From 6df5513d294ae368f2a09fb47917e11048347885 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 22 Apr 2015 13:50:56 +0200
Subject: [PATCH] kmod-setup: load ip_tables kmod at boot

The module is currently no auto-loadable (and this is unlikely to change
anytime soon, given it's API is via getsockopt/setsockopt). It is needed
by networkd and nspawn currently.

Users who really don't like the module to be loaded have the option to
blacklist it still, or not compile it at all. But for all others this
should make things work out-of-the-box.

(cherry picked from commit 1d3087978a8ee23107cb64aa55ca97aefe9531e2)

Cherry-picked from: f801bf8
Resolves: #1222517
---
 src/core/kmod-setup.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/core/kmod-setup.c b/src/core/kmod-setup.c
index c0a05b9..97f3b9b 100644
--- a/src/core/kmod-setup.c
+++ b/src/core/kmod-setup.c
@@ -63,16 +63,19 @@ int kmod_setup(void) {
                 bool (*condition_fn)(void);
         } kmod_table[] = {
                 /* auto-loading on use doesn't work before udev is up */
-                { "autofs4", "/sys/class/misc/autofs", true, NULL                 },
+                { "autofs4",   "/sys/class/misc/autofs",    true,  NULL                },
 
                 /* early configure of ::1 on the loopback device */
-                { "ipv6",    "/sys/module/ipv6",       true, NULL                 },
+                { "ipv6",      "/sys/module/ipv6",          true,  NULL                },
 
                 /* this should never be a module */
-                { "unix",    "/proc/net/unix",         true, NULL                 },
+                { "unix",      "/proc/net/unix",            true,  NULL                },
 
                 /* IPC is needed before we bring up any other services */
-                { "kdbus",   "/sys/fs/kdbus",          false, cmdline_check_kdbus },
+                { "kdbus",     "/sys/fs/kdbus",             false, cmdline_check_kdbus },
+
+                /* netfilter is needed by networkd, nspawn among others, and cannot be autoloaded */
+                { "ip_tables", "/proc/net/ip_tables_names", false, NULL                },
         };
         struct kmod_ctx *ctx = NULL;
         unsigned int i;