[CCing Greg and the stable list, to ensure he is aware of this, as well
as the regressions list]
On 21.10.24 11:45, Pablo Neira Ayuso wrote:
> - There is no NFPROTO_IPV6 family for mark and NFLOG.
> - TRACE is also missing module autoload with NFPROTO_IPV6.
>
> This results in ip6tables failing to restore a ruleset. This issue has been
> reported by several users providing incomplete patches.
>
> Very similar to Ilya Katsnelson's patch including a missing chunk in the
> TRACE extension.
>
> Fixes: 0bfcb7b71e73 ("netfilter: xtables: avoid NFPROTO_UNSPEC where needed")
> [...]
Just FYI as the culprit recently hit various stable series (v6.11.4,
v6.6.57, v6.1.113, v5.15.168) quite a few reports came in that look like
issues that might be fixed by this to my untrained eyes. I suppose they
won't tell you anything new and maybe you even have seen them, but on
the off-chance that this might not be the case you can find them here:
https://bugzilla.kernel.org/show_bug.cgi?id=219397
https://bugzilla.kernel.org/show_bug.cgi?id=219402
https://bugzilla.kernel.org/show_bug.cgi?id=219409
Ciao, Thorsten
