TononixOS/ubports_kernel_google_msm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[NETFILTER]: Keep conntrack reference until IPsec policy checks are done

Browse Source 
Keep the conntrack reference until policy checks have been performed for
IPsec NAT support. The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy
2006-01-06 23:06:10 -08:00
committed by David S. Miller
parent 5c901daaea
commit b59c270104
6 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
net/ipv4/tcp_ipv4.c
View File

@@ -1080,6 +1080,7 @@ process:
if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
goto discard_and_relse;
nf_reset(skb);
if (sk_filter(sk, skb, 0))
goto discard_and_relse;