On Wed, Jun 01, 2022 at 03:19:14PM +0200, Phil Sutter wrote:
> If nat expression does not specify an address, its family value is
> NFPROTO_INET. Disable the check against the packet's family in that
> case.
>
> Fixes: a33f387ecd5aa ("netfilter: nft_nat: allow to specify layer 4 protocol NAT only")
> Signed-off-by: Phil Sutter <phil@xxxxxx>
Florian posted this:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20220601084735.79090-1-fw@xxxxxxxxx/
> ---
> net/netfilter/nft_nat.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
> index 4394df4bc99b4..4ee690bdbf392 100644
> --- a/net/netfilter/nft_nat.c
> +++ b/net/netfilter/nft_nat.c
> @@ -335,7 +335,7 @@ static void nft_nat_inet_eval(const struct nft_expr *expr,
> {
> const struct nft_nat *priv = nft_expr_priv(expr);
>
> - if (priv->family == nft_pf(pkt))
> + if (priv->family == NFPROTO_INET || priv->family == nft_pf(pkt))
> nft_nat_eval(expr, regs, pkt);
> }
>
> --
> 2.34.1
>
