[Devel] [PATCH RHEL7 COMMIT] net: Add dependence xt_socket match on nf_conntrack_ipv4

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-693.11.1.vz7.39.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-693.11.1.vz7.39.9
------>
commit 8e3b7dabfc0c723fe3867acc23a194e796b3cb54
Author: Kirill Tkhai <ktkhai at virtuozzo.com>
Date:   Wed Dec 27 18:58:49 2017 +0300

    net: Add dependence xt_socket match on nf_conntrack_ipv4
    
    This allows to load conntrack modules on inserting a rule
    containing "socket" match.
    
    It seems this may be useful for socket_match() function,
    which uses nf_ct_get() to obtain additional information
    about skb.
    
    Note, that xt_socket already depends on VE_IP_CONNTRACK
    in kernel/kmod.c, so we don't add new dependence
    in ve0_ipt_am.
    
    https://jira.sw.ru/browse/PSBM-69269
    
    Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
---
 net/netfilter/xt_socket.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 102946ad4a0d..f7bf0ebca1e7 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -485,7 +485,9 @@ static int __init socket_mt_init(void)
 #ifdef XT_SOCKET_HAVE_IPV6
 	nf_defrag_ipv6_enable();
 #endif
-
+#ifdef XT_SOCKET_HAVE_CONNTRACK
+	need_ipv4_conntrack();
+#endif
 	return xt_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
 }