From 5ee03e6df41727652e0dc6ffaef8411b8840d812 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 20 Aug 2018 15:30:03 +0200 Subject: xtables: Use meta l4proto for -p match Use of payload expression to match against IPv6 nexthdr field does not work if extension headers are present. A simple example for that is matching for fragmented icmpv6 traffic. Instead, generate a 'meta l4proto' expression which works even if extension headers are present. For consistency, apply the same change to iptables-nft as well. No adjustment to reverse path required as the needed bits were added by commit 6ea7579e6fe24 ("nft: decode meta l4proto") already. Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal --- iptables/nft-ipv4.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'iptables/nft-ipv4.c') diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c index 105b1341..2d1bd10e 100644 --- a/iptables/nft-ipv4.c +++ b/iptables/nft-ipv4.c @@ -45,8 +45,7 @@ static int nft_ipv4_add(struct nftnl_rule *r, void *data) if (cs->fw.ip.proto != 0) { op = nft_invflags2cmp(cs->fw.ip.invflags, XT_INV_PROTO); - add_proto(r, offsetof(struct iphdr, protocol), 1, - cs->fw.ip.proto, op); + add_l4proto(r, cs->fw.ip.proto, op); } if (cs->fw.ip.src.s_addr != 0) { -- cgit v1.2.3