Re: [PATCH nf-next] netfilter: x_tables: reject missing '-p' flag and check for INV flag

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Aug 24, 2026 at 11:55:59PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > > Sashiko also hinting to fix ip6_tables core check for this protocol
> > > > flag:
> > > > 
> > > > https://sashiko.dev/#/patchset/20260821134136.18191-1-fw%40strlen.de
> > > 
> > > Not so sure.  Maybe just do this?  I don't think proto > 0 and flag
> > > unset makes any sense.
> > > 
> > > diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
> > > --- a/net/ipv6/netfilter/ip6_tables.c
> > > +++ b/net/ipv6/netfilter/ip6_tables.c
> > > @@ -647,6 +647,13 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
> > >  	/* Clear counters and comefrom */
> > >  	e->counters = ((struct xt_counters) { 0, 0 });
> > >  	e->comefrom = 0;
> > > +
> > > +	/* Make sure F_PROTO is set, else ip6_packet_match
> > > +	 * won't do the right thing.
> > > +	 */
> > > +	if (e->ipv6.proto)
> > > +		e->ipv6.flags |= IP6T_F_PROTO;
> > 
> > Userspace always provides a zeroed e->ipv6.proto when unused, correct?
> 
> Yes, ip6tables raises it when it parses '-p' option.
> 
> > If so, LGTM.
> 
> Alright, I will respin tomorrow, thanks.
> 
> Do you want me to include the TPROXY fix too?

I think that is nf-next material, for correctness. Not urgent.

Thanks!