* [PATCH] iptables: ip6t_MASQUERADE: add dependency on conntrack module
@ 2017-12-11 15:19 Konstantin Khlebnikov
2017-12-11 15:47 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Konstantin Khlebnikov @ 2017-12-11 15:19 UTC (permalink / raw)
To: netdev, David S. Miller; +Cc: Eric Dumazet, Florian Westphal, Pablo Neira Ayuso
After commit 4d3a57f23dec ("netfilter: conntrack: do not enable connection
tracking unless needed") conntrack is disabled by default unless some
module explicitly declares dependency in particular network namespace.
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Fixes: a357b3f80bc8 ("netfilter: nat: add dependencies on conntrack module")
---
net/ipv6/netfilter/ip6t_MASQUERADE.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
index 2b1a15846f9a..92c0047e7e33 100644
--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c
+++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c
@@ -33,13 +33,19 @@ static int masquerade_tg6_checkentry(const struct xt_tgchk_param *par)
if (range->flags & NF_NAT_RANGE_MAP_IPS)
return -EINVAL;
- return 0;
+ return nf_ct_netns_get(par->net, par->family);
+}
+
+static void masquerade_tg6_destroy(const struct xt_tgdtor_param *par)
+{
+ nf_ct_netns_put(par->net, par->family);
}
static struct xt_target masquerade_tg6_reg __read_mostly = {
.name = "MASQUERADE",
.family = NFPROTO_IPV6,
.checkentry = masquerade_tg6_checkentry,
+ .destroy = masquerade_tg6_destroy,
.target = masquerade_tg6,
.targetsize = sizeof(struct nf_nat_range),
.table = "nat",
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] iptables: ip6t_MASQUERADE: add dependency on conntrack module
2017-12-11 15:19 [PATCH] iptables: ip6t_MASQUERADE: add dependency on conntrack module Konstantin Khlebnikov
@ 2017-12-11 15:47 ` Pablo Neira Ayuso
2017-12-15 9:37 ` Konstantin Khlebnikov
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2017-12-11 15:47 UTC (permalink / raw)
To: Konstantin Khlebnikov
Cc: netdev, David S. Miller, Eric Dumazet, Florian Westphal
On Mon, Dec 11, 2017 at 06:19:33PM +0300, Konstantin Khlebnikov wrote:
> After commit 4d3a57f23dec ("netfilter: conntrack: do not enable connection
> tracking unless needed") conntrack is disabled by default unless some
> module explicitly declares dependency in particular network namespace.
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] iptables: ip6t_MASQUERADE: add dependency on conntrack module
2017-12-11 15:47 ` Pablo Neira Ayuso
@ 2017-12-15 9:37 ` Konstantin Khlebnikov
0 siblings, 0 replies; 3+ messages in thread
From: Konstantin Khlebnikov @ 2017-12-15 9:37 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netdev, David S. Miller, Eric Dumazet, Florian Westphal
On 11.12.2017 18:47, Pablo Neira Ayuso wrote:
> On Mon, Dec 11, 2017 at 06:19:33PM +0300, Konstantin Khlebnikov wrote:
>> After commit 4d3a57f23dec ("netfilter: conntrack: do not enable connection
>> tracking unless needed") conntrack is disabled by default unless some
>> module explicitly declares dependency in particular network namespace.
>
> Applied, thanks.
>
At least stable 4.14 needs this - without it IPv6 NAT simply doesn't work.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-12-15 9:45 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-12-11 15:19 [PATCH] iptables: ip6t_MASQUERADE: add dependency on conntrack module Konstantin Khlebnikov
2017-12-11 15:47 ` Pablo Neira Ayuso
2017-12-15 9:37 ` Konstantin Khlebnikov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.