From 08a2ba2c6981ec9fef16639d1bed16a40406f0d0 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 22 Apr 2015 13:50:56 +0200
Subject: [PATCH] kmod-setup: load ip_tables kmod at boot

The module is currently no auto-loadable (and this is unlikely to change
anytime soon, given it's API is via getsockopt/setsockopt). It is needed
by networkd and nspawn currently.

Users who really don't like the module to be loaded have the option to
blacklist it still, or not compile it at all. But for all others this
should make things work out-of-the-box.

(cherry picked from commit 1d3087978a8ee23107cb64aa55ca97aefe9531e2)
---
 src/core/kmod-setup.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/core/kmod-setup.c b/src/core/kmod-setup.c
index c0a05b97aa..97f3b9b34a 100644
--- a/src/core/kmod-setup.c
+++ b/src/core/kmod-setup.c
@@ -63,16 +63,19 @@ int kmod_setup(void) {
                 bool (*condition_fn)(void);
         } kmod_table[] = {
                 /* auto-loading on use doesn't work before udev is up */
-                { "autofs4", "/sys/class/misc/autofs", true, NULL                 },
+                { "autofs4",   "/sys/class/misc/autofs",    true,  NULL                },
 
                 /* early configure of ::1 on the loopback device */
-                { "ipv6",    "/sys/module/ipv6",       true, NULL                 },
+                { "ipv6",      "/sys/module/ipv6",          true,  NULL                },
 
                 /* this should never be a module */
-                { "unix",    "/proc/net/unix",         true, NULL                 },
+                { "unix",      "/proc/net/unix",            true,  NULL                },
 
                 /* IPC is needed before we bring up any other services */
-                { "kdbus",   "/sys/fs/kdbus",          false, cmdline_check_kdbus },
+                { "kdbus",     "/sys/fs/kdbus",             false, cmdline_check_kdbus },
+
+                /* netfilter is needed by networkd, nspawn among others, and cannot be autoloaded */
+                { "ip_tables", "/proc/net/ip_tables_names", false, NULL                },
         };
         struct kmod_ctx *ctx = NULL;
         unsigned int i;