Re: [PATCH net 2/2] netfilter: xtables: fix typo causing some targets not to load on IPv6

Re: [PATCH net 2/2] netfilter: xtables: fix typo causing some targets not to load on IPv6

[Linux regression tracking (Thorsten Leemhuis)]

[CCing Greg and the stable list, to ensure he is aware of this, as well
as the regressions list]

On 21.10.24 11:45, Pablo Neira Ayuso wrote:
> - There is no NFPROTO_IPV6 family for mark and NFLOG.
> - TRACE is also missing module autoload with NFPROTO_IPV6.
> 
> This results in ip6tables failing to restore a ruleset. This issue has been
> reported by several users providing incomplete patches.
> 
> Very similar to Ilya Katsnelson's patch including a missing chunk in the
> TRACE extension.
> 
> Fixes: 0bfcb7b71e73 ("netfilter: xtables: avoid NFPROTO_UNSPEC where needed")
> [...]

Just FYI as the culprit recently hit various stable series (v6.11.4,
v6.6.57, v6.1.113, v5.15.168) quite a few reports came in that look like
issues that might be fixed by this to my untrained eyes. I suppose they
won't tell you anything new and maybe you even have seen them, but on
the off-chance that this might not be the case you can find them here:

https://bugzilla.kernel.org/show_bug.cgi?id=219397
https://bugzilla.kernel.org/show_bug.cgi?id=219402
https://bugzilla.kernel.org/show_bug.cgi?id=219409

Ciao, Thorsten

Re: [PATCH net 2/2] netfilter: xtables: fix typo causing some targets not to load on IPv6

[Greg KH]

On Tue, Oct 22, 2024 at 09:39:38AM +0200, Linux regression tracking (Thorsten Leemhuis) wrote:
> [CCing Greg and the stable list, to ensure he is aware of this, as well
> as the regressions list]
> 
> On 21.10.24 11:45, Pablo Neira Ayuso wrote:
> > - There is no NFPROTO_IPV6 family for mark and NFLOG.
> > - TRACE is also missing module autoload with NFPROTO_IPV6.
> > 
> > This results in ip6tables failing to restore a ruleset. This issue has been
> > reported by several users providing incomplete patches.
> > 
> > Very similar to Ilya Katsnelson's patch including a missing chunk in the
> > TRACE extension.
> > 
> > Fixes: 0bfcb7b71e73 ("netfilter: xtables: avoid NFPROTO_UNSPEC where needed")
> > [...]
> 
> Just FYI as the culprit recently hit various stable series (v6.11.4,
> v6.6.57, v6.1.113, v5.15.168) quite a few reports came in that look like
> issues that might be fixed by this to my untrained eyes. I suppose they
> won't tell you anything new and maybe you even have seen them, but on
> the off-chance that this might not be the case you can find them here:
> 
> https://bugzilla.kernel.org/show_bug.cgi?id=219397
> https://bugzilla.kernel.org/show_bug.cgi?id=219402
> https://bugzilla.kernel.org/show_bug.cgi?id=219409

Is this commit in linux-next yet?  I looked yesterday but couldn't find
it anywhere...

thanks,

greg k-h

Re: [PATCH net 2/2] netfilter: xtables: fix typo causing some targets not to load on IPv6

[Pablo Neira Ayuso]

Hi Greg,

On Tue, Oct 22, 2024 at 09:44:19AM +0200, Greg KH wrote:
> On Tue, Oct 22, 2024 at 09:39:38AM +0200, Linux regression tracking (Thorsten Leemhuis) wrote:
> > [CCing Greg and the stable list, to ensure he is aware of this, as well
> > as the regressions list]
> > 
> > On 21.10.24 11:45, Pablo Neira Ayuso wrote:
> > > - There is no NFPROTO_IPV6 family for mark and NFLOG.
> > > - TRACE is also missing module autoload with NFPROTO_IPV6.
> > > 
> > > This results in ip6tables failing to restore a ruleset. This issue has been
> > > reported by several users providing incomplete patches.
> > > 
> > > Very similar to Ilya Katsnelson's patch including a missing chunk in the
> > > TRACE extension.
> > > 
> > > Fixes: 0bfcb7b71e73 ("netfilter: xtables: avoid NFPROTO_UNSPEC where needed")
> > > [...]
> > 
> > Just FYI as the culprit recently hit various stable series (v6.11.4,
> > v6.6.57, v6.1.113, v5.15.168) quite a few reports came in that look like
> > issues that might be fixed by this to my untrained eyes. I suppose they
> > won't tell you anything new and maybe you even have seen them, but on
> > the off-chance that this might not be the case you can find them here:
> > 
> > https://bugzilla.kernel.org/show_bug.cgi?id=219397
> > https://bugzilla.kernel.org/show_bug.cgi?id=219402
> > https://bugzilla.kernel.org/show_bug.cgi?id=219409
> 
> Is this commit in linux-next yet?  I looked yesterday but couldn't find
> it anywhere...

Not yet, there is a pending PR to reach netdev.git at this moment.