diff options
Diffstat (limited to 'target/linux/brcm2708/patches-4.14/950-0318-netfilter-ip6t_MASQUERADE-add-dependency-on-conntrac.patch')
| -rw-r--r-- | target/linux/brcm2708/patches-4.14/950-0318-netfilter-ip6t_MASQUERADE-add-dependency-on-conntrac.patch | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/target/linux/brcm2708/patches-4.14/950-0318-netfilter-ip6t_MASQUERADE-add-dependency-on-conntrac.patch b/target/linux/brcm2708/patches-4.14/950-0318-netfilter-ip6t_MASQUERADE-add-dependency-on-conntrac.patch new file mode 100644 index 0000000000..c3c9d5bc44 --- /dev/null +++ b/target/linux/brcm2708/patches-4.14/950-0318-netfilter-ip6t_MASQUERADE-add-dependency-on-conntrac.patch @@ -0,0 +1,42 @@ +From af4dba1b5d3cbd0bc724fca24d3d01d2878406df Mon Sep 17 00:00:00 2001 +From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> +Date: Mon, 11 Dec 2017 18:19:33 +0300 +Subject: [PATCH 318/454] netfilter: ip6t_MASQUERADE: add dependency on + conntrack module + +commit 23715275e4fb6f64358a499d20928a9e93819f2f upstream. + +After commit 4d3a57f23dec ("netfilter: conntrack: do not enable connection +tracking unless needed") conntrack is disabled by default unless some +module explicitly declares dependency in particular network namespace. + +Fixes: a357b3f80bc8 ("netfilter: nat: add dependencies on conntrack module") +Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +--- + net/ipv6/netfilter/ip6t_MASQUERADE.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c ++++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c +@@ -33,13 +33,19 @@ static int masquerade_tg6_checkentry(con + + if (range->flags & NF_NAT_RANGE_MAP_IPS) + return -EINVAL; +- return 0; ++ return nf_ct_netns_get(par->net, par->family); ++} ++ ++static void masquerade_tg6_destroy(const struct xt_tgdtor_param *par) ++{ ++ nf_ct_netns_put(par->net, par->family); + } + + static struct xt_target masquerade_tg6_reg __read_mostly = { + .name = "MASQUERADE", + .family = NFPROTO_IPV6, + .checkentry = masquerade_tg6_checkentry, ++ .destroy = masquerade_tg6_destroy, + .target = masquerade_tg6, + .targetsize = sizeof(struct nf_nat_range), + .table = "nat", |