Commit b0e214d2 authored by Madhu Koriginja's avatar Madhu Koriginja Committed by Florian Westphal
Browse files

netfilter: keep conntrack reference until IPsecv6 policy checks are done 



Keep the conntrack reference until policy checks have been performed for
IPsec V6 NAT support, just like ipv4.

The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Fixes: 58a317f1 ("netfilter: ipv6: add IPv6 NAT support")
Signed-off-by: default avatarMadhu Koriginja <madhu.koriginja@nxp.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent 36ce9982

net/dccp/ipv6.c

+1 −0
Original line number Diff line number Diff line
@@ -784,6 +784,7 @@ static int dccp_v6_rcv(struct sk_buff *skb) 


	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))

		goto discard_and_relse;

	nf_reset_ct(skb);



	return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4,

				refcounted) ? -1 : 0;

net/ipv6/ip6_input.c

+6 −8
Original line number Diff line number Diff line
@@ -404,10 +404,6 @@ void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr, 
			/* Only do this once for first final protocol */

			have_final = true;



			/* Free reference early: we don't need it any more,

			   and it may hold ip_conntrack module loaded

			   indefinitely. */

			nf_reset_ct(skb);



			skb_postpull_rcsum(skb, skb_network_header(skb),

					   skb_network_header_len(skb));
@@ -430,11 +426,13 @@ void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr, 
				goto discard;

			}

		}

		if (!(ipprot->flags & INET6_PROTO_NOPOLICY) &&

		    !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {

		if (!(ipprot->flags & INET6_PROTO_NOPOLICY)) {

			if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {

				SKB_DR_SET(reason, XFRM_POLICY);

				goto discard;

			}

			nf_reset_ct(skb);

		}



		ret = INDIRECT_CALL_2(ipprot->handler, tcp_v6_rcv, udpv6_rcv,

				      skb);

net/ipv6/raw.c

+2 −3
Original line number Diff line number Diff line
@@ -194,12 +194,10 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr) 
			struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);



			/* Not releasing hash table! */

			if (clone) {

				nf_reset_ct(clone);

			if (clone)

				rawv6_rcv(sk, clone);

		}

	}

	}

	rcu_read_unlock();

	return delivered;

}
@@ -391,6 +389,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb) 
		kfree_skb_reason(skb, SKB_DROP_REASON_XFRM_POLICY);

		return NET_RX_DROP;

	}

	nf_reset_ct(skb);



	if (!rp->checksum)

		skb->ip_summed = CHECKSUM_UNNECESSARY;

net/ipv6/tcp_ipv6.c

+2 −0
Original line number Diff line number Diff line
@@ -1723,6 +1723,8 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb) 
	if (drop_reason)

		goto discard_and_relse;



	nf_reset_ct(skb);



	if (tcp_filter(sk, skb)) {

		drop_reason = SKB_DROP_REASON_SOCKET_FILTER;

		goto discard_and_relse;

net/ipv6/udp.c

+2 −0
Original line number Diff line number Diff line
@@ -704,6 +704,7 @@ static int udpv6_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb) 
		drop_reason = SKB_DROP_REASON_XFRM_POLICY;

		goto drop;

	}

	nf_reset_ct(skb);



	if (static_branch_unlikely(&udpv6_encap_needed_key) && up->encap_type) {

		int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
@@ -1027,6 +1028,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, 


	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))

		goto discard;

	nf_reset_ct(skb);



	if (udp_lib_checksum_complete(skb))

		goto csum_error;