| Message ID | 151300557384.454702.4055341451761100641.stgit@buzz |
|---|---|
| State | Awaiting Upstream, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | iptables: ip6t_MASQUERADE: add dependency on conntrack module | expand |
On Mon, Dec 11, 2017 at 06:19:33PM +0300, Konstantin Khlebnikov wrote: > After commit 4d3a57f23dec ("netfilter: conntrack: do not enable connection > tracking unless needed") conntrack is disabled by default unless some > module explicitly declares dependency in particular network namespace. Applied, thanks.
On 11.12.2017 18:47, Pablo Neira Ayuso wrote: > On Mon, Dec 11, 2017 at 06:19:33PM +0300, Konstantin Khlebnikov wrote: >> After commit 4d3a57f23dec ("netfilter: conntrack: do not enable connection >> tracking unless needed") conntrack is disabled by default unless some >> module explicitly declares dependency in particular network namespace. > > Applied, thanks. > At least stable 4.14 needs this - without it IPv6 NAT simply doesn't work.
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c index 2b1a15846f9a..92c0047e7e33 100644 --- a/net/ipv6/netfilter/ip6t_MASQUERADE.c +++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c @@ -33,13 +33,19 @@ static int masquerade_tg6_checkentry(const struct xt_tgchk_param *par) if (range->flags & NF_NAT_RANGE_MAP_IPS) return -EINVAL; - return 0; + return nf_ct_netns_get(par->net, par->family); +} + +static void masquerade_tg6_destroy(const struct xt_tgdtor_param *par) +{ + nf_ct_netns_put(par->net, par->family); } static struct xt_target masquerade_tg6_reg __read_mostly = { .name = "MASQUERADE", .family = NFPROTO_IPV6, .checkentry = masquerade_tg6_checkentry, + .destroy = masquerade_tg6_destroy, .target = masquerade_tg6, .targetsize = sizeof(struct nf_nat_range), .table = "nat",
After commit 4d3a57f23dec ("netfilter: conntrack: do not enable connection tracking unless needed") conntrack is disabled by default unless some module explicitly declares dependency in particular network namespace. Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Fixes: a357b3f80bc8 ("netfilter: nat: add dependencies on conntrack module") --- net/ipv6/netfilter/ip6t_MASQUERADE.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)