netfilter: xtables: restrict several matches to inet family

This is a partial revert of:

  commit ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")

to allow ipv4 and ipv6 only.

- xt_mac
- xt_owner
- xt_physdev

These extensions are not used by ebtables in userspace.

Moreover, xt_realm is only for ipv4, since dst->tclassid is ipv4
specific.

Fixes: ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
Reported-by: "Kito Xu (veritas501)" <hxzene@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/xt_mac.c b/net/netfilter/xt_mac.c
index 4798cd2ca26ed5890dd7ca8afb4957307a183f4b..7fc5156825e49c384b8c480b858337aa61a2402d 100644 (file)
--- a/net/netfilter/xt_mac.c
+++ b/net/netfilter/xt_mac.c
@@ -36,25 +36,37 @@ static bool mac_mt(const struct sk_buff *skb, struct xt_action_param *par)
        return ret;
 }
 
-static struct xt_match mac_mt_reg __read_mostly = {
-       .name      = "mac",
-       .revision  = 0,
-       .family    = NFPROTO_UNSPEC,
-       .match     = mac_mt,
-       .matchsize = sizeof(struct xt_mac_info),
-       .hooks     = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_IN) |
-                    (1 << NF_INET_FORWARD),
-       .me        = THIS_MODULE,
+static struct xt_match mac_mt_reg[] __read_mostly = {
+       {
+               .name           = "mac",
+               .family         = NFPROTO_IPV4,
+               .match          = mac_mt,
+               .matchsize      = sizeof(struct xt_mac_info),
+               .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                 (1 << NF_INET_LOCAL_IN) |
+                                 (1 << NF_INET_FORWARD),
+               .me             = THIS_MODULE,
+       },
+       {
+               .name           = "mac",
+               .family         = NFPROTO_IPV6,
+               .match          = mac_mt,
+               .matchsize      = sizeof(struct xt_mac_info),
+               .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                 (1 << NF_INET_LOCAL_IN) |
+                                 (1 << NF_INET_FORWARD),
+               .me             = THIS_MODULE,
+       },
 };
 
 static int __init mac_mt_init(void)
 {
-       return xt_register_match(&mac_mt_reg);
+       return xt_register_matches(mac_mt_reg, ARRAY_SIZE(mac_mt_reg));
 }
 
 static void __exit mac_mt_exit(void)
 {
-       xt_unregister_match(&mac_mt_reg);
+       xt_unregister_matches(mac_mt_reg, ARRAY_SIZE(mac_mt_reg));
 }
 
 module_init(mac_mt_init);

diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index 5bfb4843df66361a930b0b2ed8ad936d5a38eeba..8f2e57b2a5868a3e39985389c77b8ab5f6f5af36 100644 (file)
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -127,26 +127,39 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
        return true;
 }
 
-static struct xt_match owner_mt_reg __read_mostly = {
-       .name       = "owner",
-       .revision   = 1,
-       .family     = NFPROTO_UNSPEC,
-       .checkentry = owner_check,
-       .match      = owner_mt,
-       .matchsize  = sizeof(struct xt_owner_match_info),
-       .hooks      = (1 << NF_INET_LOCAL_OUT) |
-                     (1 << NF_INET_POST_ROUTING),
-       .me         = THIS_MODULE,
+static struct xt_match owner_mt_reg[] __read_mostly = {
+       {
+               .name       = "owner",
+               .revision   = 1,
+               .family     = NFPROTO_IPV4,
+               .checkentry = owner_check,
+               .match      = owner_mt,
+               .matchsize  = sizeof(struct xt_owner_match_info),
+               .hooks      = (1 << NF_INET_LOCAL_OUT) |
+                             (1 << NF_INET_POST_ROUTING),
+               .me         = THIS_MODULE,
+       },
+       {
+               .name       = "owner",
+               .revision   = 1,
+               .family     = NFPROTO_IPV6,
+               .checkentry = owner_check,
+               .match      = owner_mt,
+               .matchsize  = sizeof(struct xt_owner_match_info),
+               .hooks      = (1 << NF_INET_LOCAL_OUT) |
+                             (1 << NF_INET_POST_ROUTING),
+               .me         = THIS_MODULE,
+       }
 };
 
 static int __init owner_mt_init(void)
 {
-       return xt_register_match(&owner_mt_reg);
+       return xt_register_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
 }
 
 static void __exit owner_mt_exit(void)
 {
-       xt_unregister_match(&owner_mt_reg);
+       xt_unregister_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
 }
 
 module_init(owner_mt_init);

diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 53997771013f6776b7dcbd2bcd7595fb8acb3667..d2b0b52434fa90d7cbc13d085eae67caf66c29e2 100644 (file)
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -137,24 +137,33 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
        return 0;
 }
 
-static struct xt_match physdev_mt_reg __read_mostly = {
-       .name       = "physdev",
-       .revision   = 0,
-       .family     = NFPROTO_UNSPEC,
-       .checkentry = physdev_mt_check,
-       .match      = physdev_mt,
-       .matchsize  = sizeof(struct xt_physdev_info),
-       .me         = THIS_MODULE,
+static struct xt_match physdev_mt_reg[] __read_mostly = {
+       {
+               .name           = "physdev",
+               .family         = NFPROTO_IPV4,
+               .checkentry     = physdev_mt_check,
+               .match          = physdev_mt,
+               .matchsize      = sizeof(struct xt_physdev_info),
+               .me             = THIS_MODULE,
+       },
+       {
+               .name           = "physdev",
+               .family         = NFPROTO_IPV6,
+               .checkentry     = physdev_mt_check,
+               .match          = physdev_mt,
+               .matchsize      = sizeof(struct xt_physdev_info),
+               .me             = THIS_MODULE,
+       },
 };
 
 static int __init physdev_mt_init(void)
 {
-       return xt_register_match(&physdev_mt_reg);
+       return xt_register_matches(physdev_mt_reg, ARRAY_SIZE(physdev_mt_reg));
 }
 
 static void __exit physdev_mt_exit(void)
 {
-       xt_unregister_match(&physdev_mt_reg);
+       xt_unregister_matches(physdev_mt_reg, ARRAY_SIZE(physdev_mt_reg));
 }
 
 module_init(physdev_mt_init);

diff --git a/net/netfilter/xt_realm.c b/net/netfilter/xt_realm.c
index 6df485f4403d02224e2f44a6169e288161ea409b..61b2f1e58d15059df3bf9e0a9c9255a9e9f882df 100644 (file)
--- a/net/netfilter/xt_realm.c
+++ b/net/netfilter/xt_realm.c
@@ -33,7 +33,7 @@ static struct xt_match realm_mt_reg __read_mostly = {
        .matchsize      = sizeof(struct xt_realm_info),
        .hooks          = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_FORWARD) |
                          (1 << NF_INET_LOCAL_OUT) | (1 << NF_INET_LOCAL_IN),
-       .family         = NFPROTO_UNSPEC,
+       .family         = NFPROTO_IPV4,
        .me             = THIS_MODULE
 };