Messages in this thread Patch in this message | | | From | Greg Kroah-Hartman <> | Subject | [PATCH 3.14 08/34] netfilter: nft_compat: set IP6T_F_PROTO flag if protocol is set | Date | Wed, 1 Jul 2015 11:40:15 -0700 |
| |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 749177ccc74f9c6d0f51bd78a15c652a2134aa11 upstream.
ip6tables extensions check for this flag to restrict match/target to a given protocol. Without this flag set, SYNPROXY6 returns an error.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
--- net/netfilter/nft_compat.c | 6 ++++++ 1 file changed, 6 insertions(+)
--- a/net/netfilter/nft_compat.c +++ b/net/netfilter/nft_compat.c @@ -82,6 +82,9 @@ nft_target_set_tgchk_param(struct xt_tgc entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; break; case AF_INET6: + if (proto) + entry->e6.ipv6.flags |= IP6T_F_PROTO; + entry->e6.ipv6.proto = proto; entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; break; @@ -313,6 +316,9 @@ nft_match_set_mtchk_param(struct xt_mtch entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; break; case AF_INET6: + if (proto) + entry->e6.ipv6.flags |= IP6T_F_PROTO; + entry->e6.ipv6.proto = proto; entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; break;
| |