netfilter: netns nat: fix ipt_MASQUERADE in netns

First, allow entry in notifier hook.
Second, start conntrack cleanup in netns to which netdevice belongs.

Signed-off-by: Alexey Dobriyan <[email protected]>
Signed-off-by: Patrick McHardy <[email protected]>

diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 5e1c81791e5af21012ad1e9af08a4da0b6f3cbb9..65c811b27b7bdb0200f90571f317905eee5aa1ac 100644 (file)
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -119,9 +119,7 @@ static int masq_device_event(struct notifier_block *this,
                             void *ptr)
 {
        const struct net_device *dev = ptr;
-
-       if (!net_eq(dev_net(dev), &init_net))
-               return NOTIFY_DONE;
+       struct net *net = dev_net(dev);
 
        if (event == NETDEV_DOWN) {
                /* Device was downed.  Search entire table for
@@ -129,7 +127,7 @@ static int masq_device_event(struct notifier_block *this,
                   and forget them. */
                NF_CT_ASSERT(dev->ifindex != 0);
 
-               nf_ct_iterate_cleanup(&init_net, device_cmp,
+               nf_ct_iterate_cleanup(net, device_cmp,
                                      (void *)(long)dev->ifindex);
        }