If nat expression does not specify an address, its family value is
NFPROTO_INET. Disable the check against the packet's family in that
case.
Fixes: a33f387ecd5aa ("netfilter: nft_nat: allow to specify layer 4 protocol NAT only")
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
net/netfilter/nft_nat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 4394df4bc99b4..4ee690bdbf392 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -335,7 +335,7 @@ static void nft_nat_inet_eval(const struct nft_expr *expr,
{
const struct nft_nat *priv = nft_expr_priv(expr);
- if (priv->family == nft_pf(pkt))
+ if (priv->family == NFPROTO_INET || priv->family == nft_pf(pkt))
nft_nat_eval(expr, regs, pkt);
}
--
2.34.1
