
    netfilter: xtables: restrict several matches to inet family

which was missing xt_nat.c?