From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752470AbcLGI30 (ORCPT ); Wed, 7 Dec 2016 03:29:26 -0500 Received: from smtp-out-so.shaw.ca ([64.59.136.138]:44593 "EHLO smtp-out-so.shaw.ca" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751865AbcLGI3Y (ORCPT ); Wed, 7 Dec 2016 03:29:24 -0500 X-Greylist: delayed 346 seconds by postgrey-1.27 at vger.kernel.org; Wed, 07 Dec 2016 03:29:24 EST X-Authority-Analysis: v=2.2 cv=cNuQihWN c=1 sm=1 tr=0 a=DXb8iGicsy0C2lNtaEhhGg==:117 a=DXb8iGicsy0C2lNtaEhhGg==:17 a=kj9zAlcOel0A:10 a=n5n_aSjo0skA:10 a=FughZ5UWS5hj5dZsYF4A:9 a=CjuIK1q_8ugA:10 Date: Wed, 7 Dec 2016 02:23:21 -0600 From: Trevor Cordes To: linux-kernel@vger.kernel.org Cc: Florian Westphal , Pablo Neira Ayuso Subject: Re: netfilter regression causes lost pings "operation not permitted" Message-ID: <20161207022321.21f67a11@pog.tecnopolis.ca> In-Reply-To: <20161207080316.GA6350@pog.tecnopolis.ca> References: <20161207080316.GA6350@pog.tecnopolis.ca> X-Mailer: Claws Mail 3.13.2 (GTK+ 2.24.31; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfOmku0pzXxsL63QM6esilh18d9ntp5McR8isaGC7OTDl4uQJ+2sQ44bvyNPxmA3PX313dSOqQlHikEB5stBNpsGDXo2t7WCPbkbKcieUei5DOaRLLcHd wvlrHu5g7YJaWLJnuqmCNBIlS5fmGR267NarsM31bsKtOTKya1oa/ssM033nsm6iB5kKnhxG5LKJWSV/WVl4a2xAnfI/kFROdhrRDX2oScD8gtbvrGFcY1rU Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2016-12-07 Trevor Cordes wrote: > Bisected down to: > 870190a9ec9075205c0fa795a09fa931694a3ff1 > 7c9664351980aaa6a4b8837a314360b3a4ad382a Oh! I forgot to mention the most important point: iptable_nat module MUST be loaded for the bug to show up! modprobe iptable_nat If you rmmod it, the bug goes away. Interestingly, the bug occurs even if you have every iptables table (including -t nat) completely empty (no rules). All that is required is iptable_nat simply to be loaded.