diff options
| author |   Florian Westphal <fw@strlen.de> | 2017-01-23 18:21:54 +0100 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2017-02-02 14:31:51 +0100 |
| commit | 6e10148c5c85629832d9156f337cbf67e96b69fe (patch) | |
| tree | de5dcd5c24789532222702f5272299379a881cf6 /net/ipv6/netfilter/nf_dup_ipv6.c | |
| parent | netfilter: conntrack: no need to pass ctinfo to error handler (diff) | |
| download | linux-dev-6e10148c5c85629832d9156f337cbf67e96b69fe.tar.xz linux-dev-6e10148c5c85629832d9156f337cbf67e96b69fe.zip | |
netfilter: reset netfilter state when duplicating packet
We should also toss nf_bridge_info, if any -- packet is leaving via
ip_local_out, also, this skb isn't bridged -- it is a locally generated
copy. Also this avoids the need to touch this later when skb->nfct is
replaced with 'unsigned long _nfct' in followup patch.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv6/netfilter/nf_dup_ipv6.c')
| -rw-r--r-- | net/ipv6/netfilter/nf_dup_ipv6.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/netfilter/nf_dup_ipv6.c b/net/ipv6/netfilter/nf_dup_ipv6.c index 4a84b5ad9ecb..5f52e5f90e7e 100644 --- a/net/ipv6/netfilter/nf_dup_ipv6.c +++ b/net/ipv6/netfilter/nf_dup_ipv6.c @@ -57,7 +57,7 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, return; #if IS_ENABLED(CONFIG_NF_CONNTRACK) - nf_conntrack_put(skb->nfct); + nf_reset(skb); skb->nfct = &nf_ct_untracked_get()->ct_general; skb->nfctinfo = IP_CT_NEW; nf_conntrack_get(skb->nfct); |