From patchwork Mon Dec 11 15:19:33 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Konstantin Khlebnikov X-Patchwork-Id: 847098 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=yandex-team.ru header.i=@yandex-team.ru header.b="WPfYn69X"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3ywRdL0NBdz9s4q for ; Tue, 12 Dec 2017 02:26:46 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752567AbdLKP0n (ORCPT ); Mon, 11 Dec 2017 10:26:43 -0500 Received: from forwardcorp1j.cmail.yandex.net ([5.255.227.105]:39747 "EHLO forwardcorp1j.cmail.yandex.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752559AbdLKP0m (ORCPT ); Mon, 11 Dec 2017 10:26:42 -0500 X-Greylist: delayed 423 seconds by postgrey-1.27 at vger.kernel.org; Mon, 11 Dec 2017 10:26:41 EST Received: from smtpcorp1o.mail.yandex.net (smtpcorp1o.mail.yandex.net [IPv6:2a02:6b8:0:1a2d::30]) by forwardcorp1j.cmail.yandex.net (Yandex) with ESMTP id E81C520E83; Mon, 11 Dec 2017 18:19:36 +0300 (MSK) Received: from smtpcorp1o.mail.yandex.net (localhost.localdomain [127.0.0.1]) by smtpcorp1o.mail.yandex.net (Yandex) with ESMTP id E04752440DCB; Mon, 11 Dec 2017 18:19:36 +0300 (MSK) Received: from unknown (unknown [2a02:6b8:0:40c:3c81:2f72:a6a0:714b]) by smtpcorp1o.mail.yandex.net (nwsmtp/Yandex) with ESMTPSA id AUo2wONUFN-Ja6CtFfV; Mon, 11 Dec 2017 18:19:36 +0300 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client certificate not present) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru; s=default; t=1513005576; bh=1NYN9w7J0DM+6Po/QfD/y9NAurrS0g6SxWB2HI1lNjI=; h=Subject:From:To:Cc:Date:Message-ID; b=WPfYn69XQ7jJZ1PCmOYzmGGPSyiH8ZlWcKDeSzkPjuIleGmxCw78Q25PeT0NtNbtK ZlPJCFJvV9hzWy5dJVnaDRKyHPdsqDT7pEvQfofcWUJ2WGCtOmTiurnPu9KhEmNXLA 4m4JQcuXjEiyQ3KVbSrwcZin0SsMahF/xkQsbZ88= Authentication-Results: smtpcorp1o.mail.yandex.net; dkim=pass header.i=@yandex-team.ru Subject: [PATCH] iptables: ip6t_MASQUERADE: add dependency on conntrack module From: Konstantin Khlebnikov To: netdev@vger.kernel.org, "David S. Miller" Cc: Eric Dumazet , Florian Westphal , Pablo Neira Ayuso Date: Mon, 11 Dec 2017 18:19:33 +0300 Message-ID: <151300557384.454702.4055341451761100641.stgit@buzz> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org After commit 4d3a57f23dec ("netfilter: conntrack: do not enable connection tracking unless needed") conntrack is disabled by default unless some module explicitly declares dependency in particular network namespace. Signed-off-by: Konstantin Khlebnikov Fixes: a357b3f80bc8 ("netfilter: nat: add dependencies on conntrack module") --- net/ipv6/netfilter/ip6t_MASQUERADE.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c index 2b1a15846f9a..92c0047e7e33 100644 --- a/net/ipv6/netfilter/ip6t_MASQUERADE.c +++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c @@ -33,13 +33,19 @@ static int masquerade_tg6_checkentry(const struct xt_tgchk_param *par) if (range->flags & NF_NAT_RANGE_MAP_IPS) return -EINVAL; - return 0; + return nf_ct_netns_get(par->net, par->family); +} + +static void masquerade_tg6_destroy(const struct xt_tgdtor_param *par) +{ + nf_ct_netns_put(par->net, par->family); } static struct xt_target masquerade_tg6_reg __read_mostly = { .name = "MASQUERADE", .family = NFPROTO_IPV6, .checkentry = masquerade_tg6_checkentry, + .destroy = masquerade_tg6_destroy, .target = masquerade_tg6, .targetsize = sizeof(struct nf_nat_range), .table = "nat",