[NETFILTER]: Revert nf_reset change

Revert the nf_reset change that caused so much trouble, drop conntrack
references manually before packets are queued to packet sockets.

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 13 insertions, 9 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 9de83e6e0f1d..80d13103b2b0 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -107,7 +107,6 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         BUG_TRAP(newskb->dst);
-        nf_reset(newskb);
         netif_rx(newskb);
         return 0;
 }
@@ -188,14 +187,6 @@ static inline int ip_finish_output2(struct sk_buff *skb)
                 skb = skb2;
         }
 
-#ifdef CONFIG_BRIDGE_NETFILTER
-        /* bridge-netfilter defers calling some IP hooks to the bridge layer
-         * and still needs the conntrack reference.
-         */
-        if (skb->nf_bridge == NULL)
-#endif
-                nf_reset(skb);
-
         if (hh) {
                 int hh_alen;
 
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 42dc95102873..1dd824f3cf0a 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -432,6 +432,13 @@ static unsigned int ip_conntrack_defrag(unsigned int hooknum,
                                         const struct net_device *out,
                                         int (*okfn)(struct sk_buff *))
 {
+#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
+        /* Previously seen (loopback)?  Ignore.  Do this before
+           fragment check. */
+        if ((*pskb)->nfct)
+                return NF_ACCEPT;
+#endif
+
         /* Gather fragments. */
         if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
                 *pskb = ip_ct_gather_frags(*pskb,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 0269616e75a1..c9d5980aa4de 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -274,6 +274,9 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct
         dst_release(skb->dst);
         skb->dst = NULL;
 
+        /* drop conntrack reference */
+        nf_reset(skb);
+
         spkt = (struct sockaddr_pkt*)skb->cb;
 
         skb_push(skb, skb->data-skb->mac.raw);
@@ -517,6 +520,9 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,  struct packe
         dst_release(skb->dst);
         skb->dst = NULL;
 
+        /* drop conntrack reference */
+        nf_reset(skb);
+
         spin_lock(&sk->sk_receive_queue.lock);
         po->stats.tp_packets++;
         __skb_queue_tail(&sk->sk_receive_queue, skb);