Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 749177cc authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_compat: set IP6T_F_PROTO flag if protocol is set 



ip6tables extensions check for this flag to restrict match/target to a
given protocol. Without this flag set, SYNPROXY6 returns an error.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Acked-by: default avatarPatrick McHardy <kaber@trash.net>
parent 3d8c6dce

net/netfilter/nft_compat.c

+6 −0
Original line number Diff line number Diff line
@@ -133,6 +133,9 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par, 
		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;

		break;

	case AF_INET6:

		if (proto)

			entry->e6.ipv6.flags |= IP6T_F_PROTO;



		entry->e6.ipv6.proto = proto;

		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;

		break;
@@ -344,6 +347,9 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, 
		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;

		break;

	case AF_INET6:

		if (proto)

			entry->e6.ipv6.flags |= IP6T_F_PROTO;



		entry->e6.ipv6.proto = proto;

		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;

		break;