Re: [PATCH nf-next] netfilter: x_tables: reject missing '-p' flag and check for INV flag

On Tue, Aug 25, 2026 at 12:18:12AM +0200, Florian Westphal wrote:
> Florian Westphal <[email protected]> wrote:
> > > Userspace always provides a zeroed e->ipv6.proto when unused, correct?
> > 
> > Yes, ip6tables raises it when it parses '-p' option.
> > 
> > > If so, LGTM.
> > 
> > Alright, I will respin tomorrow, thanks.
> > 
> > Do you want me to include the TPROXY fix too?
> 
> Actually nft_compat.c already does:
> 
>  if (proto)
>    entry->e6.ipv6.flags |= IP6T_F_PROTO;

So it is only x_tables legacy that has this issue.

> so the only other necessary fix is the check for 'INV' in xt_l2tp.c.

Agreed.

Thanks!