linux-kernel - nf_conntrack_ipv4 must be loaded explicitly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0708021937140.9319@fbirervta.pbzchgretzou.qr>
Date:	Thu, 2 Aug 2007 20:11:18 +0200 (CEST)
From:	Jan Engelhardt <jengelh@...putergmbh.de>
To:	kaber@...sh.net
cc:	Netfilter Developer Mailing List 
	<netfilter-devel@...ts.netfilter.org>,
	yasuyuki.kozakai@...hiba.co.jp,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: nf_conntrack_ipv4 must be loaded explicitly

Hi,


in recent git kernels, I experience the following "regression" that no 
packets traverse the nat table (esp. the POSTROUTING counters just stand 
still) - and hence things like ping+SNAT do not work. Bisect nailed it 
down to:

ff09b7493c8f433d3ffd6a31ad58d190f82ef0c5 is first bad commit
commit ff09b7493c8f433d3ffd6a31ad58d190f82ef0c5
Author: Yasuyuki Kozakai <yasuyuki.kozakai@...hiba.co.jp>
Date:   Sat Jul 7 22:25:28 2007 -0700

    [NETFILTER]: nf_nat: remove unused nf_nat_module_is_loaded

    Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@...hiba.co.jp>
    Signed-off-by: Patrick McHardy <kaber@...sh.net>
    Signed-off-by: David S. Miller <davem@...emloft.net>

:040000 040000 177886eca60385293ac736c8e4861a2d4910d90a 32e63b6a9399e1ea65dc6cd0b357ca811e4dc835 M      include
:040000 040000 e1c20c3db28c927af62df067b2a20f8604a5fe06 84a277d1f81e3be9ce37ce6040c6d814ca20b3b0 M      net


The diff from ff09b7^...ff09b7 made me think...

End result:

After loading nf_conntrack_ipv4.ko, everything works again (also with 
the "bad" ff09b7). But I have to load it explicitly, and I think that 
unfortunately breaks a lot of setups (such as mine) which assume ipv4 
connection tracking is always there.

Comments?


	Jan
-- 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/