Re: [PATCH nf 1/1] netfilter: xt_TPROXY: require IPv6 protocol match

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Aug 17, 2026 at 08:26:37PM +0800, ZhilingZouzhilinz@nebusec.ai wrote:
> From: Zhiling Zou <zhilinz@nebusec.ai>
> 
> tproxy_tg6_check() verifies the protocol field value but does not
> require IP6T_F_PROTO. A crafted ip6tables rule can set the field to
> TCP or UDP while leaving the protocol matching flag clear.
> 
> ip6_packet_match() treats such a rule as protocol agnostic and can
> invoke tproxy_tg6_v1() for ICMPv6. nf_tproxy_get_sock_v6() warns for
> protocols other than TCP and UDP.
> 
> Reject rules without IP6T_F_PROTO so TPROXY is invoked only for the
> protocols it supports.
> 
> Fixes: 6ad7889327a5e ("tproxy: added IPv6 support to the TPROXY target")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
>  net/netfilter/xt_TPROXY.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
> index 5f60e7298a1ea..13a94c9d06c0f 100644
> --- a/net/netfilter/xt_TPROXY.c
> +++ b/net/netfilter/xt_TPROXY.c
> @@ -179,7 +179,8 @@ static int tproxy_tg6_check(const struct xt_tgchk_param *par)
>  	if (err)
>  		return err;
>  
> -	if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) &&
> +	if ((i->flags & IP6T_F_PROTO) &&
> +	    (i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) &&
>  	    !(i->invflags & IP6T_INV_PROTO))

And why not tproxy_tg4_check?

>  		return 0;
>  
> -- 
> 2.43.0
>