Re: [PATCH nf 1/1] netfilter: xt_TPROXY: require IPv6 protocol match

[email protected] <[email protected]> wrote:
> From: Zhiling Zou <[email protected]>
> 
> tproxy_tg6_check() verifies the protocol field value but does not
> require IP6T_F_PROTO. A crafted ip6tables rule can set the field to
> TCP or UDP while leaving the protocol matching flag clear.
> 
> ip6_packet_match() treats such a rule as protocol agnostic and can
> invoke tproxy_tg6_v1() for ICMPv6. nf_tproxy_get_sock_v6() warns for
> protocols other than TCP and UDP.
> 
> Reject rules without IP6T_F_PROTO so TPROXY is invoked only for the
> protocols it supports.

Reviewed-by: Florian Westphal <[email protected]>

Looks like l2tp_mt_check6() has same problem.
Would you mind sending a second patch for xt_l2tp.c ?  Else I can
do it.