tree a2159ad00a1d5266bc13ea116f96f5013517ca4d
parent 027248d07c566f493b721b3c55bfd2834ee8296d
author Pablo Neira Ayuso <pablo@netfilter.org> 1729428591 +0200
committer Arnav Kansal <rnv@google.com> 1730941556 +0000

netfilter: xtables: fix typo causing some targets not to load on IPv6

[ Upstream commit 306ed1728e8438caed30332e1ab46b28c25fe3d8 ]

- There is no NFPROTO_IPV6 family for mark and NFLOG.
- TRACE is also missing module autoload with NFPROTO_IPV6.

This results in ip6tables failing to restore a ruleset. This issue has been
reported by several users providing incomplete patches.

Very similar to Ilya Katsnelson's patch including a missing chunk in the
TRACE extension.

BUG=b/375751802
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2024-50038 in the Linux kernel.

cos-patch: security-moderate
Fixes: 0bfcb7b71e73 ("netfilter: xtables: avoid NFPROTO_UNSPEC where needed")
Reported-by: Ignat Korchagin <ignat@cloudflare.com>
Reported-by: Ilya Katsnelson <me@0upti.me>
Reported-by: Krzysztof Olędzki <ole@ans.pl>
Change-Id: I7870fe9ea19dfd08a798a4d66966e3c4960ad712
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/85580
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Kevin Berry <kpberry@google.com>