[NETFILTER]: Keep conntrack reference until IPsec policy checks are done

Keep the conntrack reference until policy checks have been performed for
IPsec NAT support. The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 1 insertions, 0 deletions

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 3f244670764a..23ba177c1150 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -1099,6 +1099,7 @@ int dccp_v4_destroy_sock(struct sock *sk)
                 kfree_skb(sk->sk_send_head);
                 sk->sk_send_head = NULL;
         }
+        nf_reset(skb);
 
         /* Clean up a referenced DCCP bind bucket. */
         if (inet_csk(sk)->icsk_bind_hash != NULL)