tree 1565cf3ab9ceab48682d97df320b245ba1287999
parent 4d94631ff24e72fec6db447ec08d6444ed96b97d
author Pablo Neira Ayuso <pablo@netfilter.org> 1729428591 +0200
committer Arnav Kansal <rnv@google.com> 1730941744 +0000

netfilter: xtables: fix typo causing some targets not to load on IPv6

[ Upstream commit 306ed1728e8438caed30332e1ab46b28c25fe3d8 ]

- There is no NFPROTO_IPV6 family for mark and NFLOG.
- TRACE is also missing module autoload with NFPROTO_IPV6.

This results in ip6tables failing to restore a ruleset. This issue has been
reported by several users providing incomplete patches.

Very similar to Ilya Katsnelson's patch including a missing chunk in the
TRACE extension.

BUG=b/375751675
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2024-50038 in the Linux kernel.

cos-patch: security-moderate
Fixes: 0bfcb7b71e73 ("netfilter: xtables: avoid NFPROTO_UNSPEC where needed")
Reported-by: Ignat Korchagin <ignat@cloudflare.com>
Reported-by: Ilya Katsnelson <me@0upti.me>
Reported-by: Krzysztof Olędzki <ole@ans.pl>
Change-Id: Iaac880a28029817d2e61dfcaeb2db1d2ea6bf2e6
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/85603
Reviewed-by: Kevin Berry <kpberry@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>