Commit 236d2f49 authored by Jozsef Kadlecsik's avatar Jozsef Kadlecsik Committed by Linus Torvalds

[NETFILTER]: Fix NAT leak with fragmented packets, missing conntrack put in ip_copy_metadata().

parent 862e3994
......@@ -414,6 +414,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
to->nfmark = from->nfmark;
to->nfcache = from->nfcache;
/* Connection association is same as pre-frag packet */
nf_conntrack_put(to->nfct);
to->nfct = from->nfct;
nf_conntrack_get(to->nfct);
#ifdef CONFIG_BRIDGE_NETFILTER
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment