Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e10148c authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: reset netfilter state when duplicating packet 



We should also toss nf_bridge_info, if any -- packet is leaving via
ip_local_out, also, this skb isn't bridged -- it is a locally generated
copy.  Also this avoids the need to touch this later when skb->nfct is
replaced with 'unsigned long _nfct' in followup patch.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 11df4b76

net/ipv4/netfilter/nf_dup_ipv4.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -68,7 +68,7 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, 




#if IS_ENABLED(CONFIG_NF_CONNTRACK)

#if IS_ENABLED(CONFIG_NF_CONNTRACK)

	/* Avoid counting cloned packets towards the original connection. */

	/* Avoid counting cloned packets towards the original connection. */

	nf_conntrack_put(skb->nfct);

	nf_reset(skb);

	skb->nfct     = &nf_ct_untracked_get()->ct_general;

	skb->nfct     = &nf_ct_untracked_get()->ct_general;

	skb->nfctinfo = IP_CT_NEW;

	skb->nfctinfo = IP_CT_NEW;

	nf_conntrack_get(skb->nfct);

	nf_conntrack_get(skb->nfct);

net/ipv6/netfilter/nf_dup_ipv6.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -57,7 +57,7 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, 
		return;

		return;





#if IS_ENABLED(CONFIG_NF_CONNTRACK)

#if IS_ENABLED(CONFIG_NF_CONNTRACK)

	nf_conntrack_put(skb->nfct);

	nf_reset(skb);

	skb->nfct     = &nf_ct_untracked_get()->ct_general;

	skb->nfct     = &nf_ct_untracked_get()->ct_general;

	skb->nfctinfo = IP_CT_NEW;

	skb->nfctinfo = IP_CT_NEW;

	nf_conntrack_get(skb->nfct);

	nf_conntrack_get(skb->nfct);