Re: [PATCH nf-next] netfilter: x_tables: reject missing '-p' flag and check for INV flag

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > Sashiko also hinting to fix ip6_tables core check for this protocol
> > > flag:
> > > 
> > > https://sashiko.dev/#/patchset/20260821134136.18191-1-fw%40strlen.de
> > 
> > Not so sure.  Maybe just do this?  I don't think proto > 0 and flag
> > unset makes any sense.
> > 
> > diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
> > --- a/net/ipv6/netfilter/ip6_tables.c
> > +++ b/net/ipv6/netfilter/ip6_tables.c
> > @@ -647,6 +647,13 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
> >  	/* Clear counters and comefrom */
> >  	e->counters = ((struct xt_counters) { 0, 0 });
> >  	e->comefrom = 0;
> > +
> > +	/* Make sure F_PROTO is set, else ip6_packet_match
> > +	 * won't do the right thing.
> > +	 */
> > +	if (e->ipv6.proto)
> > +		e->ipv6.flags |= IP6T_F_PROTO;
> 
> Userspace always provides a zeroed e->ipv6.proto when unused, correct?

Yes, ip6tables raises it when it parses '-p' option.

> If so, LGTM.

Alright, I will respin tomorrow, thanks.

Do you want me to include the TPROXY fix too?