Re: [PATCH nf-next] netfilter: x_tables: reject missing '-p' flag and check for INV flag

Florian Westphal <[email protected]> wrote:
> > Userspace always provides a zeroed e->ipv6.proto when unused, correct?
> 
> Yes, ip6tables raises it when it parses '-p' option.
> 
> > If so, LGTM.
> 
> Alright, I will respin tomorrow, thanks.
> 
> Do you want me to include the TPROXY fix too?

Actually nft_compat.c already does:

 if (proto)
   entry->e6.ipv6.flags |= IP6T_F_PROTO;

so the only other necessary fix is the check for 'INV' in xt_l2tp.c.