Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754253AbbGASm1 (ORCPT ); Wed, 1 Jul 2015 14:42:27 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:44836 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754059AbbGASlp (ORCPT ); Wed, 1 Jul 2015 14:41:45 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso , Patrick McHardy Subject: [PATCH 3.14 08/34] netfilter: nft_compat: set IP6T_F_PROTO flag if protocol is set Date: Wed, 1 Jul 2015 11:40:15 -0700 Message-Id: <20150701183955.628405076@linuxfoundation.org> X-Mailer: git-send-email 2.4.4 In-Reply-To: <20150701183955.306219425@linuxfoundation.org> References: <20150701183955.306219425@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1489 Lines: 48 3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pablo Neira Ayuso commit 749177ccc74f9c6d0f51bd78a15c652a2134aa11 upstream. ip6tables extensions check for this flag to restrict match/target to a given protocol. Without this flag set, SYNPROXY6 returns an error. Signed-off-by: Pablo Neira Ayuso Acked-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman --- net/netfilter/nft_compat.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/net/netfilter/nft_compat.c +++ b/net/netfilter/nft_compat.c @@ -82,6 +82,9 @@ nft_target_set_tgchk_param(struct xt_tgc entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; break; case AF_INET6: + if (proto) + entry->e6.ipv6.flags |= IP6T_F_PROTO; + entry->e6.ipv6.proto = proto; entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; break; @@ -313,6 +316,9 @@ nft_match_set_mtchk_param(struct xt_mtch entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; break; case AF_INET6: + if (proto) + entry->e6.ipv6.flags |= IP6T_F_PROTO; + entry->e6.ipv6.proto = proto; entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; break; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/