netfilter: conntrack: Fix gre tunneling over ipv6

lsenecaux · ummakynes · commit 8b2030b43059 · 2021-03-18T00:32:06.000+01:00
This fix permits gre connections to be tracked within ip6tables rules

Signed-off-by: Ludovic Senecaux &lt;linuxludo@free.fr&gt;
Acked-by: Florian Westphal &lt;fw@strlen.de&gt;
Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
@@ -218,9 +218,6 @@ int nf_conntrack_gre_packet(struct nf_conn *ct,
 			    enum ip_conntrack_info ctinfo,
 			    const struct nf_hook_state *state)
 {
-	if (state->pf != NFPROTO_IPV4)
-		return -NF_ACCEPT;
-
 	if (!nf_ct_is_confirmed(ct)) {
 		unsigned int *timeouts = nf_ct_timeout_lookup(ct);
 

Original file line number	Diff line number	Diff line change
`@@ -218,9 +218,6 @@ int nf_conntrack_gre_packet(struct nf_conn *ct,`
`218`	`218`	`enum ip_conntrack_info ctinfo,`
`219`	`219`	`const struct nf_hook_state *state)`
`220`	`220`	`{`
`221`		`- if (state->pf != NFPROTO_IPV4)`
`222`		`- return -NF_ACCEPT;`
`223`		`-`
`224`	`221`	`if (!nf_ct_is_confirmed(ct)) {`
`225`	`222`	`unsigned int *timeouts = nf_ct_timeout_lookup(ct);`
`226`	`223`