diff options
author | Ignat Korchagin <ignat@cloudflare.com> | 2024-02-22 10:33:08 +0000 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-02-28 23:52:55 +0100 |
commit | 7e0f122c65912740327e4c54472acaa5f85868cb (patch) | |
tree | 140f28e24c7fc3a0fc090e356c0bb6054d3288de /net/rxrpc | |
parent | l2tp: pass correct message length to ip6_append_data (diff) | |
download | linux-7e0f122c65912740327e4c54472acaa5f85868cb.tar.gz linux-7e0f122c65912740327e4c54472acaa5f85868cb.tar.bz2 linux-7e0f122c65912740327e4c54472acaa5f85868cb.zip |
netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
Commit d0009effa886 ("netfilter: nf_tables: validate NFPROTO_* family") added
some validation of NFPROTO_* families in the nft_compat module, but it broke
the ability to use legacy iptables modules in dual-stack nftables.
While with legacy iptables one had to independently manage IPv4 and IPv6
tables, with nftables it is possible to have dual-stack tables sharing the
rules. Moreover, it was possible to use rules based on legacy iptables
match/target modules in dual-stack nftables.
As an example, the program from [2] creates an INET dual-stack family table
using an xt_bpf based rule, which looks like the following (the actual output
was generated with a patched nft tool as the current nft tool does not parse
dual stack tables with legacy match rules, so consider it for illustrative
purposes only):
table inet testfw {
chain input {
type filter hook prerouting priority filter; policy accept;
bytecode counter packets 0 bytes 0 accept
}
}
After d0009effa886 ("netfilter: nf_tables: validate NFPROTO_* family") we get
EOPNOTSUPP for the above program.
Fix this by allowing NFPROTO_INET for nft_(match/target)_validate(), but also
restrict the functions to classic iptables hooks.
Changes in v3:
* clarify that upstream nft will not display such configuration properly and
that the output was generated with a patched nft tool
* remove example program from commit description and link to it instead
* no code changes otherwise
Changes in v2:
* restrict nft_(match/target)_validate() to classic iptables hooks
* rewrite example program to use unmodified libnftnl
Fixes: d0009effa886 ("netfilter: nf_tables: validate NFPROTO_* family")
Link: https://lore.kernel.org/all/Zc1PfoWN38UuFJRI@calendula/T/#mc947262582c90fec044c7a3398cc92fac7afea72 [1]
Link: https://lore.kernel.org/all/20240220145509.53357-1-ignat@cloudflare.com/ [2]
Reported-by: Jordan Griege <jgriege@cloudflare.com>
Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/rxrpc')
0 files changed, 0 insertions, 0 deletions