redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

[NETFILTER]: Keep conntrack reference until IPsec policy checks are done

Browse source 
Keep the conntrack reference until policy checks have been performed for
IPsec NAT support. The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy 2006-01-06 23:06:10 -08:00 committed by David S. Miller
parent 5c901daaea
commit b59c270104
6 changed files with 12 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
net/dccp/ipv4.c
View file

@ -1099,6 +1099,7 @@ int dccp_v4_destroy_sock(struct sock *sk)
kfree_skb(sk->sk_send_head); kfree_skb(sk->sk_send_head);
sk->sk_send_head = NULL; sk->sk_send_head = NULL;
} }
nf_reset(skb);
/* Clean up a referenced DCCP bind bucket. */ /* Clean up a referenced DCCP bind bucket. */
if (inet_csk(sk)->icsk_bind_hash != NULL) if (inet_csk(sk)->icsk_bind_hash != NULL)

15
net/ipv4/ip_input.c
View file

@ -185,7 +185,6 @@ int ip_call_ra_chain(struct sk_buff *skb)
raw_rcv(last, skb2); raw_rcv(last, skb2);
} }
last = sk; last = sk;
nf_reset(skb);
} }
} }
@ -204,10 +203,6 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb)
__skb_pull(skb, ihl); __skb_pull(skb, ihl);
/* Free reference early: we don't need it any more, and it may
hold ip_conntrack module loaded indefinitely. */
nf_reset(skb);
/* Point into the IP datagram, just past the header. */ /* Point into the IP datagram, just past the header. */
skb->h.raw = skb->data; skb->h.raw = skb->data;
@ -232,10 +227,12 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb)
if ((ipprot = rcu_dereference(inet_protos[hash])) != NULL) { if ((ipprot = rcu_dereference(inet_protos[hash])) != NULL) {
int ret; int ret;
if (!ipprot->no_policy && if (!ipprot->no_policy) {
!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) { if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
kfree_skb(skb); kfree_skb(skb);
goto out; goto out;
}
nf_reset(skb);
} }
ret = ipprot->handler(skb); ret = ipprot->handler(skb);
if (ret < 0) { if (ret < 0) {

1
net/ipv4/raw.c
View file

@ -255,6 +255,7 @@ int raw_rcv(struct sock *sk, struct sk_buff *skb)
kfree_skb(skb); kfree_skb(skb);
return NET_RX_DROP; return NET_RX_DROP;
} }
nf_reset(skb);
skb_push(skb, skb->data - skb->nh.raw); skb_push(skb, skb->data - skb->nh.raw);

1
net/ipv4/tcp_ipv4.c
View file

@ -1080,6 +1080,7 @@ process:
if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
goto discard_and_relse; goto discard_and_relse;
nf_reset(skb);
if (sk_filter(sk, skb, 0)) if (sk_filter(sk, skb, 0))
goto discard_and_relse; goto discard_and_relse;

2
net/ipv4/udp.c
View file

@ -989,6 +989,7 @@ static int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
kfree_skb(skb); kfree_skb(skb);
return -1; return -1;
} }
nf_reset(skb);
if (up->encap_type) { if (up->encap_type) {
/* /*
@ -1149,6 +1150,7 @@ int udp_rcv(struct sk_buff *skb)
if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
goto drop; goto drop;
nf_reset(skb);
/* No socket. Drop packet silently, if checksum is wrong */ /* No socket. Drop packet silently, if checksum is wrong */
if (udp_checksum_complete(skb)) if (udp_checksum_complete(skb))

1
net/sctp/input.c
View file

@ -225,6 +225,7 @@ int sctp_rcv(struct sk_buff *skb)
if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family)) if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family))
goto discard_release; goto discard_release;
nf_reset(skb);
ret = sk_filter(sk, skb, 1); ret = sk_filter(sk, skb, 1);
if (ret) if (ret)