Commit b59c2701 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

[NETFILTER]: Keep conntrack reference until IPsec policy checks are done

Keep the conntrack reference until policy checks have been performed for
IPsec NAT support. The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5c901daa
...@@ -1099,6 +1099,7 @@ int dccp_v4_destroy_sock(struct sock *sk) ...@@ -1099,6 +1099,7 @@ int dccp_v4_destroy_sock(struct sock *sk)
kfree_skb(sk->sk_send_head); kfree_skb(sk->sk_send_head);
sk->sk_send_head = NULL; sk->sk_send_head = NULL;
} }
nf_reset(skb);
/* Clean up a referenced DCCP bind bucket. */ /* Clean up a referenced DCCP bind bucket. */
if (inet_csk(sk)->icsk_bind_hash != NULL) if (inet_csk(sk)->icsk_bind_hash != NULL)
......
...@@ -185,7 +185,6 @@ int ip_call_ra_chain(struct sk_buff *skb) ...@@ -185,7 +185,6 @@ int ip_call_ra_chain(struct sk_buff *skb)
raw_rcv(last, skb2); raw_rcv(last, skb2);
} }
last = sk; last = sk;
nf_reset(skb);
} }
} }
...@@ -204,10 +203,6 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb) ...@@ -204,10 +203,6 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb)
__skb_pull(skb, ihl); __skb_pull(skb, ihl);
/* Free reference early: we don't need it any more, and it may
hold ip_conntrack module loaded indefinitely. */
nf_reset(skb);
/* Point into the IP datagram, just past the header. */ /* Point into the IP datagram, just past the header. */
skb->h.raw = skb->data; skb->h.raw = skb->data;
...@@ -232,11 +227,13 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb) ...@@ -232,11 +227,13 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb)
if ((ipprot = rcu_dereference(inet_protos[hash])) != NULL) { if ((ipprot = rcu_dereference(inet_protos[hash])) != NULL) {
int ret; int ret;
if (!ipprot->no_policy && if (!ipprot->no_policy) {
!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) { if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
kfree_skb(skb); kfree_skb(skb);
goto out; goto out;
} }
nf_reset(skb);
}
ret = ipprot->handler(skb); ret = ipprot->handler(skb);
if (ret < 0) { if (ret < 0) {
protocol = -ret; protocol = -ret;
......
...@@ -255,6 +255,7 @@ int raw_rcv(struct sock *sk, struct sk_buff *skb) ...@@ -255,6 +255,7 @@ int raw_rcv(struct sock *sk, struct sk_buff *skb)
kfree_skb(skb); kfree_skb(skb);
return NET_RX_DROP; return NET_RX_DROP;
} }
nf_reset(skb);
skb_push(skb, skb->data - skb->nh.raw); skb_push(skb, skb->data - skb->nh.raw);
......
...@@ -1080,6 +1080,7 @@ int tcp_v4_rcv(struct sk_buff *skb) ...@@ -1080,6 +1080,7 @@ int tcp_v4_rcv(struct sk_buff *skb)
if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
goto discard_and_relse; goto discard_and_relse;
nf_reset(skb);
if (sk_filter(sk, skb, 0)) if (sk_filter(sk, skb, 0))
goto discard_and_relse; goto discard_and_relse;
......
...@@ -989,6 +989,7 @@ static int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb) ...@@ -989,6 +989,7 @@ static int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
kfree_skb(skb); kfree_skb(skb);
return -1; return -1;
} }
nf_reset(skb);
if (up->encap_type) { if (up->encap_type) {
/* /*
...@@ -1149,6 +1150,7 @@ int udp_rcv(struct sk_buff *skb) ...@@ -1149,6 +1150,7 @@ int udp_rcv(struct sk_buff *skb)
if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
goto drop; goto drop;
nf_reset(skb);
/* No socket. Drop packet silently, if checksum is wrong */ /* No socket. Drop packet silently, if checksum is wrong */
if (udp_checksum_complete(skb)) if (udp_checksum_complete(skb))
......
...@@ -225,6 +225,7 @@ int sctp_rcv(struct sk_buff *skb) ...@@ -225,6 +225,7 @@ int sctp_rcv(struct sk_buff *skb)
if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family)) if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family))
goto discard_release; goto discard_release;
nf_reset(skb);
ret = sk_filter(sk, skb, 1); ret = sk_filter(sk, skb, 1);
if (ret) if (ret)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment