Patch "netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-nf_tables-allow-nfproto_inet-in-nft_-match.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 35cc9aa0daa8cad7022e1c2a6d76448d4d912e79
Author: Ignat Korchagin <ignat@xxxxxxxxxxxxxx>
Date:   Thu Feb 22 10:33:08 2024 +0000

    netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
    
    [ Upstream commit 7e0f122c65912740327e4c54472acaa5f85868cb ]
    
    Commit d0009effa886 ("netfilter: nf_tables: validate NFPROTO_* family") added
    some validation of NFPROTO_* families in the nft_compat module, but it broke
    the ability to use legacy iptables modules in dual-stack nftables.
    
    While with legacy iptables one had to independently manage IPv4 and IPv6
    tables, with nftables it is possible to have dual-stack tables sharing the
    rules. Moreover, it was possible to use rules based on legacy iptables
    match/target modules in dual-stack nftables.
    
    As an example, the program from [2] creates an INET dual-stack family table
    using an xt_bpf based rule, which looks like the following (the actual output
    was generated with a patched nft tool as the current nft tool does not parse
    dual stack tables with legacy match rules, so consider it for illustrative
    purposes only):
    
    table inet testfw {
      chain input {
        type filter hook prerouting priority filter; policy accept;
        bytecode counter packets 0 bytes 0 accept
      }
    }
    
    After d0009effa886 ("netfilter: nf_tables: validate NFPROTO_* family") we get
    EOPNOTSUPP for the above program.
    
    Fix this by allowing NFPROTO_INET for nft_(match/target)_validate(), but also
    restrict the functions to classic iptables hooks.
    
    Changes in v3:
      * clarify that upstream nft will not display such configuration properly and
        that the output was generated with a patched nft tool
      * remove example program from commit description and link to it instead
      * no code changes otherwise
    
    Changes in v2:
      * restrict nft_(match/target)_validate() to classic iptables hooks
      * rewrite example program to use unmodified libnftnl
    
    Fixes: d0009effa886 ("netfilter: nf_tables: validate NFPROTO_* family")
    Link: https://lore.kernel.org/all/Zc1PfoWN38UuFJRI@calendula/T/#mc947262582c90fec044c7a3398cc92fac7afea72 [1]
    Link: https://lore.kernel.org/all/20240220145509.53357-1-ignat@xxxxxxxxxxxxxx/ [2]
    Reported-by: Jordan Griege <jgriege@xxxxxxxxxxxxxx>
    Signed-off-by: Ignat Korchagin <ignat@xxxxxxxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 64a2a5f195896..aee046e00bfaf 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -358,10 +358,20 @@ static int nft_target_validate(const struct nft_ctx *ctx,
 
 	if (ctx->family != NFPROTO_IPV4 &&
 	    ctx->family != NFPROTO_IPV6 &&
+	    ctx->family != NFPROTO_INET &&
 	    ctx->family != NFPROTO_BRIDGE &&
 	    ctx->family != NFPROTO_ARP)
 		return -EOPNOTSUPP;
 
+	ret = nft_chain_validate_hooks(ctx->chain,
+				       (1 << NF_INET_PRE_ROUTING) |
+				       (1 << NF_INET_LOCAL_IN) |
+				       (1 << NF_INET_FORWARD) |
+				       (1 << NF_INET_LOCAL_OUT) |
+				       (1 << NF_INET_POST_ROUTING));
+	if (ret)
+		return ret;
+
 	if (nft_is_base_chain(ctx->chain)) {
 		const struct nft_base_chain *basechain =
 						nft_base_chain(ctx->chain);
@@ -607,10 +617,20 @@ static int nft_match_validate(const struct nft_ctx *ctx,
 
 	if (ctx->family != NFPROTO_IPV4 &&
 	    ctx->family != NFPROTO_IPV6 &&
+	    ctx->family != NFPROTO_INET &&
 	    ctx->family != NFPROTO_BRIDGE &&
 	    ctx->family != NFPROTO_ARP)
 		return -EOPNOTSUPP;
 
+	ret = nft_chain_validate_hooks(ctx->chain,
+				       (1 << NF_INET_PRE_ROUTING) |
+				       (1 << NF_INET_LOCAL_IN) |
+				       (1 << NF_INET_FORWARD) |
+				       (1 << NF_INET_LOCAL_OUT) |
+				       (1 << NF_INET_POST_ROUTING));
+	if (ret)
+		return ret;
+
 	if (nft_is_base_chain(ctx->chain)) {
 		const struct nft_base_chain *basechain =
 						nft_base_chain(ctx->chain);