diff options
| author | Julian Anastasov | 2018-05-24 22:40:12 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso | 2018-06-02 00:55:38 +0200 |
| commit | 31875d4970baa02e08b719fdfea6f43e9e2f7e77 (patch) | |
| tree | a7a46fcf3b45ba6de424b83cef1fc67859142fd0 /net/netfilter/ipvs/ip_vs_ctl.c | |
| parent | netfilter: nf_tables: check msg_type before nft_trans_set(trans) (diff) | |
| download | kernel-qcow2-linux-31875d4970baa02e08b719fdfea6f43e9e2f7e77.tar.gz kernel-qcow2-linux-31875d4970baa02e08b719fdfea6f43e9e2f7e77.tar.xz kernel-qcow2-linux-31875d4970baa02e08b719fdfea6f43e9e2f7e77.zip | |
ipvs: register conntrack hooks for ftp
ip_vs_ftp requires conntrack modules for mangling
of FTP command responses in passive mode.
Make sure the conntrack hooks are registered when
real servers use NAT method in FTP virtual service.
The hooks will be registered while the service is
present.
Fixes: 0c66dc1ea3f0 ("netfilter: conntrack: register hooks in netns when needed by ruleset")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/ipvs/ip_vs_ctl.c')
| -rw-r--r-- | net/netfilter/ipvs/ip_vs_ctl.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index 3ecca0616d8c..ee0ab278f1f1 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -835,6 +835,9 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, * For now only for NAT! */ ip_vs_rs_hash(ipvs, dest); + /* FTP-NAT requires conntrack for mangling */ + if (svc->port == FTPPORT) + ip_vs_register_conntrack(svc); } atomic_set(&dest->conn_flags, conn_flags); @@ -1458,6 +1461,7 @@ static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup) */ static void ip_vs_unlink_service(struct ip_vs_service *svc, bool cleanup) { + ip_vs_unregister_conntrack(svc); /* Hold svc to avoid double release from dest_trash */ atomic_inc(&svc->refcnt); /* |