netfilter: nf_tables: add conntrack dependencies for nat/masq/redir expressions

so that conntrack core will add the needed hooks in this namespace.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index 4d69f99b8707a98db057199417cce39e14bc71e6..a0ea8aad1bf150bcb9e8e0aa2e6b45a5347599e4 100644 (file)
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -35,12 +35,19 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,
                                                    &range, nft_out(pkt));
 }
 
+static void
+nft_masq_ipv4_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+{
+       nf_ct_netns_put(ctx->net, NFPROTO_IPV4);
+}
+
 static struct nft_expr_type nft_masq_ipv4_type;
 static const struct nft_expr_ops nft_masq_ipv4_ops = {
        .type           = &nft_masq_ipv4_type,
        .size           = NFT_EXPR_SIZE(sizeof(struct nft_masq)),
        .eval           = nft_masq_ipv4_eval,
        .init           = nft_masq_init,
+       .destroy        = nft_masq_ipv4_destroy,
        .dump           = nft_masq_dump,
        .validate       = nft_masq_validate,
 };

diff --git a/net/ipv4/netfilter/nft_redir_ipv4.c b/net/ipv4/netfilter/nft_redir_ipv4.c
index 62c18e68ac5872b09cef88349e393f82a53eff10..1650ed23c15dd00bb8e4bd741dc2d02d6cbf2c4e 100644 (file)
--- a/net/ipv4/netfilter/nft_redir_ipv4.c
+++ b/net/ipv4/netfilter/nft_redir_ipv4.c
@@ -38,12 +38,19 @@ static void nft_redir_ipv4_eval(const struct nft_expr *expr,
        regs->verdict.code = nf_nat_redirect_ipv4(pkt->skb, &mr, nft_hook(pkt));
 }
 
+static void
+nft_redir_ipv4_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+{
+       nf_ct_netns_put(ctx->net, NFPROTO_IPV4);
+}
+
 static struct nft_expr_type nft_redir_ipv4_type;
 static const struct nft_expr_ops nft_redir_ipv4_ops = {
        .type           = &nft_redir_ipv4_type,
        .size           = NFT_EXPR_SIZE(sizeof(struct nft_redir)),
        .eval           = nft_redir_ipv4_eval,
        .init           = nft_redir_init,
+       .destroy        = nft_redir_ipv4_destroy,
        .dump           = nft_redir_dump,
        .validate       = nft_redir_validate,
 };

diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index 93d758f703345f69e51a3930007f8393d056a39b..6c5b5b1830a74f52e2dbc4f4f2bb8127a0ba2efb 100644 (file)
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -36,12 +36,19 @@ static void nft_masq_ipv6_eval(const struct nft_expr *expr,
                                                    nft_out(pkt));
 }
 
+static void
+nft_masq_ipv6_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+{
+       nf_ct_netns_put(ctx->net, NFPROTO_IPV6);
+}
+
 static struct nft_expr_type nft_masq_ipv6_type;
 static const struct nft_expr_ops nft_masq_ipv6_ops = {
        .type           = &nft_masq_ipv6_type,
        .size           = NFT_EXPR_SIZE(sizeof(struct nft_masq)),
        .eval           = nft_masq_ipv6_eval,
        .init           = nft_masq_init,
+       .destroy        = nft_masq_ipv6_destroy,
        .dump           = nft_masq_dump,
        .validate       = nft_masq_validate,
 };

diff --git a/net/ipv6/netfilter/nft_redir_ipv6.c b/net/ipv6/netfilter/nft_redir_ipv6.c
index 2850fcd8583f39f854853208234235f037570b32..f5ac080fc0849b0f65751458432cf4e693353c8a 100644 (file)
--- a/net/ipv6/netfilter/nft_redir_ipv6.c
+++ b/net/ipv6/netfilter/nft_redir_ipv6.c
@@ -39,12 +39,19 @@ static void nft_redir_ipv6_eval(const struct nft_expr *expr,
                nf_nat_redirect_ipv6(pkt->skb, &range, nft_hook(pkt));
 }
 
+static void
+nft_redir_ipv6_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+{
+       nf_ct_netns_put(ctx->net, NFPROTO_IPV6);
+}
+
 static struct nft_expr_type nft_redir_ipv6_type;
 static const struct nft_expr_ops nft_redir_ipv6_ops = {
        .type           = &nft_redir_ipv6_type,
        .size           = NFT_EXPR_SIZE(sizeof(struct nft_redir)),
        .eval           = nft_redir_ipv6_eval,
        .init           = nft_redir_init,
+       .destroy        = nft_redir_ipv6_destroy,
        .dump           = nft_redir_dump,
        .validate       = nft_redir_validate,
 };

diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c
index bf92de01410f8b5719e3f140af15428e43fd16f9..11ce016cd47948f3a2902402e0cbbda5e22d9438 100644 (file)
--- a/net/netfilter/nft_masq.c
+++ b/net/netfilter/nft_masq.c
@@ -77,7 +77,7 @@ int nft_masq_init(const struct nft_ctx *ctx,
                }
        }
 
-       return 0;
+       return nf_ct_netns_get(ctx->net, ctx->afi->family);
 }
 EXPORT_SYMBOL_GPL(nft_masq_init);
 

diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index ee2d71753746d0dc074bcf327b25de4791f821e9..19a7bf3236f968725a29e827012af301781802df 100644 (file)
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -209,7 +209,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                        return -EINVAL;
        }
 
-       return 0;
+       return nf_ct_netns_get(ctx->net, family);
 }
 
 static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr)
@@ -257,12 +257,21 @@ nla_put_failure:
        return -1;
 }
 
+static void
+nft_nat_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+{
+       const struct nft_nat *priv = nft_expr_priv(expr);
+
+       nf_ct_netns_put(ctx->net, priv->family);
+}
+
 static struct nft_expr_type nft_nat_type;
 static const struct nft_expr_ops nft_nat_ops = {
        .type           = &nft_nat_type,
        .size           = NFT_EXPR_SIZE(sizeof(struct nft_nat)),
        .eval           = nft_nat_eval,
        .init           = nft_nat_init,
+       .destroy        = nft_nat_destroy,
        .dump           = nft_nat_dump,
        .validate       = nft_nat_validate,
 };

diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c
index 967e09b099b2df5786da96749efda95cba9ff7f2..40dcd05146d5fb0f346e6e170d16de9813e92804 100644 (file)
--- a/net/netfilter/nft_redir.c
+++ b/net/netfilter/nft_redir.c
@@ -79,7 +79,7 @@ int nft_redir_init(const struct nft_ctx *ctx,
                        return -EINVAL;
        }
 
-       return 0;
+       return nf_ct_netns_get(ctx->net, ctx->afi->family);
 }
 EXPORT_SYMBOL_GPL(nft_redir_init);