This is a note to let you know that I've just added the patch titled net: vrf: Fix NAT within a VRF to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-vrf-fix-nat-within-a-vrf.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Thu Jan 12 21:37:26 CET 2017 From: David Ahern <dsa@xxxxxxxxxxxxxxxxxxx> Date: Wed, 14 Dec 2016 11:06:18 -0800 Subject: net: vrf: Fix NAT within a VRF From: David Ahern <dsa@xxxxxxxxxxxxxxxxxxx> [ Upstream commit a0f37efa82253994b99623dbf41eea8dd0ba169b ] Connection tracking with VRF is broken because the pass through the VRF device drops the connection tracking info. Removing the call to nf_reset allows DNAT and MASQUERADE to work across interfaces within a VRF. Fixes: 73e20b761acf ("net: vrf: Add support for PREROUTING rules on vrf device") Signed-off-by: David Ahern <dsa@xxxxxxxxxxxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/vrf.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/net/vrf.c +++ b/drivers/net/vrf.c @@ -850,8 +850,6 @@ static struct sk_buff *vrf_rcv_nfhook(u8 { struct net *net = dev_net(dev); - nf_reset(skb); - if (NF_HOOK(pf, hook, net, NULL, skb, dev, NULL, vrf_rcv_finish) < 0) skb = NULL; /* kfree_skb(skb) handled by nf code */ Patches currently in stable-queue which might be from dsa@xxxxxxxxxxxxxxxxxxx are queue-4.9/net-vrf-drop-conntrack-data-after-pass-through-vrf-device-on-tx.patch queue-4.9/net-ipv4-fix-multipath-selection-with-vrf.patch queue-4.9/net-ipv4-dst-for-local-input-routes-should-use-l3mdev-if-relevant.patch queue-4.9/net-vrf-add-missing-rx-counters.patch queue-4.9/net-vrf-do-not-allow-table-id-0.patch queue-4.9/net-vrf-fix-nat-within-a-vrf.patch queue-4.9/net-fix-incorrect-original-ingress-device-index-in-pktinfo.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html