Madhu KoriginjaandGreg Kroah-Hartman 2361aee1c5 netfilter: keep conntrack reference until IPsecv6 policy checks are done ...

[ Upstream commit b0e214d212 ]

Keep the conntrack reference until policy checks have been performed for
IPsec V6 NAT support, just like ipv4.

The reference needs to be dropped before a packet is
queued to avoid having the conntrack module unloadable.

Fixes: 58a317f106 ("netfilter: ipv6: add IPv6 NAT support")
Signed-off-by: Madhu Koriginja <madhu.koriginja@nxp.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-05-11 23:03:18 +09:00

..

ccids

…

ackvec.c

…

ackvec.h

…

ccid.c

…

ccid.h

…

dccp.h

dccp: Call inet6_destroy_sock() via sk->sk_destruct().

2023-04-26 14:28:43 +02:00

diag.c

…

feat.c

…

feat.h

…

input.c

…

ipv4.c

dccp/tcp: Fixup bhash2 bucket when connect() fails.

2022-11-22 20:15:37 -08:00

ipv6.c

netfilter: keep conntrack reference until IPsecv6 policy checks are done

2023-05-11 23:03:18 +09:00

ipv6.h

…

Kconfig

…

Makefile

…

minisocks.c

…

options.c

…

output.c

…

proto.c

dccp: Call inet6_destroy_sock() via sk->sk_destruct().

2023-04-26 14:28:43 +02:00

qpolicy.c

…

sysctl.c

…

timer.c

…

trace.h

…