From 0c371aeab906b6e65c4c86174cbe2fbca02891d1 Mon Sep 17 00:00:00 2001

From: Pablo Neira Ayuso <pablo@netfilter.org>

Date: Tue, 20 Jul 2021 18:59:44 +0200

Subject: [PATCH] evaluate: fix inet nat with no layer 3 info

nft currently reports:

 Error: Could not process rule: Protocol error

 add rule inet x y meta l4proto tcp dnat to :80

                                    ^^^^

default to NFPROTO_INET family, otherwise kernel bails out EPROTO when

trying to load the conntrack helper.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1428

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

(cherry picked from commit 9a36033ce50638a403d1421935cdd1287ee5de6b)

---

 src/evaluate.c | 5 +++--

 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/evaluate.c b/src/evaluate.c

index bba685af720ed..73d6fd0e89bc2 100644

--- a/src/evaluate.c

+++ b/src/evaluate.c

@@ -2896,9 +2896,10 @@ static int nat_evaluate_family(struct eval_ctx *ctx, struct stmt *stmt)

 			stmt->nat.family = ctx->pctx.family;

 		return 0;

 	case NFPROTO_INET:

-		if (!stmt->nat.addr)

+		if (!stmt->nat.addr) {

+			stmt->nat.family = NFPROTO_INET;

 			return 0;

-

+		}

 		if (stmt->nat.family != NFPROTO_UNSPEC)

 			return 0;

-- 

2.34.1