Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 70d9847b authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Sasha Levin
Browse files

netfilter: nft_compat: set IP6T_F_PROTO flag if protocol is set 



[ Upstream commit 749177ccc74f9c6d0f51bd78a15c652a2134aa11 ]

ip6tables extensions check for this flag to restrict match/target to a
given protocol. Without this flag set, SYNPROXY6 returns an error.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Acked-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
parent ade6bee2

net/netfilter/nft_compat.c

+6 −0
Original line number Diff line number Diff line
@@ -97,6 +97,9 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par, 
		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;

		break;

	case AF_INET6:

		if (proto)

			entry->e6.ipv6.flags |= IP6T_F_PROTO;



		entry->e6.ipv6.proto = proto;

		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;

		break;
@@ -304,6 +307,9 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, 
		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;

		break;

	case AF_INET6:

		if (proto)

			entry->e6.ipv6.flags |= IP6T_F_PROTO;



		entry->e6.ipv6.proto = proto;

		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;

		break;