-stable review patch. If anyone has any objections, please let us know.
------------------
[NETFILTER]: Revert nf_reset change
Revert the nf_reset change that caused so much trouble, drop conntrack
references manually before packets are queued to packet sockets.
Adapted for 2.6.12 by Daniel Drake <[email protected]>
Signed-off-by: Phil Oester <[email protected]>
Signed-off-by: Patrick McHardy <[email protected]>
Signed-off-by: Chris Wright <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/ipv4/ip_output.c | 3 ---
net/ipv4/netfilter/ip_conntrack_standalone.c | 7 +++++++
net/packet/af_packet.c | 6 ++++++
3 files changed, 13 insertions(+), 3 deletions(-)
--- linux-2.6.12.2.orig/net/ipv4/ip_output.c 2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/net/ipv4/ip_output.c 2005-07-13 10:56:44.000000000 -0700
@@ -111,7 +111,6 @@
#ifdef CONFIG_NETFILTER_DEBUG
nf_debug_ip_loopback_xmit(newskb);
#endif
- nf_reset(newskb);
netif_rx(newskb);
return 0;
}
@@ -196,8 +195,6 @@
nf_debug_ip_finish_output2(skb);
#endif /*CONFIG_NETFILTER_DEBUG*/
- nf_reset(skb);
-
if (hh) {
int hh_alen;
--- linux-2.6.12.2.orig/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/net/ipv4/netfilter/ip_conntrack_standalone.c 2005-07-13 10:56:44.000000000 -0700
@@ -432,6 +432,13 @@
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
+#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
+ /* Previously seen (loopback)? Ignore. Do this before
+ fragment check. */
+ if ((*pskb)->nfct)
+ return NF_ACCEPT;
+#endif
+
/* Gather fragments. */
if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
*pskb = ip_ct_gather_frags(*pskb,
--- linux-2.6.12.2.orig/net/packet/af_packet.c 2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/net/packet/af_packet.c 2005-07-13 10:56:44.000000000 -0700
@@ -274,6 +274,9 @@
dst_release(skb->dst);
skb->dst = NULL;
+ /* drop conntrack reference */
+ nf_reset(skb);
+
spkt = (struct sockaddr_pkt*)skb->cb;
skb_push(skb, skb->data-skb->mac.raw);
@@ -517,6 +520,9 @@
dst_release(skb->dst);
skb->dst = NULL;
+ /* drop conntrack reference */
+ nf_reset(skb);
+
spin_lock(&sk->sk_receive_queue.lock);
po->stats.tp_packets++;
__skb_queue_tail(&sk->sk_receive_queue, skb);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
| |
 |