netfilter: keep conntrack reference until IPsecv6 policy checks are done

Browse source

[ Upstream commit b0e214d212 ]

Keep the conntrack reference until policy checks have been performed for
IPsec V6 NAT support, just like ipv4.

The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Fixes: 58a317f106 ("netfilter: ipv6: add IPv6 NAT support")
Signed-off-by: Madhu Koriginja <madhu.koriginja@nxp.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Madhu Koriginja 2023-03-21 21:28:44 +05:30 • committed by Greg Kroah-Hartman

parent 8d05f25475

commit 2361aee1c5

5 changed files with 13 additions and 11 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

net/dccp/ipv6.c

View file

14

net/ipv6/ip6_input.c

View file

5

net/ipv6/raw.c

View file

2

net/ipv6/tcp_ipv6.c

View file

2

net/ipv6/udp.c

View file