commit b59c270104f03960069596722fea70340579244d
author Patrick McHardy <kaber@trash.net> Fri Jan 06 23:06:10 2006 -0800
committer David S. Miller <davem@sunset.davemloft.net> Sat Jan 07 12:57:36 2006 -0800
tree 5d038835626047899097b622695ead5c1eb1c499
parent 5c901daaea3be0d900b3ae1fc9b5f64ff94e4f02

[NETFILTER]: Keep conntrack reference until IPsec policy checks are done

Keep the conntrack reference until policy checks have been performed for
IPsec NAT support. The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/ipv4/raw.c

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 4b0d7e4..165a4d8 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -255,6 +255,7 @@
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
+	nf_reset(skb);
 
 	skb_push(skb, skb->data - skb->nh.raw);