[PATCH] netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()

[Ignat Korchagin <ignat@xxxxxxxxxxxxxx>]

Commit 67ee37360d41 ("netfilter: nf_tables: validate NFPROTO_* family") added
some validation of NFPROTO_* families in nftables, but it broke our use case for
xt_bpf module:

  * assuming we have a simple bpf program:

    #include <linux/bpf.h>
    #include <bpf/bpf_helpers.h>

    char _license[] SEC("license") = "GPL";

    SEC("socket")
    int prog(struct __sk_buff *skb) { return BPF_OK; }

  * we can compile it and pin into bpf FS:
    bpftool prog load bpf.o /sys/fs/bpf/test

  * now we want to create a following table

    table inet firewall {
        chain input {
                type filter hook prerouting priority filter; policy accept;
                bpf pinned "/sys/fs/bpf/test" drop
        }
    }

All above used to work, but now we get EOPNOTSUPP, when creating the table.

Fix this by allowing NFPROTO_INET for nft_(match/target)_validate()

Fixes: 67ee37360d41 ("netfilter: nf_tables: validate NFPROTO_* family")
Reported-by: Jordan Griege <jgriege@xxxxxxxxxxxxxx>
Signed-off-by: Ignat Korchagin <ignat@xxxxxxxxxxxxxx>
---
 net/netfilter/nft_compat.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 1f9474fefe84..beea8c447e7a 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -359,6 +359,7 @@ static int nft_target_validate(const struct nft_ctx *ctx,
 
 	if (ctx->family != NFPROTO_IPV4 &&
 	    ctx->family != NFPROTO_IPV6 &&
+	    ctx->family != NFPROTO_INET &&
 	    ctx->family != NFPROTO_BRIDGE &&
 	    ctx->family != NFPROTO_ARP)
 		return -EOPNOTSUPP;
@@ -610,6 +611,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
 
 	if (ctx->family != NFPROTO_IPV4 &&
 	    ctx->family != NFPROTO_IPV6 &&
+	    ctx->family != NFPROTO_INET &&
 	    ctx->family != NFPROTO_BRIDGE &&
 	    ctx->family != NFPROTO_ARP)
 		return -EOPNOTSUPP;
-- 
2.39.2