[NETFILTER]: Keep conntrack reference until IPsec policy checks are done

Keep the conntrack reference until policy checks have been performed for
IPsec NAT support. The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

4 files changed, 10 insertions, 9 deletions

diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index e45846ae570b..18d7fad474d7 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -185,7 +185,6 @@ int ip_call_ra_chain(struct sk_buff *skb)
                                         raw_rcv(last, skb2);
                         }
                         last = sk;
-                        nf_reset(skb);
                 }
         }
 
@@ -204,10 +203,6 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb)
 
         __skb_pull(skb, ihl);
 
-        /* Free reference early: we don't need it any more, and it may
-           hold ip_conntrack module loaded indefinitely. */
-        nf_reset(skb);
-
         /* Point into the IP datagram, just past the header. */
         skb->h.raw = skb->data;
 
@@ -232,10 +227,12 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb)
                 if ((ipprot = rcu_dereference(inet_protos[hash])) != NULL) {
                         int ret;
 
-                        if (!ipprot->no_policy &&
-                            !xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                                kfree_skb(skb);
-                                goto out;
+                        if (!ipprot->no_policy) {
+                                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+                                        kfree_skb(skb);
+                                        goto out;
+                                }
+                                nf_reset(skb);
                         }
                         ret = ipprot->handler(skb);
                         if (ret < 0) {
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 4b0d7e4d6269..165a4d81efa4 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -255,6 +255,7 @@ int raw_rcv(struct sock *sk, struct sk_buff *skb)
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
+        nf_reset(skb);
 
         skb_push(skb, skb->data - skb->nh.raw);
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index e9f83e5b28ce..6ea353907af5 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1080,6 +1080,7 @@ process:
 
         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
+        nf_reset(skb);
 
         if (sk_filter(sk, skb, 0))
                 goto discard_and_relse;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 223abaa72bc5..00840474a449 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -989,6 +989,7 @@ static int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                 kfree_skb(skb);
                 return -1;
         }
+        nf_reset(skb);
 
         if (up->encap_type) {
                 /*
@@ -1149,6 +1150,7 @@ int udp_rcv(struct sk_buff *skb)
 
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
                 goto drop;
+        nf_reset(skb);
 
         /* No socket. Drop packet silently, if checksum is wrong */
         if (udp_checksum_complete(skb))