path: root/iptables/nft-ipv6.c
diff options
authorPhil Sutter <>2018-08-20 15:30:03 +0200
committerFlorian Westphal <>2018-08-21 17:57:16 +0200
commit5ee03e6df41727652e0dc6ffaef8411b8840d812 (patch)
treee459442cfb4035a6bba51db4bd7c49ea344cb14f /iptables/nft-ipv6.c
parent37b68b2bc903112a74545c7f4a49c89e889582a9 (diff)
xtables: Use meta l4proto for -p match
Use of payload expression to match against IPv6 nexthdr field does not work if extension headers are present. A simple example for that is matching for fragmented icmpv6 traffic. Instead, generate a 'meta l4proto' expression which works even if extension headers are present. For consistency, apply the same change to iptables-nft as well. No adjustment to reverse path required as the needed bits were added by commit 6ea7579e6fe24 ("nft: decode meta l4proto") already. Signed-off-by: Phil Sutter <> Signed-off-by: Florian Westphal <>
Diffstat (limited to 'iptables/nft-ipv6.c')
1 files changed, 1 insertions, 2 deletions
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index dd23557c..48a7cefe 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -44,8 +44,7 @@ static int nft_ipv6_add(struct nftnl_rule *r, void *data)
if (cs->fw6.ipv6.proto != 0) {
op = nft_invflags2cmp(cs->fw6.ipv6.invflags, XT_INV_PROTO);
- add_proto(r, offsetof(struct ip6_hdr, ip6_nxt), 1,
- cs->fw6.ipv6.proto, op);
+ add_l4proto(r, cs->fw6.ipv6.proto, op);
if (!IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.src)) {